A Genuine Multipartite Bell Inequality for Device-independent Conference Key Agreement

In this work, we present a new class of genuine multipartite Bell inequalities, that is particularly designed for multipartite device-independent (DI) quantum key distribution (QKD), also called DI conference key agreement. We prove the classical bounds of this inequality, discuss how to maximally violate it and show its usefulness by calculating achievable conference key rates via the violation of this Bell inequality. To this end, semidefinite programming techniques based on [Nat. Commun. 2, 238 (2011)] are employed and extended to the multipartite scenario. Our Bell inequality represents a nontrivial multipartite generalization of the Clauser-Horne-Shimony-Holt inequality and is motivated by the extension of the bipartite Bell state to the n-partite Greenberger-Horne-Zeilinger state. For DIQKD, we suggest an honest implementation for any number of parties and study the effect of noise on achievable asymptotic conference key rates.

In this work, we present a new class of genuine multipartite Bell inequalities, that is particularly designed for multipartite device-independent (DI) quantum key distribution (QKD), also called DI conference key agreement. We prove the classical bounds of this inequality, discuss how to maximally violate it and show its usefulness by calculating achievable conference key rates via the violation of this Bell inequality. To this end, semidefinite programming techniques based on [Nat. Commun. 2, 238 (2011)] are employed and extended to the multipartite scenario. Our Bell inequality represents a nontrivial multipartite generalization of the Clauser-Horne-Shimony-Holt inequality and is motivated by the extension of the bipartite Bell state to the n-partite Greenberger-Horne-Zeilinger state. For DIQKD, we suggest an honest implementation for any number of parties and study the effect of noise on achievable asymptotic conference key rates.
Introduction.-Among a variety of quantum technology applications [1][2][3], quantum key distribution (QKD) is one of the most prominent concepts, in particular for multiple parties in a quantum network [4]. Early proposed QKD protocols [5][6][7] have high demands on experimental assumptions which are difficult to guarantee. Device-independent (DI) QKD aims at establishing a secret key without making detailed assumptions about the inner working processes of the quantum devices [8][9][10][11][12]. The security of DIQKD protocols is based on a loopholefree violation of a Bell inequality [11][12][13][14][15][16][17][18]. A connection between the DI secret-key rate and the violation of the associated Clauser-Horne-Shimony-Holt (CHSH) inequality [19] was established in [11,12] for the bipartite setting. In Ref. [18], a protocol to generate a secret key among n parties, called DI conference key agreement (DICKA) was introduced, which relies on the violation of the Parity-CHSH inequality. Hereby, nonlocality is certified via an effective Bell test of two parties depending on the measurement results of the remaining ones.
Not all multipartite Bell inequalities are suitable for DIQKD because measurements and quantum resources are required that allow a sufficiently large Bell-inequality violation and at the same time provide highly correlated measurement results among all parties. Moreover, at least one party has to use one measurement for key generation and for the Bell test, to detect a potential tampering of the devices. Achieving these requirements simultaneously should therefore be guaranteed by the very structure of the Bell inequality. This constraint disqualifies several known Bell inequalities as a viable option for a Bell test in DIQKD with certain quantum states. For instance, the archetypical n-partite Greenberger-Horne-Zeilinger (GHZ) state [20] can maximally violate the npartite Mermin-Ardehali-Belinskiȋ-Klyshko (MABK) inequality [21][22][23] and also the Bell inequality most recently introduced in Ref. [24]. However, as proven in Ref. [4], perfectly correlated measurement results with the n-GHZ state can only be obtained if and only if all parties mea-sure in the σ z eigenbasis, which then excludes maximum violation of the Bell inequalities in Refs. [21][22][23][24], see [25]. In this work, we specifically design a novel class of multipartite Bell inequalities that fulfills the aforementioned conditions. We prove the classical bounds of this inequality and discuss some features of it, in particular how to obtain a large Bell-inequality violation. To demonstrate the usefulness of our Bell inequality, we quantify achievable conference key rates based on its violation. For this, we use the approach of Ref. [13], which employs the Navasqués-Pironio-Acin (NPA) hierarchy [26,27], together with a multipartite constraint. We propose an honest implementation for a multipartite DIQKD protocol and briefly discuss how noise affects the achievable asymptotic DI secret conference key rates. A genuine multipartite Bell inequality.-We impose the following condition on the Bell test: Its structure has to be such that it allows to simultaneously yield highly correlated measurement results and sufficiently large Bellinequality violation for certain quantum states. These are crucial ingredients in any DIQKD protocol. Consider a setup of n parties, called Alice and Bob (j) for j ∈ {2, . . . , n} =: [n], cf. Fig. 1. Let each party measure two dichotomic observables A x and B (j) We define a set that contains all ordered possibilities to choose l out of the labels {2, . . . , n} for the Bobs: for all n ∈ N, l ∈ {1, . . . , n − 1}, with vectors α (n) l of length l, whose ordered components α (n) l,j label a specific Bob; e.g., S (2,4), (3,4)}. For the sake of legibility, we also use the abbreviation FIG. 1. A multipartite DIQKD setting, with parties Alice and Bob (j) n j=2 . Alice distributes a multipartite quantum state via quantum channels (dashed lines). The parties communicate over classical channels (solid lines) and they perform measurements on their part of the quantum resource, specified via an input x, y (j) ∈ {0, 1} that yields a result a, b (j) ∈ {±1}.
Definition. (Genuine multipartite Bell inequality) Let n 3 be an integer and S (n) l the set defined in Eq. (1). (2). In the Suppl. Mat., we elaborate in detail on the construction of the Bell inequality. To make it more accessible, we state the Bell correlator for n = 3, and visualize it in Fig. 2 for n = 4. Lemma. (Reduction of party number) For all n 2, Therefore, the sum over the set S Note that the upper bound is independent of n. See Suppl. Mat. for the analytical proof, whose idea is to consider all classical deterministic strategies, which can be significantly reduced by exploiting the invariance of B (n) under arbitrary relabeling of Bobs. Here, some remarks are due. First, note that for n = 2, B (n) and the classical bounds reproduce the CHSH inequality (normalized with a factor 1 2 ). Furthermore, the Parity-CHSH inequality [18] is in fact a subclass of our Bell inequality, that is recovered via the choice B Also, note that the lower classical bound on B (n) is close to the algebraic minimum of −2 n−1 . As we did not find a way to violate the lower bound, a violation of the Bell inequality (3) refers to the upper bound throughout this paper. Beyond that, a characterization of the maximum Bell value achievable with quantum correlations, the Tsirelson bound g (n) qm [28], is desirable. However, there is no general approach known that yields a tight Tsirelson bound for an arbitrary Bell inequality, as mentioned in Ref. [29]. An upper bound on the Tsirelson bound can be found by using the NPA hierarchy [27]. Usually, this procedure is numerically expensive, which is why we only calculate this bound for the first nontrivial odd-and even-numbered case, i.e., for n ∈ {3, 4}: g (3) qm = 1.5 and g (4) qm ≈ 1.5539.
These bounds are tight within numerical precision, cf. Table I. The Bell inequality (3) is particularly designed for the state |GHZ n = 1 √ 2 |0 ⊗n + |1 ⊗n , under the condition that the choice A 0 = σ z does not prohibit a violation of this inequality. The optimal measurements can be chosen to be in the σ z − σ x plane of the Bloch sphere, as further argued in the Suppl. Mat., in detail, for all j ∈ [n], where the optimal value of the polar angle θ depends on the number of parties n. Note that, due to the symmetry of the Bell correlator and the target state, θ does not depend on j. This choice allows a straightforward calculation of the Bell value achievable with the n-GHZ state, which reads g (n,odd) g (n,even) GHZ = 1 − (1 + cos (θ)) n−1 + cot (θ/2) sin n (θ) 1 + cos (θ) . (9b)  GHZ achievable with n-GHZ state, cf. Eq. (9), the ratio of g  For a given number of parties n, the corresponding relation in (9) can be numerically optimized w.r.t. θ and the limits become which is visualized in Fig. 3. GHZ according to Eq. (9) as a function of the polar angle θ for various number of parties n.
From Table I, we notice that the Bell value g (n) GHZ for n ∈ {3, 4} coincides with the Tsirelson bound in Eq. (7). Due to the symmetry and construction of the Bell inequality, we conjecture that this holds for general n. If this is true, finding the Tsirelson bound to our Bell inequality boils down to a simple numerical optimization over the parameter θ in Eq. (9). To conclude this discussion, consider the Bell inequality for n = 3 parties. States of the form ρ = ρ AB (2) ⊗ ρ B (3) do not allow to exceed the Tsirelson bound for n = 2 parties, which one can verify -either analytically or via the NPA hierarchyby taking all classical deterministic strategies for Bob (3) into account. Thus, √ 2 is a Svetlichny bound [30] which can certify genuine tripartite entanglement. Likewise, one observes that states of the form ρ = ρ A ⊗ ρ B (2) B (3) cannot violate the classical bound. Beyond the tripartite case, we have numerical indication for analogous statements concerning biseparable splits, cf. Outlook. Bounding Eves guessing probability.-Finally, we want to apply our Bell inequality (3) for DIQKD. As preparation, we briefly describe how to obtain a lower bound on the DI conference key rates. We focus on asymptotic secret-key rates and assume that quantum devices behave identically and independently in each round (i.i.d.). Let G (n) denote the Bell operator corresponding to our Bell inequality (3), i.e., B (n) = tr G (n) ρ AB , where ρ AB := ρ AB (2) ...B (n) represents the quantum state shared among all parties. Let Alice use measurement input x = 0 for raw key generation and define B y := (B Eve's guessing probability P g (a|E) about Alice's A 0measurement results a conditioned on her information E can be upper bounded by a function f of the observed Bell violation g obs , it amounts to the solution of the SDP [13,27,31] max ρAB ,Ax,By subject to: tr G (n) ρ AB = g (n) obs .
For classical-quantum states ρ AE , the guessing probability is connected to the quantum min-entropy via H min (a|E) = − log 2 P g (a|E) [32], from which we obtain a lower bound on the DI asymptotic secret-key rate, and Q denote the binary entropy and the quantum bit error rate (QBER), respectively. The noisiest channel determines the QBER [4], hence where Q AB (j) is the QBER between Alice and Bob (j) . The bound established by the SDP (11) is valid against the most general attacks the eavesdropper can perform [13] but they are in general rather loose. Recent development promises improvement in this regard [33]. Application: DI conference key agreement.-Here, we present achievable DI secret-key rates for n ∈ {2, 3, 4} parties with a DIQKD protocol similar to the one in Ref. [34]. In the honest implementation, the quantum state distributed in each round of the protocol is the n-GHZ state. To minimize the error-correction information, all parties measure σ z in key generation rounds. To test for Bell-inequality violation, the parties choose observables as proposed in Eq. (8) that lead to a maximum violation. The protocol is aborted if the Bell inequality (3) is not violated. For a realistic scenario, we assume local depolarizing noise, that corrupts each qubit subsystem ρ i according to where p ∈ [0, 1] denotes the noise parameter. In this scenario, the marginal probability distribution of Alice's A 0 measurement is uniform, i.e., A 0 = 0. Since we consider binary outcomes, we can lower bound the Von Neumann entropy in terms of the guessing probability via H(a|E) 2 (1 − P g (a|E)) [33,35], which in turn yields Asymptotic DI secret-key rates according to Eq. (14) in dependence of the noise parameter p (solid lines) for n ∈ {2, 3, 4}. In bottleneck networks and for low noise, the multipartite DIQKD protocol outperforms multiple bipartite DIQKD protocols, Eq. (15), (dashed lines). The dotted line corresponds to the analytical bounds of Ref. [18], Eq. (4) for n = 4 in the same implementation. In terms of key rates calculated via SDP, however, our Bell inequality leads to better results compared to the Parity-CHSH inequality (not shown in this Figure), an advantage that increases with the noise parameter p. secret-key rate, Eq. (14), as a function of the parameter p of the noise model in Eq. (13). To put these key rates into perspective, we consider the same comparison as in Ref. [18], where the conference key rates are compared with multiple bipartite key rates, described by [11] r CHSH where S denotes the violation of the CHSH inequality. For illustration, we consider the Bell state |φ + ∝ |00 + |11 under the noise model in Eq. (13), which connects S with Q according to S = 2 √ 2 (1 − 2Q). The QBER Q as defined in Eq. (12) is related to the noise parameter via Q = p (1 − p/2) for all n. Under the assumption that Alice cannot perform the bipartite QKD protocols with every Bob simultaneously, which can be the case in bottleneck networks, cf. Ref. [4], the bipartite key rates get a prefactor of (n − 1) −1 . As mentioned, the bounds on the guessing probability in terms of SDPs are often too pessimistic. Therefore, we cannot beat the analytical results of Ref. [18]. In direct comparison via the SDP, however, our Bell inequality leads to slightly better conference key rates than the Parity-CHSH inequality, see caption of Fig. 4. Conclusion and Outlook.-In this manuscript, we introduced a novel family of genuine multipartite Bell inequalities, that is specifically tailored to the n-GHZ state, while maintaining the possibility to maximally violate it with σ z measurements. As argued, an application is to use this Bell inequality for a Bell test in a DIQKD protocol, because there highly correlated measurement results and maximal violation are required at the same time. We established the classical bounds of this Bell inequality and suggested measurements that lead to the maximal Bell value, given the n-GHZ state is measured. Finally, we calculated via semidefinite programming conference key rates based on the violation of our Bell inequality and discussed its robustness against depolarizing noise. For future work, a more thorough study of our Bell inequality (3) is desirable. A starting point is to clarify the role of partially entangled states and the existence of associated intermediate bounds in our Bell inequality, similar to the MABK case [36]. We conjecture that the maximum Bell value B (n) for n parties with biseparable states where at most k − 1 Bobs are entangled with Alice, is determined by the maximum Bell value B (k) for k parties. In this case a Bell value larger then B (k) is a DI witness for entanglement of at least k + 1 parties, one of them being Alice. An important goal would be to find an analytical bound on the Von Neumann entropy in terms of the violation of our Bell inequality (3). As we provided a nontrivial genuinely multipartite generalization of the CHSH inequality -in a similar spirit as the n-GHZ state represents a multipartite generalization of the Bell state -we hope that our contribution paves the way for further insight into multipartite quantum communication.
The authors acknowledge support from the Federal Ministry of Education and Research BMBF (Project Q.Link.X and HQS) and from ML4Q Excellence Cluster of DFG. We thank Reinhard Werner, Gláucia Murta, and Lucas Tendick for helpful discussions.

Supplemental Material
We split the Suppl. Mat. into four parts. First, we prove the classical upper and lower bounds of our Bell inequality. Afterwards, we elaborate on the construction of the Bell inequality and discuss optimal measurements to achieve a maximum Bell value with the n-GHZ state. Finally we state the DIQKD protocol for completeness. We recall our Bell inequality for convenience:

Proof of the Theorem
The maximal and minimal classical value is achieved for deterministic strategies. To establish the classical bounds, we thus consider the variables A x and B (j) y (j) for x, y (j) ∈ {0, 1}, j ∈ {2, . . . , n} to take on values from the set {±1} and denote with the vector A, B (j) a strategy from the set that contains every possible combination of ±1 as components for this 2n-dimensional vector. We also definẽ such that we can write B (n) = A 1 j B (j) + +B (n) for the classical Bell value. We make the important observation, that any strategy A, B (j) that leads to A 1 j B (j) + = 0, eliminates the value ofB (n) as this requires that B Note, that we make use of the conventions 0! = 1 and n l = 0 ∀l > n, l < 0. We divide the proof into two parts, one for the lower and one for the upper bound.
where we used the cardinality #S . Via the normalization condition, Eq. (18a), the expression above simplifies for both n odd and even to − 2 n−1 − 1 , as claimed.
(ii) Upper bound. A maximization of A 1 j B+ (j) leads to the value of 1, but a priori it is not clear that this is indeed the maximum possible B (n) -value. We start by counting all possible strategies forB (n) and categorize them, such that we can calculate its value by a distinction of cases. There are 2 × 3 n−1 different possibilities to choose a strategy A 0 , B (j) − , however, we notice that the expressionB (n) in Eq. (17) is invariant under permutation of Bobs, i.e., we only need to calculate theB (n) -value for a subset of strategies A 0 , B (j) − , that cannot be converted into each other by permutation of Bobs. This reduces the number of different deterministic strategies to only n(n + 1). As a final remark before we work through the different strategies note that the amount of nonzero values for the variables B To proceed, let n be an odd integer, hence δ ⌊ n 2 ⌋, n 2 = 0. Then, the best Alice can do is to choose her variable A 0 ∈ {±1} such that the sum is minimized, because of the global minus sign in Eq. (20). Exploiting identity (18b), leads tõ where the only nonvanishing term is q−1 0 and thus results inB (n) = 1. For n even, we can make a similar argument. Choosing the value for A 0 that maximizes the total expression leads us tõ For the remaining cases, at least one variable B (j) − is +1 and at least one is −1. From Eq. (17) we obtain with this strategỹ Recall, that in the case where all Bobs have the same value, we have #S (q+1) l combinations to attribute the value ±1 to all l out of q Bobs. Here, the sum still has q l many terms, but some multiply to +1, while others to −1, depending on how many elements are drawn from q − . To correctly count the numbers of combinations leading to the sign ±1, we use the Chu-Vandermonde identity (18c). The idea here is to divide the total amount of options q into two subsets q + and q − , and then count all possible combinations to draw elements from these subsets. But due to the negativity of elements from the set q − , we need to include a negative sign for q− r if r is odd. Important is, that due to the alternating sign, almost all terms in Eq. (23) cancel each other. In fact, the following two relations hold Showing the validity of these relations concludes the prove, as inserting them into Eq. (23) leads to the maximum of B (n) = 1. To prove Eq. (24a) we order the left-hand side of it by positive and negative contributions The idea is to use the Pascal triangle relation (18b), to eliminate the problems that arise due to the alternating sign. Via Eq. (18b) we thus split the right-hand side of Eq. (25a) into the following two expressions: where we introduced a new index of summation x to simplify both expressions. We dropped the contributions from k = 1 and r = 0 in Eq. (26b), as they vanish anyway. To proceed, we add the right-hand sides of Eqs. (26a) and (26b). All integers from r = 0 up to r = x, for all x ∈ {0, . . . , 2⌊ n−1 2 ⌋ − 2} appear in this sum. Therefore, the right-hand side of Eq. (25a) is given by where we used ⌊⌊ n−1 To simplify Eq. (27), note that the second sum only yields a nontrivial contribution, if 2r q − −1 and 2r 2⌊ n−1 2 ⌋−q +q − , which is only possible if q 2⌊ n−1 2 ⌋+1. As we additionally have the constraint q n − 1, we require q = n − 1 and n needs to be an even integer. In this case, the only nonvanishing term in the second sum in Eq. (27) is a single expression equal to +1, corresponding to r = q−−1 2 , which can only be a valid integer if q − is odd. Beyond this, we use the Chu-Vandermonde identity (18c) to simplify the first expression of the right-hand side in Eq. (27) and obtain The same procedure can be applied to the right-hand side of Eq. (25b). Ultimately, it leads to where the additional contribution is now only obtained if q − is an even integer. The difference between Eqs. (28) and (29) represents the left-hand side of Eq. (25a). We thus obtain which proves identity (24a). Essentially the same approach now leads to the prove of relation (24b). Only minor and straightforward adjustments for the index of summations are needed, which then leads to because the second binomial coefficient is +1 if n is even and q = n − 1, and 0 otherwise. This concludes the proof.

On the Construction of the Bell Inequality
The Bell inequality (16) is constructed around two central restrictions we impose on the Bell setting. First, we want to achieve a large Bell value if the quantum resource is given by an n-GHZ state and second, that this Bell value is achievable if Alice measures A 0 = σ z . As the Bell inequality is tested for violation in a DIQKD protocol, these restrictions are clearly motivated by Theorem 1 of Ref. [4], which states that maximum correlation among all n parties with a GHZ state requires all parties to measure σ z . We set the stage by discussing known multipartite Bell inequalities and introducing some notation. A priori, it is not clear, how to devise a useful Bell inequality, that is particularly well suited for the n-GHZ state. The MABK inequality [21][22][23] for instance allows a maximum violation by the n-GHZ state, as discussed in Ref. [37]. For DIQKD however, the MABK inequality is not suitable because the very structure of it prohibits to simultaneously achieve perfectly correlated measurement results among all parties and sufficiently high Bell-inequality violation, see Ref. [25] for details. Also most recently, Ref. [24] introduces a Bell inequality which is tailored to be maximally violated by an n-GHZ state of any local dimension d. However, at least for d = 2 and m = 2 measurement settings, this inequality suffers from the same drawbacks as the MABK inequality. Imposing the additional constraint on the Bell setting, that Alice should in principle be able to measure A 0 = σ z without compromising the possibility to violate the Bell inequality has led us to our inequality (16). Another Bell inequality which embraces this idea, is the Parity-CHSH inequality [18] B (n) where each Bob (j) for j 3 only has one observable. In fact, the Parity-CHSH inequality can be reproduced from our Bell inequality (16), by choosing B . We briefly recall the notation we already introduced in Ref. [25], as it is crucial for the construction of the Bell inequality (16). Let F 2 = {0, 1} denote the finite field with two elements, which allows us to define the vector space F n 2 of bit strings of length n. Let further P n denote the n-qubit Pauli group. We define the stabilizer group S := S ∈ P n S |GHZ n = |GHZ n of the n-GHZ state χ n = |GHZ n GHZ n |. The group S is generated by the n independent operators G 1 := σ ⊗n x , and for all j ∈ [n] : (34a) where the superscript denotes the corresponding subsystems. In general, the projector of any stabilizer state can be written as the normalized sum of all of its stabilizer operators [38,39]. We obtain for χ n with s := (s 1 , . . . , s n ) ∈ F n 2 the representation: The sum in Eq. (35) consists of 2 n individual terms, where 2 n−1 of them contain only Pauli σ z and identity operators (namely those with s 1 = 0), while the other 2 n−1 ones consists of only Pauli σ x and σ y operators. The weight of such operators is given by the number of nontrivial Pauli matrices it contains. For s 1 = 1, the operators always have full weight, while for s 1 = 0 the weight of the operators is always an even number, but all possible combinations (with respect to the subsystems) of all even numbers 2k n of σ z occur. For the construction of our Bell inequality, we pursue a strategy which matches the restrictions we initially imposed on the Bell setting. To obtain a large quantum value with the n-GHZ state, the idea is to gain a contribution from as many operators as possible from the representation in Eq. (35). To quantify this, recall that Pauli matrices are traceless and that their product is given by where δ j,k and ǫ jkl denote the Kronecker delta and the Levi-Civita tensor, respectively. As we require A 0 = σ z and because of relation (36) the expression i . The counterpart of expression (37) for s 1 = 0 however, is nonvanishing if the observables have an even weight. The same argument can be done for the corresponding expression without an observable of Alice. As all possible combinations occur in the n-GHZ state, we also include all possible combinations of observables with respect to the parties for expectation values in our Bell inequality. This explains the term in our Bell inequality. The expression −δ ⌊ n 2 ⌋, n is included due to a fundamental difference between the odd-and even-numbered n-GHZ state. For n even, the operator σ ⊗n z occurs in the GHZ state representation in Eq. (35), while for n odd, this is not the case. Finally, since operators with s 1 = 1 have full weight, we include one additional expectation value in the Bell inequality that contains observables of all parties, hence the first term in our Bell inequality.

Optimal Measurements and Properties of the Bell Inequality
As our main goal was to establish a useful Bell inequality for multipartite device-independent quantum key distribution (DIQKD), our focus is not the complete characterization of our Bell inequality. For completeness, however, we want to address some properties, in particular we suggest measurement observables for all parties that lead to a maximum Bell value if the n-GHZ state is measured, because this is relevant for QKD. Further properties which could be worth investigating are, if it is possible to analytically derive the Tsirelson bounds [28], if the Bell inequalities constitute facets of the classical polytope [40], or if there exist intermediate bounds for separable states with respect to different splits of parties, as it is the case for the MABK inequality [36]. For n = 3 we discovered that B (3) is in fact a facet inequality, as one can show with the methods presented in Ref. [41]. As already mentioned in the main article, we conjecture that there exist intermediate bounds.
To motivate the optimal choices for the observables given the GHZ state χ n is measured, recall that a general qubit observable can be parametrized as and analogously for A 1 . Note that B . Due to cos(α) = − cos(π ± α), we extract θ for all j ∈ [n] from the representation (39), as a necessary condition to eliminate the σ z contribution of B (j) + . Beyond that, we note that sin(π ± α) = ∓ sin(α). Together with ϕ 1 can be chosen the same for every Bob, without compromising the possibility to achieve the maximum Bell value. We therefore set θ (j) 0 = θ and θ (j) 1 = π − θ for all j ∈ [n]. In total, the maximum Bell value B (n) given an n-GHZ state is measured, can be achieved with A 0 = σ z , A 1 = σ x , B (j) 0 = sin (θ) σ x + cos (θ) σ z , B (j) where the optimal value of the polar angle θ depends on the number of parties n. This choice allows a straightforward calculation of the Bell value with the n-GHZ state g (n) which can be simplified to (43a)

Multipartite DIQKD Protocol
Finally, we want to state the DIQKD protocol. Alice has two measurement inputs x ∈ {0, 1} implementing the measurement of a dichotomic observable A x . Each Bob (j) has three inputs y (j) ∈ {0, 1, 2}, with dichotomic observables B (j) y (j) . The protocol includes the following steps, see also [4,34]: (i) In every round of the protocol, the parties do: State preparation -Alice produces and distributes a multipartite state ρ AB . Since we assume an i.i.d. implementation, the source generates the same state in every round. Measurement -There are two types of measurement rounds, key generation (type-0) and parameter estimation (type-1) measurement rounds. For type 0, the parties choose the inputs (x, y) = (0, 2, . . . , 2), and for type 1 they choose their inputs x, y (j) ∈ {0, 1} uniformly at random. The parties use a preshared random key to agree on the type of measurement round.
(ii) Parameter estimation -The parties publicly communicate the list of bases and outcomes for type-1 rounds and an equal amount of measurement outputs for type-0 rounds. The publicly announced data from type 1 is used to estimate the Bell value g (n) obs of inequality (16), whereas the announced type-0 data is used to estimate the quantum bit error rate Q, which quantifies the asymptotic error-correction information.
(iii) Classical postprocessing -Similar to the device-dependent multipartite QKD protocol [4], an error-correction and privacy-amplification protocol is performed.
If the parties verify, that their data violates our Bell inequality (16), they commence the error correction. The solution of the SDP in the article then upper bounds Eve's guessing probability. If g (n) obs g (n)↓ cl they abort the protocol.