Universal Limitations on Quantum Key Distribution over a Network

We consider the distribution of secret keys, both in a bipartite and a multipartite (conference) setting, via a quantum network and establish a framework to obtain bounds on the achievable rates. We show that any multipartite private state--the output of a protocol distilling secret key among the trusted parties--has to be genuinely multipartite entangled. In order to describe general network settings, we introduce a multiplex quantum channel, which links an arbitrary number of parties, where each party can take the role of sender only, receiver only, or both sender and receiver. We define asymptotic and non-asymptotic LOCC-assisted secret-key-agreement (SKA) capacities for multiplex quantum channels and provide strong and weak converse bounds. The structure of the protocols we consider, manifested by an adaptive strategy of secret key and entanglement [Greenberger-Horne-Zeilinger (GHZ state)] distillation over an arbitrary multiplex quantum channel, is generic. As a result, our approach also allows us to study the performance of quantum key repeaters and measurement-device-independent quantum key distribution (MDI-QKD) setups. For teleportation-covariant multiplex quantum channels, we get upper bounds on the SKA capacities in terms of the entanglement measures of their Choi states. We also obtain bounds on the rates at which secret key and GHZ states can be distilled from a finite number of copies of an arbitrary multipartite quantum state. We are able to determine the capacities for MDI-QKD setups and rates of GHZ-state distillation for some cases of interest.

Quantum communication over a network is a pertinent issue from both fundamental and application aspects [1][2][3][4][5][6][7]. With technological advancement [8][9][10][11], and concerns for privacy [7,12], there is a need for determining protocols and criteria for secret communication among multiple trusted parties in a network. Quantum key distribution (QKD) provides unconditional security for generating secure, random bits among trusted parties against a quantum eavesdropper, i.e., an eavesdropper that is only limited by the laws of quantum mechanics. Secret key agreement (SKA) among multiple allies is called conference key agreement [13,14]. Conference key agreement can be achieved if all parties involved share a Greenberger-Horne-Zeilinger (GHZ) state [15]. As in the case of bipartite QKD, however, there exists a larger class of states, known as multipartite private states [14], which can provide conference key by means of local measurements by the parties.
Given the global efforts towards a so-called quantum internet [3,16,17], as well as quantum key distribution over long distances [18,19], it is thus pertinent to establish security criteria and benchmarks on key distribution and entanglement generation capabilities over a quantum network. A quantum network is a complex structure as it inherits various setups of different quantum channels with particular alignment due to local environmental conditions. One of the biggest obstacles in building this structure is an attenuation of the signal, which cannot be amplified by cloning or broadcasting due to its inherent quantum nature. The signal decays exponentially with distance over an optical fiber [20], and also, the interaction with the environment makes it difficult to preserve entanglement for long time [10]. Hence, even obtaining a metropolitan scale quantum network remains a challenge. To overcome these problems, there is a global effort in building technology of quantum repeaters [11,[21][22][23] that could act as relay stations for long-distance quantum communication [7,19]. Some of the first protocols to be performed once a quantum network is available will likely be bipartite as well as multipartite secret key agreement. The main concern to secure the network is a necessity for these QKD protocols to be free of loopholes. A number of spectacular attacks on implementations are based on inaccuracy (inefficiency) of detectors of polarized light [24][25][26]. Based on the idea of entanglement swapping, a novel protocol known as measurement-device-independent QKD (MDI-QKD) [27,28] was introduced, which does not require the honest parties to detect an incoming quantum signal, thus avoiding the problem of detector inefficiencies. This allowed for a QKD protocol that is independent of any measurement device and hence called measurementdevice-independent QKD (MDI-QKD) [27,28]. This idea has drawn enormous theoretical and experimental attention over the last few years in terms of analyzing achievable key rates for such a scheme with various noise models and performing experiments with current technologies [29][30][31][32][33][34][35][36][37][38][39].
Given the broad interest in implementing such technologies, understanding the fundamental limitations on the key rates achievable in scenarios such as quantum networks, quantum repeaters as well as setups for MDI-QKD is an important task. Seminal papers [40,41] on upper bounds on secret key distillation from states along with results from Refs. [42][43][44][45][46] have led to notable recent progress in the aforementioned direction, for two parties over point-to-point channels assisted by local quantum operations and classical communication (LOCC) [47][48][49][50]. Building upon these works, further progress has been made in restricted network settings, e.g., between two parties over bidirectional [51][52][53], broadcast [54][55][56], multiple access, and interference quantum channels [54], as well as quantum repeaters [50,57] and networks consisting of point-to-point [58][59][60] or broadcast channels [61].
In this work, we aim to provide a unifying framework to derive upper bounds on the key rates, both in bipartite and conference settings, achievable in a broad range of different scenarios, including but not limited to broadcast, multiple access, interference channels, repeaters, some MDI-QKD setups and more general network scenarios. To that purpose, we introduce a multiplex quantum channel, i.e., a multipartite quantum process that connects parties, each playing one of three possible roles -both sender and receiver, only sender, or only receiver. A multiplex quantum channel is the most general form of a memoryless multipartite quantum channel in a communication network setting. All other network quantum channels can be seen as a special case of this channel, see Fig. 1 for certain common examples. Even the physical setups of MDI-QKD and key repeaters can be described as special cases of multiplex quantum channels, see Fig. 2. In general, the input and output systems on which such a channel acts can be discrete (finite dimensional) or continuous variable (infinite dimensional) quantum systems.
Next, we introduce secret key distribution protocols over multiplex quantum channels with LOCC-assistance between users, as shown in Fig. 3. This provides a unifying framework to evaluate performances of various seemingly different QKD protocols. In particular, we describe a general paradigm of QKD protocols where a fixed number of trusted allies are connected over a multiplex quantum channel N . In these protocols, the allies are allowed to perform LOCC between each use of N to generate in the end a key secure against any eavesdropper that satisfies the laws of quantum mechanics. This so-called quantum eavesdropper can have access to all environment parts, including the isometric extension to the channel N . Our main technical result consists of a meta-converse bound on the one-shot conference key agreement capacity of a multiplex quantum channel, from which we can obtain a number of weak as well as strong converse bounds for many uses of the multiplex quantum channel, including adaptive and non-adaptive strategies. As our results work in the non-asymptotic setting of a finite number of channel uses, we believe them to be of wide practical interest.
In particular, as an important observation, we show that key repeater protocols, as well as commonly used setups for MDI-QKD are special cases of LOCC-assisted secret key agreement via a multiplex quantum channel. Whereas bounds on the key rates in such scenarios can also be obtained from a number of earlier results, e.g. from [50,58,60], our framework allows for higher level of specificity in the setups, e.g. by taking into consideration the lack of quantum memory or a particular kind of noisy measurement that is performed in the relay station. Thus our framework allows us obtain tighter bounds than those in Refs. [50,58,60] and even to compute MDI-QKD capacities of certain photon-based practical prototypes that use the so-called dual-rail encoding scheme. This approach provides important tools for benchmarking the performance of such experimentally relevant protocols.
When considering conference key agreement, the pivotal observation we arrive at is that multipartite quantum states with directly accessible secret bits, also called (multipartite) private states [14,62], are genuinely multipartite entangled. This fact also allows us to derive non-asymptotic upper bounds on the secret key distillation from a finite number of copies of a multipartite quantum state.
Our work showcases the topology-dependent and yet universal nature of entanglement measures based on sandwiched Rényi relative entropies [63,64], of which relative entropy is a special case. These entanglement measures provide upper bounds on the secret key rate over an arbitrary multiplex quantum channel which was first shown for bipartite states in Ref. [40]. The entanglement measures are topology-dependent because the upper bound's argument depends (only) on the partition of quantum systems held by trusted allies based on their roles in the network channel. The results are based on the observation that multipartie private states are necessarily genuinely multipartite entangled. Example of an LOCC-assisted secret key agreement protocol among six parties, Alice 1, Alice 2, Bob 1, Bob 2, Charlie 1 and Charlie 2 using the multiplex channel N three times. Inputs into N are depicted red, outputs green and reference systems black. Alice 1 and 2 enter systems into and receive systems from N , Bob 1 and 2 only enter and Charlie 1 and 2 only receive systems. In the end the six parties obtain a six-partite conference key.
The structure of this paper is as follows. We begin with a brief overview of the main results and briefly mention some important prior results along the direction of our work in Secs. II and II A, respectively. We introduce notations and review basic definitions and relevant prior results in Section III. In Section IV, we introduce and discuss the properties of entanglement measures for the multiplex quantum channel. We show that genuine multipartite entanglement is a necessary criterion for secrecy. In Section V, we introduce LOCC-assisted secret key agreement protocols over an arbitrary multiplex quantum channel. We derive upper bounds on the maximum achievable rate for conference key agreement over finite uses of multiplex quantum channels. In Section VI, we leverage our bounds to provide non-trivial upper bounds on other quantum key distribution schemes such as measurement-device-independent quantum key distribution and quantum key repeaters. In Section VII, we derive lower bounds on the secret-key-agreement capacity over an arbitrary multiplex quantum channel. In Section VIII, we derive upper bounds on the number of secret key bits that can be distilled via LOCC among trusted parties sharing a finite number of copies of multipartite quantum states. We provide concluding remarks and open questions in Section IX.

II. SUMMARY OF THE MAIN RESULTS
In the following, we will provide a brief overview of our main results. Regarding technique, our focus is on multipartite private states, which are the most general class of states that provide quantum conference key directly (i.e. without distillation) by local measurements. Such states are of the form [14] where #» K = K 1 , ..., K N denotes the so-called key part, i.e. the systems which the N parties involved have to measure in order to obtain conference and #» S = S 1 , ..., S N denotes the so-called shield systems, which the parties have to keep secure from the eavesdropper. Also, Φ GHZ is an Npartite GHZ state, ω is some density operator, and U tw is a specifically constructed bipartite unitary operation known as twisting.
We show that states of this form are necessarily genuinely multipartite entangled (GME), i.e., they cannot be expressed as a convex sum of product states no matter with respect to which partition the states are products. To show this, we define a multipartite privacy test, i.e. a dichotomic measurement {Π γ , 1 − Π γ } such that any -approximate multipartite private state ρ with fidelity F (ρ, γ) ≥ 1 − passes the test with success probability Tr[Π γ ρ] ≥ 1− . We then show that any biseparable state σ cannot pass the privacy test with probability larger than 1/K, where log K is the number of conference key bits obtainable by measuring (the key part of) γ. Namely we show that Tr[Π γ σ] ≤ 1/K for all biseparable σ.
As a means of distributing bipartite or multipartite private states among the users, e.g. in a future quantum version of the Internet [3,17], we introduce multiplex quantum channels that connect a number of parties which have one of three possible roles-that of only sender or only receiver, or both sender and receiver. We denote senders as Bob 1 ,..., Bob k, and their inputs as B 1 , ..., B k , receivers as Charlie 1 ,..., Charlie m, and their inputs as C 1 , ..., C m , as well as parties that are both senders and receivers as Alice 1 ,..., Alice n, with respective inputs A 1 , ..., A n and outputs A 1 , ..., A n . See also figure 1. To describe such channel, we use the nota- By interleaving the uses of a multiplex quantum channel with local operations and classical communications (LOCC) among the parties, we provide a general framework to describe a number of different quantum protocols. The idea is to construct a multiplex quantum channel in such a way that its use interleaved by LOCC simulates the protocol. For example, in an MDI-QKD setup, where Alice 1 and Alice 2 send states to the central measurement unit using respective channels N 1,2 , we can define a (bipartite) multiplex quantum channel of the form Here M A 1 A 2 →X is the quantum channel performing the central measurement and B X→A1A2 a classical broadcast channel sending the result back to Alice 1 and Alice 2.
Other examples include multipartite MDI-QKD and secret key agreement protocols over quantum network laced with key repeaters [50,57].
Generalizing results for point-to-point [48][49][50] and bidirectional [51][52][53] channels, we derive divergencebased measures for entangling abilities of multiplex quantum channels and show that they provide upper bounds on their secret-key-agreement capacities. The measures we introduce are of the following form: where r = E or r = GE (E and GE denote entanglement and genuine entanglement, respectively) and FS denotes the set of fully separable states (see Sections IV A and IV B). Here #» L, #» R denote ancillary systems that are kept by the respective parties. For any partition : #» X :, we have defined E r as the divergence from the convex set S E of fully separable or the convex set S GE of biseparable states, measured by some divergence D: Our main results are the following upper bounds on secret-key-agreement capacities of a multiplex quantum channel, i.e. on the maximum rates at which multipartite private states can be obtained by using the channel as well as some free operations. In the one-shot case of a multiplex quantum channel with classical preprocessing and postprocessing (cppp), we have the following weak converse result: For any fixed ε ∈ (0, 1), the achievable region of cppp-assisted secret key agreement over a multiplex channel N satisfies where E ε h,GE (N ) is the ε-hypothesis testing relative entropy of genuine multipartite entanglement of the multiplex channel N , which is based on the ε-hypothesis testing divergence [65]. In the case of many channel uses, interleaved by LOCC, we can also show the following strong converse bound: where E max,E (N ) is the max-relative entropy of entanglement of the multiplex channel N , which is based on the max-relative entropy [46]. In the case of finite dimensional Hilbert spaces we can also get a strong converse result in terms of the regularized relative entropy, If N is teleportation-simulable [48,66], i.e. it can be simulated by a resource state and an LOCC operation, the bounds on P LOCC (N ) reduce to the relative entropy of entanglement of the resource state. Our upper bounds on the secret-key-agreement capacities also are upper bounds on the multipartite quantum capacities where goal is to distill GHZ states. Our technique allows us to compute upper bounds on the rates achievable in MDI-QKD scenarios. For an instance, we consider a dual-rail scheme based on single photons [67] to determine bounds on the MDI-QKD rates for two users. In this case, the channels between the users and the relay station are describable by erasure channels E i . We obtain the MDI-QKD capacity to be where η i 's are the parameters of the erasure channels connecting users to the relay station and q is the probability of success of the Bell-measurement at the relay station (see VI D for precise model of the MDI-QKD setup). Dependence on η i allows us to consider the rate-distance trade-off. We also determine upper bounds on the maximum rates for the MDI-QKD setups where the quantum channels from the users to the relay station are depolarising and dephasing channels.
We also provide lower bounds on the secret-keyagreement rates of multiplex quantum channels that can be achieved by cppp. Our protocols are based on Devetak-Winter (DW) [68] and generalize the lower bound for multipartite states presented in Ref. [14] as well as the bound for point-to-point quantum channels presented in Ref. [69] to multiplex quantum channels. Our first lower bound is a direct extension of the result for states given in Ref. [14]. The idea is to choose a so-called distributing party that performs the (directed) DW protocol with all remaining parties. The achievable rate is then the worst-case DW rate achievable between the distributing party and any party. Further, we maximize over all choices for the distributing party. Our second protocol is a variation where we have a directed chain of parties in which each party performs the DW protocol with the next party in the chain. The obtainable rate is given by the 'weakest link', i.e., the lowest DW rate, in the chain, and we maximize over all possible permutations of the parties in the chain.
In the case of a bidirectional network, i.e., a network in which all nodes are connected with their neighbors by a product of point-to-point channels in opposite directions, we provide a tighter bound based on spanning trees. The idea is to find the lowest DW rate in a spanning tree among any pair of the parties and maximise this quantity among all spanning trees. We provide an example where this protocol achieves a higher rate than the previous ones and show that the lower bound can be computed with polynomial complexity.
Finally, we show that the techniques developed in previous sections can also be applied to upper bound the rates at which the conference key can be distilled from multipartite quantum states. In particular, we provide an upper bound on the one-shot distillable conference key in terms of the hypothesis testing relative entropy with respect to biseparable states. Our bound reads Using a particular construction of biseparable states, we provide bounds on this quantity for a number of examples, such as (multiple copies of) GHZ and W states, as well as dephased or depolarised GHZ and W states. We also provide an upper bound on the asymptotic distillable conference key, which is given by the regularized relative entropy with respect to biseparable states.
which is a generalization of the bipartite bound given in Ref. [62].
A. Relation to prior works We briefly sketch some of the major developments that provide upper bounds on the key distillation capacities from states or via LOCC-assisted secret key agreement protocol over a quantum channel. We then compare our bounds on the SKA capacities with those mentioned in prior works.
Conditions and bounds on the distillable key of bipartite states were provided in Refs. [40,62] and [41]. The former is in terms of the relative entropy of entanglement [43,44], the latter in terms of the squashed entanglement [70] (cf. [71,72]). These results were generalized to the conference key in Refs. [14] and [73], respectively.
For an LOCC-assisted secret key agreement protocol over a point-to-point channel, Ref. [47] provides a weak converse bound in terms of the squashed entanglement, which is generalized to the distribution of bi-and multipartite private states via broadcast channels in Ref. [55]. In the case of tele-covariant channels (see Section V C), Ref. [48] provides a weak and Ref. [49] a strong converse bound in terms of the relative entropy of entanglement. This bound has been generalised to the distribution of multiple pairs of bipartite private states states via broadcast channels [54,56], as well as multiple-access and interference channels [54].
For arbitrary point-to-point channels, a strong converse bound in terms of the max-relative entropy of entanglement [46] is provided in Ref. [50]. Recently, another strong converse bound in terms of the regularized relative entropy was provided in Ref. [74]. For bidirectional channels, strong converse bounds in terms of the max-relative entropy of entanglement, that reduce to the relative entropy of entanglement for tele-covariant channels, have been provided in Refs. [51][52][53].
In the case where the bipartite key is distributed between two parties using a quantum key repeater, bounds have been provided in Ref. [50] when quantum communication takes place over a point-to-point channel. Bounds on rates, at which bipartite and multipartite keys for networks of point-to-point or broadcast channels can be obtained, have been provided in Refs. [58-60, 75, 76] and [61], respectively. Also, bounds on the rates obtainable in key repeaters that are in terms of entanglement measures of the input states have been obtained in Refs. [57,77].
In an LOCC-assisted conference key agreement protocol, the use of a multiplex quantum channel is interleaved with local operations and classical communi-cations (LOCC) among trusted parties. For this scenario, we derive strong converse bounds in terms of the max-relative entropy entanglement for arbitrary multiplex channels. In the case of finite channel dimensions, we also derive bounds in terms of the regularized relative entropy of entanglement. In the case of tele-covariant channels, we obtain bounds in terms of the relative entropy of entanglement. In general, our bounds are not comparable with the squashed entanglement bounds provided in Refs. [47,55]. We are able to retain the results of Refs. [48][49][50]74] when multiplex channels are assumed to be point-to-point channels. Our bounds in terms of the max-relative entropy are a direct generalisation of the bounds on bidirectional channels presented in in Refs. [51][52][53], thus we retain those results. By using the recent results Ref. [74], we further provide bounds in terms of the regularised relative entropy of entanglement, which can provide an improvement.
Concerning quantum key repeaters as well as setups of MDI-QKD, upper bounds on the achievable key rates can be obtained from results bounding key rates achievable in quantum networks, e.g. the one presented in Ref. [60] and subsequently used in Ref. [78] or the ones presented in Refs. [50,58]. However, we would like to note that by designing the right kind of multiplex channel, we can make more specific assumptions on the operations performed at the relay stations and thus obtain tighter bounds. For example we could design a multiplex channel for a protocol that does not use a quantum memory at the relay station or that performs a particular imperfect measurement at the relay station. The bounds given in Refs. [50,58,60], on the other hand, would bound the key rates of a repeater or MDI-QKD setup by finding the weakest link between the nodes, i.e. only take into consideration limitations arising from imperfect point-to-point channels linking Alice and Bob with the central relay station, while assuming unlimited quantum memory at the nodes as well as the possibility to perform perfect measurements, resulting in looser bounds. Hence the bounds given in Refs. [50,58,60] basically reduce to the minimum of the capacities of the two point-to-point channels, whereas our bounds represent the limitation arising from both imperfect channels and imperfect node operations, which is an important factor when benchmarking experimental implementations.
As for conference key distillation from multipartite states, we provide tighter bounds than those presented in Ref. [14]. As a GHZ state is a special case of a multipartite private state, our bounds can also be applied to the distillation of GHZ states from any pure or mixed multipartite entangled state, both in the asymptotic and finite copies regime. There are a number of results concerned with computing and bounding rates of multipartite entanglement transformation, including [79][80][81][82][83][84][85][86][87]. As an example, we consider the non-asymptotic distillation of tripartite conference key from noisy and noiseless Wstates and compare our results with Ref. [80].

III. PRELIMINARIES
In this section, we introduce notations, review basic concepts, and standard definitions to be used frequently in later sections.

A. Notations and definitions
We consider quantum systems associated with separable Hilbert spaces. We study both discrete and continuous variable quantum systems, therefore the associated Hilbert spaces can be finite or infinite dimensional. For a composite quantum system AB in a state ρ AB , the reduced state Tr B [ρ AB ] of system A is denoted as ρ A . We denote identity operator as 1. Let where L a is a reference system of A a and held by A a , and same follows for # » RB, # » P C, and # » SK. A quantum state ρ #» A denotes a joint state of a system formed by composition of all A a . We use : #» A : to denote partition with respect to each system in the set #» A as they are held by separate entities, and same follows for : # » LA : # » RB :. Each separate elements in a set are held by separate party, in general. For example, let us consider #» A = {A 1 , A 2 , A 3 } for |A| = 3, then #» A also depicts composite system A 1 A 2 A 3 and : #» A : denotes the partition A 1 : A 2 : A 3 between each subsystem A a of #» A. In a conference key agreement protocol, each pair K i , S i of key and shield systems belongs to respective trusted party X i and fully secure from Eve, while all A a , A a , B b , C c , K i , S i are physically inaccessible to Eve.
Let Φ GHZ #» K denote M -partite GHZ state and Φ + #» L | #» A denote an Einstein-Podolsky-Rosen (EPR) state [88], also called a maximally entangled state, where maximal entanglement is between #» L and #» A. It should be noted that for an orthonormal basis {|i } i , where d = min{|L a |, |A a |}.
(Without loss of generality, one may assume n EPR state of an even-dimensional qudit system to be a tensor product of EPR states of qubit systems).
A quantum channel M B→C is a completely positive, trace-preserving map that acts on trace-class operators defined on the Hilbert space H B and uniquely maps them to trace-class operators defined on the Hilbert space H C . For a channel M A→B with A and B as input and output systems, its Choi state J M LB is equal to M(Φ + LA ).
A measurement channel M A →AX is a quantum instrument whose action is expressed as where each E x is a completely positive, trace nonincreasing map such that M is a quantum channel and X is a classical register that stores measurement outcomes. A classical register (system) X can be represented with a set of orthogonal quantum states {|x x| X } x∈X defined on the Hilbert space H X .
can be written as x∈X ( y∈Y E y,x A y →By ), where # » A = {A y } y and #» B = {B y } y are sets of inputs and outputs, respectively, and {E y,x } x is a set of completely positive trace nonincreasing maps for each y such that L is a quantum channel (cf. [89]). An LOCC channel does not increase value of entanglement monotones and is deemed as a free operation in resource theory of entanglement [14,62,89].

B. Multiplex quantum channels
We now formally define a general form of network channel which encompasses all other known multiplex quantum channels possible in communication or information processing settings (see Fig. 1a and Appendix B). To the best of our knowledge, we have not encountered such a general form of network channel in the literature of quantum communication and computation before.
where each pair A a , A a is held by a respective party A a and each B b , C c are held by parties B b , C c , respectively. While A a is both sender and receiver to the channel, B b is only a sender, and C c is only a receiver to the channel. Such a quantum channel is referred to as the multiplex quantum channel. Any two different systems need not be of the same size in general.
The sets A, B, or C can be empty in such a way that there is at least one input to the channel and one output from the channel. Definition 1 includes all scenarios depicted in Figure 1 (see Appendix B). For example, for a point-to-point channel from Bob to Charlie the set A = ∅ and the sets B and C are singleton sets.
Also, any physical box with quantum or classical inputs and quantum or classical outputs is a type of a multiplex quantum channel. We may not have an exact description of what is going inside the box except that undergoing process is physical, i.e., described by quantum mechanics. Physical computational devices like a physical black box (oracle) and quantum circuit [95] are also examples of multiplex quantum channels.

C. Conference key and private states
There are two usual approaches to studying secret key distillation. A direct approach starts by considering purifications of states where the purifying system is accessible to Eve, and all allied parties are allowed to perform local operations and public communication (LOPC). In this approach, we have Eve and M allied parties. Another approach is by considering private states defined below, where all allied parties perform LOCC. We need not consider Eve explicitly in the paradigm of private states, and it is assumed that purifications of states are accessible to Eve. Both approaches are known to be equivalent [40]. We discuss the equivalence of these two approaches in more detail in Section V We now review the properties of conference key states discussed in Ref. [14]. Conference key states are a multipartite generalization of secret key shared between two parties.
where σ E is a state of the system E, which is accessible to an eavesdropper Eve, D(·) = k∈K |k k| (·) |k k| is a projective measurement channel, {|k Ki } k∈K forms an orthonormal basis for each i ∈ [M ].
A conference key state γ c #» KE has log 2 K secret bits (key) that are readily accessible.
A state ρ #» KE is called an ε-approximate conference key state, for ε ∈ [0, 1], if there exists a conference key state γ c #» KE such that [14] where S is called a twisting unitary operator for some unitary operator U #» k #» S and ω is some density operator [14].
It should be noted that γ # » SK has at least log 2 K secret (key) bits (see [62] for a discussion of when the private state has exactly log 2 K bits). Similar to a conference key state, a state ρ # » SK is called an ε-approximate private state for ε ∈ [0, 1] if there exists a private state γ # » SK such that [14] Any state extension (including purification) γ # » SKE of such a private state (20) necessarily has the following form [14]: where ω #» S E is a state extension of the density operator ω #» S . It follows from [14, It is known that all perfect private states have nonlocal correlations [96].

IV. ENTANGLEMENT AND PRIVACY TEST
this section introduces frameworks for the resource theories of multipartite entanglement for the multipartite quantum channels (see Refs. [51,53,97,98] for the discussion on bipartite channels).

A. Multipartite entanglement
Here we provide a short overview of the relevant definitions. For a detailed review of the topic, see Ref. [99]. A pure n-partite state that can be written as a tensor product |ψ 1 ⊗ |ψ 2 ⊗ ... ⊗ |ψ m is called m-separable. If m < n, there are partitions of the set of all the parties into two with respect to which the state is entangled. If n = m, the pure state is said to be fully separable. If there is no bipartition with respect to which the pure state is a product state, it is called genuinely n-partite entangled.
An arbitrary n-partite state is m-separable if it can be written as following convex composition: where p X (x) is a probability distribution. The mseparable states form a convex set. Note, however, that the subsystems with respect to which the elements of the decomposition have to be product can differ.
A mixed n-partite state is considered genuinely multipartite entangled (GME) if any decomposition into pure states contains at least one genuinely n-partite entangled pure state, i.e. the state is not biseparable. Let a free set F(: #» A :) denote the set of all fully separable and biseparable states of system #» A for F = FS and F = BS, respectively. Both the sets, FS and BS, are convex. We note that while FS is preserved under LOCC operation and tensor product, BS is preserved under LOCC but not under tensor product, i.e., ρ but ρ (1) ⊗ ρ (2) need not belong to BS(: . We refer to biseparable quantum states whose biseparability is preserved under tensor products, i.e. ρ as tensor-stable biseparable states.

B. Entanglement measures
It is pertinent to quantify the resourcefulness of states and channels. The bounds on the capacities that we obtain are in terms of these quantifiers. It is desirable for entanglement quantifiers to be non-negative, attain their minimum for the free states (and separable channels respectively), and be monotone under the action of LOCC.
Definition 4. The generalized divergence of entanglement E E or genuine mulipartite entanglement (GME) E GE of an arbitrary state ρ #» A is defined as [100] E r (: when F = FS or F = BS for r = E or r = GE, respectively, where D(ρ σ) denotes the generalized divergence.
The following definition of entanglement measure of a multiplex channel generalizes the notion of entangling power of bipartite quantum channels [101] (see also [51,53,102]). 24)] is defined as the maximum possible gain in the entanglement E r when a quantum state when acted upon by the given channel N ,

Definition 5. Entangling power of a multiplex channel
where optimization is over all possible input states Another way to quantify entanglement measure of a multiplex channel is the following (see Ref. [53] for bidirectional channel). (24) and GME stands for genuinely multipartite entanglement.
For r = E, the entanglement measure in (24) is called ε-hypothesis testing relative entropy of entanglement E ε h,E , max-relative entropy of entanglement E max,E , sandwiched Rènyi relative entropy of entanglement E α,E , or relative entropy of entanglement E E when the generalized divergence is the ε-hypothesis testing relative entropy, max-relative entropy, sandwiched Rényi relative entropy, or relative entropy, respectively. For r = GE, the entanglement measure in (24) is called ε-hypothesis testing relative entropy of GME E ε h,GE , max-relative entropy of GME E max,GE , sandwiched Rènyi relative entropy of GME E α,GE , or relative entropy of GME when the generalized divergence E GE is the ε-hypothesis testing relative entropy, max-relative entropy, sandwiched Rényi relative entropy, or relative entropy, respectively. We follow the same procedure for nomenclature of entanglement measures of channels.
We note that the sets FS, BS are convex. Using the data-processed triangle inequality [50] and the argument from the proof of [51, Proposition 2], we arrive at the following lemma.

Lemma 1. The entangling power of a multiplex channel
C with respect to the max-relative entropy of entanglement E max,E is equal to the max-relative entropy of entanglement of the channel N , Using a recent result on relative entropies [103], we can also obtain a result for the relative entropy of entanglement. Let us first define the regularized relative entropy of entanglement of a multiplex channel N # » where L A , R B and P C. We can now show the following relation between the regularized relative entropy of entanglement and the relative entropy of entanglement.
Lemma 2. For finite dimensional Hilbert spaces the entangling power of a multiplex channel N # » C with respect to the relative entropy of entanglement E E is less than or equal to the regularized relative entropy of entanglement of the channel N , P be a state and let σ ∈ FS(: C an LOCC channel. Then the following inequality holds Applying the the chain rule from Ref. [103], we find that Since the above holds for arbitrary fully separable states finishing the proof. . This reduction follows from the quasi-convexity of the max-relative entropy [93] and ε-hypothesis testing relative entropy [104], as well as the convexity of the relative entropy of entanglement [44]. Namely, the maximum of a (quasi)-convex function over a convex set will be attained on a boundary point. The boundary points of the set of fully separable density matrices are given by the fully separable pure states.

C. Multipartite privacy test
A γ-privacy test corresponding to γ # » SK is defined as the dichotomic measurement [49] Using properties of fidelity and form of test measurement, we arrive at following proposition. Proof.
We employ proof arguments similar to bipartite case of Eq. (298) in Ref. [62] to arrive at the following theorem, which implies that all private states are necessarily GME states. This is a strict generalization of Eq. (281) in Ref. [62], as a direct generalization would be the same statement for fully separable states instead of biseparable states (cf. Ref. [14]). See Appendix C for the proof.
can never pass any γ-privacy test with probability greater 1/K, i.e.,

V. CONFERENCE KEY AGREEMENT PROTOCOL
In this section, we give a formal description of a secret key agreement protocol for multiple trusted parties, i.e., a conference key agreement protocol.
We consider an LOCC-assisted secret key agreement protocol among M trusted allies is held by trusted party A a and each B b , C c are held by of the channel N is accessible to Eve along with all classical information communicated among X i while performing LOCC. All other quantum systems that are locally available to X i are said to be secure from Eve, i.e., even if local operations during LOCC are noisy, purifying quantum systems are still within labs of trusted allies, which are off-limits for Eve. This assumption is justifiable because X i 's can always abandon performing local operations that would leak information to Eve. In an LOCC-assisted protocol, the uses of the multiplex channel N are interleaved with LOCC channels.
In the first round, all X i perform LOCC L 1 to generate a state ρ 1 ∈ FS(: , and let τ 1 := N 1 (ρ) be the output state after the first use N 1 of multiplex channel. In the second round, an LOCC L 2 is performed on τ 1 and then second use N 2 of multiplex channel is employed on ρ 2 := L 2 (τ 1 ). In the third round, an LOCC L 3 is performed on τ 2 := N 2 (ρ 2 ) and then the third use N 3 of multiplex channel is employed on ρ 3 := L 3 (τ 2 ). Successively, we continue this procedure for n rounds, where an L acts on the output state of previous round, after which multiplex channel is performed on the resultant state. Finally, after n th round, an LOCC L n+1 is performed as a decoding channel, which generates the final state ω # » SK . It can be concluded from the equivalence between private states, and CK states that any protocol of the above form can be purified, i.e., by considering isometric extensions of all channels (LOCC and N ) (the proof arguments are the same as for the purified protocol for LOCC-assisted secret-key-agreement [51]). At the end of the purified protocol, Eve posses all the environment systems E n from isometric extension U N of each use of multiplex channel N along with coherent copies Y n+1 of the classical data exchanged among trusted parties X i during performances of n + 1 LOCC channels. Whereas, each trusted party X i posses the key system K i and the shield system S i , which consists of all local reference systems, after the action of decoder. The state at the end of the protocol is a pure state ω # » Such a protocol is called an (n, K, ε) LOCC-assisted secret key agreement protocol. The rate P of a given (n, K, ε) protocol is equal to the number of conference (secret) bits generated per channel use: A rate P is achievable if for ε ∈ (0, 1), δ > 0, and sufficiently large n, there exists an (n, 2 n(P −δ) , ε) LOCCassisted secret key agreement protocol. The LOCCassisted secret-key-agreement capacityP LOCC (N ) of a multiplex quantum channel N is defined as the supremum of all achievable rates. A rate P is called a strong converse rate for LOCCassisted secret key agreement if for all ε ∈ [0, 1), δ > 0, and sufficiently large n, there does not exist an (n, 2 n(P +δ) , ε) LOCC-assisted secret key agreement protocol. The strong converse LOCC-assisted secret-keyagreement capacity P LOCC (N ) is defined as the infimum of all strong converse rates.
The following inequality is a direct consequence of the definitions:P We can also consider the whole development discussed above for conference key agreement assisted only with classical preprocessing and postprocessing (cppp) communication, i.e., all parties are allowed only two LOCC channels, one for encoding and the other for decoding. A (n, K, ε) cppp-assisted secret key agreement protocol over N is same as a (1, K, ε) LOCC-assisted secret key agreement protocol over channel N ⊗n , and for n = 1 both protocol are the same. The cppp-assisted secretkey-agreement capacityP cppp of the channel N is always less than or equal toP LOCC , LetP N cppp (n, ε) be the maximum rate such that (n, 2 nP , ε) cppp-assisted secret key agreement is achievable for any given N .

Remark 2.
It should be noted that the maximum rate at which secret key can be distilled using LOCC-or cpppassisted protocol over a multiplex channel N is never less than the maximum rate at which GHZ state can be distilled using LOCC-or cppp-assisted protocol over given channel N , respectively. This statement holds because GHZ state is a special private state from which secret bits are readily accessible to trusted allies.
Remark 3. Different physical constraints can be invoked in communication protocols to define constrained protocols and associated capacities. For instance, we can invoke energy constraints on input states and detectors to get energy-constrained protocols and respective capacities (cf. [105,106]).
A. Privacy from a single-use of a multiplex channel LetP N cppp (n, ε) denote the maximum rate P such that (n, K, ε) conference key agreement protocol is achievable for any N using cppp. The following bound holds for the one-shot secret-key-agreement rate of a multiplex quantum channel N (see Appendix D 1 for the proof).
Theorem 2. For any fixed ε ∈ (0, 1), the achievable region of cppp-assisted secret key agreement over a single use of multiplex channel N # » where is the ε-hypothesis testing relative entropy of genuine entanglement of the multiplex channel N . It suffices to optimize over pure input states ψ ∈ FS(: We can conclude from the above theorem that which leads to the following corollaries.
Corollary 1. A weak converse bound on the cpppassisted secret-key-agreement capacity of a multiplex channel N is given bŷ Corollary 2. Consider a class of multiplex channels The cppp-assisted secret-key-agreement capacities for such class of multiplex channels are zero.
B. Strong converse bounds on LOCC-assisted private capacity of multiplex channel We now derive converse and strong converse bounds on LOCC-assisted secret key agreement protocol over a multiplex channel N .
Whereas, for LOCC-assisted secret key agreement protocol, by employing Theorem 1, generalizing proof arguments of Ref. [51,Theorem 2] (see also [50]) to multiplex scenario, we get the following converse bound (proof in Appendix D 2).
Theorem 3. For a fixed n, K ∈ N, ε ∈ (0, 1), the following bound holds for an (n, K, ε) protocol for LOCCassisted secret key agreement over a multiplex N # » where the max-relative entropy of entanglement and it suffices to optimize over pure states ψ. (48) can also be rewritten as

Remark 4. The bound in
where we have P = 1 n log 2 K. Thus, if the secret-keyagreement rate P is strictly greater than the max-relative entropy of entanglement E max,E (N ) of the (multiplex) channel N , then the fidelity of the distillation (1 − ε) decays exponentially fast to zero in the number of channel uses.
An immediate corollary of the above remark is the following strong converse statement.
Corollary 3. The strong converse LOCC-assisted secret-key-agreement capacity of a multiplex channel N is bounded from above by its max-relative entropy of entanglement: We also have another upper bound on the private capacity of a multiplex channel N # » C with finitedimensional input and output systems in terms of the regularized relative entropy instead of the max-relative entropy (proof in Appendix D 3).
Theorem 4. For finite Hilbert space dimensions the asymptotic LOCC-assisted secret-key-agreement capacity of a multiplex channel N # » C is bounded by its regularized relative entropy of entanglement: C. Teleportation-simulable and Tele-covariant multiplex channels For a class of multipartite quantum channels obeying certain symmetries, such as teleportationsimulability [66], the LOCC-assistance does not enhance secret-key-agreement capacity, and the original protocol can be reduced to a cppp-assisted secret key agreement protocol. This observation for secret communication between two parties over point-to-point teleportationsimulable channel was first made in Ref. [48].
#» C : and output partition : Covariant channels.-For each a ∈ A and b ∈ B, let G a and G b be finite groups of respective sizes G a and G b with respective unitary representations g a → U A a (g a ) and g b → U B b (g b ) for all group elements g a and g b . Let W #» g Aa and W #» g Cc be unitary representations for all a ∈ A and c ∈ C, C is covariant with respect to these representations if the following relation holds for all input states ρ # » A #» B and group elements g a ∈ G a and g b ∈ G b for all a ∈ A and b ∈ B: where we have used the notation U(·) := U (·)U † for unitaries U .
The following observation follows from the definition of tele-covariant channels.
Remark 5. Tele-covariance of a channel is with respect to the groups and their unitary representations on the input and output Hilbert spaces of the channel. If associated unitary representations for the tele-covariant channels N 1 and N 2 are respectively same on the output Hilbert spaces of N 1 that are also the input Hilbert spaces for N 2 , then the composition channel N = N 2 • N 1 is also tele-covariant.
A quantum channel obtained by the tensor-product (super-operation " ⊗", which physically means parallel uses) of tele-covariant channels is also a tele-covariant channel.
Following the approach in Refs. [48,62], we obtain Theorem 6. The LOCC-assisted secret-key-agreement capacity of a multiplex quantum channel where E ∞ (: #» A :) ρ is the regularized relative entropy of entanglement of state ρ #» A . For the proof see Appendix D 4. Using the above theorem, we immediately get the following corollary.

Corollary 4. For a multiplex quantum channel
C , which is teleportation-simulable with a tensor-stable biseparable resource state it holdŝ P LOCC (N ) = 0.
Let us note that unlike in Refs. [48,62], which deals with the bipartite relative entropy of entanglement, we do not trivially get a non-regularized bound, which is due to the fact that the definition of biseparability is not tensor-stable. If we consider the relative entropy of entanglement with respect to fully separable states, however, we can employ proof argument of Theorem 4 in Ref. [51] and arrive at the following theorem: Theorem 7. For a fixed n, K ∈ N, ε ∈ (0, 1), the following bound holds for an (n, M, ε) protocol for LOCC-assisted secret key agreement over a multiplex teleportation-simulable quantum channel N # » For a proof see Appendix D 4. Setting α = 1 + 1 √ n and letting n → ∞, we obtain where E(: #» A :) ρ is the relative entropy of entanglement of state ρ #» A ; this bound is also a strong converse bound.

VI. APPLICATION TO OTHER PROTOCOLS
In this section, we exploit the general nature of an LOCC-assisted secret key agreement protocol over a multiplex quantum channel. We derive upper bounds on the rates for two-party and conference key distribution for a number of seemingly different protocols that are of wide interest. Such seemingly different quantum key distribution and conference key agreement protocols can be shown to be special types of LOCC-assisted secret key agreement protocol over some particular multiplex quantum channels. In particular, we identify protocols like measurement-device-independent quantum key distribution, both in the bipartite [27,28] and conference setting [30,110,111], as well as for quantum key repeaters, i.e., generalized quantum repeaters with the goal of distributing private states [50,57,77] to be special types of LOCC-assisted secret key agreement protocol over some particular multiplex quantum channels. We are able to derive upper bounds on the rates achieved in these protocols by exploiting our results in the previous Section. Furthermore, as EPR or GHZ states are special cases of bi-or multipartite private states, respectively, the same holds for LOCC-assisted quantum communication protocols, where the goal is to distill EPR or GHZ states. By providing a unified approach to such a diverse class of private communication setup, we contribute to a better understanding of limitations on respective protocols. These limitations provide benchmarks on experimental realizations of private communication protocols.
A. Measurement-Device-Independent QKD Measurement-device-independent (MDI) QKD is a form of QKD, where the honest parties, Alice and Bob, trust their state preparation but do not trust the detectors [27,28]. In a typical setup of MDI-QKD, such as the ones described in Refs. [27,28], Alice and Bob locally prepare states which they send to a relay station, that might be in the hands of Eve, using channels N 1 A →A and N 2 B →B . At the relay station, a joint measurement of the systems AB is performed, e.g., in the Bell basis, the results of which are classical values that are then communicated to Alice and Bob. Alice and Bob use the relay many times and perform classical post-processing.
A way to incorporate such protocols in our scenario is to identify Alice and Bob as two trusted parties and include the measurement performed by the relay, as well as channels N 1,2 , into a bipartite quantum-classical (qc) channel where M AB→x is the quantum instrument (channel) performing a POVM {Λ x } x and writing the output x into a classical register X and B X→Z A Z B a classical broadcast channel sending input x to Z A and Z B . Registers Z A and Z B are received by Alice and Bob respectively. The channel N MDI A B →Z A Z B is a multiplex channel which is a composition of multiplex channels (see Fig. 2).
Application of Theorem 3 for arbitrary systems and Theorem 4 for finite-dimensional systems (as well as the results of Ref. [51][52][53]), then provides bounds on the achievable key rate in terms of E max,E (N MDI The concept of MDI-QKD has also been generalized to the multipartite setting [30,110,111]. We assume a setup of MDI conference agreement, where a number of trusted parties A i , for i ∈ [n], locally prepare a states which they send to a central relay via channels N 1 A 1 →A1 , ..., N n A n →An . At the relay a joint measurement is performed on A 1 A 2 ...A n , the result of which is broadcasted back to the trusted parties. It is straightforward to generalize (57) to the multipartite case and apply Theorems 3 and 4 (or Theorem 5 for tele-covariant channels) to obtain bounds on the conference key rates.

C. Quantum Key Repeater
Let us now consider the quantum key repeater. In its simplest setup, there are three parties, Alice, Bob, and Charlie. Alice and Bob are trusted parties who wish to establish a cryptographic key, whereas Charlie is assumed to be cooperative but is not trusted. One could think of Charlie as a telecom provider. There are two quantum channels, N A→C A 1 from Alice to Charlie and N B→C B 2 from Bob to Charlie. Alice and Bob are not connected by a quantum channel and are assumed not to have any pre-shared entanglement. Instead, Alice and Bob locally prepare quantum states, e.g., two singlets Φ + AR A and Φ + BR B , and both send a subsystem to Charlie, using the respective channels. This is then followed by an entanglement swapping operation [112], where Charlie performs a joint measurement on the C A C B subsystem, communicates the result to Bob, who then performs a unitary on his reference system R B , which should create entanglement that can be used for cryptographic key, between Alice and Bob. The key has to be secure even in the case that Charlie's information falls into the hands of Eve.
If the channels N A→C A 1 and N B→C B 2 are too noisy, it might be necessary to use them multiple times and perform an entanglement purification or error correction protocol before applying the swapping operation. Whereas early quantum repeater protocols [21,22] make use of entanglement purification protocols that require two-way classical communication, between Alice and Charlie and between Charlie and Bob, it is also possible to use error correction that only requires one-way classical communication. Such protocols are known as second and third-generation repeater protocols (see [23] and references therein).
By using a large enough number of repeater stations, the key can, in principle distributed across arbitrarily long distances. A way to extend a basic threeparty repeater protocol to arbitrarily long repeater chains is known as nested purification [22]. More advanced schemes using error correction and one-way communication have also been developed [23].
As in Refs. [50,57,77], we want to find upper bounds on the rates at which the key can be distributed. Depending on the repeater protocol, there are different ways in which we can describe a quantum key repeater as a multipartite channel and use our results to obtain such bounds. We will now describe how a repeater can be described by a bipartite channel. For an alternative way to describe a repeater we refer to Appendix E.
In order to describe a repeater as a bipartite channel, we consider two trusted parties, Alice and Bob, and a bipartite quantum-to-classical (qc) channel that takes two quantum (and possibly also classical) inputs from Alice and Bob and returns two classical outputs to Alice and Bob, respectively. Such an operation could include the channels from Alice to Charlie and from Bob to Charlie, the measurement performed by Bob, as well as classical communication of the measurement result from Charlie to Alice and Bob. It could also include an error correction protocol that uses the channels from Alice to Charlie and from Bob to Charlie multiple times and makes use of one-way classical communication from Alice to Charlie and from Bob to Charlie. It is then followed by Charlie's measurement and classical communication to Alice and Bob. Alice and Bob are then allowed to perform LOCC among them but not including Charlie. In the case without error correction, we can define where M C A C B →XY describes the measurement and sending of classical messages X and Y to Alice and Bob, respectively. If we add one-way error correction, we get a bipartite channel of the form , the transmission of the classical data X obtained by Alice's part of the one-way error correction protocol to Charlie, as well as Charlie's part of the error correction protocol (Alice's part of the one-way error correction protocol is included in the LOCC). E Y B k →C B 2 is defined in the same way.
By recursively combining the bipartite channels N repeater , it is possible to derive a bipartite channel N repeater chain between Alice and Bob that includes a repeater chain with an arbitrary amount of repeater stations.
Using the results of Refs. [51][52][53], or Theorem 4, we can obtain upper bounds for key repeater protocols that only involve one-way classical communication from Charlie to Alice and Bob, as have been considered in Refs. [57,77]. The bounds are given by min{E max,E (N repeater (chain) ), E ∞ E (N repeater (chain) }. By Remark 5, if N 1,2 as well as M are tele-covariant, so will be N repeater (chain) . Hence, by Theorem 5, the bound reduces to the relative entropy of entanglement of the Choi state of N repeater (chain) . Note that, whereas the bounds in Refs. [57,77] only depend on the initial states shared by Alice and Charlie as well as Bob and Charlie, the formulation in terms of a bipartite channel can provide bounds that also depend on the measurement performed by Charlie, as well as operations performed during error correction. The new bounds take into account imperfect measurements and error correction, which provide an additional limitation on the obtainable rate in practical implementations. Our bounds can at least shown to be comparable with the results of Refs. [57,77] under certain situations of practical interest. For an example, our bound is certainly better when N A→C A 1 and N B→C B 2 are identity channels, allowing Alice and Charlie as well as Bob and Charlie to share maximally entangled states, whereas Charlie's measurement is noisy.

D. Limitations on some practical prototypes
In this section, we explore fundamental limitations on some practical prototypes for MDI-QKD protocols between two trusted parties. We begin first by considering photon-based prototypes for which a detailed discussion of quantum system and transmission noise model can be found in Ref. [67]. In Appendix F, we consider MDI-QKD prototypes with qubit systems and transmission noise models depicted by dephasing or depolarizing channels.
We begin by considering a dual-rail scheme based on single photons to encode the qubits [113]. The dual-rail encoding of a qubit in two orthogonal optical modes can be represented in the computational basis of the qubit system, where only one of the two modes is occupied by a single photon and another mode is vacuum. When these optical modes are two polarization modes-horizontal and vertical-of the light, then we express eigenstates in computational basis as |H and |V for horizontal and vertical polarization. It is also possible to consider frequency-offset modes instead of polarization modes for dual-rail encodings. We assume a noise model for the transmission of a photon through the optical fiber to be a pure-loss bosonic channel with transmissivity η. The inputs to the optical fiber are restricted to a singlephoton subspace that is spanned by |H and |V . The action of this pure-loss channel on qubit encoded with our dual-rail scheme is identical to an erasure channel [114] E with erasure parameter 1 − η and erasure state |e , where |e is the vacuum state, i.e., zero photon in both modes. We note that an erasure channel is tele-covariant. Two trusted parties A i , i ∈ [2], use above mentioned polarization-based dual-rail photons to transmit their qubit systems to Charlie at the measurement-relay station, through the optical fibers with respective transmissivities η i (see Fig. 4 for MDI-QKD). We make a simplis-tic noise model assumption on the measurement channel M # » Ci→X by Charlie: it can perform perfect qubit Bellmeasurement for bipartite MDI-QKD, respectively, with probability q. Whereas with probability 1 − q for the failed measurement, we assume the relay station signals |⊥ ⊥| X to the users. In addition, we can safely assume classical communication X → #» Z among all parties to be clean (noiseless) as they do not require any quantum resource. Finally, for simplicity, we assume error-correcting local operations for all parties can be made perfectly.
To calculate upper bound on the MDI-QKD capacity, it suffices to consider the relative entropy of entanglement of the Choi state of associated multiplex channel N MDI,E Then, the Choi state For the bipartite MDI-QKD where {Φ  We note that the Bell-measurement is tele-covariant. Upon action of the measurement channel M C1C2→X on the state J E L1L2C1C2 (Eq. (61)), the output state is essentially of the form (see Ref. [67]) This implies, the relative entropy of entanglement of the Choi state of N MDI,E A1A2→Z1Z2 is qη 1 η 2 . Employing Theorem 7, the bipartite MDI-QKD capacity for the given MDI-QKD prototype with erasure channels is as qη 1 η 2 bits is an achievable rate for the given setup (see Refs. [48,49,105] for the private capacities of E Ai→Ci ). Notice that qη 1 η 2 is a strong converse bound. For bipartite MDI-QKD (see Fig. 4), using the results of Ref. [48,105] we get upper bound (RB) on the bipartite MDI-QKD capacity to be min{η 1 , η 2 } (e.g., see [50,60]). This bound is always looser than our strong converse upper bound qη 1 η 2 bits for all practical purposes. In Fig. 5, we plot rate-distance trade-off (secret key capacity versus distance L in km) for our bound in Eq. (64) when n = 2, η 1 = η 2 = exp(−αL), and α = 1 22km and compare it with the upper bound (RB) η 1 (since η 1 = η 2 ).
We would like to note that, whereas there now exist variants of MDI-QKD schemes or setups that can achieve the repeaterless bound, e.g. [31,32,34], the dual-rail protocols we consider here, while being suboptimal, may be easier to implement practically. In particular, implementation of a twin-field protocol requires long distance phase-stabilization, which can be challenging [115]. We showcase here the ability to get non-trivial upper bounds for a specific, sub-optimal implementation of QKD schemes. These non-trivial upper bounds are derived from a universal framework, which illustrates the usefulness of the framework we have proposed.

VII. LOWER BOUNDS ON PRIVACY
In this section, we will derive lower bounds on the secret-key-agreement rate of a multiplex channel achievable by means of cppp, in the sense of Ref. [68]. This is a generalization of the lower bound presented in Ref. [14] from multipartite states to multiplex channels, as well as a generalization of the lower bounds on one-to-one channels presented in Ref. [69] to the multiplex case.
The Devetak-Winter (DW) protocol [68], which is considered with bipartite states, only uses one-way communication from Alice to Bob. In Ref. [69], which is concerned with one-to-one channels, a direct and reverse sce-narios are considered. The former corresponding to the case where the quantum channel and the classical communication are oriented in the same direction. The latter corresponding to the case where the two are oriented in opposite directions. In Ref. [14] the DW protocol is generalized to multipartite states by selecting one distributing party, which performs the DW protocol with all remaining parties simultaneously.
We will now generalize this result to the setting of multiplex channels. We begin with a fully separable pure state φ n ∈ FS : # » A n L : # » B n R : #» P : . Here the notation # » X n means we consider n copies of all subsystems X 1 , ..., X M . Application of n copies of the isometric extension of multiplex channel N # » where ω x is the post measurement state of the remaining parties and Eve. Party X i then processes X using classical channels X → Y and Y → Z, where Y = {y, q(y)} and Z = {z, r(z)} are classical random variables. Y is kept by party X i (to be used for the key) and Z is broadcasted to all other trusted parties (and Eve). Upon receiving Z, the other parties then perform their respective POVMs with the goal of estimating the key variable Y . Thus, as shown in Ref. [68], every trusted party X j , where i = j ∈ {1, ..., M }, obtains a common key with X at a rate r i→j n of r i→j where in a slight abuse of notation we use X j as a placeholder for A n j L j , R j or C n j P j , depending if X j is in {A a } a , {B b } b or {C c } c , respectively. The second and third case corresponds of the reverse and direct scenarios in Ref. [69], respectively. Whereas, Eq. (66) has to be maximized over all free input states φ n ∈ FS : # » A n L : # » B n R : #» P : , POVMs Q as well as classical channels X → Y and Y → Z. As discussed in Ref. [14], a conference key among all trusted parties can be obtained at the worst case rate between any pair (X i , X j ). We also have the freedom to choose the distributing party. Putting it all together, we can achieve the following rate of conference key: with φ n ∈ FS : # » A n L : # » B n R : #» P : . Note that in the case of a single-sender-single-receiver channel N : B → C this reduces to the maximum of the direct and reverse key rates presented in Ref. [69].
Next, we propose an alternative generalization of the DW protocol to the case of multipartite states and multiplex channels. The rough idea is that instead of performing the DW protocol simultaneously with all other parties after her measurement, the distributing party performs a one-way protocol with a second party, who then performs a one-way protocol with a third party, and the iteration continues. In particular, the random variables obtained in all previous measurements can be passed on in every classical communication step, so that a party can adapt her measurement depending on all previous measurements instead of the first measurement as in the protocol described in Ref. [14].
We will now describe the protocol in detail: As before, we begin with a fully separable pure state φ n ∈ FS : # » A n L : # » B n R : #» P : and apply n copies of the isometric extension of multiplex channel N # »

A B→
# » AC , resulting in a pure state ψ n : # » A n L: #» R: # » C n P :E n . Assume now we are given some permutation σ : {1, ..., M } → {σ(1), ..., σ(M )}, which determines the order in which the parties participate in the protocol. Party X σ(1) begins by performing a POVM Q (1) on her share of ψ n , i.e. on subsystem A n σ(1) L σ(1) , R σ(1) or C n σ(1) P σ(1) , depending on which kind of party X σ(1) is. This results in a random variable X (1) = {p 1 (x 1 ), x 1 }. The corresponding classical-quantum-...-quantum (cq) state is Party X σ(1) then performs classical channels X (1) → Y (1) → Z (1) , keeping random variable Y (1) and sending Z (1) to party X σ (2) . The corresponding cq state is then given bỹ where ω x1 is the state of the remaining parties and Eve. Next, party X σ(2) performs a POVM Q Z (1) on her share of ω x1 , which provides random variable (X (2) . Party X σ(2) then performs classical channels Z (1) X (2) → Y (2) → Z (2) , keeps Y (2) for herself and sends Z (2) to the next party X σ(3) , who applies the same procedure. The protocol is repeated until party X σ(M ) receives Z (M −1) , followed by her POVM and post-processing. The cq after k ∈ {1, ..., M } measurements and post-processing steps is given bỹ where we have defined recursivelỹ Parties X σ(k) and X σ(k+1) can establish a key rate of [68] We can again maximize over all free input states, POVMs as well as classical channels and consider the worst-case rate between any pair (X i , X j ). Further we have the freedom to choose the order of the parties. Putting it all together, we can achieve the following rate of conference key: with φ n ∈ FS : # » A n L : # » B n R : #» P : .

A. Lower bound for Bidirectional Network via spanning tree
In this section, we observe that one can tighten the lower bounds presented in the previous Section for a particular multiplex channel called bidirectional network (BN). In the BN, each of the nodes is connected with its neighbors by product bidirectional channels, which are specific bidirectional channels that is a tensor product of two point-to-point channels directed in opposite ways from each other.
We first observe that BN is a particular case of a multiplex channel (call it N ). Indeed, in this case, all the parties are of type A; i.e., they can read and write. The rule is that each party represented in the network as a vertex v has deg(v) of neighbors (see Ref. [116] for introduction to graph theory). Each party is assumed to write to her neighbors and also receive from these neighbors some quantum data. We present now a tighter bound on the private capacity of N based on the above exemplary graph.
To be more specific, the BN can be represented by a weighted, directed multi-graph G = (E, V ) in which each edge e ij = (v i , v j ) ∈ E represents a product bidirectional channel Λ ij = Λ i→j ⊗ Λ j→i with weight W : E → R + such that W (e ij ) = W (e ji ) = P(Λ i→j ) = P(Λ j→i ) (this edge can be represented by two directed edges: one from v i to v j and the other vice versa, hence the structure is directed multi-graph). Each product bidirectional channel has in both directions the same private capacity (that 6. An exemplary graph on a). Red edges correspond to private capacity 1 and blue to private capacity 2. The first strategy of obtaining conference key uses a vertex connected to all others, and reaches sub-optimal rate min{w(eij) : (v1, v6), (v1, v5), (v1, v4), (v1, v3), (v1, v2)} = 1. The same happens for any path, which inevitably has to pass through some red edge. The solution is a tree, which is a spanning tree of this graph, and contains no red edge b). Traversing edges of this tree is equivalent to the breadth-first search.
however may differ for different channels). By convention, we consider edges with index i > j only. The number of nodes in the network is denoted as |V | := n and the number of edges as |E| := m.
As a motivation for the next consideration, there comes the fact that for such multiplex channels, the bounds given in inequalities (68) and (74) above are not tight. We exemplify this on the graph presented in Fig. 6(a). Namely, we assume that each red edge of the graph G depicted there represents a (bidirectional) channel with private capacity 1, while each blue -with this capacity equal to 2. We do not depict all other edges (connections) as they have zero private capacity by assumption. We are ready to make two observations (i) approach of inequality (68) would yield overall secret key agreement at rate 1, as the only node connected all others in G (v 1 ) contains (in fact, more than one) red edge. (ii) We observe by direct inspection that every path connecting all vertices also contains at least one red edge. On the other hand, there is a set of vertices [depicted with edges on Fig. 6(b)] that forms the so-called spanning tree T := (V T , E T ) ⊂ G of the graph G. Spanning tree is an acyclic connected subgraph of G, and the word "spanning" refers to the fact that all the vertices of the graph G belong to V T . It is easy to see that starting from any vertex of this tree, by the breadth-first search algorithm, one can visit all its edges, and one can obtain conference key at rate 2 (see Ref. [117] for introduction to algorithms).
As a generalization of this idea, one easily comes up with the following lower bound, which is the main result of this section: where 1 ≤ l ≤ n is an index that counts how many times the breadth-first search needs to be invoked in order to traverse all the edges of the spanning tree T . For the ease of notation T is meant to be a rooted, without loss of generality, at vertex v 1 . By N [v] we mean the proper neighborhood of the node v (i.e. the set of all vertices that are connected by a single edge with v). In rooted tree every vertex is reachable from the root vertex by a path. By N i [v 1 ] we will mean the set of vertices reachable from vertex v 1 by a path of length i. Owing to this no- , while all vertices achievable from v 1 by traversing two edges belong to N 2 [v 1 ] and so on. The first inner maximization needs to be understood inductively. The first step is obvious: we begin with an arbitrary vertex v 1 ∈ V T . The party X v1 who is at node v 1 performs a POVM Q 1 which produces a random variable X (v1) . She processes this variable further to obtain Y (v1) and sends a communication in the form of a variable Z (v1) . The latter variable is broadcasted to all the next neighbors of v 1 i.e. N [v 1 ] \ {v 1 }. Further, if at step m − 1 the form of operations and communication between the nodes has concise notation X Sm Z Sm−1 → Y Sm → Z Sm | deg≥2 , then the next level of nesting i.e. (76) has to be understood as a short notation of the following postprocessing at a number of nodes from the set where p(s i ) denotes the parent vertex of the vertex s i , that is the unique vertex belonging to the neighbourhood which is the closest to the root v 1 in terms of traversed edges.
The above description means, that if some vertex of the tree is of degree equal to one, it has no further children in the tree to pass useful information contained in Z-type variable, while all vertices with larger degree than 1 need to broadcast appropriate data to their further neighbors in the tree.
We exemplify the lower bound given in inequality (75) with the Broadcast Network depicted on Fig. 6. Let us first focus on involved sets of vertices in the process of the breadth-first search over the tree T . The set of vertices of the spanning tree T reads {v 1 , ..., v 6 }. As the root vertex The presented lower bound reads in this case: In Appendix G, we briefly comment on the complexity of finding a sub-graph, which allows us to realize the Conference Key Agreement with the capacity indicated by the inequality (75).

VIII. KEY DISTILLATION FROM STATES
In this section, we concentrate on the subject of the distillation of secret keys from quantum states. An (n, K, ε) LOCC conference key distillation begins with M parties A i for i ∈ [M ] sharing n copies of M -partite quantum state ρ #» A , to which they apply an LOCC channel The resulting output state satisfies the following condition: The one-shot secret key distillation rate from a single copy of a multipartite quantum state K (1,ε) D is upper bounded as follows (cf. Section V).
Theorem 8. For any fixed ε ∈ (0, 1), the achievable region of secret key agreement from a single copy of an arbitrary multipartite quantum state ρ #» A satisfies where E ε h,GE (: is the ε-hypothesis testing relative entropy of genuine entanglement of multipartite state ρ #» A . Proof. The proof argument is the same as that of Theorem 2, so we omit proof here. In the asymptotic limit the rate K (n,ε) D satisfies inf ε>0 lim sup which follows directly from the definition of the secret key rate K D [14].
Using the same argument as in the proof of Theorem 6 in Section V C, we can also get the following asymptotic bound, which generalizes Theorem 9 in [62]: In general, to share the conference key, it is necessary for the honest parties to distill genuine multipartite entanglement.

Corollary 6. For a tensor-stable biseparable state ρ #»
A it holds K D (ρ #» A ) = 0. The above Corollary of Theorem 8, is precisely due to the infimum over biseparable states. However already in tripartite setting there are two non equivalent families of three-partite genuinely entangled states, that is Φ GHZ M type and Φ W M type states [79,85,[118][119][120][121]. Both families of states contain states which are maximally entangled; however, they can not be transformed with LOCC one into another at unit rate [81,84,86,87,122,123]. As the perfect Φ GHZ M state plays a role of the honest (or perfect) implementation of conference quantum key agreement protocols, the distillation of Φ GHZ 3 states from Φ W 3 states has been intensively studied [80][81][82][83][84]86]. In particular, recalling Example 11 of Ref. [80], it is known that one can not transform a single Φ W 3 state into Φ GHZ 3 state even in a probabilistic manner. However, according to [80,Theorem 2], the calculated asymptotic rate for conversion form Φ W 3 to Φ GHZ 3 due to certain protocol is approximately 0.643 (per copy), what constitutes a lower bound for the general case. Another, complementary lower bound has been provided in Ref. [86].
Surprisingly, in the one shot regime, distillation of Φ GHZ 3 states from Φ W 3 states, and therefore of secret key is still possible. To accomplish this task, it is sufficient to consider the initial state as being made up of two copies of the Φ W 3 state. Then using results in Ref. [81], it follows that we can obtain two Φ + 2 states in two distinct bipartite systems with a probability that is arbitrarily close to 2 3 ; having this in mind, one can obtain Φ GHZ 3 by employing ancilla and the entanglement swapping protocol [112]. In this way, we calculated a lower bound on the distillation of Φ GHZ 3 states from tow copies of Φ W 3 state in one-shot regime (one Φ GHZ 3 state with probability 2 3 from two Φ W 3 states). This lower bound can be compared with the upper bound in Theorem 8 given above.
Nevertheless distillation of Φ GHZ M states is only an example of key distillation technique [13,14,84,86,[124][125][126][127]. A more general conference key agreement scenario of our interest incorporates distillation of twisted Φ GHZ M states (see Definition 3) [14,61,119,128,129]. In that case, an approach for upper bounding conference key rates that is different than the estimation of Φ W M to Φ GHZ M conversion rates is required. This corresponds to a possible gap between rates of Φ GHZ M (that can be distilled) and secret key distillation. Since the Φ GHZ M state is an instance of a private state, an upper bound on the conference key rate is also an upper bound on the distillation rate from any state. For plotting our numerical results, we do concentrate on secret key distillation from n copies of Φ W M state in order to compare with other limitations discussed in this section.
The upper bound in Theorem 8 has optimization over all possible biseparable states. Computation of the exact value of the bound given in Eq. (79) need not be feasible in general. As we take the infimum in Eq. (80), we can obtain non-trivial upper bounds on the upper bound given in Eq. (79) by considering optimization over suitable subsets of biseparable states. We make an educated guess for the form of biseparable state to yield a nontrivial upper bound. We remark here that the set of biseparable states is not closed under tensor product so that we have to find different states for any tensor power n of Φ W M or Φ GHZ M states. We devise two families of biseparable states π n,M W , π n,M GHZ adjusted to both number of copies n and number of parties M .
where the operator S 1,i swaps the qubit of the first party with qubit of the ith party. The choice of π n,M GHZ and π n,M W states is motivated by keeping correlation between M −1 parties most similar to these in Φ GHZ M or Φ W M states, while keeping one party explicitly separated. Additionally π n,M GHZ and π n,M W states by definition are symmetric with respect to permutation of parties, due to permutations with S 1,i .
We would like to point out here that π 1,3 W presented here is closer to Φ W 3 state in the Hilbert-Schmidt norm than the state (let us call it Υ) in Ref. [130], even though the state constructed there was supposed to biseparable state closest to Φ W 3 in the Hilbert-Schmidt norm. This result is due to different definitions of biseparability; the state in Ref. [130] is a tensor product with respect to one of the cuts, whereas we make use of convexity of the set of biseparable states. Indeed our states are biseparable by construction (see Sec. IV A).
The upper bound on asymptotic secret key rate can be compared with lower bound on asymptotic Φ GHZ 3 states from Φ W 3 sates distillation [80]. This can be done in the following way. First, we notice that if two parties unite, then M − 1-partite key is no less than initial M -partite key because the set of operations of M -partite LOCC protocol is a strict subset the set of operations for the case in which two parties i and j, are in the same laboratory. We have the following Proposition: , the asymptotic secret-key-agreement rate satisfies the following inequality: where Proof. It is enough to notice that class of LOCC protocols involved in definition of K D (ρ [M ] ) is strictly contained in the class of the protocols involved in definition of K D (ρ [M −1]ij ). Indeed, the merged parties can still simulate any operation from the former class; however, together, they can perform many more operations including global quantum operations on all merged subsystems together. Since K D is defined as the supremum of the key rate over such protocols, the upper bound follows. For the lower bound it is enough to notice that by splitting subsystem(s) of ρ we restrict the class of operations that can be used to distill key.
We immediately observe that Proposition 3 provides a whole family of nonequivalent upper bounds. To see this one can consider of a state that is not invariant under permutations. What is more, one can continue merging as long as there is still two or more subsystems left.

Corollary 7.
For any M -partite state ρ [M ] defined on the Hilbert space H, the asymptotic secret-key-agreement rate satisfies the following inequality: where the state ρ [L] is obtained from the state ρ [M ] by splitting its subsystems so that L ≥ log dim(H). Analogously the state ρ [N ] is obtained via any merging of subsystems of ρ [M ] , such that ρ [N ] has at least two subsystems.
Hence in particular case of Φ W 3 state we can also skip minimization with respect to i, j since the state is symmetric. Using properties of entanglement measures [131][132][133], we have where h 2 (x) is the binary entropy function. The asymptotic key rate and bounds on it are usually noninteger real numbers. In the one-shot regime, expressing these quantities in a similar manner, instead of integers obtained with floor or ceiling functions, is no less meaningful because the amount of secret key and the value of bounds are functions of privacy test parameter ε, which can vary, yielding, in general, different values of these quantities. Therefore dependence of the scenario on the privacy parameter ε is interesting on its own. See Appendix H and Ref. [134].
Remark 6. It is natural that the analogies of Proposition 3 and Corollary 7 hold for the multiplex quantum channel N . The upper bound on M -partite multiplex quantum channel takes the form of M − 1-partite multiplex channel, where the new party's type is determined according to the following rule: If the two parties are of the same type (say B), then the new type is the same as the same (B in that case). If the types are different, then the new type becomes always A because, e.g., when B and C are merged, they have the ability to both read and write.

IX. DISCUSSION
We have provided universal limits on the rates at which one can distribute conference key over a quantum network described by a multiplex quantum channel. We have shown that multipartite private states are necessarily genuine multipartite entangled. As a consequence, it is not possible to distill multipartite private states from tensor-stable biseparable states. We have obtained an upper bound on the single-shot, classical preprocessing and postprocessing assisted secret-key-agreement capacity. The bound is in terms of the hypothesis testing divergence with respect to biseparable states of the output state of the multiplex channel, maximized over all fully separable input states. We have further provided strong-converse bounds on the LOCC-assisted private capacity of multiplex channels that are in terms of the max-relative entropy of entanglement as well as the regularized relative entropy of entanglement. In the case of tele-covariant multiplex channels, we have also obtained bounds in terms of the relative entropy of entanglement of the resource state. We have shown the versatility of our bounds by applying it to several communication scenarios, including measurement-device independent QKD and conference key agreement as well as quantum key repeaters. In addition to our upper bounds, we have also provided lower bounds on asymptotic conference key rates, that are asymptotically achievable in Devetak-Winter-like protocols. We have also derived an upper bound on the secret key that can be distilled from finite copies of multipartite states via LOCC and show some numerical examples. The task of distillation of Φ GHZ 3 from Φ W 3 was extensively studied in the literature [81,122,123]. Here we initiate the study on the distillation of the key rather than Φ GHZ 3 distillation from the Φ W 3 state. This is the rate of the distillation of "twisted" Φ GHZ 3 being private states -a class to which Φ GHZ 3 belongs. It would be interesting to find if the distillation of the key from Φ W 3 is just equivalent to the distillation of Φ GHZ 3 (see recent result on this topic [127]). Distillation of secret key allows trusted parties to access private random bits. Our lower bound on an asymptotic LOCC-assisted secret-key-agreement capacity over a multiplex channel also provides an asymptotic achievable rate of private random bits for trusted parties over a multiplex channel with classical preprocessing and postprocessing.
Our work also provides frameworks for the resource theories of multipartite entanglement for quantum multipartite channels (analogous to bipartite channels as discussed in Refs. [51,53,97,98]). In this context, it is natural to extend the results of Ref. [135] where the so-called layered QKD is considered, to the noisy case of multipartite private states. It would be interesting to systematically consider other frameworks in the resource theory of multipartite entanglement. An important future direction for application purposes is to identify new information processing tasks and determine bounds on the rate regions of classical and quantum communication protocols over a multiplex channel (e.g., see Refs. [53,[136][137][138][139][140][141][142]). Any generalized divergence D(· ·) satisfies the following two properties for an isometry U and a state τ [63]: The sandwiched Rényi relative entropy obeys the following "monotonicity in α" inequality [64]: (A3) The following inequality states that the sandwiched Rényi relative entropy D α (ρ σ) between states ρ, σ is a particular generalized divergence for certain values of α [143,144]. For a quantum channel N , (A4) In the limit α → 1, the sandwiched Rényi relative entropy D α (ρ σ) between quantum states ρ, σ converges to the quantum relative entropy [63,64]: and quantum relative entropy [92] between states is for supp(ρ) ⊆ supp(σ) and otherwise it is ∞.
In a specific case ε-hypothesis testing relative entropy can be calculated exactly.

Appendix B: Multiplex quantum channels
All network channels possible in a communication setting are special cases of multiplex quantum channels Fig. 1), e.g., 1. Point-to-point quantum channel: This is a quantum channel of the form N B b →Cc with a single sender and a single receiver. When a multiplex quantum channel has the form N B b →Cc then A = ∅ and |B| = 1 = |C|. This is arguably the simplest form of a communication (network) channel as it involves only two parties with one party sending input to the channel and the other receiving the output from the channel.
2. Bidirectional quantum channel: This is a multiplex quantum channel of the form N A 1 A 2 →A1A2 with two parties who are both senders and receivers, i.e. |A| = 2 and B = ∅ = C (cf. [53,101]).
3. Quantum interference channel: This is a bipartite quantum channel of the form N B1B2→C1C2 with two senders and two receivers (cf. [149]). We may also call N #» B→ #» C with an equal number of senders and receivers as quantum interference channel.

Broadcast quantum channel: This is a multipartite
quantum channel of the form N B b → #» C with a single sender and multiple receivers (cf. [150,151]). We may also call N #»

B→
#» C as a broadcast channel if the number of senders is less than the number of receivers. 5. Multiple access quantum channel: This is a multipartite quantum channel of the form N #» B→Cc with multiple senders and a single receiver (cf. [152]). We may also call N #»

B→
#» C as a multiple access channel if the number of senders is more than the number of receivers.
6. Physical box: Any physical box with quantum or classical inputs and quantum or classical outputs.

Network quantum channels of types
A . If inputs and outputs to a multiplex channel are classical systems and underlying processes are governed by classical physics, then the channel is called classical multiplex channel (see [137] for examples of such network channels). If input and output to the channel are quantum and classical systems, respectively, then the channel is called quantum to classical channel. If input and output to the channel are classical and quantum systems, respectively, then the channel is called classical to a quantum channel.

Appendix C: Privacy test
Recall the definition the twisting operation and a privacy test as where we have defined the notation i M := i...i Here α i1...im ∈ C such that K−1 i1,...,im=0 | α i1...im | 2 = 1 and α j1...jn ∈ C such that K−1 j1,...,jn=0 |α j1...jn | 2 = 1. Further it holds where we have defined the state We note that eq. (C8) is a probability, in particular it is real and non-negative. Hence it holds where in the first inequality we have used the subadditivity and multiplicity of the absolute value of complex numbers. We note that for all i, k in the sum | ζ k |ζ i | ≤ 1. Let us define p i = | α i m | 2 and note that p i ≥ 0 and K−1 i=0 p i ≤ 1. Let us also define q i = |α i n | 2 and note that q i ≥ 0 and K−1 i=0 q i ≤ 1. Hence there exist respective probability distributions {p i } and {q i } over {0, ..., K − 1} such that p i ≤p i and q i ≤q i for all i = 0, ..., K − 1. We then obtain where we have used that the classical fidelity between two probability distributions is upper bounded by 1. This establishes the theorem for pure biseparable states with respect to arbitrary bipartitions. Noting that every mixed biseparable state σ # » KS ∈ BS(: # » KS :) can be expressed as a convex sum of pure biseparable states finishes the proof. Proof. Let us consider any cppp-assisted protocol that achieves a rateP N cppp ≡P . Let ρ (1) ∈ FS(: ) be a fully separable state generated by the first use of LOCC among all spatially separated allies. Let We note that τ (1) is a separable state with respect to bipartition # » LA #» R #» C : #» P . The action of the decoder channel D := L By assumption we have that for some (M -partite) private state γ. This implies that there exists a projector Π γ # » SK corresponding to a γ-privacy test such that (see Proposition 1) From Theorem 1, for any σ ∈ BS(: # » SK :). Let us suppose a state σ # » arbitrary. It holds that σ # » SK := L (2) (σ # » LA #» R # » P C ) ∈ BS(: # » SK :). Thus, the privacy test is feasible for D ε h (ω σ) and we find that The second inequality follows from data processing inequality. The third inequality follows from the quasiconvexity of D ε h . The equality follows from Eq. (A2) and suitable choice of σ #» P that always exists because for any pure state ψ ∈ FS( # » LA : Since inequality (D9) also holds for an arbitrary σ ∈ BS(:

Proof of Theorem 3
Proof. The following inequality holds for an (n, K, ε) LOCC-assisted secret key agreement protocol over a multiplex channel N : For any σ # » SK ∈ FS(: # » SK :), we have following bound due to inequality (D11) and Theorem 1: Employing inequality (A8) in the limit α → +∞, we obtain Above inequality holds for arbitrary σ ∈ FS(: # » SK :), therefore where E max,E (: # » SK :) ω is the max-relative entropy of entanglement of the state ω # » SK . The max-relative entropy of entanglement E max,E of a state is monotonically non-increasing under the action of LOCC channels and it is zero for states that are fully separable. Using these facts, we get that The first equality follows because E max,E (: The second inequality follows because E max,GE is monotone under LOCC channels and ρ i = L i (τ i−1 ) for all i ∈ {2, 3, . . . , n}. The final inequality follows from Lemma 1.

Proof of Theorem 4
Proof. For an (n, K, ε) LOCC-assisted secret key agreement protocol over a multiplex channel N , such that F (ω # » SK , γ # » SK ) ≥ 1 − ε, due to inequality (D11) and Theorem 1 it holds for any σ # » SK ∈ FS(: # » SK :): Using the fact that [94] where h is the binary entropy function, and that the bound (D22) holds for arbitrary σ ∈ FS(: # » SK :), we obtain As the relative entropy of entanglement of a state is monotonically non-increasing under the action of LOCC channels and vanishes for states that are fully separable we can repeat the argument in inequalities (D16)-(D20) and obtain where the second inequality follows from Lemma 2, Taking the limits ε → 0 and n → ∞, we obtain showing the converse. As for the strong converse, we follow the argument used in Ref. [49]: From inequalities (D22) and (A8) we obtain where α ∈ (1, ∞) and E α,E (: # » SK :) ω is the sandwiched Rényi relative entropy of entanglement of the state ω # » SK . Rewriting inequality (D27) we obtain Assuming that the rate log 2 K n exceeds E ∞ E (N ), by inequality (D25) it will be larger than 1 n E E (: # » SK :) ω . Hence, there exists an α > 1, such that log 2 K n − 1 n E α,E (: # » SK :) ω > 0 and the error increases to 1 exponentially.

Proof of Theorem 5
C be a multipartite quantum channel that is tele-covariant with respect to groups {G a } a∈A and {G b } b∈B as defined in Section V C. By definition, for all a ∈ A and b ∈ B, we have respectively, where A a L a , B b R b and Φ + denotes an EPR state. Note that in order for each {U ga A a } and } to be one-designs, it is necessary that |A a | 2 ≤ G a and |B b | 2 ≤ G b [153]. For every a ∈ A and every b ∈ B, we can now de- where A a A a and B b B b . It follows from the fact that |A a | 2 ≤ G a and |B b | 2 ≤ G b as well as (D29) and The simulation of the channel N # » The desired outcome is for the receivers to receive the state N (ρ # » A # » B ) and for the protocol to work independently of the input state ρ # » The first step is for senders A a and B b to locally perform the measurement and then send the outcomes #» g to the receivers. Based on the outcomes #» g , the receivers A a and C c then perform W #» g Aa and W #» g Cc , respectively. The following analysis demonstrates that this protocol works, by simplifying the form of the postmeasurement state: The first three equalities follow by substitution and some rewriting. The fourth equality follows from the fact that for any operator M and where * denotes the complex conjugate, taken with respect to the basis in which |Φ A A is defined. Continuing, we have that , so that this protocol simulates the action of the multipartite channel N on the state ρ.

Proof of Theorem 6
Before proving Theorem 6, we need the following lemma, which generalizes Lemma 7 in [62]: # » SK :)} be the set of twisted biseparable states. Then for any By the concavity of the logarithm it then holds finishing the proof.
Now we can follow [48] to prove Theorem 6: Proof of Theorem 6. Let > 0 and n ∈ N. We begin by noting that in the case of teleportation-simulable multiplex channels LOCC-assistance does not enhance secretkey-agreement capacity, and the original protocol can be reduced to a cppp-assisted secret key agreement protocol [48]. Namely, in every round 1 ≤ i ≤ n it holds where L i and T are LOCC. As the initial state ρ 0 is assumed to be fully separable, we can get that the final state ω # » SK = ρ n of an adaptive LOCC CKA-protocol involving n uses of teleportation-simulable multiplex chan- C , can be expressed as where L is an LOCC operation with respect to the partition : # » L n A n : # » R n : # » C n :. By assumption it holds # » R n : # » C n :). Following the proof of Theorem 9 in [62], we obtain where in the last two inequalities we have used the asymptotic continuity of the relative entropy and Lemma 4, respectively. Letting n → ∞ and → 0 finishes the proof.

Proof of Theorem 7
As in the proof of Theorem 6 we have where L is an LOCC operation with respect to the partition : # » L n A n : # » R n : # » C n :. Now following the proof of Theorem 2, we have that for some private state γ, hence there exists a projector Π γ # » SK corresponding to a γ-privacy test such that (see Proposition 1) On the other hand, from Theorem 1, we have for any σ ∈ FS(: # » SK :). Let us suppose a state ) and let us define ). Hence for all α > 1 it holds, The first inequality holds for any σ ∈ FS( # » SK). The second inequality follows from data processing inequality. The third inequality follows from eq. (A8). The equality is due to the additivity of D α [64]. As the above holds for any σ # » , we obtain Theorem 7.
Appendix E: Repeater as multipartite channel In order to provide bounds for more repeater protocols that involve two-way communication between Alice and Charlie or between Bob and Charlie before Charlie's measurement, we will have to slightly generalize our results in section V. Namely, in addition to trusted parties we can add a number of cooperative but untrusted parties Let us denote the quantum systems hold by respective untrusted parties as A ã , Lã, Aã, Bb, Rb, Cc, Pc and redefine while keeping the old definitions for #» K and #» S . We then assume we have a multiplex channel N # » C and LOCC operations L i , for i = 1, .., n, among trusted and untrusted parties. However, we assume that as part of the last round of LOCC, L n+1 all subsystems belonging to untrusted parties are traced out, resulting in a state ω # » SK among the trusted parties only. It is now easy to show that the proofs of Theorems 3 and 4 also go through in this slightly generalized scenario. Namely, tracing out parties in a fully separable state results in a fully separable state on the remaining parties, and by the monotonicity of the generalized divergences, inequalities (D16) and (D25) also hold if we trace out the untrusted parties in order to obtain ω. Note that the same does not hold true in the case of Theorem 2, where we are dealing with the distance to the set of biseparable states, which is not preserved under traceout.
Returning to the quantum key repeater, we can now identify Alice and Bob as two trusted parties and Charlie as an untrusted party and define a multiplex channel as the tensor product of the two channels from Alice to Charlie and Bob to Charlie, namely: N repeater We include the local state preparation by Alice and Bob, the LOCC performed by Alice, Charlie, and Bob during key distillation protocols, as well as Bob's entanglement-swapping measurement and subsequent classical communication into the LOCC operations that interleave the uses of N repeater AB→C . Crucially, the final LOCC operation has to include the trace-out of Charlie's system, as he is an untrusted party. Application of the generalized versions of Theorem 3 or Theorem 4 then provides us with an upper bound on the achievable key rate in terms of min{E max,E (N repeater AB→C ), E ∞ E (N repeater AB→C )}. As has been shown in Ref. [74], there are examples of channels acting on finite-dimensional systems where the regularized relative entropy of entanglement is strictly less than maxrelative entropy of entanglement, in which case Theorem 4 provides tighter bounds than the ones provided in Ref. [50]. For tele-covariant channels, we can invoke Remark 5 and Theorem 5 to obtain bounds in terms of the relative entropy of entanglement.
Let us now consider repeater chains with more than a single repeater station. We assume a protocol where each channel has to be used the same number of times to get the desired fidelity. We consider Alice and Bob as trusted parties and the repeater stations C 1 , ..., C l as cooperative but untrusted parties. Defining a multiplex channel N repeater chain AC 1 ,...,C l →C1,...,C l B := N 1 C l →B and including entanglement purification and swapping operations of all nesting levels into the LOCC operations, we then apply Theorem 3 or Theorem 4 to bound the achievable key rate between Alice and Bob by min{E max,E (N repeater chain ), E ∞ E (N repeater chain )}. If involved channels are tele-covariant then we obtain bounds in terms of the relative entropy of entanglement.

Appendix F: Limitations on some MDI-QKD prototypes
Following discussion in Section VI D, let us now consider MDI-QKD settings with noise model for transmission of qubit systems from both A a1 and A a2 to Charlie through qubit channels given by either depolarizing channel D l Ai→Ci or dephasing channel D s Ai→Ci : where Z is a Pauli-Z operator, and ρ is an arbitrary input state. Same as for MDI-QKD setup with erasure channels discussed earlier, we assume that Charlie can perform perfect Bell measurement M #» C →X with probability q and failure probability to be 1 − q. We notice that the multiplex channels N MDI,D l for these MDI-QKD prototypes are also tele-covariant. This implies, the MDI-QKD capacities for respective MDI-QKD settings, i.e., with depolarizing channels and dephasing channels, to be upper bounded as (see following subsections for proofs and plots for some values of q): followed by communication of the outcomes (with probability (1 − λ l ) 2 ). As one can check by inspection, all the three operations result in the state 1 4 on system AB. The relative entropy of the ρ out AB reads: where ρ out AB|11 = 1 AB 4 ⊗ |⊥ ⊥| I A I B ⊗ |11 11| I A I B and ρ out AB|00 is such that (1 − q)ρ AB|11 + qρ AB|00 = ρ AB . We have used there convexity of the relative entropy and the fact that it is zero for maximally mixed state. We then observe that where |ψ i ψ i | are the Bell states. We then use the fact that for each i the state λ 2 l |ψ i ψ i | AB + (1 − λ 2 l ) 1 4 is a Bell diagonal state. A Bell diagonal state of the form j p j |ψ j ψ j | has E R equal to 1 − h(p max ) where p max = max j p j is maximal of the weights of the Bell state |ψ j ψ j | in the mixture, or 0 if p max ≤ 1 2 . In our case p max = λ 2 l + (1 − λ 2 l )/4. Thus, via convexity and Eq. (F8) we obtain that for λ 2 l +(1−λ 2 l )/4 > 1/2, and 0 otherwise. The condition λ 2 l +(1−λ 2 l )/4 > 1/2 on λ l is equivalent to λ l > 1 √ 3 . This implies that for q = 1 the bound is zero for λ l ∈ ( 1 3 , 1 √ 3 ], for which depolarizing channel is non-zero, and hence its private capacity is non-zero as well. We interpret this as noncommutativity of the independent and identically distributed (i.i.d.) Bell measurement and entanglement distillation. Indeed, for this range of λ l given access to an isotropic state ρ(λ l ) one can distil E D (ρ(λ l )) = (1 − h 2 (λ l )) of entanglement, and hence the quantum capacity Q(D l ) = 1 − h 2 (λ l ) (or zero for λ l ≤ 1/3). On the other hand, this amount of key becomes inaccessible when the Bell measurement is done first.

MDI-QKD via dephasing channels
In this section we consider two dephasing channels (F1) between Alice and Charlie and Bob and Charlie. We will again observe that the operation of distillation and iid entanglement swapping via Bell measurement do not commute. Altering them leads to different amount of key in the output. We will use the fact that MDI-QKD via dephasing channel is teleportation-covariant.
Note that the Choi-Jamiolkowski state (up to local unitary operation as the input state is Ψ − ) of the dephasing channel equals λ s Ψ − + (1 − λ s )Ψ + = (2λ s − 1)Ψ − + (2 − 2λ s )ρ cl with ρ cl = 1 2 (|01 01| + |10 10|). Hence, the Choi-Jamiolkowski state of the dephasing-MDIQKD channel reads: given that Alice has performed the control-Pauli operations on her systems AI A . We can safely assume that this decoding has been done, because local unitary operation does not change the relative entropy of entanglement. The first case is a straightforward result of correct entanglement swapping. Regarding the next term, with probability (2−2λ s )(2λ s −1) a subsystem C A of the state ρ cl gets correctly teleported to A, and hence finally ρ AB cl is shared by Alice and Bob. However with probability (2 − 2λ s ) = (2 − 2λ s ) 2 + (2 − 2λ s )(2λ s − 1), resulting state is maximally mixed. This is because with probability (2−2λ s ) 2 the state on system C is traced out, hence a product of subsystems of ρ AB cl is an output. On the other hand, with probability (2 − 2λ s )(2λ s − 1), subsystem C B of the state ρ cl is teleported to Bob, however Bob does not do the decoding. It is strightforward then to check that 1 4 1 i=0 σ B i ⊗ 1 A ρ AB cl σ B i ⊗ 1 A with σ i being Pauli operators, is the maximally mixed state of two qubits.
The relative entropy of the ρ out AB reads: where ρ out AB|11 = 1 AB 4 ⊗ |⊥ ⊥| I A I B ⊗ |11 11| I A I B and ρ out AB|00 is such that (1 − q)ρ AB|11 + qρ AB|00 = ρ AB . We have used again the convexity of the relative entropy and the fact that it is zero for maximally mixed state. We then observe that where we have neglected systems I A I B and I A I B due to subadditivity of E R and the fact that it is zero for both the state 3 i=0 |ii ii| I A I B and |00 00| I A I B . Resulting state is Bell diagonal (note that ρ AB cl = 1 2 (|Ψ − Ψ − |+ |Ψ + Ψ + |)), it is thus sufficient to find the largest weight of a Bell state to compute its relative entropy. Bell diagonal states are separable if the largest weight is less than or equal to half, i.e., when none of the Bell states (Φ + , Φ − , Ψ + , Ψ − ) has weight greater than 1/2.
Appendix G: On the complexity of finding lower bound of SKA rate for Bidirectional Network Here, we briefly comment on the complexity of finding a sub-graph, which allows us to realize the Conference Key Agreement with the capacity indicated by the inequality (75). As we show, the complexity is a polynomial of low degree O(n 2 ). In what follows a minimum spanning tree is a tree with a minimal sum of the weights of its edges. A minimum bottleneck spanning tree is the one in which the edge with the highest weight has the lowest possible value for the considered graph.
The algorithm of finding maximal of the minimal edges over all spanning trees of the graph is as follows.
(1) Find maximal weight of the edges of G (denoted as M ) (2) Find minimum spanning tree T M ST in the graph G = (V G , E G ), which is same as G, but with weights of edges changed from w(e) to M − w(e), where M ≡ max e ∈E G w(e ).
(3) Find minimal weight of the edges in T , denoted w min . Return M − w min .
The correctness of this algorithm follows from the fact that every minimal spanning tree is a minimal bottleneck spanning tree. Finding the highest weight of edges of this tree that is as low as possible is the opposite task to ours. Indeed, we aim at finding trees with the lowest weight over its edges to be as high as possible. This is why we search for minimal spanning tree in the graph with converted edges to M ≡ max e ∈E G w(e ) − w(e). Next, we use the fact that min T ⊆G max e∈E T [M −w(e)] = M − max T ⊆G min e∈E T w(e), so the M − w min is the solution. The overall time complexity of this algorithm is O(m + n log n). Indeed, the first step takes O(m) time. The next two take O(m + n log n), where the finding of minimum spanning tree is via the Prim's algorithm based on the data structure called Fibonacci heap [117]. The final step takes O(n log n), which is the time of sorting the weights of edges (e.g. by QuickSort algorithm). Taking into account that m scales pessimistically as n 2 , we obtain O(n 2 ) worst-case complexity.
To summarize, the value of the lower bound can be found efficiently on a classical computer, given all the capacities describing the Bidirectional Network are known and represented in the form of a graph. FIG. 9. Plot of ε-hypothesis testing upper bound on conference key rate for single copy of Φ GHZ To calculate our upper bounds, we utilize the technique of semidefinite programming (SDP) with MatLab (version) library "SDPT3 4.0" [154]. We calculate upper bounds for several cases incorporating both Φ GHZ M states and Φ W M states. Firstly we vary the number of copies of the state that entered the protocol; secondly, we make calculations for multipartite states with the number of parties exceeding three. Finally, we extend our consideration to states subjected to dephasing or depolarizing noises characterized in Eq. (H1) (each qubit is subjected to noise separately). We investigate the effect of noise in the case of a different number of copies and different number of parties.
for D given by where σ z is the Pauli Z matrix, and q is the noise parameter.
We present the plots for the upper bound on the key rate distilled from both Φ GHZ M , Φ W M states and tensor powers of them. The plots are a function of ε parameter controlling the fidelity of the target state ρ A with respect to a private state. We compare performance of our upper bound and choice of biseparable states for tripartite single copy state in the plots in Figs. 9 and 10. In the control plot in Fig. 9 for the noiseless Φ GHZ M state the upper bound as expected, exhibits the value to be just above 1 for the chosen range of ε. This indicates that the ε-hypothesis testing upper  Fig. 10 for ε ≈ 0 is below 0.6, what is below the value of the rate of the optimal LOCC asymptotic protocol being approximately 0.643 per copy [80]. In the case of two copies of bipartite Φ W M in Fig. 11 state we obtain an upper bound that for ε ≈ 0 has the value around 1.18 what is significantly above 2 3 achieved by the protocol described earlier in this section and 1.286 what is an asymptotic limit for state being two copies of Φ W M state [80,Theorem 2]. Both these results stand with an agreement with the fact that single copy and two copies one-shot protocols constitute very limited class of protocols compared to those available for calculating the asymptotic limit. For two copies of Φ W M state, the large gap between our upper bound for the conference key rate and rate of Φ GHZ M states distillation protocol makes us think that indeed the former is larger than the latter. However, formal proof is still missing. Moreover, we notice that optimal protocol Φ W M to Φ GHZ M conversion have to incorporate at least three copies of Φ W M state. This is because our ε-hypothesis testing upper bound is smaller than the asymptotic limit for Φ GHZ M distillation.