Fully device-independent conference key agreement

We present a security analysis of conference key agreement (CKA) in the most adversarial model of device independence (DI). Our protocol can be implemented by any experimental setup that is capable of performing Bell tests [specifically, the Mermin-Ardehali-Belinskii-Klyshko (MABK) inequality], and security can in principle be obtained for any violation of the MABK inequality that detects genuine multipartite entanglement among the $N$ parties involved in the protocol. As our main tool, we derive a direct physical connection between the $N$-partite MABK inequality and the Clauser-Horne-Shimony-Holt (CHSH) inequality, showing that certain violations of the MABK inequality correspond to a violation of the CHSH inequality between one of the parties and the other $N-1$. We compare the asymptotic key rate for device-independent conference key agreement (DICKA) to the case where the parties use $N-1$ device-independent quantum key distribution protocols in order to generate a common key. We show that for some regime of noise the DICKA protocol leads to better rates.

Figure 1

Asymptotic key rate for $N$-DICKA (dashed lines), and for the distribution of a secret key between $N$ parties through $N-1$ DIQKD protocols (solid lines), when each qubit experiences independent bit errors measured at a bit error rate (QBER) $Q$. From top to bottom, the lines correspond to $N=\{3,4,5,6,7\}$. We observe that for the low noise regime it is advantageous to use DICKA instead of $(N-1)\times \mathrm{DIQKD}$ [11]. In general, the comparison between the two methods depends on the cost and noisiness of producing GHZ states over pairwise EPR pairs.

Figure 2

Description of the map ${\mathcal{M}}_i$. This map describes the round $i$ of the first step of Protocol t20. $T_i$ is chosen at random such that $P(T_i=1)=\mu$. $X_i\in \{0,1\}$ represents the “basis” in which Alice's device, represented by the CPTP map ${\mathcal{A}}_i$, measures its input to get the output $A_i^{\prime }\in \{0,1\}$. $X_i=0$ when $T_i=0$ and $X_i{\in }_R\{0,1\}$ otherwise. $Y_{\left(k\right),i}\in \{0,1,2\}$ represents the “basis” in which ${\mathrm{Bob}}_k$'s device, represented by the CPTP map ${\mathcal{B}}_{\left(k\right),i}$, measures its input to get the output $B_{\left(k\right),i}^{\prime }\in \{0,1\}$. If $T_i=0$ we have $Y_{\left(k\right),i}=2$, else we have $Y_{\left(k\right),i}{\in }_R\{0,1\}$. If $T_i=0$ then ${\tilde{C}}_i=\perp$, else ${\tilde{C}}_i=w_{\mathrm{MABK}}(A_i^{\prime },B_{(1...N-1),i}^{\prime },X_i,Y_{(1...N-1),i})$.