Genuine multipartite entanglement is not a precondition for secure conference key agreement

Entanglement plays a crucial role in the security of quantum key distribution. A secret key can only be obtained by two parties if there exists a corresponding entanglement-based description of the protocol in which entanglement is witnessed, as shown by Curty et al (2004). Here we investigate the role of entanglement for the generalization of quantum key distribution to the multipartite scenario, namely conference key agreement. In particular, we ask whether the strongest form of multipartite entanglement, namely genuine multipartite entanglement, is necessary to establish a conference key. We show that, surprisingly, a non-zero conference key can be obtained even if the parties share biseparable states in each round of the protocol. Moreover we relate conference key agreement with entanglement witnesses and show that a non-zero conference key can be interpreted as a non-linear entanglement witness that detects a class of states which cannot be detected by usual linear entanglement witnesses.

Introduction -Secure communication is a central demand for modern society. Security can be provided by Quantum Key Distribution (QKD) which readily enters the industrial market. In QKD [2,3] entanglement plays a crucial role in the security proofs [4,5]. Indeed, even prepare-and-measure protocols [2,6], which do not require any entanglement for their implementation, have an entanglement-based counterpart [7] which can be used for the protocol's security analysis. In Ref. [1], the authors showed that entanglement is in fact a necessary condition to obtain a secure key in a QKD protocol and, moreover, the entanglement of the state shared by Alice and Bob can be witnessed using the measurements performed in the protocol.
We consider a generalization of QKD to the scenario where N parties wish to establish a common shared secret key. This task is called conference key agreement (CKA) and allows for secure broadcast. CKA can be achieved using a concatenation of bipartite QKD [8][9][10], together with additional classical communication. However, the rich structure of multipartite correlations opens the possibility to design new protocols. Several protocols exploiting the correlations of multipartite entangled states have been proposed using qubit systems in the device-dependent [11][12][13][14][15] and deviceindependent scenario [16][17][18], as well as continuousvariables systems [19][20][21]. Even a proof of principle implementation of CKA with four nodes has been recently realized [22].
Here we ask the question of whether the strongest form of multipartite entanglement, namely genuine multipartite entanglement, is a necessary ingredient for CKA based on multipartite quantum correlations. We will show that, counter-intuitively, this is not the case: N parties can establish a secret conference key even when the state distributed in each round of the protocol is * carrara@uni-duesseldorf.de † glaucia.murta@uni-duesseldorf.de biseparable. Moreover, we prove that, in order to obtain a non-zero conference key, the measurements used in the protocol need to be able to witness entanglement across any partition of the set of parties, extending the result of Ref. [1] to the multipartite scenario. Preliminaries -We focus on CKA protocols [23] consisting of several rounds where, in each round, a single copy of a multipartite state is distributed to the N parties, namely Alice and Bob 1 , . . . , Bob N −1 . Upon receiving the systems, the parties perform local measurements and record the classical outcome. In such protocols, an important figure of merit is the asymptotic secret key rate, i.e. the ratio between the number of extracted secret bits and the number of shared copies of the state, in the limit of an infinite number of rounds. Analogously to the bipartite case [24,25], the asymptotic secret key rate of the CKA protocols under consideration can be expressed, after the usual postprocessing (parameter estimation, one-way information reconciliation and privacy amplification) as [13] where X and Y i denote the registers that store the outcomes of the measurements performed by Alice and Bob i , respectively, in the key generation rounds. Here is the von Neumann entropy of Alice's outcome in the key generation rounds, conditioned on Eve's (possibly quantum) side information. 3. Conditioning on classical information [26,Proposition 5.4]: if ρ ABF = j q j ρ j AB ⊗ |j j| F is a classical-quantum state where the system F is a classical register, then H(A|BF ) = j q j H(A|BF = j) where H(A|BF = j) is evaluated on the state ρ j AB . Our goal is to investigate the role of multipartite entanglement in the single copy of the state shared by the N parties in each round of the protocol. In the bipartite case either the state is separable and no key can be extracted, or the state is entangled and can potentially be used for QKD [1]. In the multipartite scenario, however, different classes of entanglement can be defined, which have been extensively studied [27][28][29][30][31].
Let S α be a proper subset of the parties andS α be the complement. Then a state ρ AB1...B N −1 is separable with respect to the partition S α |S α if it is of the form where ρ j Sα and ρ jS α are states shared by the parties in S α andS α , respectively, and where q j ≥ 0 and j q j = 1.
A state is called biseparable [27], if it is a convex combination of states that are separable with respect to different partitions, that is where the first sum is performed over all proper subsets S α of the parties. Again, the coefficients must satisfy q j Sα ≥ 0 ∀j, S α and α j q j Sα = 1. It is worth noting that a state can be biseparable, yet not separable with respect to any partition.
Finally, if a state cannot be written in the form of Eq. (3) we call it genuine multipartite entangled (GME). All CKA protocols based on multipartite entanglement proposed so far [11][12][13][14][15][16][17][19][20][21], explore the correlations of GME states, such as the Greenberger-Horne-Zeilinger (GHZ) state [32] or the W state [33]. Entanglement is necessary for CKA -In the following we prove that entanglement across all partitions in the state shared by the parties is necessary in order to lead to a non-zero asymptotic conference key rate. Theorem 1. Given a CKA protocol, if the state shared by the N parties is separable with respect to some partition S α |S α , then r ∞ = 0.
Proof of Theorem 1. To prove the statement, since the asymptotic key rate in Eq. (1) includes an optimization over all the Bobs, it suffices to prove that H(X|Y l ) ≥ H(X|E) for a specific Bob l . Let us consider a state separable with respect to a partition S α |S α , in the form of Eq.
(2), such that S α contains Alice. We consider a Bob contained inS α , let us say Bob l . Let Eve have a purification of the state of the form where |ψ j SαSαE is a purification of ρ j Sα ⊗ρ jS α and the systems F and F are classical registers held by Eve. The additional classical register F is necessary to exploit the properties of the von Neumann entropy of classicalquantum states. In fact, tracing out the system F , Eve's system E and all the Bobs except B l will result in a state of the form which is a classical-quantum state consisting of a separable state for Alice and Bob B l , paired with the classical register F held by Eve. We remark that performing local measurements on a separable state will result in a separable state. Thus, after the measurements of the CKA protocol the state will still be in the form of Eq. (5). Moreover, we can write the following chain of inequalities: where E tot indicates the global subsystem of Eve, which includes the classical registers. In the first, second and third line we used Property 2, Property 3 and Property 1 of the conditional Von Neumann entropy, respectively. Finally, in the fourth line we used again Properties 2 and 3. This concludes the proof.
It follows that there must be some entanglement shared between Alice and all the Bobs in order to establish a secret common key. It is worth noting that for N = 2 this proof simplifies the argumentation given in Ref. [1]. CKA without GME -We will now focus on the main question, that is whether a positive conference key can be established without GME. We answer this question in the affirmative by exhibiting a family of biseparable states that can lead to non-zero conference key: where S (k) is the set of subsets of k parties that contain Alice and k − 1 Bobs, Φ GHZ,k Sα = |GHZ GHZ| Sα is the projector of the GHZ state shared by the k parties of the subset S α , defined as |GHZ Sα = 1 √ 2 |0 ⊗k + |1 ⊗k and |+ = 1 √ 2 (|0 + |1 ). The normalization factor is equal to N = N −1 k−1 since the number of terms in the convex combination is equal to the number of subsets of cardinality k − 1 within the N − 1 Bobs.
If the parties perform measurements in the Z basis for key generation, we can show that this class of states always leads to H(X|E) = 1. The reason is that the reduced density matrix, describing Alice and Eve's state after the measurement, has the form ρ XE = 1 X 2 ⊗ ρ E , where ρ E is Eve's reduced state. Thus, using Property 1 of the conditional entropy we have H(X|E) = H(X) = 1. The detailed proof can be found in the Supplemental Material.
We calculate the asymptotic conference key rate for the family of states ρ , as a function of the total number of parties N and the number of parties that are entangled k (for details, see the Supplemental Material): We remark that we have assumed a full characterization of the state, which can be achieved, e.g., if the parties perform measurements in all the Pauli bases during the test rounds of the CKA protocol. In Figure 1 we show the secret key rate as a function of the number of parties N for different values of the number of entangled parties k. We conclude that it is indeed possible to obtain a k=N-1 k=2 k=5 k=10  non-zero asymptotic secret key rate from a biseparable state. Figure 1 shows that r ∞ asymptotically (i.e. for N → ∞) approaches 1 if k equals N −1. Moreover, even in the case when only 2 parties, Alice and one of the Bobs, are entangled in each term of the mixture, a non-zero secret key can be obtained. However, for a fixed value of k, r ∞ → 0 as N increases. Figure 2 illustrates the behavior of the asymptotic key rate for the family of states ρ function of N , the asymptotic key rate reaches a finite value, whereas for k = √ N the key rate drops asymptotically to zero as N increases.
We have also analyzed the previously introduced protocols that generalize the six-state [13] and the BB84 [14] protocols to the multipartite scenario. Using the criterion introduced in Ref. [34], we can exhibit a family of biseparable states that yield a non-zero key rate in these simple protocols. The full analysis can be found in the Supplemental Material.
Our results show that CKA without GME states is possible. We remark that in Ref. [35] the authors have established that GME is a necessary condition for nonzero key in a one-shot conference key agreement protocol. This result, at first, seems in contradiction to our findings, however Ref. [35] refers to the global input state, that for the class of protocols we consider would be ρ ⊗n AB1...B N −1 , where n is the number of rounds. Since the set of biseparable states is not closed under tensor product, the global input state can be GME even if the single copy of the state is biseparable. Here we focus on analysing the entanglement properties of the single copy of the states. This is because we consider a class of protocols in which the states are distributed and measured at each round, therefore no storage or quantum global operation on all the copies is required. CKA and entanglement witnesses -Theorem 1 provides us with a necessary condition to obtain a non-zero key rate in a CKA protocol. We now want to extend to the multipartite scenario the bipartite result presented in Ref. [1]: no secret key can be extracted in a QKD protocol unless Alice and Bob are able to witness entanglement in the shared state using the measurements performed in the protocol. An entanglement witness [31,36,37] is a Hermitian operator W such that Tr(W σ) ≥ 0 for all separable states σ and Tr(W ρ) < 0 for at least one entangled state ρ. This definition of an entanglement witness is based on the fact that the set of separable states is closed and convex, and can thus be separated with a hyperplane from its complement [36,38]. In the multipartite scenario, given the more intricate structure of possible correlations, witnesses can be defined to distinguish different classes of states [31]. We thus consider the same approach of Ref. [1,Theorem 1]: starting from the measurements performed by the parties, we analyze the entanglement witnesses that can be constructed with them. We obtain the following theorem.
Theorem 2. Given a CKA protocol in which the parties use a set of local measurements, for the test and key generation rounds, which are represented by the POVMs indicate the outputs of the measurements labeled by x, y 1 , . . . , y N −1 , then one can obtain a non-zero asymptotic conference key rate r ∞ > 0 only if the presence of entanglement can be proved across any partition of the parties into two subsets.
Moreover, the presence of entanglement across each bipartition can be verified through a set of entanglement witnesses of the form where α labels the partition S α |S α with S α being a proper subset of the parties andS α is its complement, and where c The proof is given in the Supplemental Material. Theorem 2 implies that entanglement across any bi-partition can be witnessed using the statistics of results of the measurements specified by the protocol, since the witness operators W α are constructed from the POVM elements of these measurements. Theorem 2, combined with the results of the previous Section, leads to the following Corollary. This corollary is due to the result of Theorem 2 in combination with the examples presented in the previous Section: In fact, the union of all the sets of states that are separable with respect to a specific partition is not a convex set and thus cannot be separated by linear witnesses from its complement [36] (see Figure 3). Moreover, if a CKA protocol is performed and a non-zero key rate is obtained, it is a necessary condition that the state shared by the parties is not separable across any partition of the parties. Therefore, a non-zero key rate reveals that the state utilized in the protocol is outside of the union of the sets of states that are separable with respect to a fixed partition. Finally, the results of the previous Section tell us that non-GME states can also lead to a non-zero conference key, thus allowing us to conclude that the witness cannot be linear, hence the corollary.

A|BC B|AC
C|AB GME Linear witness Fully separable Figure 3. (Color online) Schematic representation of the set of tripartite states, adapted from Ref. [39]. In blue is represented the set of GME states. In red is highlighted the set of biseparable states that are not separable with respect to any fixed partition, whereas in yellow are represented the sets of states that are separable with respect to a fixed partition. In green is represented the set of fully separable states. A linear witness defines a hyperplane in the space of states. A non-zero conference key rate can be seen as a non-linear entanglement witness, as it can detect states in the red area, i.e. outside a non-convex set.
Conclusions -We addressed the question of whether GME is a necessary resource for a conference key agreement protocol. We proved that, surprisingly, the parties can establish a conference key by sharing biseparable states in each round of the protocol. To show this, we exhibited a family of suitable biseparable states. Moreover, we proved that no conference key can be extracted if the state is separable with respect to any partition of the parties. We remark that our results can have direct implications to experimental implementations, as we have shown an explicit way to obtain a conference key using biseparable states, which are much less costly to produce. Further investigation is required to determine the noise tolerance of implementations that aim to produce these states.
Finally, we related our results to the concept of entanglement witness, showing that a non-zero asymptotic conference key rate can only be obtained if one is able to detect entanglement, across any partition, in the state shared by the parties in each round of the CKA protocol. This extends the result of Ref. [1] for bipartite QKD to the multipartite scenario. As a consequence, we can infer that a non-zero asymptotic conference key rate represents a non-linear entanglement witness, which can detect a type of entanglement that cannot be detected by the traditional linear entanglement witnesses.
Given our results, several lines of research can follow. For example, it is known that distillation of GHZ states starting from biseparable states is possible [31]. More-over, the GHZ state can be used to generate a perfect conference key. It is an open question whether the considered class of CKA protocols is equivalent to the distillation of a GHZ state from biseparable states. Such a result can lead to converse bounds on the key rates achievable by different classes of multipartite entangled states in the considered CKA protocols.
We start the explicit calculation of the conditional entropy H(X|E) by writing a purification of the state in Eq. (S1). An explicit valid purification of the state is given by where {|e α } α is an orthonormal basis of Eve's subsystem of proper dimension. We thus look at the state after Alice performs her measurements on the Pauli Z basis. We obtain the following explicit expression of the state where I α,β = (S α ∩ S β ) is the intersection and U α,β = S α ∪ S β the union between the subsets of the Bobs in S α and S β ,Ū α,β is the complement of U α,β and ρ XB1,...,B N −1 E indicates the state after Alice's measurement. We can then trace out all the Bobs, which leaves us with Alice and Eve's reduced state in the form where s α,β is the cardinality of I α,β , where we defined E α,β = √ qαq β 2 k−s α,β in the second line of the equation and where ρ E = α,β E α,β |e α e β | is Eve's reduced state. Finally, since ρ XE is a product state, we can use Property 1 of the conditional entropy to write H(X|E) = H(X) = 1, thus concluding the proof. We now evaluate the analytical expression for the asymptotic key rate for the family of biseparable states ρ (N,k) AB1,...,B N −1 , given by Eq. (7) in the main text. We recall that the number of terms in the convex combination is equal to the number of subsets of cardinality k − 1 within the N − 1 Bobs, which is equal to N = N −1 k−1 , and that we consider all the coefficients to be equal to q α = 1 N . To calculate the asymptotic key rate, since H(X|E) = 1, as proven in Section I, we need to evaluate the leakage H(X|Y i ) ∀ Bob i which, with our choice of coefficients, will be equal for all the Bobs. We thus calculate the reduced density matrix of Alice and Bob i after they perform the key generation measurements, ρ XYi , in order to estimate the leakage term. Tracing out all the Bobs except one and performing the measurement both on Bob i and Alice's side gives us the state

II. CONFERENCE KEY RATES FOR THE FAMILY OF STATES ρ
where f is the number of terms in which Bob i is entangled with Alice in the original state. The number f can be expressed in term of k and N as f = N −2 k−2 . Thus the reduced density matrix in the computational basis has the form where Note that the reduced density matrix of Bob i after the measurement is ρ Yi = We therefore obtain

III. KNOWN CKA PROTOCOLS: MULTIPARTY BB84 [14] AND SIX-STATE [13]
We now consider two well known CKA protocols, namely the generalizations to the multipartite scenario of the BB84 [14] and the six-state [13] protocols. Our aim is to show that, even for these protocols, a secure conference key can also be established using biseparable states.
For that we consider the following N -partite state 3 4 |ψ , undergoing a depolarizing noise: where p ∈ [0, 1]. A criterion introduced in Ref. [34] provides a necessary and sufficient condition for biseparability of states diagonal in the GHZ basis. Using this criterion, we can establish that the state ρ (N ) dep (p), given in Eq. (S8), is biseparable for all N and the whole range of p.
In Figure S1 we plot the asymptotic conference key rates achieved by the state ρ (N ) dep (p) in the multiparty BB84 [14] and six-state [13] protocols for N = 3 and N = 10.
The plots show that for both simple protocols a non-zero key rate is achievable with the biseparable state ρ (N ) dep (p) for some range of p. The asymptotic key rate, however, rapidly drops to zero as the white noise fraction increases.

IV. PROOF OF THEOREM 2
We give here the full proof of Theorem 2. For completeness we repeat the statement of the theorem. Moreover, the presence of entanglement across each partition can be verified through a set of entanglement witnesses of the form where α labels the partition S α |S α with S α being a proper subset of the parties andS α is its complement, and where c where G a x , G bi yi are the POVM elements of the measurements performed by Alice and Bob i , respectively. We analyze the map that maps each state into the corresponding probability distribution, given the measurements of the protocol, that is Considering a subset of the Hilbert space, namely Σ, we call Σ Π the projection of the subset Σ through the map Π CKA , defined as in Eq. (S10). We now denote the set of states separable across the partition S α |S α as Σ α . We note that Σ α is a closed and convex set. Furthermore, the projection of the set Σ α through the linear map Π CKA , namely Σ Π α is still a closed and convex set. The elements of the projected set represent the probability distributions that come from states that are separable across the partition S α |S α . Due to Theorem 1, a necessary condition to obtain a non-zero key rate is that the state is not separable with respect to any partition. This implies that, given a state ρ * A,B1,...,B N −1 that leads to a non-zero key rate in a specific protocol, the corresponding probability distribution P * (a, b 1 , . . . , b N −1 |x, y 1 , . . . , y N −1 ) is such that P * (a, b 1 , . . . , b N −1 |x, y 1 , . . . , y N −1 ) / ∈ Σ Π α ∀α. Moreover, since each Σ Π α is a convex and compact set, it is a well known fact that each element of its complementΣ Π α can be separated from Σ Π α with a proper hyperplane [36,38]. In the probability space any hyperplane can be defined as G a x ⊗ G b1 y1 ⊗ · · · ⊗ G b N −1 y N −1 (S14) such that, due to Eq. (S13), for each α Tr(W α σ α ) ≥ 0 , ∀σ α ∈ Σ α Tr(W α ρ * A,B1,...,B N −1 ) < 0. (S15) As a matter of fact, Eq. (S15) tells us that the operator W α is an entanglement witness [31,36] that detect entanglement across partition S α |S α . This concludes the proof of the Theorem.