$\begin{split}\max_{\\{V_{i,a}\\}_{i,a}}\quad&\sum_{a\in\mathcal{A}}\mathrm{tr}\left[\left(M_{a|x^{*}}\otimes\left(\frac{V_{1,a}+V_{1,a}^{\dagger}}{2}\right)\right){\lvert\psi\rangle\\!\langle\psi\rvert}\right]\\\
\text{s.t.
}\quad&\sum_{a\in\mathcal{A}}V_{k,a}^{\dagger}V_{k,a}\preceq\mathds{1}_{E}\\\
&V_{1,a}+V_{1,a}^{\dagger}\succeq 0,\quad\forall a\in\mathcal{A}\\\
&V_{i+1,a}+V_{i+1,a}^{\dagger}\succeq 2V_{i,a}^{\dagger}V_{i,a}\quad\forall
i<k,a\in\mathcal{A}\end{split}$ (64)

This allows us to bound $Q^{\uparrow}_{(\alpha_{k})}(\rho)$ using the
objective function of a non-commutative polynomial optimisation problem which
can be relaxed using the SDP hierarchy. To implement the operator inequality
constraints, we can use the localising matrix technique Pironio et al. (2010).
Therefore, $Q^{\uparrow}_{(\alpha_{k})}(\rho)$ (and hence, the conditional
entropy $H^{\uparrow}_{(\alpha_{k})}(A_{x^{*}}|E)$) can be computed using the
SDP hierarchy with the help of localising matrices. The SDP relaxations are
then of the form

$\begin{split}\max\quad&\sum_{a\in\mathcal{A}}{\langle\psi\rvert}\left[M_{a|x^{*}}\left(\frac{V_{1,a}+V_{1,a}^{\dagger}}{2}\right)\right]{\lvert\psi\rangle}\\\
\text{s.t.
}\quad&\mathds{1}-\sum_{a\in\mathcal{A}}V_{k,a}^{\dagger}V_{k,a}\succeq 0\\\
&V_{1,a}+V_{1,a}^{\dagger}\succeq 0,\quad\forall a\in\mathcal{A}\\\
&V_{i+1,a}+V_{i+1,a}^{\dagger}-2V_{i,a}^{\dagger}V_{i,a}\succeq 0\quad\forall
i<k,a\in\mathcal{A}\end{split}$ (65)

where additionally, we impose that $\\{M_{a|x}\\}_{a,x}$ and
$\\{V_{i,a},V_{i,a}^{\dagger}\\}_{i,a}$ commute. We also impose the
constraints from the observed statistics. Finally, the conditional entropy
associated to the iterated mean divergences are lower bounds on the
conditional von Neumann entropy. As $k$ increases, the bound becomes tighter.

The main advantage of the iterated mean divergence method, as compared to the
Gibbs-Golden-Thompson method, is that it applies the NPA hierarchy to low
degree polynomials, at the cost of introducing more monomials and the
localising matrix, which could reduce the overall computation time.
Furthermore, it is proven that the lowest level of the iterated mean hierarchy
(i.e., $k=1$ or $\alpha_{k}=2$) can be relaxed to the conditional min-entropy,
which guarantees that the iterated mean divergence method would be at least as
tight as the conditional min-entropy bound. The iterated mean method is also
shown to be able to give better bounds than the Gibbs-Golden-Thompson method
in the low noise regime, but the Gibbs-Golden-Thompson method gives better
bounds in the high noise regime.

####  5.3.4 Quasi-relative entropies

Finally, the tightest bound that has been obtained so far in this family of
methods was presented by Brown, Fawzi and Fawzi Brown et al. (2021b). They
showed that one can use the integral representation of the logarithm function
and the Gauss-Radau quadrature252525The Gaussian quadrature is a family of
numerical techniques of approximating definite integrals by taking a discrete
weighted sum of its integrand evaluated at appropriately chosen nodes. The
Gauss-Radau quadrature is a variant of the Gaussian quadrature with one of its
nodes fixed to one of the endpoints of the integration. For more details, we
refer the readers to (Davis and Rabinowitz, 1984, pg.103) to obtain a rational
lower bound for the logarithm function:

$\ln(x)\geq r_{m}(x)\coloneqq\sum_{i=1}^{m}w_{i}f(t_{i},x),$ (66)

with

$f(t,x)\coloneqq\frac{x-1}{t(x-1)+1}$ (67)

and

$\lim_{m\to\infty}r_{m}(x)=\ln(x).$

Here, $\\{(t_{i},w_{i})\\}_{i=1}^{m}$ are nodes and weights of the $m$-point
Gauss-Radau quadrature in the interval (0,1] with a fixed node $t_{m}=1$.

We next define

$F_{t}(x,y)\coloneqq yf(t,x/y)=\frac{y(x-y)}{t(x-y)+y},$ (68)

which gives the bound

$y\ln(y/x)\leq-\sum_{i=1}^{m}\frac{w_{i}}{\ln
2}\underbrace{yf(t_{i},x/y)}_{F_{t_{i}}(x,y)}.$ (69)

Now, observe that the quantum relative entropy

$D(\rho||\sigma)\coloneqq\mathrm{tr}[\rho(\log\rho-\log\sigma)]$ (70)

can be expressed using $F(x,y)\coloneqq y\log(y/x)$ as

$D(\rho||\sigma)=\mathrm{tr}[F(\sigma,\rho)]\leq-\sum_{i=1}^{m}\frac{w_{i}}{\ln
2}\underbrace{\mathrm{tr}[F_{t_{i}}(\sigma,\rho)]}_{\eqqcolon
D_{F_{t_{i}}}(\rho||\sigma)},$ (71)

where $D_{F_{t}}(\rho||\sigma)$ is the quasi-relative entropy defined using
the function $F_{t}$. The key insight is that this quantity admits the
variational expression

$\frac{1}{t}\inf_{Z}\\{\mathrm{tr}\left[\rho(\mathds{1}+Z+Z^{\dagger}+(1-t)Z^{\dagger}Z)\right]\\\
+t\,\mathrm{tr}[\sigma Z^{\dagger}Z]\\}$ (72)

where the infimum is taken over all bounded operators in the Hilbert space
$\mathcal{H}$ in which $\rho$ and $\sigma$ live. Since the objective function
of this optimisation is a linear combination of moments, its optimal value can
be approximated using the NPA hierarchy.

For protocols with a single key-generating basis, we can express the relevant
conditional von Neumann entropy in terms of the quantum relative entropy as

$H(\mathsf{A}_{x^{*}}|E)_{\rho_{\mathsf{A}E}}=-D(\rho_{\mathsf{A}E}||\mathds{1}_{\mathsf{A}}\otimes\rho_{E}),$
(73)

where $\mathsf{A}$ is Alice’s classical register holding her raw bit, and the
classical-quantum state $\rho_{\mathsf{A}E}$ is given by

$\rho_{\mathsf{A}E}=\sum_{a\in\mathcal{A}}{\lvert a\rangle\\!\langle
a\rvert}_{\mathsf{A}}\otimes\mathrm{tr}_{AB}[(M_{a|x^{*}}\otimes\mathds{1}_{BE}){\lvert\psi\rangle\\!\langle\psi\rvert}_{ABE}].$
(74)

This yields the lower bound

$H(\mathsf{A}_{x^{*}}|E)_{\rho_{\mathsf{A}E}}\geq\sum_{i=1}^{m}\frac{w_{i}}{\ln
2}D_{F_{t_{i}}}(\rho_{\mathsf{A}E}||\mathds{1}_{\mathsf{A}}\otimes\rho_{E})$
(75)

on the conditional von Neumann entropy.

Assuming that the alphabet for Alice’s raw bit $\mathcal{A}$ is finite, $Z$
can be written as $Z=\sum_{a,a^{\prime}\in\mathcal{A}}{\lvert
a\rangle\\!\langle a^{\prime}\rvert}\otimes Z_{(a,a^{\prime})}$ with
$Z_{(a,a^{\prime})}$ acting on the Hilbert space $\mathcal{H}_{E}$. After some
straightforward algebra, the variational problem in Eq. (72) for the quasi-
relative entropy
$D_{F_{t}}(\rho_{\mathsf{A}E}||\mathds{1}_{\mathsf{A}}\otimes\rho_{E})$ can
then be solved using the SDP hierarchy. The objective function for each node
$t$ is

$\frac{1}{t}\inf_{\\{Z_{a}\\}}\sum_{a\in\mathcal{A}}{\langle\psi\rvert}M_{a|x^{*}}(Z_{a}+Z_{a}^{\dagger}+(1-t)Z_{a}^{\dagger}Z_{a})\\\
+t(Z_{a}Z_{a}^{\dagger}){\lvert\psi\rangle},$ (76)

where $Z_{a}=Z_{(a,a)}$.

In principle, one should perform the optimisation for all $t_{i}$ in a single
SDP by including all $\\{Z_{a,i}\\}_{a,i}$ in the moment matrix and using the
RHS of Eq. (71) as the objective function (instead of the quasi-relative
entropy for a given $t_{i}$) to obtain the tightest bound. However, in
practice, a faster solution can be obtained by solving the optimisation (76)
for each Gauss-Radau node separately. This numerical trick provides a valid
lower bound to the case in which we perform the optimisation for all $t_{i}$
in a single SDP. Furthermore, in protocols where tight analytical bounds are
known, the bounds obtained by the faster algorithm are still very close to the
analytical bounds for a sufficiently high number of nodes.

After solving (76) for each node $t_{i}$ in the Gauss-Radau quadrature, we can
obtain a lower bound on the conditional von Neumann entropy $H(A_{x^{*}}|E)$.
Moreover, as we increase the number of nodes $m$, the approximation converges
to the conditional von Neumann entropy Brown et al. (2021b).

Just like the Gibbs-Golden-Thompson Tan et al. (2021) and the iterated mean
divergence methods Brown et al. (2021a), the quasi-relative entropy method can
be easily adapted to other DI-QKD protocols that include noisy pre-processing,
random post-selection, as well as random key bases. Importantly, for each
optimisation, if we optimise the quasi-relative entropy for each node
separately, the size of the moment matrix is smaller than the ones used in the
Gibbs-Golden-Thompson and iterated mean divergence method, although one has to
perform the optimisation (76) $m$ times (with different values of $t$). As the
required computation time scales linearly with $m$, in many cases, the quasi-
relative entropy method allows us to obtain a tighter bound with less
computation time.

###  5.4 Upper bounds

While security proofs require us to find lower bounds on the secret key length
$\ell$ (and equivalently, the secret key rate $r$), upper bounds on the secret
key rate of DI-QKD protocols indicate how much further they can be improved.

For example, when the upper bound of the key rate for a specific protocol
matches its lower bound, we can conclude that the security proof is tight and
one needs to modify the protocol if one hopes to improve its key rate. In this
case, one cannot hope to improve the key rate of that protocol by improving
the proof techniques, although the effort in developing new proof techniques
can still be fruitful if they are applicable to other protocols or if they
give fundamental insights on the optimal attacks for the protocol.

One can also derive upper bounds that hold for a _family_ of protocols, as was
done in a number of recent works Kaur et al. (2020); Winczewski et al. (2019);
Arnon-Friedman and Leditzky (2021); Christandl et al. (2021); Farkas et al.
(2021); Kaur et al. (2021), some of which we discuss further below. In the
most general case, one could allow that family to include all possible DI-QKD
protocols (based on some fixed honest behaviour), but the existing works
consider slightly more restricted families, e.g. only protocols where the
secret key is generated from the device outputs (rather than inputs), or in
some cases only protocols where the inputs are announced. In this section, we
shall refer to such bounds as protocol-independent, though with the implicit
understanding that the bounds hold only for a corresponding family of
protocols. In principle, if such a bound were to be saturated by a protocol,
one could conclusively rule out the possibility that any alternative protocols
from the family can attain a higher key rate, and instead focus protocol
design efforts on protocols outside that family.

Since a DI-QKD protocol can be seen as a special case of DD-QKD protocol, one
common strategy for upper-bounding the DI-QKD key rate achievable from a
behaviour is to use an upper bound on the DD-QKD key rate from a state, and
minimise over all states that give the observed behaviour. Mathematically, if
$r_{\text{DD}}(\rho)$ is the secret key rate achievable from the state $\rho$
with DD-QKD, and $r_{\text{DI}}(P)$ is the secret key rate achievable from the
behaviour $P(a,b|x,y)$ with DI-QKD,

$r_{\text{DI}}(P)\leq\inf_{\rho}r_{\text{DD}}(\rho),$ (77)

where the minimisation is over all states $\rho$ that can exhibit the
behaviour $P(a,b|x,y)$, since there is no device-independent way to
distinguish between these states. We will therefore also discuss some DD-QKD
upper bounds in this section.

####  5.4.1 Explicit attacks for specific protocols

The simplest way to derive an upper bound for a specific protocol is to
consider a particular attack (e.g. specifying the state that Eve distributes
and the measurements the devices perform) and compute the achievable key rate
of that protocol under that attack using a tight formula, e.g. the Devetak-
Winter bound which is optimal in a particular context Devetak and Winter
(2005). This approach is inherently protocol-dependent, i.e. the resulting
upper bound is only applicable to the specific protocol under consideration.
For example, the key rate originally computed in Pironio et al. (2009) for the
standard DI-QKD protocol can be shown to be tight because the authors
discovered an explicit attack that saturated their lower bound. One way to
come up with explicit attacks is to use a heuristic numerical optimisation
after assuming certain Hilbert space dimensions for the quantum systems. Since
any valid quantum state and measurements would yield a valid upper bound on
the secret key rate, certified global optimality is not needed and hence a
heuristic approach is valid here.

####  5.4.2 Intrinsic information and intrinsic nonlocality

An approach for deriving more general (protocol-independent) upper bounds on
the achievable DI-QKD key rates is essentially based on the so-called quantum
intrinsic information. This quantity was previously studied in the context of
device-dependent QKD, where it was shown to give protocol-independent upper
bounds on the key rate achievable from a specific state. For a tripartite
quantum state $\rho_{ABE}$, the quantum conditional mutual information
$I(A;B|E)_{\rho}$ is defined as

$I(A;B|E)_{\rho}=H(AE)_{\rho}+H(BE)_{\rho}\\\ -H(E)_{\rho}-H(ABE)_{\rho},$
(78)

and the quantum intrinsic information $I(A;B\downarrow E)$ is then defined as
Christandl et al. (2007)

$I(A;B\downarrow E)_{\rho}=\inf_{\Lambda:\,E\rightarrow
E^{\prime}}I(A;B|E^{\prime})_{\sigma},$ (79)

where the infimum is taken over all states
$\sigma_{ABE^{\prime}}=(\operatorname{id}_{AB}\otimes\Lambda)[\rho_{ABE}]$
with $\Lambda$ being a quantum channel to be optimised.

Since this quantity gave upper bounds on the key rates in device-dependent
QKD, it is natural to consider whether a similar quantity based on the quantum
conditional mutual information could do likewise for DI-QKD. One such quantity
was introduced in Kaur et al. (2020), the quantum intrinsic nonlocality. For a
given correlation $P(a,b|x,y)\in\mathcal{Q}$, this quantity can be understood
as the amount of nonlocality present in $P(a,b|x,y)$ and is defined as:

$N^{Q}(\mathsf{A};\mathsf{B})_{P}\coloneqq\sup_{P(x,y)}\inf_{\rho_{\mathsf{A}\mathsf{B}XYE}}I(\mathsf{A};\mathsf{B}|XYE)_{\rho_{\mathsf{A}\mathsf{B}XYE}}$
(80)

where $P(x,y)$ is a probability distribution for the inputs $x$ and $y$, and
the infimum is taken over all classical-quantum states
$\rho_{\mathsf{A}\mathsf{B}XYE}$ (with $\mathsf{A}\mathsf{B}XY$ being
classical registers corresponding to the outputs and inputs of Alice and Bob,
respectively) that are “compatible with” the correlation $P(a,b|x,y)$. More
precisely, this means that the optimisation is taken over states of the form

$\rho_{\mathsf{A}\mathsf{B}XYE}=\sum_{a,b,x,y}P(x,y){\lvert
a,b,x,y\rangle\\!\langle a,b,x,y\rvert}_{\mathsf{A}\mathsf{B}XY}\\\
\otimes\text{Tr}_{AB}[(M_{a|x}\otimes
N_{b|y}\otimes\mathds{1}_{E})\rho_{ABE}],$ (81)

for some measurement operators $M_{a|x},N_{b|y}$ such that
$\text{Tr}[(M_{a|x}\otimes
N_{b|y}\otimes\mathds{1}_{E})\rho_{ABE}]=P(a,b|x,y)$.

Kaur et al. (2020) showed that for an i.i.d. device characterised by the
correlation $P(a,b|x,y)$, the quantum intrinsic nonlocality
$N^{Q}(\mathsf{A};\mathsf{B})_{P}$ gives a protocol-independent upper bound on
the secret key rate that can be achieved using a large family of DI-QKD
protocols (against a quantum adversary). The family of protocols to which this
bound applies includes those that use pre-processing and advantage
distillation, but is restricted to protocols where the measurement choices are
announced and the secret key is extracted from the measurement outcomes. This
covers the majority of existing DI-QKD protocols, but there are some
exceptions, such as protocols where the secret key is extracted from the
measurement choices (inputs) instead Rahaman et al. (2015).

Note that as we are concerned about upper bounds, one does not need to exactly
solve the infimum in the definition (80) — any feasible $\rho_{ABE}$ in Eq.
(81) will yield a valid upper bound. This is helpful, as this optimisation
problem may be difficult to solve.

####  5.4.3 Explicit bounds from intrinsic information

Similarly, while the optimisation in the definition of the intrinsic
information may be difficult to solve, in certain cases, there are upper
bounds on it which can be explicitly computed, which would then in turn be
upper bounds on the key rate in those cases. For instance, for protocols where
Alice and Bob use fixed key generation inputs $x^{*}$ and $y^{*}$, Arnon-
Friedman and Leditzky (2021) showed that for any state and measurements
compatible with the accepted correlations, the intrinsic information of the
post-measurement ccq state $\rho_{\mathsf{A}\mathsf{B}E}$ (for inputs $x^{*}$
and $y^{*}$) shared between Alice, Bob and Eve is an upper bound on the
achievable DI-QKD key rate. As before, this upper bound also holds for
protocols involving pre-processing or advantage distillation.

By considering explicit strategies and bounding the corresponding intrinsic
information value, one can thus derive upper bounds on the secret key rate. As
an example, an upper bound for DI-QKD protocols with fixed measurement basis
that estimate the CHSH value $S$ and the QBER $Q$ can be derived by
considering the following state

${\lvert\psi\rangle}_{ABE}=\sqrt{\frac{1+C}{2}}{\lvert\Phi^{+}\rangle}_{AB}{\lvert
0\rangle}_{E}\\\ +\sqrt{\frac{1-C}{2}}{\lvert\Phi^{-}\rangle}_{AB}{\lvert
1\rangle}_{E},$ (82)

and the following measurements

$\begin{split}A_{0}&=\sigma_{Z}\\\ A_{1}&=\sigma_{X},\\\
B_{0}&=\frac{1}{\sqrt{1+C^{2}}}\sigma_{Z}+\frac{C}{\sqrt{1+C^{2}}}\sigma_{X},\\\
B_{1}&=\frac{1}{\sqrt{1+C^{2}}}\sigma_{Z}-\frac{C}{\sqrt{1+C^{2}}}\sigma_{X},\end{split}$
(83)

where $C=\sqrt{(S/2)^{2}-1}$. For Bob’s key measurement $B_{2}$, he uses
$\sigma_{Z}$ with probability $1-2Q$ and with probability $2Q$, he outputs a
random bit. This strategy was an optimal attack on the DI-QKD protocol of
Pironio et al. (2009); the observation made in Arnon-Friedman and Leditzky
(2021) was essentially that it also yields upper bounds on a broader family of
protocols by considering the intrinsic information. Explicitly, they obtained
the upper bound

$1+h_{2}(a_{S,Q})-h_{2}(Q)-h_{2}\left(\frac{1+\sqrt{(S/2)^{2}-1}}{2}\right),$
(84)

where $a_{S,Q}=\frac{1}{2}(1+\sqrt{1+Q(1-Q)(S^{2}-8)})$. (Since this
expression is focused on protocols based on the CHSH inequality, it does not
directly apply to those using other Bell inequalities, such as Woodhead et al.
(2021); Sekatski et al. (2021).)

This approach differs from the aforementioned intrinsic nonlocality method
Kaur et al. (2020), because this approach is restricted to protocols using
fixed key generation inputs for both parties ($x^{*}$ and $y^{*}$), while
intrinsic nonlocality also applies to protocols using multiple generation
inputs. In fact, the authors Arnon-Friedman and Leditzky (2021) give some
explicit comparisons between the bounds; for the example considered here, the
upper bound (84) is tighter whenever $S\gtrsim 2.2$. However, since it is
restricted to protocols with fixed generation inputs, it does not apply to the
random key basis protocol of Schwonnek et al. (2021).

Another significant subsequent development was the work Farkas et al. (2021),
which gave the first explicit example of a correlation that is nonlocal (in
that it violates a Bell inequality) but cannot yield any secret key from any
of a large family of DI-QKD protocols Farkas et al. (2021); namely, those
protocols which

  1. 1.

Establish nonlocal correlations by applying local measurements on an entangled
quantum state,

  2. 2.

Have both parties announce the measurement used, and

  3. 3.

Construct the key by classically post-processing the outcomes.

Note that most DI-QKD protocols — in particular, all protocols covered in
Section 4 — fall into this family.

The approach used in that work was to construct a so-called convex combination
attack. In such an attack, Eve mixes a local strategy with behaviour
$P^{\mathcal{L}}(a,b|x,y)$ and a nonlocal strategy with behaviour
$P^{\mathcal{N}\mathcal{L}}(a,b|x,y)$, with weights $q_{\mathcal{L}}$ and
$1-q_{\mathcal{L}}$ respectively. When the local behaviour is distributed, it
is assumed that she has full information about $a$ and $b$, but when the
nonlocal behaviour is distributed, we assume that she is completely
uncorrelated with Alice and Bob. Hence, the overall tripartite behaviour is
given by

$P(a,b,e|x,y)=q_{\mathcal{L}}P^{\mathcal{L}}(a,b|x,y)\delta_{(a,b),e}\\\
+(1-q_{\mathcal{L}})P^{\mathcal{N}\mathcal{L}}(a,b|x,y)\delta_{?,e},$ (85)

where $\delta$ is the Kronecker delta and $e=?$ denotes the case in which Eve
is not correlated to Alice and Bob. We then assume that Eve maximises the
local weight $q_{\mathcal{L}}$ given an overall behaviour $P(a,b|x,y)$ and an
appropriately chosen $P^{\mathcal{N}\mathcal{L}}(a,b|x,y)$. Then, the
asymptotic secret key rate achievable from such behaviour can be upper bounded
by considering the _classical_ intrinsic information.

In Farkas et al. (2021), the above convex combination attack is considered on
correlations arising from arbitrarily many projective measurements on two-
qubit Werner state with visibility $v$ Werner (1989). More precisely, by
choosing the nonlocal correlation $P^{\mathcal{N}\mathcal{L}}(a,b|x,y)$ to be
the one attainable using the maximally entangled state (i.e., $v=1$) and the
local correlation to be the one obtained using a local deterministic strategy,
one can derive a lower bound on the critical visibility, i.e. the minimum
visibility for positive intrinsic information. They thus obtained a lower
bound on the critical visibility of $v^{L}_{\text{crit}}\approx 0.7263$. On
the other hand, it is well-known that there exist projective measurements that
give rise to nonlocal correlations whenever the visibility is higher than
$v_{\mathcal{N}\mathcal{L}}\approx 0.6964$. Since
$v^{L}_{\text{crit}}>v_{\mathcal{NL}}$, it can be concluded that nonlocality
is not sufficient for typical DI-QKD protocols: there exist nonlocal
behaviours that do not allow such protocols to generate secret keys.

####  5.4.4 Extensions via the cc-squashed entanglement

In Kaur et al. (2021), these protocol-independent bounds based on the
conditional mutual information were superseded (in certain regimes) and
generalised using the _classical-classical (cc) squashed entanglement_

$E^{cc}_{sq}(\rho,\mathcal{M},P(x,y))\coloneqq\\\
\sum_{x,y}P(x,y)\inf_{\Lambda_{E}}I(\mathsf{A};\mathsf{B}|E)_{\sigma(x,y)},$
(86)

where

$\mathcal{M}\coloneqq\\{\\{M_{a|x}\\}_{a,x},\\{N_{b|y}\\}_{b,y}\\}$

and

$\sigma(x,y)\coloneqq(\Lambda_{A|x}\otimes\Lambda_{B|y}\otimes\Lambda_{E})[\psi^{\rho}],$
(87)

with $\rho$ being the bipartite state shared by Alice and Bob, $\psi^{\rho}$
the tripartite purification262626As explained in (Kaur et al., 2021, Sec. D),
any purification is sufficient for Eve’s optimal attack. thereof,
$\Lambda_{A|x}$ the map
$\rho_{A}\mapsto\sum_{a}\mathrm{tr}[M_{a|x}\rho_{A}]{\lvert a\rangle}{\langle
a\rvert}$, $\Lambda_{B|y}$ the analogous map for $\\{N_{b|y}\\}_{b}$, and
$\Lambda_{E}$ an arbitrary CPTP map on Eve’s subsystem.

Using (Kaur et al., 2021, Obsv. 4), which shows that any extension can be
obtained from applying an appropriate map to a purification, the quantum
intrinsic nonlocality $N_{Q}$ can then be expressed as

$N_{Q}(\mathsf{A};\mathsf{B})_{P}=\sup_{P(x,y)}\inf_{(\rho,\mathcal{M})}E^{cc}_{sq}(\rho,\mathcal{M},P(x,y)),$
(88)

with the infimum taken over all bipartite states and measurements giving the
behaviour $P(a,b|x,y)$. As discussed previously, the quantum intrinsic
nonlocality gives an upper bound on a very large class of protocols, but
optimising the cc-squashed entanglement over different feasible sets can give
tighter bounds in more specific scenarios.

In particular, for a protocol which uses only a fixed pair of inputs
$(x^{\star},y^{\star})$ to generate the key,

$\inf_{(\sigma,\,\mathcal{N})}E^{cc}_{sq}\left(\sigma,\mathcal{N},P(x,y)=\delta_{xx^{\star}}\delta_{yy^{\star}}\right)$
(89)

is a convex upper bound on the key rate of that protocol using a pair
$(\rho,\mathcal{M})$, where the infimum is taken over all pairs of state and
measurements that are indistinguishable from $(\rho,\mathcal{M})$ in that
protocol (Kaur et al., 2021, Eq. 4).272727For example, we optimise over all
states and measurements with the same CHSH value if the protocol uses only the
CHSH value to evaluate security, while we optimise over all states and
measurements with the same behaviour if the protocol uses a particular
behaviour. It was shown that, for any such protocol, and any state and
measurements to which the bounds in Farkas et al. (2021); Arnon-Friedman and
Leditzky (2021) apply, the bounds in those works are lower-bounded by (89)
(Kaur et al., 2021, Cor. 5). Since the lower bound is convex, it lies below
the convex hull of the above two bounds, and therefore supersedes them (Kaur
et al., 2021, Thm. 9).

A broader result, that the average intrinsic information of the behaviour in
(85) is an upper bound on the key rate of protocols where the inputs are
announced (Farkas et al., 2021, Eq. 5), is also superseded by this work, by
showing that this bound is a special case of

$\inf_{(\sigma,\,\mathcal{N})}E^{cc}_{sq}(\sigma,\mathcal{N},P(x,y)),$ (90)

with the infimum taken over all pairs giving the marginal behaviour
$P(a,b|x,y)=\sum_{e}P(a,b,e|x,y)$, and that this infimum is a convex upper
bound on the key rate of this behaviour under such protocols.

####  5.4.5 Other upper bounds on the DI-QKD key rate

A few other upper bounds on DI-QKD key rates have been recently obtained.
These also follow the typical recipe of constructing a strategy that is
indistinguishable from honest behaviour under the protocol, then bounding the
DD-QKD key rate of the strategy. These results are collected in this section
because the examples given in their corresponding papers do not rely on the
conditional mutual information to bound the key rates of the alternative
strategy, but the construction of the alternative strategy can of course be
used in conjunction with a bound based on the conditional mutual information.

In Christandl et al. (2021), the alternative strategy is constructed by
considering the partial transpose of the state in an honest implementation.
Consider a set of measurements $\\{M_{a|x}\\}_{a,x}$ for Alice,
$\\{N_{b|y}\\}_{b,y}$ for Bob and the bipartite quantum state $\rho$, giving
behaviour $P(a,b|x,y)$. Let $\rho^{\Gamma}$ denote the state $\rho$ with the
partial transpose applied to Bob’s subsystem. Then, $P(a,b|x,y)$ can be
obtained from $\rho^{\Gamma}$ using the measurements $\\{M_{a|x}\\}_{a,x}$ and
$\\{N_{b|y}^{T}\\}_{b,y}$, i.e.

$\mathrm{tr}[(M_{a|x}\otimes N_{b|y})\rho]=\mathrm{tr}[(M_{a|x}\otimes
N_{b|y}^{T})\rho^{\Gamma}].$ (91)

For the partial-transposed strategy to be valid, we need $\rho^{\Gamma}\succeq
0$, i.e. the quantum state $\rho$ must have a positive partial transpose
(PPT). Hence, for a bipartite PPT state $\rho$ shared between Alice and Bob,
the device-independent key rate is upper bounded by

$\min\\{r(\rho),r(\rho^{\Gamma})\\},$ (92)

where $r(\rho)$ is an upper bound on the key rate of a state $\rho$.
Interestingly, there are PPT states where the lower bound on $r(\rho)$ is high
but the upper bound on $r(\rho^{\Gamma})$ is very low Christandl et al.
(2021)282828For this family of states, the lower bound on the key rate is
given by the Devetak-Winter protocol Devetak and Winter (2005) while the upper
bound was computed in Christandl and Ferrara (2017).. However, if $\rho$ is
PPT, then its device-independent key rate is upper bounded by the upper bound
on $r(\rho^{\Gamma})$. This implies a huge gap between the DD and DI-QKD rates
of such states.

In Kaur et al. (2021), the following state decomposition was used:

$\rho=p\rho^{L}+(1-p)\rho^{NL},$ (93)

with $(\rho^{L},\mathcal{M})$ giving a local behaviour and
$(\rho^{NL},\mathcal{M})$ giving a nonlocal behaviour, while the infima are
taken over pairs $(\sigma^{L},\mathcal{N}^{L})$ and
$(\sigma^{NL},\mathcal{N}^{NL})$ that reproduce the behaviour of
$(\rho^{L},\mathcal{M})$ and $(\rho^{NL},\mathcal{M})$, respectively.

Then, we have the following upper bound on the DI-QKD key rate of
$(\rho,\mathcal{M})$ under any protocol:

$p\inf_{(\sigma^{L},\,\mathcal{N}^{L})}E_{R}(\sigma^{L})+(1-p)\inf_{(\sigma^{NL},\,\mathcal{N}^{NL})}E_{R}(\sigma^{NL})$
(94)

where $E_{R}(\rho)$ is the _relative entropy of entanglement_

$E_{R}(\rho)\coloneqq\min_{\sigma\text{ separable}}D(\rho||\sigma),$ (95)

and $D(\cdot||\cdot)$ is the quantum relative entropy. This bound follows
because $E_{R}$ is an upper bound on the DD-QKD key rate of a state, and the
pairs $(\sigma^{L},\,\mathcal{N}^{L})$ and $(\sigma^{NL},\,\mathcal{N}^{NL})$
can be used to construct a state $\sigma$ and measurements $\mathcal{N}$ such
that $E_{R}(\sigma)$ is given by (94), and $(\sigma,\mathcal{N})$ reproduces
the behaviour of $(\rho,\mathcal{M})$, being therefore indistinguishable in a
DI-QKD protocol.

While these optimisations are difficult to solve, in the simpler case of CHSH-
based protocols, this technique gives tighter bounds than Kaur et al. (2020)
for all CHSH values, and Arnon-Friedman and Leditzky (2021) in the low CHSH
value regime.

##  6 Finite-key analyses

In the preceding sections, we have mainly discussed key rates in the
asymptotic setting. However, in a practical implementation, the number of
rounds will always be finite, and hence it is important to address the
question of proving that a protocol is secure in such a setting. We now
discuss various techniques for achieving this. (A more detailed introduction
to this topic can be found in e.g. Tan (2021).) The main task is to ensure
that the security definition (4) holds, and as noted in the Introduction, it
is convenient to do so by separately arguing that correctness (Eq. (9)) and
secrecy (Eq. (10)) are satisfied.

Let $\mathbf{S}$ denote Alice’s raw key (possibly after sifting, noisy pre-
processing or random post-selection292929More precisely: for random post-
selection in particular, it is possible in principle to perform finite-size
analysis under an i.i.d. assumption, but it is currently not known how to
prove it is secure in the non-i.i.d. case — we return to this point after
discussing the entropy accumulation theorem.), and let $E$ denote all of Eve’s
quantum side-information over the course of the protocol (this is a change of
notation from previous sections, where it only denoted her side-information in
a single round). Let $\mathbf{P}$ be the transcript of the public
communication, which in general would depend on the protocol description.
However, as in our discussion in Section 5, in many protocols this transcript
can be viewed as consisting of two parts: a string $\mathbf{T}$ of
announcements $T_{j}$ made in individual rounds (for instance, Alice and Bob’s
setting choices $X_{j}Y_{j}$ in each round), followed by some additional
communication $\mathbf{P}_{\text{EC}}$ at the end for error correction and
verification. Furthermore, we shall again focus on the case where Bob directly
produces a guess for Alice’s string $\mathbf{S}$ (and they immediately apply
privacy amplification on the resulting values), rather than having Alice and
Bob use public communication to modify _both_ their raw strings to some common
values. (The latter situation can be more complicated and we do not discuss it
here.)

For such protocols, the length of secret key that can be extracted via privacy
amplification can then be characterised using the conditional smooth min-
entropy, as mentioned in the Introduction. More precisely, we can ensure the
secrecy condition holds as long as the final key length is chosen to be
slightly shorter than $H_{\text{min}}^{\epsilon_{s}}(\mathbf{S}|\mathbf{P}E)$
(where $\epsilon_{s}\in(0,1)$ is a smoothing parameter chosen depending on the
desired value of the secrecy parameter $\varepsilon_{\text{sec}}$), so a key
task in the security proof is to lower-bound this quantity. For transcripts
$\mathbf{P}$ with the structure mentioned above, we have
$H_{\text{min}}^{\epsilon_{s}}(\mathbf{S}|\mathbf{P}E)=H_{\text{min}}^{\epsilon_{s}}(\mathbf{S}|\mathbf{T}\mathbf{P}_{\text{EC}}E)$.
To bound this, a convenient approach is to use a chain rule for smooth
entropies, which states an intuitive lower bound

$H_{\text{min}}^{\epsilon_{s}}(\mathbf{S}|\mathbf{P}E)\geq
H_{\text{min}}^{\epsilon_{s}}(\mathbf{S}|\mathbf{T}E)-\text{len}(\mathbf{P}_{\text{EC}}),$
(96)

where $\text{len}(\mathbf{P}_{\text{EC}})$ is the length of
$\mathbf{P}_{\text{EC}}$ (in bits). In other words, publicly communicating the
register $\mathbf{P}_{\text{EC}}$ decreases the smooth min-entropy by at most
$\text{len}(\mathbf{P}_{\text{EC}})$ bits. (We briefly remark that this chain
rule is a fully general bound, but in the context of security proofs, it is
most suited for application in protocols of the form we described above rather
than more elaborate procedures.)

For convenience in this description, we shall focus on protocols where
$\mathbf{P}_{\text{EC}}$ can be further broken down into two parts: first, a
string of length at most some value $\text{leak}_{\text{EC}}$ to allow Bob to
produce a guess for Alice’s string $\mathbf{S}$, second, a hash of
$\mathbf{S}$ with length
$\left\lceil\log_{2}(1/\varepsilon_{\text{cor}})\right\rceil$ to allow error
verification (by having Bob compare it to the hash of his guess). Importantly,
if the latter is chosen from a two-universal hash family, then it is
straightforward to show (from the properties of two-universal hashing) that
this procedure immediately ensures the protocol is
$\varepsilon_{\text{cor}}$-correct, without _any_ conditions on how Bob
produced his guess or what the actual device behaviour was. (Some earlier
error-correction procedures, e.g. in Renner (2005), used other approaches to
ensure the correctness condition, but applying them requires some technical
conditions we do not discuss here.)

Therefore, with such an error verification procedure, it is possible to simply
choose the value $\text{leak}_{\text{EC}}$ based on the _honest_ behaviour of
the devices — essentially, this is only required in order to ensure
completeness of the protocol (i.e. that the abort probability is low in the
honest case), and is not involved at all in proving correctness or
secrecy.303030It is worth stressing that since we are focusing on fixed-length
protocols, and the length of the final key will depend on
$\text{leak}_{\text{EC}}$, this value must be fixed before the protocol
begins, _not_ chosen adaptively during the protocol. As noted above, the error
verification procedure described here ensures the correctness condition holds
even without choosing $\text{leak}_{\text{EC}}$ adaptively. For the same
reason, performing information reconciliation in this fashion also implies
that e.g. for protocols where the generation rounds are characterised by a
QBER value $Q$ in the honest case, Alice and Bob do not need to estimate the
value of $Q$ in the actual implementation; they can simply use the honest
value. Since the honest behaviour is usually i.i.d., one can then apply well-
known classical protocols for error correction in this form, which usually
require

$\text{leak}_{\text{EC}}\approx nf_{\text{EC}}\,h_{2}(Q),$ (97)

for an “efficiency” prefactor $f_{\text{EC}}$ that lies between 1.1 and 1.2
for typical sample sizes in QKD implementations (in the asymptotic limit, we
simply have $f_{\text{EC}}\to 1$).

With this form of information reconciliation procedure, we see that the length
of $\mathbf{P}_{\text{EC}}$ is upper bounded by
$\text{leak}_{\text{EC}}+\log_{2}(2/\varepsilon_{\text{cor}})$. By the chain
rule (96), this yields the following bound:

$H_{\text{min}}^{\epsilon_{s}}(\mathbf{S}|\mathbf{P}E)\geq
H_{\text{min}}^{\epsilon_{s}}(\mathbf{S}|\mathbf{T}E)\\\
-\text{leak}_{\text{EC}}-\log_{2}\frac{2}{\varepsilon_{\text{cor}}}.$ (98)

Thus, to prove the secrecy of the protocol, it is roughly313131Though as
emphasised in Tomamichel and Leverrier (2017), a rigorous security proof would
need to account for the fact that conditioning on different steps of the
protocol accepting can change the entropy; see e.g. Lemma 10 in that work for
one approach to handle this. sufficient to find a lower bound on the
conditional smooth min-entropy
$H_{\text{min}}^{\epsilon_{s}}(\mathbf{S}|\mathbf{T}E)$ — with that, we would
have a lower bound on $H_{\text{min}}^{\epsilon_{s}}(\mathbf{S}|\mathbf{P}E)$,
which characterises the length of $\varepsilon_{\text{sec}}$-secret key that
can be extracted in the privacy amplification process, e.g. via the Quantum
Leftover Hash Lemma Tomamichel et al. (2011).

However, finding a lower bound on
$H_{\text{min}}^{\epsilon_{s}}(\mathbf{S}|\mathbf{T}E)$ is still very
challenging when non-i.i.d. behaviour323232In the i.i.d. case, one can use the
quantum asymptotic equipartition property Tomamichel et al. (2009) to obtain a
bound of the form (99), after applying an appropriate analysis of the
parameter-estimation aspect; see e.g. Renner (2005); Tan (2021). has to be
taken into account. Fortunately, it turns out that for a large class of
protocols, we can find bounds of the form

$H_{\text{min}}^{\epsilon_{s}}(\mathbf{S}|\mathbf{T}E)\geq nh-O(\sqrt{n}),$
(99)

where the constant $h$ can be constructed by analysing individual rounds of
the protocol instead of analysing all the rounds at once. In the next
subsection, we shall discuss a technique known as the entropy accumulation
theorem (EAT) that allow us to establish bounds of the form (99), and after
that we will briefly discuss other techniques that have been used to analyse
the finite-key security of DI-QKD.

###  6.1 Entropy accumulation theorem

The entropy accumulation theorem is designed to apply to “sequential” device
behaviours, in the sense that in each round, the device measurements can act
not only on the state received from Eve in that round, but also additional
registers that store (quantum or classical) “memory” from previous rounds. In
particular, this implies for instance that the outputs in each round can
depend on the inputs in all earlier rounds; however, they cannot depend on
inputs in future rounds, i.e. there is a form of time-ordering condition.
While some proof techniques have been constructed for correlations that do not
even have such a time-ordering condition (as we shall discuss later), this
sequential model should already be sufficiently general to cover all currently
plausible realisations of DI-QKD, in which the measurements are performed
round-by-round.

With this in mind, suppose that the parameter-estimation aspect of the
protocol is described in the following fashion: in every round, some function
of the input and output values is computed and recorded in a classical
register $Z_{j}$ with alphabet $\mathcal{Z}$ (which is the same in each
round), and the parameter-estimation step accepts if the frequency
distribution computed from the string $\mathbf{Z}$ lies within some set of
“acceptable” distributions on $\mathcal{Z}$. (As a simple example, for a
protocol based on the CHSH game in the test rounds, $Z_{j}$ can simply be a
register that records whether the round was a test round, and if so, whether
the CHSH game was won or lost in that round. More generally, we could consider
other functions of the input/output values, up to and including simply
recording all the input and output values in full.)

The core component of the EAT is constructing a function defined on
distributions on the alphabet $\mathcal{Z}$, called the min-tradeoff function.
Note that $\mathcal{Z}$ is the alphabet for a single round, i.e. this
construction is centred around analysing the rounds individually. To give a
qualitative description in the context of DI-QKD, a min-tradeoff function is
roughly333333There are other technical details in the full definition of a
min-tradeoff function, such as requiring it to be convex or affine depending
on the EAT formulation, and some issues regarding what values the $Z_{j}$
registers can depend on. However, we do not discuss them here. a function
$f_{\mathrm{min}}$ with the following main property: for every round $j$, if
the state and measurements in that round were to produce some distribution $q$
on the register $Z_{j}$, then the von Neumann entropy $H(S_{j}|T_{j}R)$
against any purification $R$ (of the state before measurement) is at least
$f_{\mathrm{min}}(q)$. In other words, for any round, $f_{\mathrm{min}}$ is a
lower bound on the von Neumann entropy as a function of the distribution
produced in that round — this is basically the bound being formulated in Eq.
(29), hence justifying our earlier claim that solving that optimization is
also essentially sufficient to allow a finite-size analysis against general
attacks. It is worth emphasising that in this context, $q$ is a distribution
involving only an individual round. As such, it is an “abstract” quantity that
cannot be directly observed, unlike the final frequency distribution on the
full string $\mathbf{Z}$.

This brings us to the main technical advance offered by the EAT, which is that
it connects the “abstract” individual-round analysis to a bound on
$H_{\text{min}}^{\epsilon_{s}}(\mathbf{S}|\mathbf{T}E)$ that is expressed in
terms of the observed string $\mathbf{Z}$. Specifically, the EAT can be used
to derive the following statement: for any event $\Omega$ on $\mathbf{Z}$, if
there is a constant $h$ such that
$f_{\mathrm{min}}(\mathrm{freq}_{\mathbf{Z}})\geq h$ for all values of
$\mathbf{Z}$ in $\Omega$, then the final state conditioned on $\Omega$
satisfies a bound of roughly the form (99)343434In the full derivation, there
is a small additional correction due to technicalities regarding Bob’s
registers, but this correction also vanishes in the asymptotic limit.. (The
implicit constants in the $O(\sqrt{n})$ term in this case are functions of
$\Pr[\Omega]$, the smoothing parameter $\epsilon_{s}$, and some properties of
$f_{\mathrm{min}}$ — that final point is why we had to introduce an
“intermediate” object $f_{\mathrm{min}}$ rather than directly introducing the
lower bound $h$ on the von Neumann entropy.) Notice that $f_{\mathrm{min}}$
could be constructed by only analysing the individual rounds, whereas $\Omega$
is an event defined in terms of the actual observed value of $\mathbf{Z}$, and
hence the EAT serves the crucial purpose of relating the two frameworks.

The EAT does come with a technical restriction, in the form of a particular
Markov condition — informally, this condition states that the publicly
announced data in the $j^{\text{th}}$ round must not “leak” any information
about the device outputs in preceding rounds. On the abstract level, some
condition of roughly this form is necessary, because without it, the public
announcement in the $j^{\text{th}}$ round might simply be a copy of the
previous round’s outputs, making the scenario completely insecure (even with a
nontrivial min-tradeoff function). Fortunately, this condition is trivially
satisfied for most of the basic DI-QKD protocols, where the
$j^{\text{th}}$-round public announcement consists only of the input values
$X_{j}Y_{j}$, which are generated using trusted randomness and completely
independent of previous rounds. However, some later protocols such as the
random post-selection protocol Xu et al. (2021); Liu et al. (2021b) have
public announcements that do not necessarily fulfill this condition, and it is
currently unclear how to construct a security proof for such protocols against
non-i.i.d. attacks.

###  6.2 Other techniques

Another technique that can be useful in deriving lower bounds on the
conditional smooth-min entropy is called the quantum probability estimation
(QPE) technique Knill et al. (2018); Zhang et al. (2020a, b). Similar to the
EAT, the technique relies on the fact that most protocols are implemented
sequentially, and it reduces the analysis to a single round of the protocol.
However, when QPE is used, the mathematical object of interest is a quantity
known as the _sandwiched $\alpha$-Rényi power_, which is to be upper-bounded
in the security proof. This is done by deriving the so-called quantum
estimation factors (QEF), which serve to yield a lower bound on the smoothed
min-entropy. Importantly, when the quantum Markov chain condition is
satisfied, it is possible to analyse the QEF for all the rounds by analysing
the QEF for a single round of the protocol Knill et al. (2018); Zhang et al.
(2020a, b). However, so far, the quantum probability estimation technique has
only been used in the context of randomness generation and not in QKD.
Importantly, in the context of DI randomness generation, the QPE method
offered some advantage in terms of the minimum number of rounds required as
compared to the original EAT Arnon-Friedman et al. (2018), especially for
systems with low CHSH violation. It would be interesting to see if the same
improvement can be observed in the context of DI-QKD.

Furthermore, another proof technique was recently developed using an argument
based on complementary observables Zhang et al. (2021c). Roughly, this
technique focuses on protocols where a reduction to qubit systems can be
achieved using Jordan’s lemma. With such a reduction, there is a well-defined
notion of a complementary observable (in the sense that a qubit $X$
measurement is complementary to a qubit $Z$ measurement) for Alice’s key-
generating measurement in each round. That work uses this notion to reduce the
analysis to a situation similar to earlier device-dependent security proofs
Shor and Preskill (2000); Koashi (2009) based on phase errors (i.e. the rounds
in which Alice and Bob’s outcomes would have disagreed _if_ they had both
measured in the complementary basis to the key-generating measurement). A core
technical step in their work was an argument to relate the observed CHSH score
to the distribution of phase errors, which allowed them to apply those proof
techniques.

We now also briefly highlight some earlier techniques used for finite-key
proofs (against coherent attacks). All of these techniques had the limitation
that they generally gave lower asymptotic key rates than those discussed above
(which yield asymptotic key rates that match the i.i.d. case). For instance,
an approach based on entropic uncertainty relations was put forward in Lim et
al. (2013) (for a somewhat modified form of DI-QKD protocol, although the
technique could be generalised to the standard DI-QKD setting). Another
approach was presented in Vazirani and Vidick (2014), deriving a lower bound
on the conditional smooth min-entropy for devices with sequential behaviour
(similar to the EAT, but with a lower asymptotic rate).

There have also been security proofs Jain et al. (2020); Vidick (2017) in the
more challenging scenario of parallel-input behaviour, where Alice and Bob
supply all their inputs at once, and the outputs can depend on the input
choices in all the rounds. This is a very general form of device behaviour,
and it is in fact currently an open question whether the same asymptotic key
rates as the i.i.d. case can even be achieved at all in this setting.
Nonetheless, the proof techniques in those works can generalised even further
to a DI-QKD scenario where the devices can leak a small amount of information
about the inputs Jain and Kundu (2021).

##  7 Outlook

In theory, DI-QKD offers an information-theoretically secure method to
distribute secret keys across distant parties with minimal assumption. In
practice however, implementations of DI-QKD are still restricted to the the
confines of state-of-the-art laboratories with sophisticated experimental
techniques and setups that are far more advanced than commonly available
experimental devices, let alone practical devices. While there have been a
couple of demonstrations Nadlinger et al. (2021); Zhang et al. (2021b); Xu et
al. (2021) recently, the transmission distance and the key rate are severely
limited. From here, there are multiple research directions to pursue.

###  7.1 Other frameworks for finite-key analyses

In this review article, we have focused on finite-key analyses in the
framework of EAT. As we have mentioned earlier, other frameworks for security
analyses in the finite-key regime exist. In particular, the QPE framework
Knill et al. (2018); Zhang et al. (2020a, b) has been shown to provide a
significant improvement in terms of the minimum number of rounds as compared
to the EAT when applied to device-independent quantum randomness generation or
expansion. However, the main bottleneck in applying this framework is the fact
that we have yet to find an efficient method to construct the optimal QEF, as
noted in Zhang et al. (2020a). In fact, at the moment of writing, there do not
appear to be any known method for constructing QEFs suitable for DI-QKD. In
contrast, we have many systematic methods (as listed in Section 5) to
construct min-tradeoff functions, and hence the EAT can be more readily
applied.

On another note, a generalised version of the EAT has been recently applied in
the context of DD-QKD Metger and Renner (2022); Metger et al. (2022). As
compared to the versions of EAT discussed in this review Dupuis and Fawzi
(2019); Dupuis et al. (2020), the generalised EAT uses a somewhat weaker
assumption than the original Markov condition, and hence could be applied to a
broader class of scenarios. As this generalised version still has the property
that it is independent of the dimension of the underlying Hilbert space, it
can also be applied to DI-QKD.

###  7.2 Finite-key analyses of some protocols

The DI-QKD protocol with random post-selection Xu et al. (2021) offers a
promising direction in which a fully-photonic setup can distribute secret keys
if one assume that the block size is asymptotically large and the devices
behave in an i.i.d. manner. Indeed, the required specifications are not beyond
the state-of-the-art technology, as shown in the recent demonstration of the
protocol Liu et al. (2021b). Importantly, as the protocol can be implemented
using a fully-photonic setup, the setup can be made simpler as no heralding
system is required353535Although to achieve longer transmission distances,
qubit amplifiers may be required. See Section 3.1.3 for more details..
Additionally, large block sizes can be easily achieved due to the higher
clockrate of the devices as compared to the heralded entanglement setups.
However, to achieve fully device-independent security, one has to extend the
security analysis to the finite-key regime and against general attacks (i.e.,
without the i.i.d. assumption). At the moment of writing, it is unclear
whether any of the available finite-key proof techniques can be used to
analyse such protocols or whether the key rate under general attacks would
asymptotically converge to the value under collective attacks. That being
said, it has been shown that a non-i.i.d. attack can be more powerful than any
i.i.d. attacks (even in the asymptotic limit) when a deterministic post-
selection strategy is employed Thinh et al. (2016), hence indicating some
difficulties in trying to prove such a result. Another protocol in which
security against general attacks is still an open question is the advantage
distillation protocol studied in Tan et al. (2020a).

###  7.3 Protocol design: more inputs/more outputs

Another interesting direction is designing protocols beyond the two-input-two-
output scenario. Most of the well-studied protocols with tight security bounds
are based on the two-input-two-output scenario, which allows reduction to a
qubit analysis via Jordan’s lemma. A couple of other techniques Tan et al.
(2021); Brown et al. (2021a, b) that do not rely on Jordan’s lemma were also
mainly applied to protocols with two binary measurements on Alice and three
binary measurements on Bob363636With notable exception of Brown et al. (2021a)
where a three-output protocol was studied.. Given that the technique in Brown
et al. (2021b) is efficient and versatile, and the resulting bounds are
reasonably tight, it would be interesting to analyse the performance of DI-QKD
protocols with more inputs and/or outputs.

###  7.4 Trade-off between security and practicality

Last but not least, although device-independent security is an appealing
feature, perhaps full device-independence is not necessary for practical QKD.
In practical cryptography, having assumptions that can be justified is often
sufficient for all intents and purposes. Indeed, research in device-dependent
QKD still forms a significant portion of research in practical QKD. As
mentioned in the Introduction, the invention of DI-QKD has given rise to the
new sub-field of semi-DI quantum information processing, in which the quantum
devices are partially characterised.

In practice, a well-chosen semi-DI framework in which the assumed features can
be reasonably characterised and enforced might be a good trade-off between
security and practicality. For example, a power limiter Zhang et al. (2021a)
that can passively enforce the constraint required in the energy-based semi-DI
framework Van Himbeeck et al. (2017) has been proposed. On a similar note,
one-sided device-independent (1SDI-) QKD Branciard et al. (2012); Tomamichel
et al. (2012) removes the need for any characterisation on the detection
device used by one of the honest parties. Numerical toolboxes enabling
security analysis of generic 1SDI-QKD protocols have been developed Wang et
al. (2019), paving the way for practical protocols Ioannou et al. (2021a, b).
Furthermore, MDI-QKD Lo et al. (2012); Braunstein and Pirandola (2012) closes
all detector-side-channels, allowing users to employ untrusted measurement
devices as long as the state preparation is well-characterised. MDI-QKD also
has an advantage in long-distance QKD experiments, as it is able to overcome
the fundamental limit on repeaterless quantum communications Pirandola et al.
(2017). Other than the detectors, one can also relax the assumptions made on
the sources Navarrete et al. (2021); Zhang et al. (2021a) in QKD protocols. Of
course, as practicality is a subjective matter, the level of characterisation
needed would also depend on the application of QKD.

Beside relaxing the requirements on the devices by introducing more
characterisation, one could also introduce computational assumptions on the
devices, as studied in Metger et al. (2021). Those computational assumptions
allowed the protocol in that work to achieve device-independent security
without a no-signalling condition. This could hence serve as an alternative to
closing the locality loophole (or otherwise ensuring that the device inputs do
not leak), although it would still be important to impose the condition that
the device outputs are not leaked.

## Acknowledgement

We acknowledge funding support from the National Research Foundation of
Singapore (NRF) Fellowship grant (NRFF11-2019-0001), NRF Quantum Engineering
Programme 1.0 grant (QEP-P2), and National Quantum-Safe Network project
(NRF2021-QEP2-04-P01). E. Y.-Z. Tan was funded by the Natural Sciences and
Engineering Research Council of Canada (NSERC) Alliance, and Huawei
Technologies Canada Co., Ltd. We thank Víctor Zapatero and Gláucia Murta for
their valuable feedback.

## References

  * Acín et al. (2007) A. Acín, N. Brunner, N. Gisin, S. Massar, S. Pironio, and V. Scarani.  Device-independent security of quantum cryptography against collective attacks.  _Phys. Rev. Lett._ , 98:230501, Jun 2007.  doi: 10.1103/PhysRevLett.98.230501.  URL https://link.aps.org/doi/10.1103/PhysRevLett.98.230501.
  * Arnon-Friedman and Leditzky (2021) R. Arnon-Friedman and F. Leditzky.  Upper bounds on device-independent quantum key distribution rates and a revised Peres conjecture.  _IEEE Transactions on Information Theory_ , 67(10):6606–6618, Oct 2021.  ISSN 1557-9654.  doi: 10.1109/TIT.2021.3086505.
  * Arnon-Friedman et al. (2018) R. Arnon-Friedman, F. Dupuis, O. Fawzi, R. Renner, and T. Vidick.  Practical device-independent quantum cryptography via entropy accumulation.  _Nature Communications_ , 9(459):1–11, 2018.  URL https://doi.org/10.1038/s41467-017-02307-4.
  * Arnon-Friedman et al. (2019) R. Arnon-Friedman, R. Renner, and T. Vidick.  Simple and tight device-independent security proofs.  _SIAM Journal on Computing_ , 48(1):181–225, 2019\.  URL https://doi.org/10.1137/18M1174726.
  * Bae and Acín (2007) J. Bae and A. Acín.  Key distillation from quantum channels using two-way communication protocols.  _Phys. Rev. A_ , 75:012334, Jan 2007.  doi: 10.1103/PhysRevA.75.012334.  URL https://link.aps.org/doi/10.1103/PhysRevA.75.012334.
  * Barrett et al. (2005) J. Barrett, L. Hardy, and A. Kent.  No signaling and quantum key distribution.  _Phys. Rev. Lett._ , 95:010503, Jun 2005.  doi: 10.1103/PhysRevLett.95.010503.  URL https://link.aps.org/doi/10.1103/PhysRevLett.95.010503.
  * Barrett et al. (2013) J. Barrett, R. Colbeck, and A. Kent.  Memory attacks on device-independent quantum cryptography.  _Phys. Rev. Lett._ , 110:010503, Jan 2013.  doi: 10.1103/PhysRevLett.110.010503.  URL https://link.aps.org/doi/10.1103/PhysRevLett.110.010503.
  * Bell (1964) J. S. Bell.  On the Einstein-Podolsky-Rosen paradox.  _Physics_ , 1(3):195, 1964.
  * Bell (2004) J. S. Bell.  _Speakable and unspeakable in quantum mechanics: Collected papers on quantum philosophy_.  Cambridge University Press, 2004.
  * Ben-Or et al. (2005) M. Ben-Or, M. Horodecki, D. W. Leung, D. Mayers, and J. Oppenheim.  The universal composable security of quantum key distribution.  In _Theory of Cryptography_ , pages 386–406. Springer Berlin Heidelberg, 2005.  doi: 10.1007/978-3-540-30576-7˙21.  URL https://doi.org/10.1007/978-3-540-30576-7_21.
  * Bennett and Brassard (1984) C. H. Bennett and G. Brassard.  Quantum cryptography.  In _Proc. IEEE Int. Conf. on Computers, Systems and Signal Processing, Bangalore, India_ , pages 175–179, 1984.
  * Bennett et al. (1992) C. H. Bennett, G. Brassard, and N. D. Mermin.  Quantum cryptography without Bell’s theorem.  _Phys. Rev. Lett._ , 68:557–559, Feb 1992.  doi: 10.1103/PhysRevLett.68.557.  URL https://link.aps.org/doi/10.1103/PhysRevLett.68.557.
  * Bhavsar et al. (2021) R. Bhavsar, S. Ragy, and R. Colbeck.  Improved device-independent randomness expansion rates from tight bounds on the two sided randomness using CHSH tests.  _arXiv preprint arXiv:2103.07504_ , 2021.  URL https://doi.org/10.48550/arXiv.2103.07504.
  * Bierhorst et al. (2018) P. Bierhorst, E. Knill, S. Glancy, Y. Zhang, A. Mink, S. Jordan, A. Rommal, Y.-K. Liu, B. Christensen, S. W. Nam, et al.  Experimentally generated randomness certified by the impossibility of superluminal signals.  _Nature_ , 556(7700):223–226, 2018.  URL https://doi.org/10.1038/s41586-018-0019-0.
  * Branciard et al. (2012) C. Branciard, E. G. Cavalcanti, S. P. Walborn, V. Scarani, and H. M. Wiseman.  One-sided device-independent quantum key distribution: Security, feasibility, and the connection with steering.  _Phys. Rev. A_ , 85:010301, Jan 2012.  doi: 10.1103/PhysRevA.85.010301.  URL https://link.aps.org/doi/10.1103/PhysRevA.85.010301.
  * Braunstein and Pirandola (2012) S. L. Braunstein and S. Pirandola.  Side-channel-free quantum key distribution.  _Phys. Rev. Lett._ , 108:130502, Mar 2012.  doi: 10.1103/PhysRevLett.108.130502.  URL https://link.aps.org/doi/10.1103/PhysRevLett.108.130502.
  * Briët and Harremoës (2009) J. Briët and P. Harremoës.  Properties of classical and quantum Jensen-Shannon divergence.  _Physical Review A_ , 79(5), May 2009.  doi: 10.1103/physreva.79.052311.  URL https://doi.org/10.1103/physreva.79.052311.
  * Brown et al. (2021a) P. Brown, H. Fawzi, and O. Fawzi.  Computing conditional entropies for quantum correlations.  _Nature Communications_ , 12(575):1–12, 2021a.  URL https://doi.org/10.1038/s41467-020-20018-1.
  * Brown et al. (2021b) P. Brown, H. Fawzi, and O. Fawzi.  Device-independent lower bounds on the conditional von Neumann entropy.  _arXiv preprint arXiv:2106.13692_ , 2021b.  URL https://arxiv.org/abs/2106.13692.
  * Brunner et al. (2014) N. Brunner, D. Cavalcanti, S. Pironio, V. Scarani, and S. Wehner.  Bell nonlocality.  _Rev. Mod. Phys._ , 86:419–478, Apr 2014.  doi: 10.1103/RevModPhys.86.419.  URL https://link.aps.org/doi/10.1103/RevModPhys.86.419.
  * Carter and Wegman (1979) J. L. Carter and M. N. Wegman.  Universal classes of hash functions.  _Journal of Computer and System Sciences_ , 18(2):143–154, 1979.  ISSN 0022-0000.  doi: https://doi.org/10.1016/0022-0000(79)90044-8.  URL https://www.sciencedirect.com/science/article/pii/0022000079900448.
  * Chau (2002) H. F. Chau.  Practical scheme to share a secret key through a quantum channel with a 27.6% bit-error rate.  _Phys. Rev. A_ , 66:060302, Dec 2002.  doi: 10.1103/PhysRevA.66.060302.  URL https://link.aps.org/doi/10.1103/PhysRevA.66.060302.
  * Christandl and Ferrara (2017) M. Christandl and R. Ferrara.  Private states, quantum data hiding, and the swapping of perfect secrecy.  _Phys. Rev. Lett._ , 119:220506, Nov 2017.  doi: 10.1103/PhysRevLett.119.220506.  URL https://link.aps.org/doi/10.1103/PhysRevLett.119.220506.
  * Christandl et al. (2007) M. Christandl, A. Ekert, M. Horodecki, P. Horodecki, J. Oppenheim, and R. Renner.  Unifying classical and quantum key distillation.  In _Theory of Cryptography_ , pages 456–478, Berlin, Heidelberg, 2007\. Springer Berlin Heidelberg.  ISBN 978-3-540-70936-7.  URL https://doi.org/10.1007/978-3-540-70936-7_25.
  * Christandl et al. (2021) M. Christandl, R. Ferrara, and K. Horodecki.  Upper bounds on device-independent quantum key distribution.  _Phys. Rev. Lett._ , 126:160501, Apr 2021.  doi: 10.1103/PhysRevLett.126.160501.  URL https://link.aps.org/doi/10.1103/PhysRevLett.126.160501.
  * Clauser et al. (1969) J. F. Clauser, M. A. Horne, A. Shimony, and R. A. Holt.  Proposed experiment to test local hidden-variable theories.  _Phys. Rev. Lett._ , 23:880–884, Oct 1969.  doi: 10.1103/PhysRevLett.23.880.  URL https://link.aps.org/doi/10.1103/PhysRevLett.23.880.
  * Coladangelo and Stark (2018) A. Coladangelo and J. Stark.  Unconditional separation of finite and infinite-dimensional quantum correlations.  _arXiv preprint arXiv:1804.05116_ , 2018.  URL https://doi.org/10.48550/arXiv.1804.05116.
  * Coles et al. (2016) P. J. Coles, E. M. Metodiev, and N. Lütkenhaus.  Numerical approach for unstructured quantum key distribution.  _Nature Communications_ , 7(11712):1–9, 2016\.  URL https://doi.org/10.1038/ncomms11712.
  * Coles et al. (2017) P. J. Coles, M. Berta, M. Tomamichel, and S. Wehner.  Entropic uncertainty relations and their applications.  _Rev. Mod. Phys._ , 89:015002, Feb 2017.  doi: 10.1103/RevModPhys.89.015002.  URL https://link.aps.org/doi/10.1103/RevModPhys.89.015002.
  * Curty and Lo (2019) M. Curty and H.-K. Lo.  Foiling covert channels and malicious classical post-processing units in quantum key distribution.  _npj Quantum Information_ , 5(14):1–11, 2019\.  doi: 10.1038/s41534-019-0131-5.
  * Curty and Moroder (2011) M. Curty and T. Moroder.  Heralded-qubit amplifiers for practical device-independent quantum key distribution.  _Phys. Rev. A_ , 84:010304, Jul 2011.  doi: 10.1103/PhysRevA.84.010304.  URL https://link.aps.org/doi/10.1103/PhysRevA.84.010304.
  * Datta et al. (2021) S. Datta, H. Kampermann, and D. Bruß.  Device-independent secret key rates via a post-selected Bell inequality.  _arXiv preprint arXiv:2111.04482_ , 2021.  URL https://doi.org/10.48550/arXiv.2111.04482.
  * Davis and Rabinowitz (1984) P. J. Davis and P. Rabinowitz.  _Methods Of Numerical Integration_.  Academic Press, 2nd edition, 1984.  ISBN 9781483264288.
  * Devetak and Winter (2005) I. Devetak and A. Winter.  Distillation of secret key and entanglement from quantum states.  _Proceedings of the Royal Society A: Mathematical, Physical and Engineering Sciences_ , 461(2053):207–235, 2005.  doi: 10.1098/rspa.2004.1372.  URL https://doi.org/10.1098/rspa.2004.1372.
  * Dupuis and Fawzi (2019) F. Dupuis and O. Fawzi.  Entropy accumulation with improved second-order term.  _IEEE Transactions on Information Theory_ , 65(11):7596–7612, 2019.  doi: 10.1109/TIT.2019.2929564.  URL https://doi.org/10.1109/TIT.2019.2929564.
  * Dupuis et al. (2020) F. Dupuis, O. Fawzi, and R. Renner.  Entropy accumulation.  _Communications in Mathematical Physics_ , 379(3):867–913, 2020.  URL https://doi.org/10.1007/s00220-020-03839-5.
  * Ekert (1991) A. K. Ekert.  Quantum cryptography based on Bell’s theorem.  _Phys. Rev. Lett._ , 67:661–663, Aug 1991.  doi: 10.1103/PhysRevLett.67.661.  URL https://link.aps.org/doi/10.1103/PhysRevLett.67.661.
  * Farkas et al. (2021) M. Farkas, M. Balanzó-Juandó, K. Łukanowski, J. Kołodyński, and A. Acín.  Bell nonlocality is not sufficient for the security of standard device-independent quantum key distribution protocols.  _Phys. Rev. Lett._ , 127:050503, Jul 2021.  doi: 10.1103/PhysRevLett.127.050503.  URL https://link.aps.org/doi/10.1103/PhysRevLett.127.050503.
  * Gisin et al. (2006) N. Gisin, S. Fasel, B. Kraus, H. Zbinden, and G. Ribordy.  Trojan-horse attacks on quantum-key-distribution systems.  _Phys. Rev. A_ , 73:022320, Feb 2006.  doi: 10.1103/PhysRevA.73.022320.  URL https://link.aps.org/doi/10.1103/PhysRevA.73.022320.
  * Gisin et al. (2010) N. Gisin, S. Pironio, and N. Sangouard.  Proposal for implementing device-independent quantum key distribution based on a heralded qubit amplifier.  _Phys. Rev. Lett._ , 105:070501, Aug 2010.  doi: 10.1103/PhysRevLett.105.070501.  URL https://link.aps.org/doi/10.1103/PhysRevLett.105.070501.
  * Giustina et al. (2015) M. Giustina, M. A. M. Versteegh, S. Wengerowsky, J. Handsteiner, A. Hochrainer, K. Phelan, F. Steinlechner, J. Kofler, J.-A. Larsson, C. Abellán, W. Amaya, V. Pruneri, M. W. Mitchell, J. Beyer, T. Gerrits, A. E. Lita, L. K. Shalm, S. W. Nam, T. Scheidl, R. Ursin, B. Wittmann, and A. Zeilinger.  Significant-loophole-free test of Bell’s theorem with entangled photons.  _Phys. Rev. Lett._ , 115:250401, Dec 2015.  doi: 10.1103/PhysRevLett.115.250401.  URL https://link.aps.org/doi/10.1103/PhysRevLett.115.250401.
  * Goh et al. (2016) K. T. Goh, J.-D. Bancal, and V. Scarani.  Measurement-device-independent quantification of entanglement for given Hilbert space dimension.  _New Journal of Physics_ , 18(4):045022, apr 2016\.  doi: 10.1088/1367-2630/18/4/045022.  URL https://doi.org/10.1088/1367-2630/18/4/045022.
  * Gonzales-Ureta et al. (2021) J. R. Gonzales-Ureta, A. Predojević, and A. Cabello.  Device-independent quantum key distribution based on bell inequalities with more than two inputs and two outputs.  _Phys. Rev. A_ , 103:052436, May 2021.  doi: 10.1103/PhysRevA.103.052436.  URL https://link.aps.org/doi/10.1103/PhysRevA.103.052436.
  * Gottesman and Lo (2003) D. Gottesman and H.-K. Lo.  Proof of security of quantum key distribution with two-way classical communications.  _IEEE Transactions on Information Theory_ , 49(2):457–475, 2003.  doi: 10.1109/TIT.2002.807289.  URL https://doi.org/10.1109/TIT.2002.807289.
  * Grasselli et al. (2021) F. Grasselli, G. Murta, H. Kampermann, and D. Bruß.  Entropy bounds for multiparty device-independent cryptography.  _PRX Quantum_ , 2:010308, Jan 2021.  doi: 10.1103/PRXQuantum.2.010308.  URL https://link.aps.org/doi/10.1103/PRXQuantum.2.010308.
  * Harris and Pandey (2016) S. J. Harris and S. K. Pandey.  Entanglement and Non-Locality (lecture notes), 2016.  URL https://www.math.uwaterloo.ca/~vpaulsen/EntanglementAndNonlocality_LectureNotes_7.pdf.
  * Hensen et al. (2015) B. Hensen, H. Bernien, A. E. Dréau, A. Reiserer, N. Kalb, M. S. Blok, J. Ruitenberg, R. F. Vermeulen, R. N. Schouten, C. Abellán, et al.  Loophole-free Bell inequality violation using electron spins separated by 1.3 kilometres.  _Nature_ , 526(7575):682–686, 2015.  URL https://doi.org/10.1038/nature15759.
  * Ho et al. (2020) M. Ho, P. Sekatski, E. Y.-Z. Tan, R. Renner, J.-D. Bancal, and N. Sangouard.  Noisy preprocessing facilitates a photonic realization of device-independent quantum key distribution.  _Phys. Rev. Lett._ , 124:230502, Jun 2020.  doi: 10.1103/PhysRevLett.124.230502.  URL https://link.aps.org/doi/10.1103/PhysRevLett.124.230502.
  * Hucul et al. (2015) D. Hucul, I. V. Inlek, G. Vittorini, C. Crocker, S. Debnath, S. M. Clark, and C. Monroe.  Modular entanglement of atomic qubits using photons and phonons.  _Nature Physics_ , 11(1):37–42, 2015.  URL https://doi.org/10.1038/nphys3150.
  * Humphreys et al. (2018) P. C. Humphreys, N. Kalb, J. P. Morits, R. N. Schouten, R. F. Vermeulen, D. J. Twitchen, M. Markham, and R. Hanson.  Deterministic delivery of remote entanglement on a quantum network.  _Nature_ , 558(7709):268–273, 2018.  URL https://doi.org/10.1038/s41586-018-0200-5.
  * Ioannou et al. (2021a) M. Ioannou, M. A. Pereira, D. Rusca, F. Grünenfelder, A. Boaron, M. Perrenoud, A. A. Abbott, P. Sekatski, J.-D. Bancal, N. Maring, et al.  Receiver-device-independent quantum key distribution.  _arXiv preprint arXiv:2104.14574_ , 2021a.  URL https://doi.org/10.48550/arXiv.2104.14574.
  * Ioannou et al. (2021b) M. Ioannou, P. Sekatski, A. A. Abbott, D. Rosset, J.-D. Bancal, and N. Brunner.  Receiver-device-independent quantum key distribution protocols.  _arXiv preprint arXiv:2111.04351_ , 2021b.  URL https://doi.org/10.48550/arXiv.2111.04351.
  * Jain and Kundu (2021) R. Jain and S. Kundu.  A direct product theorem for quantum communication complexity with applications to device-independent QKD.  _arXiv preprint arXiv:2106.04299_ , 2021.  URL https://doi.org/10.48550/arXiv.2106.04299.
  * Jain et al. (2020) R. Jain, C. A. Miller, and Y. Shi.  Parallel device-independent quantum key distribution.  _IEEE Transactions on Information Theory_ , 66(9):5567–5584, 2020.  URL https://doi.org/10.1109/TIT.2020.2986740.
  * Ji et al. (2021) Z. Ji, A. Natarajan, T. Vidick, J. Wright, and H. Yuen.  MIP* = RE.  _Commun. ACM_ , 64(11):131–138, oct 2021.  ISSN 0001-0782.  doi: 10.1145/3485628.  URL https://doi.org/10.1145/3485628.
  * Kalb et al. (2017) N. Kalb, A. A. Reiserer, P. C. Humphreys, J. J. W. Bakermans, S. J. Kamerling, N. H. Nickerson, S. C. Benjamin, D. J. Twitchen, M. Markham, and R. Hanson.  Entanglement distillation between solid-state quantum network nodes.  _Science_ , 356(6341):928–932, 2017.  doi: 10.1126/science.aan0070.  URL https://www.science.org/doi/abs/10.1126/science.aan0070.
  * Kaur et al. (2020) E. Kaur, M. M. Wilde, and A. Winter.  Fundamental limits on key rates in device-independent quantum key distribution.  _New Journal of Physics_ , 22(2):023039, feb 2020\.  doi: 10.1088/1367-2630/ab6eaa.  URL https://doi.org/10.1088/1367-2630/ab6eaa.
  * Kaur et al. (2021) E. Kaur, K. Horodecki, and S. Das.  Upper bounds on device-independent quantum key distribution rates in static and dynamic scenarios.  _arXiv preprint arXiv:2107.06411_ , 2021.  URL https://arxiv.org/abs/2107.06411.
  * Khatri and Lütkenhaus (2017) S. Khatri and N. Lütkenhaus.  Numerical evidence for bound secrecy from two-way postprocessing in quantum key distribution.  _Phys. Rev. A_ , 95:042320, Apr 2017.  doi: 10.1103/PhysRevA.95.042320.  URL https://link.aps.org/doi/10.1103/PhysRevA.95.042320.
  * Knill et al. (2018) E. Knill, Y. Zhang, and H. Fu.  Quantum probability estimation for randomness with quantum side information.  _arXiv preprint arXiv:1806.04553_ , 2018.  URL https://doi.org/10.48550/arXiv.1806.04553.
  * Koashi (2009) M. Koashi.  Simple security proof of quantum key distribution based on complementarity.  _New Journal of Physics_ , 11(4):045018, apr 2009\.  doi: 10.1088/1367-2630/11/4/045018.  URL https://doi.org/10.1088/1367-2630/11/4/045018.
  * Kołodyński et al. (2020) J. Kołodyński, A. Máttar, P. Skrzypczyk, E. Woodhead, D. Cavalcanti, K. Banaszek, and A. Acín.  Device-independent quantum key distribution with single-photon sources.  _Quantum_ , 4:260, Apr. 2020.  ISSN 2521-327X.  doi: 10.22331/q-2020-04-30-260.  URL https://doi.org/10.22331/q-2020-04-30-260.
  * Kraus et al. (2005) B. Kraus, N. Gisin, and R. Renner.  Lower and upper bounds on the secret-key rate for quantum key distribution protocols using one-way classical communication.  _Phys. Rev. Lett._ , 95:080501, Aug 2005.  doi: 10.1103/PhysRevLett.95.080501.  URL https://link.aps.org/doi/10.1103/PhysRevLett.95.080501.
  * Larsson (2014) J.-Å. Larsson.  Loopholes in ”bell” inequality tests of local realism.  _Journal of Physics A: Mathematical and Theoretical_ , 47(42):424003, oct 2014.  doi: 10.1088/1751-8113/47/42/424003.  URL https://doi.org/10.1088/1751-8113/47/42/424003.
  * Li et al. (2018) M.-H. Li, C. Wu, Y. Zhang, W.-Z. Liu, B. Bai, Y. Liu, W. Zhang, Q. Zhao, H. Li, Z. Wang, L. You, W. J. Munro, J. Yin, J. Zhang, C.-Z. Peng, X. Ma, Q. Zhang, J. Fan, and J.-W. Pan.  Test of local realism into the past without detection and locality loopholes.  _Phys. Rev. Lett._ , 121:080404, Aug 2018.  doi: 10.1103/PhysRevLett.121.080404.  URL https://link.aps.org/doi/10.1103/PhysRevLett.121.080404.
  * Li et al. (2021) M.-H. Li, X. Zhang, W.-Z. Liu, S.-R. Zhao, B. Bai, Y. Liu, Q. Zhao, Y. Peng, J. Zhang, Y. Zhang, W. J. Munro, X. Ma, Q. Zhang, J. Fan, and J.-W. Pan.  Experimental realization of device-independent quantum randomness expansion.  _Phys. Rev. Lett._ , 126:050503, Feb 2021.  doi: 10.1103/PhysRevLett.126.050503.  URL https://link.aps.org/doi/10.1103/PhysRevLett.126.050503.
  * Lim et al. (2013) C. C. W. Lim, C. Portmann, M. Tomamichel, R. Renner, and N. Gisin.  Device-independent quantum key distribution with local Bell test.  _Phys. Rev. X_ , 3:031006, Jul 2013.  doi: 10.1103/PhysRevX.3.031006.  URL https://link.aps.org/doi/10.1103/PhysRevX.3.031006.
  * Liu et al. (2021a) W.-Z. Liu, M.-H. Li, S. Ragy, S.-R. Zhao, B. Bai, Y. Liu, P. J. Brown, J. Zhang, R. Colbeck, J. Fan, et al.  Device-independent randomness expansion against quantum side information.  _Nature Physics_ , 17(4):448–451, 2021a.  URL https://doi.org/10.1038/s41567-020-01147-2.
  * Liu et al. (2021b) W.-Z. Liu, Y.-Z. Zhang, Y.-Z. Zhen, M.-H. Li, Y. Liu, J. Fan, F. Xu, Q. Zhang, and J.-W. Pan.  High-speed device-independent quantum key distribution against collective attacks.  _arXiv preprint arXiv:2110.01480_ , 2021b.  URL https://arxiv.org/abs/2110.01480.
  * Liu et al. (2018a) Y. Liu, X. Yuan, M.-H. Li, W. Zhang, Q. Zhao, J. Zhong, Y. Cao, Y.-H. Li, L.-K. Chen, H. Li, T. Peng, Y.-A. Chen, C.-Z. Peng, S.-C. Shi, Z. Wang, L. You, X. Ma, J. Fan, Q. Zhang, and J.-W. Pan.  High-speed device-independent quantum random number generation without a detection loophole.  _Phys. Rev. Lett._ , 120:010503, Jan 2018a.  doi: 10.1103/PhysRevLett.120.010503.  URL https://link.aps.org/doi/10.1103/PhysRevLett.120.010503.
  * Liu et al. (2018b) Y. Liu, Q. Zhao, M.-H. Li, J.-Y. Guan, Y. Zhang, B. Bai, W. Zhang, W.-Z. Liu, C. Wu, X. Yuan, et al.  Device-independent quantum random-number generation.  _Nature_ , 562(7728):548–551, 2018b.  URL https://doi.org/10.1038/s41586-018-0559-3.
  * Lo et al. (2005) H.-K. Lo, H. F. Chau, and M. Ardehali.  Efficient quantum key distribution scheme and a proof of its unconditional security.  _Journal of Cryptology_ , 18(2):133–165, 2005\.  URL https://doi.org/10.1007/s00145-004-0142-y.
  * Lo et al. (2012) H.-K. Lo, M. Curty, and B. Qi.  Measurement-device-independent quantum key distribution.  _Phys. Rev. Lett._ , 108:130503, Mar 2012.  doi: 10.1103/PhysRevLett.108.130503.  URL https://link.aps.org/doi/10.1103/PhysRevLett.108.130503.
  * Lydersen et al. (2010) L. Lydersen, C. Wiechers, C. Wittmann, D. Elser, J. Skaar, and V. Makarov.  Hacking commercial quantum cryptography systems by tailored bright illumination.  _Nature Photonics_ , 4(10):686–689, 2010.  URL https://doi.org/10.1038/nphoton.2010.214.
  * Ma et al. (2006) X. Ma, C.-H. F. Fung, F. Dupuis, K. Chen, K. Tamaki, and H.-K. Lo.  Decoy-state quantum key distribution with two-way classical postprocessing.  _Phys. Rev. A_ , 74:032330, Sep 2006.  doi: 10.1103/PhysRevA.74.032330.  URL https://link.aps.org/doi/10.1103/PhysRevA.74.032330.
  * Makarov (2009) V. Makarov.  Controlling passively quenched single photon detectors by bright light.  _New Journal of Physics_ , 11(6):065003, jun 2009\.  doi: 10.1088/1367-2630/11/6/065003.  URL https://doi.org/10.1088/1367-2630/11/6/065003.
  * Masini et al. (2021) M. Masini, S. Pironio, and E. Woodhead.  Simple and practical DIQKD security analysis via BB84-type uncertainty relations and Pauli correlation constraints.  _arXiv preprint arXiv:2107.08894_ , 2021.  URL https://arxiv.org/abs/2107.08894.
  * Mayers and Yao (1998) D. Mayers and A. Yao.  Quantum cryptography with imperfect apparatus.  In _Proceedings 39th Annual Symposium on Foundations of Computer Science (Cat. No.98CB36280)_ , pages 503–509, 1998.  doi: 10.1109/SFCS.1998.743501.
  * Mayers and Yao (2004) D. Mayers and A. Yao.  Self testing quantum apparatus.  _Quantum Info. Comput._ , 4(4):273–286, jul 2004\.  ISSN 1533-7146.  URL https://dl.acm.org/doi/10.5555/2011827.2011830.
  * Metger and Renner (2022) T. Metger and R. Renner.  Security of quantum key distribution from generalised entropy accumulation.  _arXiv preprint arXiv:2203.04993_ , 2022.  URL https://doi.org/10.48550/arXiv.2203.04993.
  * Metger et al. (2021) T. Metger, Y. Dulek, A. Coladangelo, and R. Arnon-Friedman.  Device-independent quantum key distribution from computational assumptions.  _New Journal of Physics_ , 23(12):123021, dec 2021\.  doi: 10.1088/1367-2630/ac304b.  URL https://doi.org/10.1088/1367-2630/ac304b.
  * Metger et al. (2022) T. Metger, O. Fawzi, D. Sutter, and R. Renner.  Generalised entropy accumulation.  _arXiv preprint arXiv:2203.04989_ , 2022.  URL https://doi.org/10.48550/arXiv.2203.04989.
  * Meyer-Scott et al. (2013) E. Meyer-Scott, M. Bula, K. Bartkiewicz, A. Černoch, J. Soubusta, T. Jennewein, and K. Lemr.  Entanglement-based linear-optical qubit amplifier.  _Phys. Rev. A_ , 88:012327, Jul 2013.  doi: 10.1103/PhysRevA.88.012327.  URL https://link.aps.org/doi/10.1103/PhysRevA.88.012327.
  * Miller and Shi (2016) C. A. Miller and Y. Shi.  Robust protocols for securely expanding randomness and distributing keys using untrusted quantum devices.  _J. ACM_ , 63(33):1–63, oct 2016.  ISSN 0004-5411.  URL https://doi.org/10.1145/2885493.
  * MOSEK (2015) A. MOSEK.  The MOSEK optimization toolbox for MATLAB manual, 2015.
  * Murta et al. (2020) G. Murta, F. Grasselli, H. Kampermann, and D. Bruß.  Quantum conference key agreement: A review.  _Advanced Quantum Technologies_ , 3(11):2000025, 2020.  doi: https://doi.org/10.1002/qute.202000025.  URL https://onlinelibrary.wiley.com/doi/abs/10.1002/qute.202000025.
  * Nadlinger et al. (2021) D. Nadlinger, P. Drmota, B. Nichol, G. Araneda, D. Main, R. Srinivas, D. Lucas, C. Ballance, K. Ivanov, E. Tan, et al.  Device-independent quantum key distribution.  _arXiv preprint arXiv:2109.14600_ , 2021.  URL https://doi.org/10.48550/arXiv.2109.14600.
  * Nagamatsu et al. (2016) Y. Nagamatsu, A. Mizutani, R. Ikuta, T. Yamamoto, N. Imoto, and K. Tamaki.  Security of quantum key distribution with light sources that are not independently and identically distributed.  _Phys. Rev. A_ , 93:042325, Apr 2016.  doi: 10.1103/PhysRevA.93.042325.  URL https://link.aps.org/doi/10.1103/PhysRevA.93.042325.
  * Navarrete et al. (2021) A. Navarrete, M. Pereira, M. Curty, and K. Tamaki.  Practical quantum key distribution that is secure against side channels.  _Phys. Rev. Applied_ , 15:034072, Mar 2021.  doi: 10.1103/PhysRevApplied.15.034072.  URL https://link.aps.org/doi/10.1103/PhysRevApplied.15.034072.
  * Navascués et al. (2007) M. Navascués, S. Pironio, and A. Acín.  Bounding the set of quantum correlations.  _Phys. Rev. Lett._ , 98:010401, Jan 2007.  doi: 10.1103/PhysRevLett.98.010401.  URL https://link.aps.org/doi/10.1103/PhysRevLett.98.010401.
  * Navascués et al. (2008) M. Navascués, S. Pironio, and A. Acín.  A convergent hierarchy of semidefinite programs characterizing the set of quantum correlations.  _New Journal of Physics_ , 10(7):073013, jul 2008\.  doi: 10.1088/1367-2630/10/7/073013.  URL https://doi.org/10.1088/1367-2630/10/7/073013.
  * Navascués et al. (2012) M. Navascués, T. Cooney, D. Pérez-García, and N. Villanueva.  A physical approach to Tsirelson’s problem.  _Foundations of Physics_ , 42(8):985–995, Aug 2012.  ISSN 1572-9516.  doi: 10.1007/s10701-012-9641-0.  URL https://doi.org/10.1007/s10701-012-9641-0.
  * Pawłowski and Brunner (2011) M. Pawłowski and N. Brunner.  Semi-device-independent security of one-way quantum key distribution.  _Phys. Rev. A_ , 84:010302, Jul 2011.  doi: 10.1103/PhysRevA.84.010302.  URL https://link.aps.org/doi/10.1103/PhysRevA.84.010302.
  * Pearle (1970) P. M. Pearle.  Hidden-variable example based upon data rejection.  _Phys. Rev. D_ , 2:1418–1425, Oct 1970.  doi: 10.1103/PhysRevD.2.1418.  URL https://link.aps.org/doi/10.1103/PhysRevD.2.1418.
  * Pereira et al. (2020) M. Pereira, G. Kato, A. Mizutani, M. Curty, and K. Tamaki.  Quantum key distribution with correlated sources.  _Science Advances_ , 6(37):eaaz4487, 2020.  doi: 10.1126/sciadv.aaz4487.  URL https://www.science.org/doi/abs/10.1126/sciadv.aaz4487.
  * Petitcolas (2011) F. A. P. Petitcolas.  _Kerckhoffs’ Principle_ , pages 675–675.  Springer US, Boston, MA, 2011.  ISBN 978-1-4419-5906-5.  doi: 10.1007/978-1-4419-5906-5˙487.  URL https://doi.org/10.1007/978-1-4419-5906-5_487.
  * Pirandola et al. (2017) S. Pirandola, R. Laurenza, C. Ottaviani, and L. Banchi.  Fundamental limits of repeaterless quantum communications.  _Nature Communications_ , 8(15043):1–15, 2017\.  URL https://doi.org/10.1038/ncomms15043.
  * Pironio et al. (2009) S. Pironio, A. Acín, N. Brunner, N. Gisin, S. Massar, and V. Scarani.  Device-independent quantum key distribution secure against collective attacks.  _New Journal of Physics_ , 11(4):045021, 2009\.  URL https://iopscience.iop.org/article/10.1088/1367-2630/11/4/045021/meta.
  * Pironio et al. (2010) S. Pironio, M. Navascués, and A. Acín.  Convergent relaxations of polynomial optimization problems with noncommuting variables.  _SIAM Journal on Optimization_ , 20(5):2157–2180, 2010.  URL https://doi.org/10.1137/090760155.
  * Pitkanen et al. (2011) D. Pitkanen, X. Ma, R. Wickert, P. van Loock, and N. Lütkenhaus.  Efficient heralding of photonic qubits with applications to device-independent quantum key distribution.  _Phys. Rev. A_ , 84:022325, Aug 2011.  doi: 10.1103/PhysRevA.84.022325.  URL https://link.aps.org/doi/10.1103/PhysRevA.84.022325.
  * Portmann and Renner (2014) C. Portmann and R. Renner.  Cryptographic security of quantum key distribution.  _arXiv preprint arXiv:1409.3525_ , 2014.  URL https://arxiv.org/abs/1409.3525.
  * Portmann and Renner (2021) C. Portmann and R. Renner.  Security in Quantum Cryptography.  _arXiv preprint arXiv:2102.00021_ , 2021.  URL https://arxiv.org/abs/2102.00021.
  * Rahaman et al. (2015) R. Rahaman, M. G. Parker, P. Mironowicz, and M. Pawłowski.  Device-independent quantum key distribution based on measurement inputs.  _Phys. Rev. A_ , 92:062304, Dec 2015.  doi: 10.1103/PhysRevA.92.062304.  URL https://link.aps.org/doi/10.1103/PhysRevA.92.062304.
  * Ralph and Lund (2009) T. C. Ralph and A. P. Lund.  Nondeterministic noiseless linear amplification of quantum systems.  _AIP Conference Proceedings_ , 1110(1):155–160, 2009.  doi: 10.1063/1.3131295.  URL https://aip.scitation.org/doi/abs/10.1063/1.3131295.
  * Renner (2005) R. Renner.  _Security of Quantum Key Distribution_.  PhD thesis, ETH Zurich, 9 2005.  Available at https://arxiv.org/abs/quant-ph/0512258.
  * Renner et al. (2005) R. Renner, N. Gisin, and B. Kraus.  Information-theoretic security proof for quantum-key-distribution protocols.  _Phys. Rev. A_ , 72:012332, Jul 2005.  doi: 10.1103/PhysRevA.72.012332.  URL https://link.aps.org/doi/10.1103/PhysRevA.72.012332.
  * Ribeiro et al. (2018) J. Ribeiro, G. Murta, and S. Wehner.  Fully device-independent conference key agreement.  _Phys. Rev. A_ , 97:022307, Feb 2018.  doi: 10.1103/PhysRevA.97.022307.  URL https://link.aps.org/doi/10.1103/PhysRevA.97.022307.
  * Rosenfeld et al. (2017) W. Rosenfeld, D. Burchardt, R. Garthoff, K. Redeker, N. Ortegel, M. Rau, and H. Weinfurter.  Event-ready Bell test using entangled atoms simultaneously closing detection and locality loopholes.  _Phys. Rev. Lett._ , 119:010402, Jul 2017.  doi: 10.1103/PhysRevLett.119.010402.  URL https://link.aps.org/doi/10.1103/PhysRevLett.119.010402.
  * Scarani (2019) V. Scarani.  _Bell nonlocality_.  Oxford Graduate Texts, 2019.
  * Scarani and Renner (2008) V. Scarani and R. Renner.  Security Bounds for Quantum Cryptography with Finite Resources.  In _Theory of Quantum Computation, Communication, and Cryptography_ , pages 83–95. Springer Berlin Heidelberg, 2008.  doi: 10.1007/978-3-540-89304-2˙8.  URL https://doi.org/10.1007/978-3-540-89304-2_8.
  * Scarani et al. (2009) V. Scarani, H. Bechmann-Pasquinucci, N. J. Cerf, M. Dušek, N. Lütkenhaus, and M. Peev.  The security of practical quantum key distribution.  _Rev. Mod. Phys._ , 81:1301–1350, Sep 2009.  doi: 10.1103/RevModPhys.81.1301.  URL https://link.aps.org/doi/10.1103/RevModPhys.81.1301.
  * Schwonnek et al. (2021) R. Schwonnek, K. T. Goh, I. W. Primaatmaja, E. Y.-Z. Tan, R. Wolf, V. Scarani, and C. C.-W. Lim.  Device-independent quantum key distribution with random key basis.  _Nature Communications_ , 12(2880):1–8, 2021\.  URL https://www.nature.com/articles/s41467-021-23147-3.
  * Seevinck and Uffink (2007) M. Seevinck and J. Uffink.  Local commutativity versus bell inequality violation for entangled states and versus non-violation for separable states.  _Phys. Rev. A_ , 76:042105, Oct 2007.  doi: 10.1103/PhysRevA.76.042105.  URL https://link.aps.org/doi/10.1103/PhysRevA.76.042105.
  * Sekatski et al. (2021) P. Sekatski, J.-D. Bancal, X. Valcarce, E. Y.-Z. Tan, R. Renner, and N. Sangouard.  Device-independent quantum key distribution from generalized CHSH inequalities.  _Quantum_ , 5:444, Apr. 2021.  ISSN 2521-327X.  doi: 10.22331/q-2021-04-26-444.  URL https://doi.org/10.22331/q-2021-04-26-444.
  * Seshadreesan et al. (2016) K. P. Seshadreesan, M. Takeoka, and M. Sasaki.  Progress towards practical device-independent quantum key distribution with spontaneous parametric down-conversion sources, on-off photodetectors, and entanglement swapping.  _Phys. Rev. A_ , 93:042328, Apr 2016.  doi: 10.1103/PhysRevA.93.042328.  URL https://link.aps.org/doi/10.1103/PhysRevA.93.042328.
  * Shalm et al. (2015) L. K. Shalm, E. Meyer-Scott, B. G. Christensen, P. Bierhorst, M. A. Wayne, M. J. Stevens, T. Gerrits, S. Glancy, D. R. Hamel, M. S. Allman, K. J. Coakley, S. D. Dyer, C. Hodge, A. E. Lita, V. B. Verma, C. Lambrocco, E. Tortorici, A. L. Migdall, Y. Zhang, D. R. Kumor, W. H. Farr, F. Marsili, M. D. Shaw, J. A. Stern, C. Abellán, W. Amaya, V. Pruneri, T. Jennewein, M. W. Mitchell, P. G. Kwiat, J. C. Bienfang, R. P. Mirin, E. Knill, and S. W. Nam.  Strong loophole-free test of local realism.  _Phys. Rev. Lett._ , 115:250402, Dec 2015.  doi: 10.1103/PhysRevLett.115.250402.  URL https://link.aps.org/doi/10.1103/PhysRevLett.115.250402.
  * Shalm et al. (2021) L. K. Shalm, Y. Zhang, J. C. Bienfang, C. Schlager, M. J. Stevens, M. D. Mazurek, C. Abellán, W. Amaya, M. W. Mitchell, M. A. Alhejji, et al.  Device-independent randomness expansion with entangled photons.  _Nature Physics_ , 17(4):452–456, 2021.  URL https://doi.org/10.1038/s41567-020-01153-4.
  * Shannon (1949) C. E. Shannon.  Communication theory of secrecy systems.  _The Bell System Technical Journal_ , 28(4):656–715, 1949.  doi: 10.1002/j.1538-7305.1949.tb00928.x.
  * Shen et al. (2018) L. Shen, J. Lee, L. P. Thinh, J.-D. Bancal, A. Cerè, A. Lamas-Linares, A. Lita, T. Gerrits, S. W. Nam, V. Scarani, and C. Kurtsiefer.  Randomness extraction from bell violation with continuous parametric down-conversion.  _Phys. Rev. Lett._ , 121:150402, Oct 2018.  doi: 10.1103/PhysRevLett.121.150402.  URL https://link.aps.org/doi/10.1103/PhysRevLett.121.150402.
  * Shor and Preskill (2000) P. W. Shor and J. Preskill.  Simple proof of security of the BB84 quantum key distribution protocol.  _Phys. Rev. Lett._ , 85:441–444, Jul 2000.  doi: 10.1103/PhysRevLett.85.441.  URL https://link.aps.org/doi/10.1103/PhysRevLett.85.441.
  * Sturm (1999) J. F. Sturm.  Using SeDuMi 1.02, a MATLAB toolbox for optimization over symmetric cones.  _Optimization methods and software_ , 11(1-4):625–653, 1999.
  * Šupić and Bowles (2020) I. Šupić and J. Bowles.  Self-testing of quantum systems: a review.  _Quantum_ , 4:337, Sept. 2020.  ISSN 2521-327X.  doi: 10.22331/q-2020-09-30-337.  URL https://doi.org/10.22331/q-2020-09-30-337.
  * Tan (2021) E. Y.-Z. Tan.  Prospects for device-independent quantum key distribution.  _arXiv preprint arXiv:2111.11769_ , 2021.  URL https://arxiv.org/abs/2111.11769.
  * Tan et al. (2020a) E. Y.-Z. Tan, C. C.-W. Lim, and R. Renner.  Advantage distillation for device-independent quantum key distribution.  _Phys. Rev. Lett._ , 124:020502, Jan 2020a.  doi: 10.1103/PhysRevLett.124.020502.  URL https://link.aps.org/doi/10.1103/PhysRevLett.124.020502.
  * Tan et al. (2020b) E. Y.-Z. Tan, P. Sekatski, J.-D. Bancal, R. Schwonnek, R. Renner, N. Sangouard, and C. C.-W. Lim.  Improved DIQKD protocols with finite-size analysis.  _arXiv preprint arXiv:2012.08714_ , 2020b.  URL https://arxiv.org/abs/2012.08714.
  * Tan et al. (2021) E. Y.-Z. Tan, R. Schwonnek, K. T. Goh, I. W. Primaatmaja, and C. C.-W. Lim.  Computing secure key rates for quantum cryptography with untrusted devices.  _npj Quantum Information_ , 7(158):1–6, 2021\.  URL https://doi.org/10.1038/s41534-021-00494-z.
  * Thinh et al. (2016) L. P. Thinh, G. de la Torre, J.-D. Bancal, S. Pironio, and V. Scarani.  Randomness in post-selected events.  _New Journal of Physics_ , 18(3):035007, mar 2016\.  doi: 10.1088/1367-2630/18/3/035007.  URL https://doi.org/10.1088/1367-2630/18/3/035007.
  * Toh et al. (1999) K.-C. Toh, M. J. Todd, and R. H. Tütüncü.  SDPT3—a MATLAB software package for semidefinite programming, version 1.3.  _Optimization methods and software_ , 11(1-4):545–581, 1999.
  * Tomamichel and Hänggi (2013) M. Tomamichel and E. Hänggi.  The link between entropic uncertainty and nonlocality.  _Journal of Physics A: Mathematical and Theoretical_ , 46(5):055301, jan 2013.  doi: 10.1088/1751-8113/46/5/055301.  URL https://doi.org/10.1088/1751-8113/46/5/055301.
  * Tomamichel and Leverrier (2017) M. Tomamichel and A. Leverrier.  A largely self-contained and complete security proof for quantum key distribution.  _Quantum_ , 1:14, July 2017.  ISSN 2521-327X.  doi: 10.22331/q-2017-07-14-14.  URL https://doi.org/10.22331/q-2017-07-14-14.
  * Tomamichel et al. (2009) M. Tomamichel, R. Colbeck, and R. Renner.  A fully quantum asymptotic equipartition property.  _IEEE Transactions on Information Theory_ , 55(12):5840–5847, 2009.  doi: 10.1109/TIT.2009.2032797.
  * Tomamichel et al. (2011) M. Tomamichel, C. Schaffner, A. Smith, and R. Renner.  Leftover hashing against quantum side information.  _IEEE Transactions on Information Theory_ , 57(8):5524–5535, 2011.  URL https://doi.org/10.1109/TIT.2011.2158473.
  * Tomamichel et al. (2012) M. Tomamichel, C. C. W. Lim, N. Gisin, and R. Renner.  Tight finite-key analysis for quantum cryptography.  _Nature Communications_ , 3(634):1–6, 2012.  URL https://doi.org/10.1038/ncomms1631.
  * Toner (2009) B. Toner.  Monogamy of non-local quantum correlations.  _Proceedings of the Royal Society A: Mathematical, Physical and Engineering Sciences_ , 465(2101):59–69, 2009.  doi: 10.1098/rspa.2008.0149.  URL https://royalsocietypublishing.org/doi/abs/10.1098/rspa.2008.0149.
  * Tsujimoto et al. (2018) Y. Tsujimoto, K. Wakui, M. Fujiwara, K. Hayasaka, S. Miki, H. Terai, M. Sasaki, and M. Takeoka.  Optimal conditions for the Bell test using spontaneous parametric down-conversion sources.  _Phys. Rev. A_ , 98:063842, Dec 2018.  doi: 10.1103/PhysRevA.98.063842.  URL https://link.aps.org/doi/10.1103/PhysRevA.98.063842.
  * Vakhitov et al. (2001) A. Vakhitov, V. Makarov, and D. R. Hjelme.  Large pulse attack as a method of conventional optical eavesdropping in quantum cryptography.  _Journal of Modern Optics_ , 48(13):2023–2038, 2001.  doi: 10.1080/09500340108240904.  URL https://www.tandfonline.com/doi/abs/10.1080/09500340108240904.
  * Van Himbeeck et al. (2017) T. Van Himbeeck, E. Woodhead, N. J. Cerf, R. García-Patrón, and S. Pironio.  Semi-device-independent framework based on natural physical assumptions.  _Quantum_ , 1:33, Nov. 2017.  ISSN 2521-327X.  doi: 10.22331/q-2017-11-18-33.  URL https://doi.org/10.22331/q-2017-11-18-33.
  * Vazirani and Vidick (2014) U. Vazirani and T. Vidick.  Fully device-independent quantum key distribution.  _Phys. Rev. Lett._ , 113:140501, Sep 2014.  doi: 10.1103/PhysRevLett.113.140501.  URL https://link.aps.org/doi/10.1103/PhysRevLett.113.140501.
  * Vidick (2017) T. Vidick.  Parallel DIQKD from parallel repetition.  _arXiv preprint arXiv:1703.08508_ , 2017.  URL https://doi.org/10.48550/arXiv.1703.08508.
  * Vivoli et al. (2015a) V. C. Vivoli, P. Sekatski, J.-D. Bancal, C. Lim, B. Christensen, A. Martin, R. Thew, H. Zbinden, N. Gisin, and N. Sangouard.  Challenging preconceptions about Bell tests with photon pairs.  _Phys. Rev. A_ , 91:012107, Jan 2015a.  doi: 10.1103/PhysRevA.91.012107.  URL https://link.aps.org/doi/10.1103/PhysRevA.91.012107.
  * Vivoli et al. (2015b) V. C. Vivoli, P. Sekatski, J.-D. Bancal, C. Lim, A. Martin, R. Thew, H. Zbinden, N. Gisin, and N. Sangouard.  Comparing different approaches for generating random numbers device-independently using a photon pair source.  _New Journal of Physics_ , 17(2):023023, 2015b.  URL https://doi.org/10.1088/1367-2630/17/2/023023.
  * Walk et al. (2016) N. Walk, S. Hosseini, J. Geng, O. Thearle, J. Y. Haw, S. Armstrong, S. M. Assad, J. Janousek, T. C. Ralph, T. Symul, H. M. Wiseman, and P. K. Lam.  Experimental demonstration of Gaussian protocols for one-sided device-independent quantum key distribution.  _Optica_ , 3(6):634–642, Jun 2016.  doi: 10.1364/OPTICA.3.000634.  URL http://opg.optica.org/optica/abstract.cfm?URI=optica-3-6-634.
  * Wang et al. (2019) Y. Wang, I. W. Primaatmaja, E. Lavie, A. Varvitsiotis, and C. C. W. Lim.  Characterising the correlations of prepare-and-measure quantum networks.  _npj Quantum Information_ , 5(17):1–6, 2019.  URL https://doi.org/10.1038/s41534-019-0133-3.
  * Watanabe et al. (2007) S. Watanabe, R. Matsumoto, T. Uyematsu, and Y. Kawano.  Key rate of quantum key distribution with hashed two-way classical communication.  _Phys. Rev. A_ , 76:032312, Sep 2007.  doi: 10.1103/PhysRevA.76.032312.  URL https://link.aps.org/doi/10.1103/PhysRevA.76.032312.
  * Wegman and Carter (1981) M. N. Wegman and J. L. Carter.  New hash functions and their use in authentication and set equality.  _Journal of Computer and System Sciences_ , 22(3):265–279, 1981.  ISSN 0022-0000.  doi: https://doi.org/10.1016/0022-0000(81)90033-7.  URL https://www.sciencedirect.com/science/article/pii/0022000081900337.
  * Werner (1989) R. F. Werner.  Quantum states with Einstein-Podolsky-Rosen correlations admitting a hidden-variable model.  _Phys. Rev. A_ , 40:4277–4281, Oct 1989.  doi: 10.1103/PhysRevA.40.4277.  URL https://link.aps.org/doi/10.1103/PhysRevA.40.4277.
  * Winczewski et al. (2019) M. Winczewski, T. Das, and K. Horodecki.  Limitations on device independent key secure against non signaling adversary via the squashed non-locality.  _arXiv preprint arXiv:1903.12154_ , 2019.  URL https://arxiv.org/abs/1903.12154.
  * Winick et al. (2018) A. Winick, N. Lütkenhaus, and P. J. Coles.  Reliable numerical key rates for quantum key distribution.  _Quantum_ , 2:77, July 2018.  ISSN 2521-327X.  doi: 10.22331/q-2018-07-26-77.  URL https://doi.org/10.22331/q-2018-07-26-77.
  * Woodhead (2016) E. Woodhead.  Semi device independence of the BB84 protocol.  _New Journal of Physics_ , 18(5):055010, may 2016\.  doi: 10.1088/1367-2630/18/5/055010.  URL https://doi.org/10.1088/1367-2630/18/5/055010.
  * Woodhead and Pironio (2015) E. Woodhead and S. Pironio.  Secrecy in prepare-and-measure Clauser-Horne-Shimony-Holt tests with a qubit bound.  _Phys. Rev. Lett._ , 115:150501, Oct 2015.  doi: 10.1103/PhysRevLett.115.150501.  URL https://link.aps.org/doi/10.1103/PhysRevLett.115.150501.
  * Woodhead et al. (2021) E. Woodhead, A. Acín, and S. Pironio.  Device-independent quantum key distribution with asymmetric CHSH inequalities.  _Quantum_ , 5:443, Apr. 2021.  ISSN 2521-327X.  doi: 10.22331/q-2021-04-26-443.  URL https://doi.org/10.22331/q-2021-04-26-443.
  * Xu et al. (2020) F. Xu, X. Ma, Q. Zhang, H.-K. Lo, and J.-W. Pan.  Secure quantum key distribution with realistic devices.  _Rev. Mod. Phys._ , 92:025002, May 2020.  doi: 10.1103/RevModPhys.92.025002.  URL https://link.aps.org/doi/10.1103/RevModPhys.92.025002.
  * Xu et al. (2021) F. Xu, Y.-Z. Zhang, Q. Zhang, and J.-W. Pan.  Device-independent quantum key distribution with random post selection.  _arXiv preprint arXiv:2110.02701_ , 2021.  URL https://arxiv.org/abs/2110.02701.
  * Yoshino et al. (2018) K.-i. Yoshino, M. Fujiwara, K. Nakata, T. Sumiya, T. Sasaki, M. Takeoka, M. Sasaki, A. Tajima, M. Koashi, and A. Tomita.  Quantum key distribution with an efficient countermeasure against correlated intensity fluctuations in optical pulses.  _npj Quantum Information_ , 4(8):1–8, 2018.  URL https://doi.org/10.1038/s41534-017-0057-8.
  * Zapatero and Curty (2019) V. Zapatero and M. Curty.  Long-distance device-independent quantum key distribution.  _Scientific Reports_ , 9(17749):1–18, 2019.  URL https://doi.org/10.1038/s41598-019-53803-0.
  * Zapatero and Curty (2021) V. Zapatero and M. Curty.  Secure quantum key distribution with a subset of malicious devices.  _npj Quantum Information_ , 7(26):1–8, 2021.  doi: 10.1038/s41534-020-00358-y.
  * Zhang et al. (2021a) G. Zhang, I. W. Primaatmaja, J. Y. Haw, X. Gong, C. Wang, and C. C. W. Lim.  Securing practical quantum communication systems with optical power limiters.  _PRX Quantum_ , 2:030304, Jul 2021a.  doi: 10.1103/PRXQuantum.2.030304.  URL https://link.aps.org/doi/10.1103/PRXQuantum.2.030304.
  * Zhang et al. (2021b) W. Zhang, T. van Leent, K. Redeker, R. Garthoff, R. Schwonnek, F. Fertig, S. Eppelt, V. Scarani, C. C.-W. Lim, and H. Weinfurter.  Experimental device-independent quantum key distribution between distant users.  _arXiv preprint arXiv:2110.00575_ , 2021b.  URL https://doi.org/10.48550/arXiv.2110.00575.
  * Zhang et al. (2021c) X. Zhang, P. Zeng, T. Ye, H.-K. Lo, and X. Ma.  Quantum complementarity approach to device-independent security.  _arXiv preprint arXiv:2111.13855_ , 2021c.  URL https://arxiv.org/abs/2111.13855.
  * Zhang et al. (2020a) Y. Zhang, H. Fu, and E. Knill.  Efficient randomness certification by quantum probability estimation.  _Phys. Rev. Research_ , 2:013016, Jan 2020a.  doi: 10.1103/PhysRevResearch.2.013016.  URL https://link.aps.org/doi/10.1103/PhysRevResearch.2.013016.
  * Zhang et al. (2020b) Y. Zhang, L. K. Shalm, J. C. Bienfang, M. J. Stevens, M. D. Mazurek, S. W. Nam, C. Abellán, W. Amaya, M. W. Mitchell, H. Fu, C. A. Miller, A. Mink, and E. Knill.  Experimental low-latency device-independent quantum randomness.  _Phys. Rev. Lett._ , 124:010505, Jan 2020b.  doi: 10.1103/PhysRevLett.124.010505.  URL https://link.aps.org/doi/10.1103/PhysRevLett.124.010505.