Device-independent quantum key distribution based on Bell inequalities with more than two inputs and two outputs

PHYSICAL REVIEW A 103, 052436 (2021) Device-independent quantum key distribution based on Bell inequalities with more than two inputs and two outputs Junior R. Gonzales-Ureta ,1,*Ana Predojevi´ c,1,†and Adán Cabello 2,3,‡ 1Department of Physics, Stockholm University, 10691 Stockholm, Sweden 2Departamento de Física Aplicada II, Universidad de Sevilla, E-41012 Sevilla, Spain 3Instituto Carlos I de Física Teórica y Computacional, Universidad de Sevilla, E-41012 Sevilla, Spain (Received 20 March 2021; accepted 12 May 2021; published 28 May 2021) Device-independent quantum key distribution (DI-QKD) offers the strongest form of security against eavesdroppers bounded by the laws of quantum mechanics. However, a practical implementation is still pending due to the requirement of combinations of visibility and detection efficiency that are beyond those possible with current technology. This mismatch motivates the search for DI-QKD protocols that can close the gap between theoretical and practical security. In this work, we present two DI-QKD protocols whose security relies on Bell inequalities with more than two inputs and two outputs. We show that, for maximally entangled states and perfect visibility, a protocol based on a Bell inequality with three inputs and four outputs requires a slightly lower detection efficiency than the protocols based on Bell inequalities with two inputs and two outputs. DOI: 10.1103/PhysRevA.103.052436 I. INTRODUCTION A. Context In the device independent quantum key distribution (DIQKD) paradigm [1–5], two parties (Alice and Bob), using only the input-output correlations obtained in a Bell inequalitylike experiment, aim to generate a cryptographic key while quantifying the amount of information available to an eavesdropper (Eve) bounded by the laws of quantum mechanics. Suppose that each party can choose between ndifferent measurements and each measurement yields one of mpossible outcomes. Then, there are n2probability distributions each of them specified by m2probabilities, which can be arranged in a list P={p(a,b|x,y)}, where p(a,b|x,y) is the probability that Alice obtains outcome afor measurement xand Bob obtains outcome bfor measurement y.Pis usually referred to as a behavior [6] and is the tool used by Alice and Bob to check the security of the key. Since a behavior does not refer to any particular physical realization or quantum system of a given dimension, in DI-QKD Alice and Bob can treat their preparation and measurement devices as black boxes in which the measurement choices are the inputs and the measurement outcomes are the outputs. A quantum realization Qof a behavior Pconsists of a *junior[email protected] †ana.predoje[email protected] ‡[email protected] Published by the American Physical Society under the terms of the Creative Commons Attribution 4.0 International license. Further distribution of this work must maintain attribution to the author(s) and the published article’s title, journal citation, and DOI. Funded by Bibsam. quantum state ρ, a set of measurements for Alice {Ma|x}, and a set of measurements for Bob {Mb|y}. DI-QKD offers security under a minimal set of assumptions [7,8] and against a wide range of side channel attacks [5]. Side channel attacks have been shown to compromise the security of some commercial implementations of QKD [9–12]. However, DI-QKD still has to overcome several challenges before being technologically feasible. In what follows, we focus on photonic implementations, given that photons are the most suitable physical systems to carry out QKD in real life. One of the most significant obstacles is that DI-QKD requires combinations of overall detection efficiency ηand visibility V, which are very difficult to achieve with current technology. The overall detection efficiency ηis defined as the probability of detecting a photon emitted by the source. The visibility Vis defined assuming that the targeted state |ψ is affected by white noise. That is, assuming that the actual state is of the form ρ=V|ψψ|+1−V d21, where dis the dimension of the local systems. For example, for the most studied DI-QKD protocols, which are those based on the Clauser-Horne-Shimony-Holt (CHSH) [13] Bell inequality, the minimum detection efficiency required to distill a secret key was initially found to be η=0.924, assuming V=1[5]. Subsequently, it was shown that, using partially entangled states, the threshold can be reduced to η=0.865, again with V=1[14–16]. Recently, various efforts have been made to reduce the detection efficiency threshold [14,17–19]. The most successful one [14] reported detection efficiency thresholds of η= 0.8257 for V=1 and η=0.8757 for V=0.99. However, any of these requirements is still very difficult to meet. To date, the best combination of parameters (η,V)reported in photonic experiments are (0.763,≈0.99) [20], (0.774,0.99) [21], and (0.8411,0.9875) [22]. 2469-9926/2021/103(5)/052436(8) 052436-1 Published by the American Physical Society JUNIOR R. GONZALES-URETA et al. PHYSICAL REVIEW A 103, 052436 (2021) All the examples just mentioned refer to CHSH inequalitybased DI-QKD protocols. This Bell inequality has two inputs and two outputs per party. There, Jordan’s lemma (or similar arguments) [5,6,23,24] offers a convenient reduction of the problem to a two-qubit system. This reduction allowed Pironio et al. [5] to derive an analytical tight bound on the quantum conditional entropy Alice-Eve H(A|E)asafunction of the value of the Bell parameter S=A1B1+A1B2+ A2B1−A2B2of the CHSH inequality H(A|E)⩾1−h1+S2/4−1 2.(1) The quantum conditional entropy quantifies the strength of the correlations between Alice and Eve, and hence the secrecy of the key. Analytical bounds for the quantum entropy like the one in Eq. (1) are only known for a few cases [14,19]. In addition to Jordan’s Lemma, some previous results were crucial to derive these analytical bounds. One of them is the possibility to calculate the maximum violation of a Bell inequality that a two-qubit state can attain [25,26]. B. Approach The motivation for the present work is the observation that the minimum detection efficiency for reaching detectionloophole-free Bell tests can decrease when Bell inequalities with more inputs and outputs are considered [27,28]. For example, Massar [27] proved that entangled states of large local dimension dand 2dmeasurements per party require lower detection efficiencies. Specifically, in that case, the detection efficiency threshold decreases exponentially with the dimension of the state as η=d1/22−0.0035d. This means that loophole-free Bell tests with arbitrary low detection efficiency are, in principle, possible. In addition, it has also been shown that high dimensional entangled states are more robust against noise than twoqubit systems [29–31]. Correspondingly, violations of Bell inequalities with lower visibilities are achievable. Furthermore, it has been recently shown that QKD protocols benefit from the resistance to noise exhibited by high dimensional systems [32]. Therefore, a natural question is whether similar benefits may occur in DI-QKD protocols based on Bell inequalities with more than two inputs and two outputs. In this article, we present two DI-QKD protocols of this type and explore their performance using the technique developed by Brown et al. [16] to estimate H(A|E) in a device-independent way (for details, see the Appendix). This technique, together with the one in Ref. [15], have shown significant improvement with respect to the min-entropy approach [33,34]. II. THE TWO DI-QKD PROTOCOLS A. General considerations Here, we introduce two DI-QKD protocols. Each of them is constructed around a Bell inequality that has some specific features that make it worth considering for DI-QKD. Both protocols follow the structure of the protocol by Pironio et al. [5]. In each measurement round, Alice randomly chooses one of ninputs x∈{1,...,n}, while Bob randomly chooses one of n+1 inputs y∈{1,...,n+1}. Each measurement has mpossible outputs a,b∈{1,...,m}.Theraw key is obtained from the rounds where x=1 and y=n+1, while the other rounds are used to characterize the behavior. Our first protocol has n=4 and m=2, while the second one has n=3 and m=4. In both cases, to generate the behaviors P, we use quantum realizations Qwith entangled states of two ququarts (i.e., quantum systems of dimension four). Using a particular realization ensures that the statistics obtained corresponds to a valid quantum probability distribution. The information revealed by the behavior allows Alice and Bob to bound H(A|E), which quantifies the information available to an eavesdropper. If the behavior exhibits sufficiently strong correlations between Alice and Bob and sufficiently weak correlations between each of them and an eavesdropper, then the raw key can be turned into a shared secret key by using classical error correction and privacy amplification [5,14]. Unlike, Eq. (1), where H(A|E) is bounded solely by the value of the Bell parameter, in our case, we use the complete behavior to estimate H(A|E). The behavior contains much more information than the value of the Bell parameter, thus allowing a more accurate evaluation of H(A|E)[35]. The asymptotic secret key rate against collective attacks is given by the Devetak-Winter formula [36] rDW ⩾H(A1|E)−H(A1|Bn+1),(2) where H(A1|Bn+1) is the conditional Shannon entropy, which quantifies the strength of the correlations between Alice and Bob. H(A1|Bn+1) is calculated from the behavior as follows: H(A1|Bn+1)=− a,b p(a,b|1,n+1) log2p(a,b|1,n+1) + b pB(b|n+1) log2pB(b|n+1),(3) where pB(b|n+1) is the probability that Bob obtains outcome bwhen the input is n+1. We investigate how the secret key rate changes when white noise and limited detection efficiency are taken into account. To study the effect of the limited detection efficiency, we assume that Alice and Bob have the same detection efficiency ηa=ηb=ηfor all detectors and measurement settings. We also assume that Alice and Bob map the nondetection events, denoted ⊥,tothemth output. This way, the violation of the Bell inequality by itself assures that there is no local hidden variable model even when the detectors have limited detection efficiency [37,38]. The limited detection efficiency transforms the probabilities as follows: p(a,b|x,y)−→ η2p(a,b|x,y)+η¯η[δa,mpB(b|y) +δb,mpA(a|x)] +δa,mδb,m¯η2,(4) where ¯η=1−η, and δx,yis the Kronecker delta function. 052436-2 DEVICE-INDEPENDENT QUANTUM KEY DISTRIBUTION … PHYSICAL REVIEW A 103, 052436 (2021) B. Protocol based on I4 4422 using maximal ququart-ququart entanglement The first protocol is constructed around the I4 4422 inequality [39], which can be written as I4 4422 ⩽0,(5) with I4 4422 =I(1,2;1,2) CH +I(3,4;3,4) CH −I(2,1;4,3) CH −I(4,3;2,1) CH −pA(1|2) −pA(1|4) −pB(1|2) −pB(1|4),(6) where I(i,j;u,v) CH =p(1,1|i,u)+p(1,1|j,u)+p(1,1|i,v)− p(1,1|j,v)−pA(1|i)−pB(1|u). The reason for choosing this Bell inequality is that the threshold detection efficiency for attaining the loophole-free regime for I4 4422 is 0.7698 and 0.618, for maximally and partially entangled states, respectively [40]. That is, the I4 4422 inequality requires lower threshold detection efficiencies than the CHSH inequality, for which these thresholds are 0.828 and 2/3[41], respectively. Therefore, the hope is that this advantage can be translated into a similar advantage in the threshold detection efficiency for DI-QKD. We used the quantum realization Q4422 given in the Supplementary Material of Ref. [40], consisting of the maximally entangled two-ququart state |ψ=1 2(|11+|22+|33+|44),(7) and four measurements with two outcomes. Each measurement is a projector defined by four coefficients cias follows: 4  i,j=1 cic∗ j|ij|,(8) with 4 i=1|ci|2=1. The coefficients for Alice’s measurements x∈{1,2,3,4}are 1=(−0.2816,−0.2816,0.9159,0.0499), 2=(−0.5438,0.5438,0.5625,−0.3035), (9) 3=(0.2816,0.2816,0.9159,0.0499), 4=(0.5438,−0.5438,0.5625,−0.3035), and for Bob’s measurements y∈{1,2,3,4}are 1=(−0.2816,0.2816,0.9159,−0.0499), 2=(−0.5438,−0.5438,0.5625,0.3035), (10) 3=(0.2816,−0.2816,0.9159,−0.0499), 4=(0.5438,0.5438,0.5625,0.3035). Since each measurement is a projector, it has only two eigenvalues λ∈{0,1}. For the QKD protocol, we consider that the output 1 corresponds to the eigenvalue λ=1, while the output 2 corresponds to λ=0. Also, in order to distill the key, Bob’s extra input is y=5=(−0.2816,−0.2816,0.9159,0.0499). Notice that Q4422 does not reach the maximum quantum violation of the I4 4422 inequality (Fig. 3), which value is √2−1 and it is achieved with pairs of real qubits and degenerate measurements [42]. FIG. 1. Secret key rates versus detection efficiency η(dimensionless). Comparison between the secret key rate obtained with Q234 (solid blue line), Q4422 (dashed orange line), and the realization described in Sec. II C (dotted orange line). The corresponding thresholds to distill a secret key are 0.9218, 0.9474, and 0.9317, respectively. The key rate of the resulting QKD protocol, as a function of the detection efficiency, is presented in Fig. 1, while Fig. 2 shows the key rate as a function of the visibility. In both cases the key rate is represented with dashed orange lines. The thresholds to distill a secret key are η⩾0.9474 and V⩾0.9396. Note that Q4422 does not reach the value of 1 bit for the key rate, even with η=1 and V=1. Instead, the maximum key rate obtained is 0.4516 bits. This is a consequence of Q4422 not reaching the maximum value of the I4 4422 inequality. C. Protocol based on I4 4422 using partially entangled states We also investigated the performance of the protocol using partially entangled states. For that, we searched for the quantum realization that maximizes the value I4 4422 for a particular FIG. 2. Secret key rates versus visibility V(dimensionless). Comparison between the secret key rate obtained with the Q234 realization (solid blue line) and the Q4422 one (dashed orange line). The corresponding thresholds to distill a secret key are 0.9104 and 0.9396, respectively. 052436-3 JUNIOR R. GONZALES-URETA et al. PHYSICAL REVIEW A 103, 052436 (2021) FIG. 3. Comparison between the violations of the I4 4422 inequality with maximally (dotted blue line) and partially entangled states (dashed orange line). The upper bound (solid black line) was calculated using the NPA hierarchy. For any detection efficiency η the partially entangled states outperformed the maximally entangled ones. The quantities in both axes are dimensionless. class of ququart-ququart entangled states and measurements, optimized for each η. Specifically, we use the parametrization given in Ref. [40]. This parametrization is |ψ()=1−2 3(|11+|22+|33)+|44(11) and gives a maximally entangled ququart-ququart state for =1/2. As in the previous case, the measurements performed are projectors. Alice’s measurements x∈{1,2,3,4} have the coefficients 1=(−u,−u, p1), 2=(−v,v, p2), (12) 3=(u,u, p1), 4=(v,−v, p2), and for Bob’s measurements y∈{1,2,3,4}are 1=(−u,u, q1), 2=(−v,−v, q2), 3=(u,−u, q1), 4=(v,v, q2),(13) where  pi=(pi1,pi2) and  qi=(qi1,qi2), with i∈{1,2}.The normalization condition 4 i=1|ci|2=1 is introduced as a constraint in the optimization. We found that stronger violations than the ones obtained with maximally entangled states can be reached using partially entangled states. This is shown in Fig. 3, where the violations obtained are compared with the bounds to the maximal quantum violation of the I4 4422 inequality computed using the Navascués-Pironio-Acín (NPA) hierarchy [43]. The change in the slope of the violation given by the partially entangled states (dashed orange line), at η=0.84, is due to an abrupt change in the value of in Eq. (11). For η>0.84, the optimization yielded a value of ≈0, which means that qutrits are enough to achieve these violations. However, for η⩽0.84, ququarts are needed as >0. This change in the dimension of the systems is likely to be the reason for the high accuracy of the parametrization in the regions η⩽0.75 and 0.92 ⩽η⩽0.95. Using partially entangled states, better bounds for H(A|E) were achieved, allowing us to improve the threshold to distill a secret key in this scenario. The key rate as a function of the detection efficiency is presented in Fig. 1(dotted orange lines). The detection efficiency threshold obtained in this case was η=0.9317. This corresponds to a reduction in the threshold of 0.0157 with respect to the one obtained using Q4422.To accomplish this improvement, we had to also optimize Bob’s measurement Bn+1, targeting the minimum H(A1|Bn+1). Notice that in this case the key rate reaches a maximum of 0.89 bits at η=1, which is higher than the value of 0.4516 bits obtained using Q4422. This is due to the stronger violation of the I4 4422 inequality achieved with partially entangled states. D. Protocol based on the I234 Bell inequality using maximal ququart-ququart entanglement The second protocol is constructed around the following Bell inequality with three inputs and four outputs: I234 ⩽8,(14) with I234 =p(1,1|1,1) +p(1,2|1,1) +p(2,1|1,1) +p(2,2|1,1) +p(3,3|1,1) +p(3,4|1,1) +p(4,3|1,1) +p(4,4|1,1) +p(1,1|1,2) +p(1,2|1,2) +p(2,3|1,2) +p(2,4|1,2) +p(3,1|1,2) +p(3,2|1,2) +p(4,3|1,2) +p(4,4|1,2) +p(1,1|2,1) +p(1,3|2,1) +p(2,1|2,1) +p(2,3|2,1) +p(3,2|2,1) +p(3,4|2,1) +p(4,2|2,1) +p(4,4|2,1) +p(1,1|2,2) +p(1,3|2,2) +p(2,2|2,2) +p(2,4|2,2) +p(3,1|2,2) +p(3,3|2,2) +p(4,2|2,2) +p(4,4|2,2) +p(1,1|1,3) +p(1,2|1,3) +p(2,3|1,3) +p(2,4|1,3) +p(3,3|1,3) +p(3,4|1,3) +p(4,1|1,3) +p(4,2|1,3) +p(1,1|2,3) +p(1,3|2,3) +p(2,2|2,3) +p(2,4|2,3) +p(3,2|2,3) +p(3,4|2,3) +p(4,1|2,3) +p(4,3|2,3) +p(1,1|3,1) +p(1,4|3,1) +p(2,1|3,1) +p(2,4|3,1) +p(3,2|3,1) +p(3,3|3,1) +p(4,2|3,1) +p(4,3|3,1) +p(1,1|3,2) +p(1,4|3,2) +p(2,2|3,2) +p(2,3|3,2) +p(3,1|3,2) +p(3,4|3,2) +p(4,2|3,2) +p(4,3|3,2) +p(1,2|3,3) +p(1,3|3,3) +p(2,1|3,3) +p(2,4|3,3) +p(3,1|3,3) +p(3,4|3,3) +p(4,2|3,3) +p(4,3|3,3). (15) 052436-4 DEVICE-INDEPENDENT QUANTUM KEY DISTRIBUTION … PHYSICAL REVIEW A 103, 052436 (2021) This inequality was introduced in Ref. [44] and is tight in the two-party, three-setting, four-measurement or (2,3,4) scenario [45]. Its maximum quantum violation, I234 =9, requires pairs of ququarts. The reason for choosing this inequality is that it is the simplest bipartite Bell inequality in which the maximum quantum violation equals the nonsignaling bound [46]. We chose a quantum realization that leads to the maximum violation. This realization Q234 is defined as follows. Each party has a ququart. The initial state of the pair is the maximally entangled state given in Eq. (7). Each ququart can be seen as a pair of qubits. Then, each local measurement can be seen as a pair of compatible measurements on the corresponding qubit-qubit local system. Specifically, if we relabel the basis of Alice and Bob as |1−→|0|0, |2−→|0|1, (16) |3−→|1|0, |4−→|1|1, then Alice’s measurements can be written as 1=σ(b) z,σ(a) x, 2=σ(a) z,σ(b) x, 3=σ(a) z⊗σ(b) z,σ(a) x⊗σ(b) x.(17) Similarly, Bob’s measurements can be written as 1=σ(d) z,σ(c) z, 2=σ(c) x,σ(d) x, 3=σ(c) x⊗σ(d) z,σ(c) z⊗σ(d) x,(18) where σk idenotes the i={x,y,z}Pauli matrix for qubit k={a,b,c,d}. The qubits {a,b}correspond to Alice, while qubits {c,d}to Bob. Bob’s extra input to distill the key is y=4=(σ(d) z,σ(c) x). The local observables correspond to the three rows (Alice’s observables) and columns (Bob’s) of the Peres-Mermin table [47,48]. Previous DI-QKD protocols have used this realization [49,50]. In addition, the pair of outcomes (±1,±1) that each measurement yields can also be mapped as (+1,+1) −→ 1, (+1,−1) −→ 2, (−1,+1) −→ 3 and (−1,−1) −→ 4. The key rates of this protocol are presented in Figs. 1and 2. We obtained the following thresholds to distill a secret key, η⩾0.9218 and V⩾0.9104. Also notice that since Q234 reaches the maximum value of the I234 inequality, the key rate achieves its maximum of 2 bits, for η=1 and V=1. Our detection efficiency threshold is lower than the one obtained with the CHSH-based protocol using a maximally entangled state (0.924). However, it is still beyond the scope of the current technology. On the other hand, our visibility threshold, under the assumption of perfect detection efficiency, shows that the experiment reported in Ref. [51] has good enough visibility to distill a secret key (V≈0.95). E. Protocol based on the I234 Bell inequality using qutrit-qutrit partially entangled states We optimized the inequality I234 over the family of states given by |ψ=cos θ1cos θ2|11+cos θ1sin θ2|22 +sin θ1cos θ2|33+sin θ1sin θ2|44.(19) In the most general case, each four-outcome measurement is specified by 15 parameters. However, using 15 variables per measurement would make the parameter space extremely large and impractical to optimize. Therefore, we opted for trying an ansatz that involved less parameters. Concretely, we tried three different parametrizations for the measurements. Our first parametrization was given by projections in the plane for each qubit, i=(cos ασ z+sin ασ x)a⊗(cos βσ z+sin βσ x)b, j=(cos γσ z+sin γσ x)c⊗(cos δσ z+sin δσ x)d,(20) where i=1,2,3 are Alice’s measurements and j=1,2,3 are Bob’s. The second parametrization was the one introduced in Refs. [29,52]. For this parametrization it is convenient to define the projectors into each subspace for Alice and Bob. Specifically, we denote by xthe measurements that Alice performs and with ythe measurements of Bob. Moreover, the outputs of the measurements are afor Alice and bfor Bob. The projectors are then given by a x=V( φx)†|aa|V( φx), b y=V( ϕy)†|bb|V( ϕy),(21) where V( φx)=UFTU( φx) and V( ϕy)=U∗ FTU( ϕy). The unitary operators U( φx) and U( ϕy) have nonzero elements only in their diagonal. The elements in the diagonal are exp iφx(k) for Alice and exp iϕy(l)forBob.Also,φx(k) and ϕy(l) refer to the components of the real vectors  φxand  ϕy, respectively. UFT is the Fourier transform. Under this prescription, the probability is p(a,b|x,y)=tra x⊗b yρ.(22) The third parametrization uses pairs of compatible measurements as in Eqs. (17) and (18). However, now each operator, aside from the identity, is replaced by cos ασz+sin ασx. The first and second parametrizations do not reach any violations of the I234 inequality. The third parametrization achieved values of I234 ⩾8. However, these are smaller than the violations obtained by maximally entangled states together with measurements in Eqs. (17) and (18). As a consequence, none of the models is able to improve the key rate presented in Fig. 1. We speculate that for η<1, there are quantum realizations that are better than the one we used Q234. Our guess is supported by the fact that the NPA hierarchy predicts stronger violations of the I234 when η<1. In fact, the lowest detection efficiency required to violate the I234 inequality using the quantum realization Q234 is η=0.8828, while the NPA hierarchy predicts that there is a quantum realization that requires 052436-5 JUNIOR R. GONZALES-URETA et al. PHYSICAL REVIEW A 103, 052436 (2021) FIG. 4. Comparison of the violation of the I234 inequality with maximally entangled states (dashed blue line) and the maximum allowed by quantum mechanics (solid black line). The gap between both realizations increases when detectors are less efficient. The quantities in both axes are dimensionless. η≈0.86. The quantum realizations predicted by the NPA hierarchy can potentially improve the detection efficiency threshold that we presented in Fig. 1. Further research is required to find a suitable parametrization and identify the state and measurements that reach the violations of I234 predicted by the NPA hierarchy (Fig. 4). III. CONCLUSIONS We have presented two DI-QKD protocols whose security relies on Bell inequalities with more than two inputs and two outputs. Both protocols were based on behaviors that display features that are potentially interesting for DI-QKD. Our best results were obtained with the protocol based on a behavior using maximally entangled states violating the I234 Bell inequality. We found that this protocol requires a lower detection efficiency than the protocol based on maximally entangled states violating the CHSH inequality. Regarding visibility, we have noticed that previous experiments based on Q234 could be used to distill a cryptographic key (if ηwould have been 1). Our results could be improved using more general partially entangled states and noise preprocessing [14,19](see Sec. II E). We will investigate these possibilities in a future work. Summing up, we have addressed the problem of the detection efficiency in DI-QKD protocols from a different angle than previous works [14,17–19]. Although our findings are still not capable to close the gap between theoretical and practical security, they show that DI-QKD protocols indeed benefit from the usage of Bell inequalities with more than two inputs and two outputs and should stimulate further research in this direction. ACKNOWLEDGMENTS The authors thank P. Brown and D. García for enlightening discussions. A.C. is supported by Project Qdisc (Project No. US-15097), with FEDER funds, MINECO Project No. FIS2017-89609-P, with FEDER funds, by MINECO (Project No. PCI2019-111885-2). A.P. acknowledges the Swedish Research Council. J.R.G.U. is supported by project HYPER- U-P-S. Project HYPER-U-P-S has received funding from the QuantERA ERA-NET Cofund in Quantum Technologies implemented within the European Union’s Horizon 2020 Programme. APPENDIX: METHODS Here, we summarize the method to bound the quantum conditional entropy H(A|E)ofBrownet al. [16]. They introduced a family of iterated mean quantum Rényi divergences that is applicable on device-independent tasks. Using this technique, it is possible to lower bound device-independent random number generation rates, as well as secret key rates of DI-QKD protocols. The required quantum Rényi divergence is obtained after the following optimization (Lemma 1 in Ref. [16]): Lemma. Let |ψψ|∈D(QAE), {Ma}a∈Abe a POVM on QAand ρAE =a|aa|⊗ρE(a) be a cq-state where ρE(a)= trQA[(Ma⊗1)|ψψ|]. Then, for each k∈N,wehave H↑ (αk)=αk 1−αk log QDI (αk),(A1) where QDI αk=max Vj,a:1⩽j⩽k,a∈A a trMa⊗V1,a+V∗ 1,a 2|ψψ| s.t.  a V∗ k,aVk,a⩽IE (A2) V1,a+V∗ 1,a⩾0 for all a∈A 2V∗ i,aVi,a⩽Vi+1,a+V∗ i+1,afor all 1 ⩽i⩽k−1 and a∈A. The family of iterated mean quantum Rényi divergences is indexed by the parameter αk=1+1 2k−1, with kbeing a positive integer. The optimization in Eq. (A2) is not yet yielding a device-independent entropy, as it is performed in a particular Hilbert space. In order to compute the entropy H↑ (αk) in a device-independent way, the optimization can be relaxed to a semidefined program through the NPA hierarchy [43]. Whether or not the relaxation of H↑ (αK)converges to H(A|E) 052436-6 DEVICE-INDEPENDENT QUANTUM KEY DISTRIBUTION … PHYSICAL REVIEW A 103, 052436 (2021) for k−→∞, it is still an open question. This technique does not rely on any Bell inequality to estimate H↑ (αk); instead, it uses the complete behavior of the system as a constraint of Eq. (A2), in contrast to the CHSH-based protocol [5]. Since H↑ (αk)constitutes a valid lower bound of H(A|E)for any value of k, we can choose the kthat fits better with our hardware. The calculations of r4422 were performed with k= 2 up to the second level of the NPA hierarchy. The certificates required approximately 30 GB of RAM. The calculations for r234 proved to be considerably more demanding given the high number of inputs and outputs. At first instance, we performed the calculations with k=2, but we ran out of memory to include the necessary monomials to ensure H↑ (αk+1)⩾H↑ (αk). Thus, this first estimation was outperformed by the result with k=1. Finally, the results presented for r234 were all calculated with k=1 (applying the dilation theorem in the Supplementary Material of Ref. [16]), the NPA hierarchy at level 2, and adding as many monomials as our hardware allowed us. The certificates required around 180 GB of RAM. All the semidefinite programs in this work were constructed with the Python package ncpol2sdpa and solved with Mosek [53,54]. [1] A. K. Ekert, Phys.Rev.Lett.67, 661 (1991). [2] D. Mayers and A. Yao, Proceedings 39th Annual Symposium on Foundations of Computer Science (IEEE, New York, 1998), p. 503. [3] D. Mayers and A. Yao, Quant. Inf. Comput. 4, 273 (2004). [4] J. Barrett, L. Hardy, and A. Kent, Phys. Rev. Lett. 95, 010503 (2005). [5] S. Pironio, A. Acín, N. Brunner, N. Gisin, S. Massar, and V. Scarani, New J. Phys. 11, 045021 (2009). [6] B. S. Tsirelson, Hadron. J. Suppl. 8, 329 (1993). [7] V. Zapatero and M. Curty, Sci. Rep. 9, 17749 (2019). [8] G. Murta, S. B. van Dam, J. Ribeiro, R. Hanson, and S. Wehner, Quantum Sci. Technol. 4, 035011 (2019). [9] C. H. F. Fung, B. Qi, K. Tamaki, and H.-K. Lo, Phys. Rev. A 75, 032314 (2007). [10] L. Lydersen, C. Wiechers, C. Wittmann, D. Elser, J. Skaar, and V. Makarov, Nat. Photon. 4, 686 (2010). [11] Y. Zhao, C. H. F. Fung, B. Qi, C. Chen, and H.-K. Lo, Phys. Rev. A 78, 042333 (2008). [12] S. Pirandola, U. L. Andersen, L. Banchi, M. Berta, D. Bunandar, R. Colbeck, D. Englund, T. Gehring, C. Lupo, C. Ottaviani, J. L. Pereira, M. Razavi, J. S. Shaari, M. Tomamichel, V. C. Usenko, G. Vallone, P. Villoresi, and P. Wallden, Adv. Opt. Photon. 12, 1012 (2020). [13] J. F. Clauser, M. A. Horne, A. Shimony, and R. A. Holt, Phys. Rev. Lett. 23, 880 (1969). [14] E. Woodhead, A. Acín, and S. Pironio, Quantum 5, 443 (2021). [15] E. Y.-Z. Tan, R. Schwonnek, K. T. Goh, I. W. Primaatmaja, and C. C.-W. Lim, arXiv:1908.11372. [16] P. Brown, H. Fawzi, and O. Fawzi, Nat. Commun. 12,1 (2021). [17] P. Sekatski, J.-D. Bancal, X. Valcarce, E. Y.-Z. Tan, R. Renner, and N. Sangouard, Quantum 5, 444 (2021). [18] R. Schwonnek, K. T. Goh, I. W. Primaatmaja, E. Y.-Z. Tan, R. Wolf, V. Scarani, and C. C.-W. Lim, Nat. Commun. 12,1 (2021). [19] M. Ho, P. Sekatski, E. Y.-Z. Tan, R. Renner, J.-D. Bancal, and N. Sangouard, Phys. Rev. Lett. 124, 230502 (2020). [20] L. K. Shalm, Y. Zhang, J. C. Bienfang, C. Schlager, M. J. Stevens, M. D. Mazurek, C. Abellán, W. Amaya, M. W. Mitchell, M. A. Alhejji, H. Fu, J. Ornstein, R. P. Mirin, S. W. Nam, and E. Knill, Nat. Phys. 17, 452 (2021). [21] M. Giustina, M. A. M. Versteegh, S. Wengerowsky, J. Handsteiner, A. Hochrainer, K. Phelan, F. Steinlechner, J. Kofler, J.-A. Larsson, C. Abellán, W. Amaya, V. Pruneri, M. W. Mitchell, J. Beyer, T. Gerrits, A. E. Lita, L. K. Shalm, S. W. Nam, T. Scheidl, R. Ursin et al.,Phys. Rev. Lett. 115, 250401 (2015). [22] W.-Z. Liu, M.-H. Li, S. Ragy, S.-R. Zhao, B. Bai, Y. Liu, P. J. Brown, J. Zhang, R. Colbeck, J. Fan, Q. Zhang, and J.-W. Pan, Nat. Phys. 17, 1 (2021). [23] C. Jordan, Bull. Soc. Math. (France) 3, 103 (1875). [24] L. Masanes, Phys. Rev. Lett. 97, 050503 (2006). [25] R. Horodecki, P. Horodecki, and M. Horodecki, Phys. Lett. A 200, 340 (1995). [26] A. Acín, S. Massar, and S. Pironio, Phys. Rev. Lett. 108, 100402 (2012). [27] S. Massar, Phys.Rev.A65, 032121 (2002). [28] S. Massar, S. Pironio, J. Roland, and B. Gisin, Phys. Rev. A 66, 052112 (2002). [29] D. Collins, N. Gisin, N. Linden, S. Massar, and S. Popescu, Phys. Rev. Lett. 88, 040404 (2002). [30] D. Kaszlikowski, P. Gnaci´ nski, M. ˙ Zukowski, W. Miklaszewski, and A. Zeilinger, Phys.Rev.Lett.85, 4418 (2000). [31] J.-L. Chen, D. Kaszlikowski, L. C. Kwek, C. H. Oh, and M. ˙ Zukowski, Phys.Rev.A64, 052109 (2001). [32] M. Doda, M. Huber, G. Murta, M. Pivoluska, M. Plesch, and C. Vlachou, Phys. Rev. Appl. 15, 034003 (2021). [33] L. Masanes, S. Pironio, and A. Acín, Nat. Commun. 2,1 (2011). [34] R. Konig, R. Renner, and C. Schaffner, IEEE Trans. Inf. Theory 55, 4337 (2009). [35] O. Nieto-Silleras, S. Pironio, and J. Silman, New J. Phys. 16, 013035 (2014). [36] I. Devetak and A. Winter, Proc. R. Soc. A 461, 207 (2005). [37] N. Brunner, D. Cavalcanti, S. Pironio, V. Scarani, and S. Wehner, Rev. Mod. Phys. 86, 419 (2014). [38] A. Ekert and R. Renner, Nature (London) 507, 443 (2014). [39] N. Brunner and N. Gisin, Phys. Lett. A 372, 3162 (2008). [40] T. Vértesi, S. Pironio, and N. Brunner, Phys. Rev. Lett. 104, 060401 (2010). [41] P. H. Eberhard, Phys.Rev.A47, R747 (1993). [42] K. F. Pál and T. Vértesi, Phys.Rev.A79, 022120 (2009). [43] M. Navascués, S. Pironio, and A. Acín, New J. Phys. 10, 073013 (2008). [44] A. Cabello, Phys. Rev. Lett. 87, 010403 (2001). [45] N. Gisin, A. A. Méthot, and V. Scarani, Int. J. Quantum Inform. 5, 525 (2007). [46] L. Aolita, R. Gallego, A. Acín, A. Chiuri, G. Vallone, P. Mataloni, and A. Cabello, Phys.Rev.A85, 032107 (2012). 052436-7 JUNIOR R. GONZALES-URETA et al. PHYSICAL REVIEW A 103, 052436 (2021) [47] A. Peres, Phys. Lett. A 151, 107 (1990). [48] N. D. Mermin, Phys.Rev.Lett.65, 3373 (1990). [49] K. Horodecki, M. Horodecki, P. Horodecki, R. Horodecki, M. Pawlowski, and M. Bourennane, arXiv:1006.0468. [50] R. Jain, C. A. Miller, and Y. Shi, IEEE Trans. Inf. Theory 66, 5567 (2020). [51] T. Yang, Q. Zhang, J. Zhang, J. Yin, Z. Zhao, M. ˙ Zukowski, Z.-B. Chen, and J.-W. Pan, Phys. Rev. Lett. 95, 240406 (2005). [52] A. Acín, T. Durt, N. Gisin, and J. I. Latorre, Phys. Rev. A 65, 052325 (2002). [53] P. Wittek, ACM Trans. Math. Softw. 41, 1 (2015). [54] M. ApS, MOSEK Optimizer API for Python (2019). 052436-8