# Relaxed bound on performance of quantum key repeaters and secure content of
generic private and independent bits

Karol Horodecki  Institute of Informatics, National Quantum Information
Centre, Faculty of Mathematics, Physics and Informatics, University of Gdańsk,
Wita Stwosza 57, 80-308 Gdańsk, Poland  International Centre for Theory of
Quantum Technologies (ICTQT), University of Gdańsk, 80-308 Gdańsk, Poland
School of Electrical and Computer Engineering, Cornell University, Ithaca, New
York 14850, USA  Łukasz Pawela  Institute of Theoretical and Applied
Informatics, Polish Academy of Sciences, Bałtycka 5, 44-100 Gliwice, Poland

###### Abstract

Quantum key repeater is the backbone of the future Quantum Internet. It is an
open problem for an arbitrary mixed bipartite state shared between stations of
a quantum key repeater, how much of the key can be generated between its two
end-nodes. We place a novel bound on quantum key repeater rate, which uses
relative entropy distance from, in general, entangled quantum states. It
allows us to generalize bound on key repeaters of M. Christandl and R. Ferrara
[Phys. Rev. Lett. 119, 220506]. The bound, albeit not tighter, holds for a
more general class of states. In turn, we show that the repeated key of the so
called key-correlated states can exceed twice the one-way distillable
entanglement at most by twice the max-relative entropy of entanglement of its
attacked version. We also provide a non-trivial upper bound on the amount of
private randomness of a generic independent bit.

##  I Introduction

The Quantum Internet (QI) for secure quantum communication is one of the most
welcome applications of quantum information theory. In the future, Quantum
Internet qubits rather than bits will be sent. However, both quantum and
classical communication suffer from notorious noise in the communication
channel. This is because the channel is often realized by an optical fiber
with a high attenuation parameter. To overcome this, in the ”classical”
Internet we got used to, the signal on the way between sender and receiver is
amplified several times in the intermediate stations by copying it. This
solution does not work in the case of the Quantum Internet, which transmits
qubits as the signal they carry can not be amplified on the way due to the
quantum no-cloning theorem Wootters and Zurek (1982); Dieks (1982). The
seminal idea of quantum repeaters Briegel  _et al._ (1998) resolves the no-
cloning obstacle.

A quantum repeater is a physical realization of a protocol that allows two far
apart stations to share the secure key that can be used for the one-time pad
encryption. There has been tremendous effort put into building such a
facility, which is now considered the backbone of the future QI Wehner  _et
al._ (2018). The most basic quantum repeater, according to the original idea
of Briegel  _et al._ (1998) consist of an intermediate station $C=C_{1}C_{2}$
between two distant stations $A$ and $B$. The stations $A$ and $C_{1}$ obtain
an entangled, partially secure quantum state from some source, and so do the
$B$ and $C_{2}$. The intermediate states’ role is to swap the security content
so that $A$ and $B$ share a maximally entangled state. In theory, due to the
seminal idea of Briegel  _et al._ (1998) (for other architectures, see
Muralidharan  _et al._ (2016) and references therein), this can be achieved by
altering two phases: (i) that of entanglement distillation, that is making the
entangled states less noisy i.e. as close as possible to the singlet state

$|\psi_{+}\rangle={1\over\sqrt{2}}(|00\rangle+|11\rangle).$ (1)

In the simplest setup mentioned above, this step enhances entanglement between
$A$ and $C_{1}$ station and $C_{2}$ and $B$ respectively. The second phase
(ii) is entanglement swapping i.e. Żukowski  _et al._ (1993) teleporting one
subsystem $C_{1}$ of the state distilled in point (i) on $AC_{1}$ using the
other singlet $C_{2}B$ to obtain a singlet between $A$ and $B$. Increasing the
number of stations results, theoretically in arbitrarily distant quantum
connections realized by means of singlet state.

One of the main reasons for building the Quantum Internet is the need for
secure communication. Distributing pure entangled states is only one of the
ways to achieve such a communication. In general, the underlying shared output
state of such a secure key distribution protocol is described by the so-called
private state - a state containing privacy in ideal form Horodecki  _et al._
(2005, 2009a). A private state containing (at least) one bit of ideal key is a
bipartite state on systems $ABA^{\prime}B^{\prime}$ that takes the following
form when purified to the system of eavesdropper $E$:

$\displaystyle{1\over{\sqrt{2}}}$ $\displaystyle\left(|00\rangle_{AB}\otimes
U_{0}^{A^{\prime}B^{\prime}}\otimes\mathrm{I}_{E}|\phi\rangle_{A^{\prime}B^{\prime}E}+\right.$
$\displaystyle\left.|11\rangle_{AB}\otimes
U_{1}^{A^{\prime}B^{\prime}}\otimes\mathrm{I}_{E}|\phi\rangle_{A^{\prime}B^{\prime}E}\right),$
(2)

where $U_{i}$ for $i\in\\{0,1\\}$ are unitary transformations that act on a
system $A^{\prime}B^{\prime}$ only and $|\phi\rangle_{A^{\prime}B^{\prime}E}$
is arbitrary state of $A^{\prime}B^{\prime}E$. One can see the correspondence
of the unitary rotations $U_{i}$ to the complex phases in a usual maximally
entangled state of the form
$|\psi_{max}\rangle={1\over\sqrt{2}}(e^{\theta_{0}i}|00\rangle+e^{\theta_{1}i}|11\rangle)$.
The secure key is obtained by measuring systems $A$ and $B$ of the private
state in the computational basis. This is why the system $AB$ is called the
key part. The system $A^{\prime}B^{\prime}$ plays a passive role of shielding
system $AB$ from the system $E$ of Eve, and it is therefore called a ’shield’.

For this reason, the idea of quantum repeaters has been generalized in Bäuml
_et al._ (2015) to the notion of quantum key repeater. The quantum key
repeater involves the same setup of stations $AC_{1}C_{2}B$. However, the task
of the protocol is to output some private state between stations $A$ and $B$
(that need not be maximally entangled in general). The target is to distribute
the secure key not in the form of pure entangled states (the singlet) but in
the form of general mixed quantum states that nonetheless contain ideal
security.

There have been established bounds on the performance of protocols
distributing the key secure against quantum adversaries via the quantum key
repeaters. The first obtained works for the so-called states with positive
partial transposition Bäuml  _et al._ (2015). Later it has been partially
generalized to the case of the states which resemble private states in their
structure Christandl and Ferrara (2017). Specifically, in Christandl and
Ferrara (2017) there has been shown a significant bound on a variant of the
key repeater rate $R$ for the case of two special so-called key correlated
states $\rho_{AC_{1}}=\rho_{C_{2}B}\equiv\rho$. To recall this bound below we
recall also the notion of key-attacked states of the key correlated states.
Namely, the key correlated states, like private states, have two distinguished
subsystems $\rho_{AC_{1}}\equiv\rho_{AA^{\prime}C_{1}C_{1}^{\prime}}$ where
with an abuse of notation we identify system $A$ with key part system $A$ and
shielding system $A^{\prime}$ (similarly for $C_{1}$). Now, when the key part
systems $AC_{1}$ got measured in computational basis
$\\{|ij\rangle_{AC_{1}}\\}$, the state becomes the key-attacked state of the
key correlated state, and is denoted as
$\hat{\rho}_{AA^{\prime}C_{1}C_{1}^{\prime}}$ (see Definition 1), and
analogously for $\hat{\rho}_{C_{2}C_{2}^{\prime}BB^{\prime}})$. With this
notions, the bound of Christandl and Ferrara (2017) applies to those key
correlated states, the key attacked-state of which are separable i.e. totally
insecure:

$R^{C_{1}C_{2}\rightarrow A:B}(\rho_{AC_{1}},\rho_{CB_{2}})\leq
2E_{D}^{C\rightarrow A}(\rho).$ (3)

Here $E_{D}^{\rightarrow}$ is the one-way distillable entanglement Bennett
_et al._ (1996), that is the amount of entanglement in the form of maximally
entangled states that can be distilled from $\rho_{CA}$ via local quantum
operations and one-way (from Charlie to Alice) classical communication
operations. The $C_{1}C_{2}\rightarrow A:B$ denotes the fact that classical
communication in the repeater’s protocol takes direction from $C_{1}C_{2}$ to
$AB$ and later arbitrarily between $A$ and $B$ stations.

In what follows, we would like to drop the assumption that the states
$\rho_{AC_{1}}$ and $\rho_{C_{2}B}$ get separable after an attack on their key
parts by measurement in computational basis. That is, more precisely, that
their key-attacked states are separable. The reason is that checking
separability for a given quantum state is a computationally hard problem
(precisely NP-hard). In that sense, we broaden the class of states for which
an extension of the bound of Christandl and Müller-Hermes (2017) holds. We do
so by relaxing it a bit so that the obtained bound is not tighter than the
previous one but naturally less stringent.

In the second part of this manuscript, we consider the scenario of private
randomness distillation from a bipartite state by two honest parties Yang  _et
al._ (2019). In the latter scenario, the parties share n copies of a bipartite
state $\rho_{AB}$ and distil private randomness in the form of the so-called
independent states. These are states from which, after local measurements, one
can obtain ideal uniform bits for two parties that are private i.e.
decorrelated from the system of an eavesdropper. The operations that the
parties can perform in this resource theory are (i) local unitary operations
and (ii) sending system via dephasing channel. In Yang  _et al._ (2019) there
were also considered cases when communication is not allowed, and maximally
mixed states are accessible locally for the parties (or are disallowed). In
all these four cases, the achievable rate regions were provided there, tight
in most cases.

Here, we study the amount of private randomness in generic local independent
states. The latter states are bipartite states
$\alpha_{AA^{\prime}B^{\prime}}$ possessing one bit of ideal randomness
accessible via the measurement in computational basis on system $A$. The other
party, holding system $B^{\prime}$ is honest in this scenario. We consider a
random local independent state and prove that, given large enough systems
$d_{s}$ of $A^{\prime}$ and $B^{\prime}$, in the above-mentioned scenarios,
the localisable private randomness $R_{A}$ at the system of Alice is bounded
as follows:

$R_{A}(\alpha_{AA^{\prime}B^{\prime}})\leq 1+\frac{1}{2\ln
2}+O(\frac{\log_{2}d_{s}}{d_{s}^{2}})$ (4)

and this rate is achievable for asymptotically growing dimension of the
shielding system at $A^{\prime}$, $d_{s}$, in all the four scenarios.

The remainder of the manuscript is organized as follows. Section III is
devoted to technical facts and definitions used throughout the rest of the
manuscript. Section IV provides the bounds on key repeater rate in terms of
distillable entanglement and the Renyi relative entropy of entanglement.
Section V presents a simple bound on the distillable key of a random private
state. In Section VI we also provide bounds on private randomness for a
generic independent state. We finalize the manuscript by short discussion
Section VII. The Appendix contains the bound on the distillable key, which is
formulated using an arbitrary state as a proxy in the relative entropy
formulas. It also contains a short description of the main facts staying
behind the randomization technique used in Section V.

##  II Main results

In this manuscript, we develop a relaxed bound on quantum key repeater rate,
which holds for the key-correlated states without the assumption that the
$\hat{\rho}$ is separable. This relaxation is essential, as checking
separability is, in general, an NP-hard problem Gurvits (2003). We provide a
bound on the key repeater rate based on relative entropy distance from
arbitrary  states rather than separable ones. The freedom in choosing a state
in the relative entropy distance is, however compensated by another relative-
entropy-based term (the sandwich R$\acute{e}$nyi relative entropy of
entanglement $\tilde{E}_{\alpha}$ Wilde  _et al._ (2014); Müller-Lennert  _et
al._ (2013)) and a pre-factor $\alpha$ from the interval $(1,+\infty)$. It
reads the following bound:

$\displaystyle R^{C_{1}C_{2}\rightarrow
A:B}(\rho_{AC_{1}},\rho_{C_{2}B})\leq\inf_{\alpha\in(1,\infty)}$
$\displaystyle\left[{\alpha\over\alpha-1}E_{D}^{C_{1}C_{2}\rightarrow
A}(\rho_{AC_{1}}\otimes\rho_{C_{2}B})+{\tilde{E}}_{\alpha}(\hat{\rho}_{AC_{1}}\otimes\hat{\rho}_{C_{2}B})\right],$
(5)

where $\hat{\rho}_{AC_{1}}$ and $\hat{\rho}_{C_{2}B}$ are the key-attacked
states of the key correlated states $\rho_{AC_{1}}$ and $\rho_{C_{2}B}$
respectively (see Definition 1). Although the above bound is not tighter than
the known one, it holds for a more general class of states: we do not demand
the key-attacked states $\hat{\rho}$ to be separable. We note here that for
the case when $\hat{\rho}$ is separable, we recover the bound (3) by taking
the limit of $\alpha\rightarrow\infty$. In this case, $\tilde{E}_{\alpha}$
tends to the max-relative entropy Datta (2009a), which is zero for separable
states, while the factor $\frac{\alpha}{\alpha-1}$ goes to $1$. In proving the
above bound, we base on the strong converse bound on private key recently
shown in Wilde  _et al._ (2017); Das  _et al._ (2020) (see also Christandl and
Müller-Hermes (2017); Das  _et al._ (2021) in this context). In particular,
the bound given above implies, for an arbitrary key correlated state

$R^{C_{1}C_{2}\rightarrow A:B}(\rho,\rho)\leq 2E_{D}^{C_{1}\rightarrow
A}(\rho)+2E_{max}(\hat{\rho}),$ (6)

where the $E_{max}$ is the max-relative entropy of entanglement Datta (2009a,
b).

We further show an upper bound on the distillable key of a random private bits
Horodecki  _et al._ (2005, 2009a). These states contain ideal keys for one-
time pad encryption secure against a quantum adversary who can hold their
purifying system. The importance of this class of states stems from the fact
that, as shown recently, they can be used in the so-called hybrid quantum key
repeaters to improve the security of the Quantum Internet Sakarya  _et al._
(2020). The first study on generic private states was done in Christandl  _et
al._ (2020). We take a different randomization procedure than the one utilized
there. We base it on the fact that every private bit can be represented by, in
general, not normal, operator $X$ Horodecki  _et al._ (2009a). The latter, in
turn, can be represented as $X=U\sigma$ for some unitary transformation and a
state $\sigma$. We utilize techniques known from standard random matrix theory
(see Appendix) to draw a random $X$ and upper bound the mutual information of
the latter state, half of which upper bounds the distillable key Christandl
and Winter (2004). Based on this technique via the bound of Eq. (6) we show,
that a randomly chosen private bit $\gamma_{rand}$, satisfies:

$\displaystyle R^{C_{1}C_{2}\rightarrow A:B}(\gamma_{rand},\gamma_{rand})\leq
2E_{D}^{\rightarrow}(\gamma_{rand})+2.$ (7)

Let us recall here that a private bit has two distinguished systems. That of
the key part, from which the von-Neumann measurement can directly obtain the
key in the computational basis, and the system of shield, the role of which is
to protect the key part from the environment. In this language, the state
$U_{0}\sigma U_{0}^{\dagger}$ and $U_{1}\sigma U_{1}^{\dagger}$ are the ones
appearing on its shield part, given the key of value $0$ (or respectively $1$)
is observed on its key part, and are called the conditional states. Any
private bit $\gamma_{2}$ has distillable key at least equal to
$1+\frac{1}{2}K_{D}(U_{0}\sigma U_{0}^{\dagger}\otimes U_{1}\sigma
U_{1}^{\dagger})$as it is shown in Horodecki  _et al._ (2018). From what we
prove here, it turns out that the amount of key that can be drawn from the
conditional states is bounded by a constant irrespective of the dimension of
the shield part. More precisely, we improve on the bound from Eq. (7) by
showing that a random private bit $\gamma_{rand}$ satisfies

$K_{D}(\gamma_{rand})\leq 1+\frac{1}{4\ln 2}\approx 1.360674.$ (8)

##  III Technical preliminaries

We recall in this section certain facts and definitions and fix notation. A
private state is a state of the form

$\displaystyle\gamma_{ABA^{\prime}B^{\prime}}=\frac{1}{d_{k}}\sum_{ij=0}^{d_{k}-1}|ii\rangle\langle
jj|\otimes U_{i}\rho_{A^{\prime}B^{\prime}}U_{j}^{\dagger}\equiv$
$\displaystyle\tau|\psi_{+}\rangle\langle\psi_{+}|\otimes\rho_{A^{\prime}B^{\prime}}\tau^{\dagger}$
(9)

where $U_{i}$ are unitary transformations, and $\rho_{A^{\prime}B^{\prime}}$
is an arbitrary state on system $A^{\prime}B^{\prime}$ of dimension
$d_{s}\otimes d_{s}$. A controlled unitary transformation
$\tau:=\sum_{i}|ii\rangle\langle ii|\otimes U_{i}$ where $U_{i}$ are unitary
transformations, is called a twisting and
$|\psi_{+}\rangle\langle\psi_{+}|=\sum_{i,j=0}^{d_{k}-1}\frac{1}{d_{k}}|ii\rangle\langle
jj|$. In the case of $d_{k}=2$, it can be obtained from Eq. (2) by tracing out
system $E$. System $AB$ is called the key part, and system
$A^{\prime}B^{\prime}$ is called the shield. We denote by $\gamma^{k}$ a
private state with $2^{k}\otimes 2^{k}$ key part, i.e. containing at least $k$
key bits. In the case of $k=1$, the private state is called a private bit, or
pbit, while for $k>1$, it is called a pdit (with $d_{k}=2^{k}$). A state
$\rho$ is an $\epsilon$-approximate private state $\gamma_{d_{k}}$ if there
exists $\epsilon>0$ such that $||\rho-\gamma_{d_{k}}||_{tr}\leq\epsilon$.

The notion of private states allowed the problem of distillation of secret key
described by the so-called Local Operations and Public Communication Devetak
and Winter (2005) in a tripartite scenario with Alice Bob and an eavesdropper
Eve, to be described as a problem of distillation of private states by Local
Operations and Classical Communication (i.e. a composition of local quantum
operations and classical communication in both directions) in the worst case
scenario where Eve holds a purification of the state shared by Alice and Bob.
We recall the obtained definition of the distillable key below. Horodecki  _et
al._ (2009a, 2005)

$\displaystyle
K_{D}(\rho):=\inf_{\epsilon>0}\limsup_{n\rightarrow\infty}\sup_{{\cal P}\in
LOCC}\\{\frac{k}{n}:{\cal P}(\rho^{\otimes
n})\approx_{\epsilon}\gamma^{k}\\},$ (10)

where $\rho\approx_{\epsilon}\sigma$ denotes
$||\rho-\sigma||_{tr}\leq\epsilon$, i.e. closeness is the trace-norm distance
by $\epsilon$, with $||X||:=Tr\sqrt{XX^{\dagger}}$ and ${\cal P}$ is a
completely positive trace-preserving map from the set of LOCC operations.

Technical, but important role in our considerations plays the so-called key
attacked private state denoted as $\hat{\gamma}$. This is a private state that
got measured on its key part and takes form

$\hat{\gamma}:=\frac{1}{d_{k}}\sum_{ij=0}^{d_{k}-1}|ii\rangle\langle
ii|\otimes U_{i}\rho_{A^{\prime}B^{\prime}}U_{i}^{\dagger}.$ (11)

We note here, that $\hat{\gamma}$ is separable iff $U_{i}\rho U_{i}^{\dagger}$
are separable for $i\in\\{0,\ldots,d_{k}-1\\}$. We aim at generalizing results
of Christandl and Ferrara (2017) to the case when we do not know if a certain
key attacked state is separable.

Below we recall the main definitions and results from Christandl and Ferrara
(2017). There the notion of key correlated states is introduced. this class of
states is the one for which the bound for quantum key repeaters is given in
Christandl and Ferrara (2017). Denoting by ${\cal Z}_{d_{k}}$ the Weyl
operator of dimension $d_{k}$ of the form ${\cal
Z}_{d_{k}}=\sum_{l=0}^{d_{k}-1}e^{i2\pi l/d_{k}}|l\rangle\langle l|$ we obtain
the generalized Bell states as $\phi_{j}:={\cal
Z}_{d_{k}}^{j}\otimes\mathds{1}_{B}(\phi)$ where
$\phi:={1\over\sqrt{d_{k}}}\sum_{i}|i\rangle_{A}|i\rangle_{B}$. Then, the key
correlated  state takes form:

$\rho_{ABA^{\prime}B^{\prime}}^{key-
cor}\coloneqq\sum_{\mu,\nu}|\phi_{\mu}\rangle\langle\phi_{\nu}|_{AB}\otimes
M^{(\mu,\nu)}_{A^{\prime}B^{\prime}},$ (12)

where $M^{(\mu,\nu)}$ are $d_{s}\times d_{s}$ matrices on
$A^{\prime}B^{\prime}$.

The notion of the key attacked state of a private state naturally generalizes
to the case of a key attacked state of the key correlated result. It can be
obtained as follows:

######  Definition 1.

The key attacked state of a key correlated state $\rho^{key-
cor}_{ABA^{\prime}B^{\prime}}$ is the state obtained from it by applying local
von-Neumann measurements on systems $A$ and $B$ in the computational basis. It
takes the following form:

$\hat{\rho}_{ABA^{\prime}B^{\prime}}\coloneqq\sum_{i}p_{i}|ii\rangle\langle
ii|_{AB}\otimes\sigma_{A^{\prime}B^{\prime}}^{(i)}$ (13)

where $\sigma_{A^{\prime}B^{\prime}}^{(i)}$ are some states on the
$A^{\prime}B^{\prime}$ system such that
$\sum_{i}p_{i}\sigma_{A^{\prime}B^{\prime}}^{(i)}=Tr_{AB}\rho_{ABA^{\prime}B^{\prime}}$
and $\\{p_{i}\\}$ forms a probability distribution.

One of the main results of Christandl and Ferrara (2017) connects the problem
of distinguishability of a key correlated state from its key attacked version.
It states that the one-way distillable entanglement of the key correlated
state $\rho$ is quantified by means of the so-called locally measured-relative
entropy ”distance” between the $\rho$ and its key attacked version when the
latter state is separable. By locally measured relative entropy distance
between two states we mean the relative entropy of two states measured both by
a quantum completely positive, trace preserving map ${\cal M}$ (not
necessarily a POVM as it was defined in Piani (2009)) on Alice’s side:

$\displaystyle\sup_{{\cal M}\in LO_{A}}D({\cal M}(\rho)||{\cal M}(\sigma)):=$
$\displaystyle\sup_{{\cal M}}D(({\cal M}\otimes\mathrm{I}_{B})\rho||({\cal
M}\otimes\mathrm{I}_{B})\sigma)$ (14)

where $D(\rho||\sigma)=-\mathrm{Tr}\rho\log\rho-{\mathrm{T}r}\rho\log\sigma$.
In what follows, we need a regularized version of it, which reads:

$\displaystyle\sup_{{\cal M}\in LO_{A}}D^{\infty}(\rho||\sigma):=$
$\displaystyle\lim_{n\rightarrow\infty}\frac{1}{n}\sup_{{\cal M}\in
LO_{A}}D({\cal M}(\rho^{\otimes n})||{\cal M}(\sigma^{\otimes n})).$ (15)

where in the above ${\cal M}$ acts naturally on all the $n$ subystems $A$ of
$\rho$ (and $\sigma$ respectively).

In what follows, we will need to recall the definition of one-way distillable
entanglement. It is the maximal number of approximate singlet states that can
be produced from $n$ copies of the input state $\rho$ via LOCC operations that
use only communication from $A$ to $B$ (denoted as $LOCC(A\rightarrow B))$, in
the asymptotic limit of large $n$ and vanishing error of approximation.
Formally it reads:

$\displaystyle E_{D}^{A\rightarrow
B}(\rho):=\inf_{\delta>0}\limsup_{n\rightarrow\infty}\sup_{\Lambda\in
LOCC(A\rightarrow B)}$ $\displaystyle\\{E:\Lambda(\rho^{\otimes
n})\approx_{\delta}|\psi_{+}\rangle\langle\psi_{+}|^{\otimes nE}\\}$ (16)

We are ready to invoke the above-mentioned result of Christandl and Ferrara
(2017).

######  Theorem 1 (cf. Theorem 2 in Christandl and Ferrara (2017)).

For any key correlated state $\rho$, and its key attacked state
$\hat{\sigma}$, it holds

$\displaystyle E_{D}^{\rightarrow}(\rho)\geq
D_{A}(\rho||\hat{\rho}):=\sup_{{\cal M}\in LO_{A}}D({\cal M}(\rho)||{\cal
M}(\hat{\rho})),$ $\displaystyle E_{D}^{\rightarrow}(\rho)\geq
D_{A}^{\infty}(\rho||\hat{\rho}):=\sup_{{\cal M}\in LO_{A}}D({\cal
M}(\rho^{\otimes n})||{\cal M}(\hat{\rho}^{\otimes n})).$ (17)

If $\hat{\rho}$ is separable then:

$E_{D}^{\rightarrow}(\rho)=D^{\infty}_{A}(\rho||\hat{\rho}).$ (18)

The central role that plays in our considerations is a variant of the key
repeater rate. The one-way key repeater rate is defined in Christandl and
Ferrara (2017), as follows, where the protocols consist of Local Operations
and Classical Communication LOCC operations that are a composition of (i)
local quantum operation on system $C_{1}C_{2}\equiv C$ followed by one-way
classical communication, i.e. the one from $C_{1}C_{2}\equiv{\bf C}$ to $AB$
followed by (ii) arbitrary LOCC operation between $A$ and $B$. We denote this
composition as $LOCC(C_{1}C_{2}\rightarrow A\leftrightarrow B)$.

######  Definition 2.

(cf. Appendix G in Christandl and Ferrara (2017)) Consider any two bipartite
states $\rho_{AC_{1}}$ of systems $AC_{1}$ and $\rho^{\prime}_{C_{2}B}$ of
systems $C_{2}B$ (not necesarily equal), called further input states. A
protocol ${\cal P}$ consisting of $LOCC(C_{1}C_{2}\rightarrow A\leftrightarrow
B)$ operations which transform $n$ copies of the input states into $\epsilon$
approximation (in trance norm distance) of a private state $\gamma^{k}$ shared
between $A$ and $B$ has the key rate $\frac{k}{n}$. The maximal value of the
key rates over such protocols in the asymptotic limit of large $n$ and
vanishing error $\epsilon$ is is called a one-way key repeater rate of
$\rho_{AC_{1}}\otimes\rho_{C_{2}B}^{\prime}$, and reads

$\displaystyle R^{C_{1}C_{2}\rightarrow
AB}(\rho_{AC_{1}},\rho^{\prime}_{C_{2}B})\coloneqq\lim_{\epsilon\rightarrow
0}\lim_{n\rightarrow\infty}\sup_{{\cal P}\in LOCC(C_{1}C_{2}\rightarrow
A\leftrightarrow B)}$ $\displaystyle\\{\frac{k}{n}:{\cal
P}((\rho_{AC_{1}}\otimes\rho_{C_{2}B}^{\prime})^{\otimes
n})\approx_{\epsilon}\gamma_{AB}^{k}\\}.$ (19)

Following Christandl and Ferrara (2017) we will use the locally measured on
system ${\bf C}\equiv C_{1}C_{2}$, regularized relative entropy applied to the
scenario of key repeaters:

$\displaystyle
D_{\bf{C}}^{\infty}(\rho_{AC_{1}}\otimes\rho^{\prime}_{C_{2}B}||\rho^{\prime\prime})\coloneqq\lim_{n\rightarrow\infty}{1\over
n}$ $\displaystyle\sup_{{\cal M}_{\bf C}\in LO_{C_{1}C_{2}}}D({\cal M}_{\bf
C}({\rho_{AC_{1}}\otimes\rho^{\prime}_{C_{2}B}}^{\otimes n})||{\cal M}_{\bf
C}({\rho^{\prime\prime}_{AC_{1}C_{2}B}}^{\otimes n})),$ (20)

which is nothing but the locally measured relative entropy with $A$ in Eq.
(15) identified with the system ${\bf C}=C_{1}C_{2}$ and $B$ with $AB$
respectively, for the input state $\rho_{AC_{1}}\otimes\rho_{C_{2}B}$.Let us
emphasise here, that ${\cal M}_{\bf C}$ acts locally on all $n$ subsystems
$C_{1}C_{2}$ of the state $(\rho_{AC_{1}}\otimes\rho_{C_{2}B})^{\otimes n}$
and analogously on all $n$ subsystems $C_{1}C_{2}$ of the state
${\rho^{\prime\prime}_{AC_{1}C_{2}B}}^{\otimes n}$.

As it was further noted in Christandl and Ferrara (2017), there holds a bound
obtained from the Theorem 4 of Bäuml  _et al._ (2015):

$\displaystyle R^{C_{1}C_{2}\rightarrow
AB}(\rho_{AC_{1}},\rho^{\prime}_{C_{2}B})\leq
D_{\bf{C}}^{\infty}(\rho_{AC_{1}}\otimes\rho^{\prime}_{C_{2}B}||\sigma)$ (21)

for any $\sigma$ separable in $ACC_{1}:B$ or $A:CC_{2}B$ cut. Then for
$\rho,\rho^{\prime}$ being key correlated states, and by choosing
$\sigma=\hat{\rho}\otimes\hat{\rho^{\prime}}$ (i.e. assuming that the key
attacked the correlated state of at least one of the two states is separable)
in Christandl and Ferrara (2017) they have obtained from Theorem 18 invoked
above

$\displaystyle R^{C_{1}C_{2}\rightarrow
AB}(\rho_{AC_{1}},\rho^{\prime}_{C_{2}B})\leq E_{D}^{C_{1}\rightarrow
A}(\rho_{AC_{1}}\otimes\rho^{\prime}_{C_{2}B})$ (22)

The main contribution of this manuscript amounts to obtaining a bound for
which neither of the states $\hat{\rho}$ and $\hat{\rho^{\prime}}$ need to be
separable.

Further, the following quantities are relevant for the proof technique. We
will need the notion of $\epsilon$-hypothesis-testing divergence Buscemi and
Datta (2010); Wang and Renner (2012), which is defined as

$D^{\epsilon}_{h}(\rho||\sigma):=-\log_{2}\inf_{{\mathrm{P}}:0\leq{\mathrm{P}}\leq\mathds{1}}\\{\operatorname{Tr}[{\mathrm{P}}\sigma]:\operatorname{Tr}[{\mathrm{P}}\rho]\geq
1-\epsilon\\},$ (23)

and the sandwiched R$\acute{e}$nyi relative entropy Wilde  _et al._ (2014);
Müller-Lennert  _et al._ (2013):

$\tilde{D}_{\alpha}(\rho||\sigma):={1\over\alpha-1}\log_{2}\operatorname{Tr}[\left(\sigma^{1-\alpha\over
2\alpha}\rho\sigma^{1-\alpha\over 2\alpha}\right)^{\alpha}].$ (24)

In Hayashi (2017), based on the above quantity, the sandwiched relative
entropy is defined as follows:

${\tilde{E}}_{\alpha}(\rho):=\inf_{\sigma\in
SEP}\tilde{D}_{\alpha}(\rho||\sigma),$ (25)

where $SEP$ denotes the set of separable states Horodecki  _et al._ (2009b).
As it is shown in Christandl and Müller-Hermes (2017) (and independently in
Zhu  _et al._ (2017)), for $\alpha\rightarrow\infty$ the above quantity takes
as a limit the max relative entropy of entanglement Datta (2009a, b), where
the latter quantity is defined as:

$E_{max}(\rho)=\inf_{\sigma\in SEP}\inf\\{\lambda\in{\mathrm{R}}:\rho\leq
2^{\lambda}\sigma\\}.$ (26)

As the second part of this work heavily utilizes random quantum objects, we
provide a crash course on random matrices in Appendix B.

Finally, we would like to recall the results of Yang  _et al._ (2019) on
private randomness distillation, as our result will also apply to this
resource. There the notion of independent states was introduced. These states
take the form of twisted coherence, just like the private state is twisted
entanglement.

######  Definition 3.

The independent state is defined as follows

$\alpha_{d_{A},d_{B}}:={1\over
d_{A}d_{B}}\sum_{i,j=0}^{d_{A}-1}\sum_{k,l=0}^{d_{B}-1}|i\rangle\langle
j|_{A}\otimes|k\rangle\langle l|_{B}\otimes
U_{ik}\sigma_{A^{\prime}B^{\prime}}U_{jl}^{\dagger}$ (27)

where the unitary transformation $\tau=\sum_{ij}|ij\rangle\langle ij|\otimes
U_{ij}$ is the twisting, and $\sigma_{A^{\prime}B^{\prime}}$ is an arbitrary
state on $A^{\prime}B^{\prime}$ system.

The independent state has the property that measured on system $AB$ yields
$\log_{2}d_{A}$ bits of ideally private randomness for Alice and
$\log_{2}d_{B}$ for Bob. The randomness is ideally private since the
construction of the state assures that the outcomes of measurements on the key
part system $AB$ are decorrelated from the purifying system $E$. We also
recall the scenario of distributed randomness distillation of Yang  _et al._
(2019). In the latter scenario, two parties are trying to distil locally
private randomness, which is independent for each party and decoupled from the
system of the environment. The honest parties share a dephasing channel via
which they can communicate. One can also consider the case in which the honest
parties have local access to an unlimited number of maximally mixed states.
The parties distil private randomness in the form of independent states. We
recall below the main results of Yang  _et al._ (2019):

######  Theorem 2 (Cf. Yang  _et al._ (2019)).

The achievable rate regions of $\rho_{AB}$ are:

  1. 1.

for no communication and no noise, $R_{A}\leq\log|A|-S(A|B)_{+}$,
$R_{B}\leq\log|B|-S(B|A)_{+}$, and $R_{A}+R_{B}\leq R_{G}$, where
$[t]_{+}=\max\\{0,t\\}$;

  2. 2.

for free noise but no communication, $R_{A}\leq\log|A|-S(A|B)$,
$R_{B}\leq\log|B|-S(B|A)$, and $R_{A}+R_{B}\leq R_{G}$;

  3. 3.

for free noise and free communication, $R_{A}\leq R_{G}$, $R_{B}\leq R_{G}$,
and $R_{A}+R_{B}\leq R_{G}$;

  4. 4.

for free communication but no noise, $R_{A}\leq\log|AB|-\max\\{S(B),S(AB)\\}$,
$R_{B}\leq\log|AB|-\max\\{S(A),S(AB)\\}$, and $R_{A}+R_{B}\leq R_{G}$.

Further, the rate regions in settings 1), 2), 3) are tight.

In the above $S(A|B)_{+}=\max\\{0,S(A|B)\\}$. Here $S(X)_{\rho_{XY}}$ is the
von-Neumann entropy of subsystem $X$ of the state $\rho_{XY}$,
$S(X|Y)_{\rho_{XY}}$ is the conditional von-Nuemann entropy while

$I(X:Y)_{\rho_{XY}}\coloneqq
S(X)_{\rho_{XY}}+S(Y)_{\rho_{XY}}-S(XY)_{\rho_{XY}}$ (28)

is the quantum mutual information. We will sometimes neglect the subscript
$XY$ in the above if understood from the context. Recently, it has been shown
that private states are independent states Horodecki  _et al._ (2020).
However, naturally, the set of independent states is strictly larger. In
particular, a local independent bit is not necessarily a private state:

$\alpha_{d_{A}}:=\tau|+\rangle\langle+|\otimes\sigma_{A^{\prime}B^{\prime}}\tau^{\dagger},$
(29)

where $|+\rangle={1\over\sqrt{d}_{A}}\sum_{i=0}^{d_{A}}|i\rangle$. In what
follows, we will estimate the private randomness content of a generic local
independent bit.

##  IV Relaxed bound on one-way private key repeaters

In this section, we provide relaxed bound on one-way private key repeaters. It
holds for the so-called key correlated states $\rho_{key}$ Christandl and
Ferrara (2017). The bound takes the form of the regularized, measured relative
entropy of entanglement from any state scaled by the factor
$\alpha\over\alpha-1$ increased by the $\alpha$-sandwiched relative entropy of
entanglement $E_{\alpha}$ of the key-attacked version of $\rho_{key}$.
Although the latter bound can not be tighter than the bound by relative
entropy of entanglement Horodecki  _et al._ (2005, 2009a), it has appealing
form, as it in a sense, computes the distance from a separable state via a
’proxy’ state, which can be arbitrary.

As the main technical contribution, we will first present the lemma, which
upper bounds the fidelity with a singlet of a state which up to its inner
structure (being outcome of certain protocol) is arbitrary. Such a bound was
known so far for the fidelity of singlet with the so-called twisted separable
states (see lemma 7 of Horodecki  _et al._ (2009a)) and proved useful in
providing upper bounds on distillable key (see Khatri and Wilde (2020) and
references therein). Our relaxation is based on the strong-converse bound for
the private key, formulated in terms of the $E_{\alpha}$.

We begin by explaining the idea of a technical lemma which we present below.
It is known that any $d\otimes d$ separable state is bounded away as $1\over
d$ from a maximally entangled state of local dimension $d$ in terms of
fidelity Horodecki  _et al._ (2009a). However, an arbitrary state can not be
bounded arbitrarily away from the singlet state in terms of fidelity. There
must be a penalty term that shows how fast this fidelity grows when the state
is increasingly entangled, i.e., far and far from being separable. Such a term
follows from the strong converse bound on the distillable key. Indeed, this is
the essence of $\tilde{E}_{\alpha}$ being the strong converse bound: If one
tries to distil more key than the $\tilde{E}_{\alpha}$ from a state, then the
fidelity with singlet of the output state increases exponentially fast to $1$,
in terms of $\tilde{E}_{\alpha}$. In our case, the state compared with the
singlet in terms of fidelity will be the state after the performance of the
key repeater protocol subjected to twisting and partial trace. Namely, a state
$\sigma^{\otimes n}$ of systems $ABC$ after the action of a map $\Lambda\in
LOCC({\bf C}\rightarrow(A\leftrightarrow B))$ which can be now of systems
$ABA^{\prime}B^{\prime}C$, traced over $C$ and further rotated by a twisting
unitary transformation $\tau$ and traced over system $A^{\prime}B^{\prime}$.
The last two actions, i.e., rotation and twisting, form just a mathematical
tool that allows checking if the state under consideration, here the
protocol’s output, is close to a private state. Indeed, a private state, after
performing the inverse operation to twisting and the partial trace becomes the
singlet state Horodecki  _et al._ (2005). We note here, that the proof
technique in the Lemma (1) below, bare partial analogy to the proof of the
fact that the so called second type distillable entanglement is upper bounded
by the relative entropy of entanglement as shown in Vedral and Plenio (1998)
and described in Theorem $8.7$ of Hayashi (2017).

######  Lemma 1.

For a bipartite state of the form
$\tilde{\sigma}:=\operatorname{Tr}_{A^{\prime}B^{\prime}}\tau\operatorname{Tr}_{C}\Lambda(\sigma^{\otimes
n})\tau^{\dagger}$, where $\sigma_{ABC}$ is arbitrary state, $\tau$ is an
arbitrary twisting, and $\Lambda\in LOCC({\bf C}\rightarrow(A\leftrightarrow
B))$ there is

$\operatorname{Tr}\tilde{\sigma}\psi_{+}^{nR}\leq
2^{-n(\frac{\alpha-1}{\alpha})[R-1/n\tilde{E}_{\alpha}(\sigma^{\otimes n})]},$
(30)

where $R>0$ is a real number, and $\psi_{+}$ denotes the maximally entangled
state, and $\alpha\in(1,\infty)$.

###### Proof.

In what follows, we directly use the proof of the strong-converse bound for
the distillable key of Das  _et al._ (2021), which is based on Wilde  _et al._
(2017); Das  _et al._ (2020); Christandl and Müller-Hermes (2017). Let us
suppose $\operatorname{Tr}\tilde{\sigma}\psi_{+}^{nR}=1-\epsilon$. Let us also
choose a state $\hat{\sigma}$, to be a twisted separable state of the form
$\hat{\sigma}=\operatorname{Tr}_{A^{\prime}B^{\prime}}\tau\operatorname{Tr}_{C}\Lambda(\sigma_{A{\bf
C}:B}^{\prime})\tau^{\dagger}$ with $\sigma^{\prime}$ being arbitrary
separable state in $(A{\bf C}:B)$ cut. Note here that by definition $\Lambda$
preserves separability in $A{\bf C}:B$ cut, and hence in $A:B$ as well.

Since any such state has overlap with the singlet state $\psi^{nR}_{+}$ less
than $\frac{1}{2^{nR}}\equiv 1/K$ (see lemma 7 of Horodecki  _et al._
(2009a)), we have by taking
${\mathrm{P}}=|\psi_{+}^{nR}\rangle\langle\psi_{+}^{nR}|$ definition of
$D^{\epsilon}_{h}$ given in Eq. (23) a bound:

$\log_{2}K\leq D^{\epsilon}_{h}(\tilde{\sigma}||\hat{\sigma}).$ (31)

We then upper bound $D^{\epsilon}_{h}$ by $\tilde{D}_{\alpha}$ as follows, for
every $\alpha\in(1,\infty)$ (see A8 in the Appendix of Das  _et al._ (2021)):

$\displaystyle\log_{2}K\leq\tilde{D}_{\alpha}(\tilde{\sigma}||\hat{\sigma})+\frac{\alpha}{\alpha-1}\log_{2}(\frac{1}{1-\epsilon})=$
$\displaystyle\tilde{D}_{\alpha}(\operatorname{Tr}_{A^{\prime}B^{\prime}}\tau\operatorname{Tr}_{C}\Lambda(\sigma^{\otimes
n})\tau^{\dagger}||\operatorname{Tr}_{A^{\prime}B^{\prime}}\tau\operatorname{Tr}_{C}\Lambda(\sigma^{\prime}_{A{\bf
C}B})\tau^{\dagger})+$
$\displaystyle\frac{\alpha}{\alpha-1}\log_{2}(\frac{1}{1-\epsilon}).$ (32)

We can now relax $\tilde{\sigma}$ to $\Lambda(\sigma^{\otimes n})$ due to
monotonicity of the sandwich R$\acute{e}$nyi relative entropy distance under
jointly applied channel, so that

$\log_{2}K\leq\tilde{D}_{\alpha}(\Lambda(\sigma^{\otimes
n})||\Lambda(\sigma^{\prime}))+\frac{\alpha}{\alpha-1}\log_{2}(\frac{1}{1-\epsilon}).$
(33)

We can further drop also the operation $\Lambda$ again using monotonicity of
the relative Renyi divergence $\tilde{D}_{\alpha}$. We thus arrive at

$\log_{2}K\leq\tilde{D}_{\alpha}(\sigma^{\otimes
n}||\sigma^{\prime})+\frac{\alpha}{\alpha-1}\log_{2}(\frac{1}{1-\epsilon}).$
(34)

Since $\sigma^{\prime}$ is an arbitrary separable state, we can take also
infimum over this set obtaining:

$\log_{2}K\leq\tilde{E}_{\alpha}(\sigma^{\otimes
n})+\frac{\alpha}{\alpha-1}\log_{2}(\frac{1}{1-\epsilon}).$ (35)

It suffices to rewrite it as follows:

$1-\epsilon\leq
2^{-n(\frac{\alpha-1}{\alpha})(R-\frac{1}{n}E_{\alpha}(\sigma^{\otimes n}))}.$
(36)

Since $1-\epsilon=\operatorname{Tr}\tilde{\sigma}\psi_{+}^{nR}$, the assertion
follows. ∎

Owing to the above lemma, we can formulate a bound on the relative entropy
distance from the set of states constructed from an arbitrary state $\rho$ by
admixing a body of separable states.

$\mbox{Cone}(SEP,\rho):=\\{\tilde{\sigma}|\exists_{p\in[0,1]},\,\tilde{\sigma}=p\rho+(1-p)\sigma,\,\sigma\in
SEP\\}$ (37)

We denote this set as $\mbox{Cone}(SEP,\rho)$ and the relative entropy
distance from it by $E_{R}^{\mbox{Cone}(\rho)}$ or $E_{R}^{\mbox{Cone}}$ when
$\rho$ is known from the context.

######  Lemma 2.

For a maximally entangled state $\psi_{+}^{Rn}$, a state
$\tilde{\sigma}_{n}:=\operatorname{Tr}_{A^{\prime}B^{\prime}}\tau\operatorname{Tr}_{C}\Lambda(\sigma^{\otimes
n})\tau^{\dagger}$ where $\tau$ is a twisting, for every
$\alpha\in(1,\infty)$, there is

$\displaystyle
E_{R}^{\mbox{Cone}(\tilde{\sigma}_{n})}(\psi_{+}^{Rn})\equiv\inf_{\sigma_{n}\in\mbox{Cone}(SEP,\tilde{\sigma}_{n})}D(\psi_{+}^{Rn}||\sigma_{n})\geq$
$\displaystyle
n(\frac{\alpha-1}{\alpha})(R-\frac{1}{n}E_{\alpha}(\sigma^{\otimes n})).$ (38)

###### Proof.

We follow the proof of the lemma $7$ of Horodecki  _et al._ (2009a). Using
concavity of the logarithm function we first note that
$D(\psi_{+}^{Rn}||\sigma_{n})=-\operatorname{Tr}\psi_{+}^{Rn}\log\sigma_{n}\geq-\log\operatorname{Tr}\psi_{+}^{Rn}\sigma_{n}=-\log\sum_{i}p_{i}\operatorname{Tr}\psi_{+}^{Rn}\sigma_{n}^{(i)}$.
Since $\sigma_{n}\in\mbox{Cone}(SEP,\tilde{\sigma}_{n})$, we have that
$\sigma^{(i)}_{n}$ can be considered either separable or equal to
$\tilde{\sigma}_{n}$.Suppose $\tilde{\sigma}_{n}$ is admixed in $\sigma_{n}$
with probability $p_{i_{0}}$. For the separable states
$\operatorname{Tr}\sigma_{n}^{(i)}\psi_{+}^{Rn}\leq 2^{-Rn}$ by lemma 7 of
Horodecki  _et al._ (2009a). Since $Rn\geq
n(\frac{\alpha-1}{\alpha})(R-\frac{1}{n}E_{\alpha}(\sigma^{\otimes n}))$, we
have

$\displaystyle D(\psi_{+}^{Rn}||\tilde{\sigma}_{n})\geq$
$\displaystyle(1-p_{i_{0}})\left[n(\frac{\alpha-1}{\alpha})(R-\frac{1}{n}E_{\alpha}(\sigma^{\otimes
n}))\right]$
$\displaystyle+p_{i_{0}}\left[-\log\operatorname{Tr}\psi_{+}^{Rn}\tilde{\sigma}_{n}\right]$
(39)

The last step is bounding
$-\log\operatorname{Tr}\psi_{+}^{Rn}\tilde{\sigma}_{n}$ by
$n(\frac{\alpha-1}{\alpha})(R-\frac{1}{n}E_{\alpha}(\sigma^{\otimes n}))$ from
below by Lemma 1∎

We are ready to state the main theorem. It shows that the one-way repeater
rate is upper bounded by the locally measured regularized relative entropy of
entanglement (increased by factor $\frac{\alpha}{\alpha-1}$) in addition with
the sandwich relative entropy of entanglement. In what follows we will use
notation $\rho\equiv\rho_{AC_{1}}$ and
$\rho^{\prime}\equiv\rho^{\prime}_{C_{2}B}$, as well as
$\rho^{\prime\prime}\equiv\rho^{\prime\prime}_{ABC_{1}C_{2}}$ and
$C_{1}C_{2}\equiv{\bf C}$.

######  Theorem 3.

For any bipartite states $\rho,\rho^{\prime},\rho^{\prime\prime}$ and a real
parameter $\alpha\in(1,\infty)$, there is

$R^{\rightarrow}(\rho,\rho^{\prime})\leq\frac{\alpha}{\alpha-1}D_{\bf{C}}^{\infty}(\rho\otimes\rho^{\prime}||\rho^{\prime\prime})+\tilde{E}_{\alpha}(\rho^{\prime\prime}\otimes\rho^{\prime\prime}).$
(40)

###### Proof.

Our proof closely follows Christandl and Ferrara (2017), with suitable
modifications. We first note, that there is the following chain of
(in)equalities, as it is noted in Christandl and Ferrara (2017):

$\displaystyle{\frac{1}{n}}D_{\bf{C}}(\rho^{\otimes
n}\otimes\rho^{\prime\otimes n}||\rho^{\prime\prime\otimes n})\geq$ (41)
$\displaystyle{\frac{1}{n}}D_{\bf{C}}({\cal M}(\rho^{\otimes
n}\otimes\rho^{\prime\otimes n})||{\cal M}(\rho^{\prime\prime\otimes n}))\geq$
(42) $\displaystyle{\frac{1}{n}}D_{\bf{C}}(\Lambda\circ{\cal M}(\rho^{\otimes
n}\otimes\rho^{\prime\otimes n})||\Lambda\circ{\cal
M}(\rho^{\prime\prime\otimes n}))\geq$ (43)
$\displaystyle\frac{1}{n}D(\tilde{\gamma}^{Rn}||\tilde{\sigma}_{n}),$ (44)

where $\Lambda$ is on optimal one-way protocol realizing
$R^{\rightarrow}(\rho,\rho^{\prime})$, and $\tilde{\gamma}^{Rn}$ is a state
close to a private state by $\epsilon$. The state $\tilde{\sigma}_{n}$ is an
arbitrary state. In the above, we have used monotonicity of the locally
measured regularized relative entropy of entanglement under joint application
of a CPTP map.

We further have the following chain of (in)equalities:

$\displaystyle{\frac{1}{n}}D_{\bf{C}}(\rho^{\otimes
n}\otimes\rho^{\prime\otimes n}||\rho^{\prime\prime\otimes n})\geq$ (45)
$\displaystyle\frac{1}{n}D({\cal S}(\tilde{\gamma}^{Rn})||{\cal
S}(\tilde{\sigma}_{n}))\geq$ (46)
$\displaystyle\frac{1}{n}\inf_{\sigma\in\mbox{Cone}(SEP,{\cal
S}(\tilde{\sigma}_{n}))}D({\cal S}(\tilde{\gamma}^{Rn})||\sigma)\geq$ (47)
$\displaystyle\frac{1}{n}E_{R}^{\mbox{Cone}}(\psi_{+}^{Rn})-{1\over
n}O(\epsilon)\geq$ (48)
$\displaystyle\frac{1}{n}[n\frac{\alpha-1}{\alpha}(R-\frac{1}{n}\tilde{E}_{\alpha}((\rho^{\prime\prime}\otimes\rho^{\prime\prime})^{\otimes
n})]+\frac{1}{n}O(\epsilon+h(\epsilon)).$ (49)

In equation (46), we use joint monotonicity of the relative entropy under a
privacy squeezing map ${\cal S}$, i.e., the inverse operation to twisting and
tracing out the shielding system. In Eq. (47) we relax the relative entropy
distance to the infimum over a convex set - the cone of states obtained by
admixing any separable state to the state ${\cal S}(\tilde{\sigma}_{n})$. The
latter state forms the apex of this set. Since the relative entropy distance
from a bounded convex set that contains a maximally mixed state is
asymptotically continuous Winter (2016), the subsequent inequality follows. In
the last inequality, we use Lemma 2 and the fact that $\tilde{E}_{\alpha}$ is
subadditive (see Eq. $5.26$ of Wilde  _et al._ (2017)). ∎

From the Theorem 40 and the main result of Christandl and Ferrara (2017),
which states that any key correlated state $\rho$ and its attacked version
$\hat{\rho}$ satisfy

$E_{D}^{A\rightarrow B}(\rho_{AB})\geq D_{A}^{\infty}(\rho||{\hat{\rho}}),$
(50)

we have immediate corollary stated below.

######  Corollary 1.

For a key-correlated states $\rho,\rho^{\prime}$ given in Eq. (12) and its
attacked version $\hat{\rho},\hat{\rho}^{\prime}$ there is

$R^{\rightarrow}(\rho,\rho^{\prime})\leq\frac{\alpha}{\alpha-1}E_{D}^{\rightarrow}(\rho\otimes\rho^{\prime})+\tilde{E}_{\alpha}(\hat{\rho}\otimes\hat{\rho}^{\prime}).$
(51)

###### Proof.

We identify $A$ and $B$ from Eq. (50) with ${\bf C}\equiv C_{1}C_{2}$, and
$AB$ respectively, to bound $D^{\infty}_{\bf C}(\rho\otimes\rho^{\prime})$ by
$E_{D}^{\rightarrow}(\rho\otimes\rho^{\prime})$ from above. We further use
Theorem 40. ∎

We can introduce some simplifications by considering the extremal value of
$\alpha$ and behavior of the entanglement monotones involved in the above
corollary. This leads us to a relaxed bound for a single state:

######  Corollary 2.

For a key correlated state $\rho$ given in Eq. (12) and its key attacked
version $\hat{\rho}$ there is

$R^{\rightarrow}(\rho,\rho)\leq
2E_{D}^{\rightarrow}(\rho)+2E_{max}(\hat{\rho}).$ (52)

###### Proof.

It follows straightforwardly from the Corollary 51. Indeed, consider first the
case $\rho=\rho^{\prime}$, and note that $\tilde{E}_{\alpha}$ is subadditive
(see Eq. $5.26$ of Wilde  _et al._ (2017)) and $E_{D}^{\rightarrow}$ is
additive by definition. This implies

$R^{\rightarrow}(\rho,\rho)\leq
2({\alpha\over\alpha-1})E_{D}^{\rightarrow}(\rho)+2\tilde{E}_{\alpha}(\hat{\rho}).$
(53)

Relaxing the above inequality by taking the limit of $\alpha\rightarrow\infty$
we arrive at the claim. ∎

A special case of a key correlated state is a private bit (a private state
with key part of local dimension $d_{k}=2$). When the private state is taken
at random, we can then upper bound the term $E_{max}$ to obtain the bound
which is dependent only on the one-way distillable entanglement and a constant
factor. We thus arrive at the second main result of this section.

######  Theorem 4.

For a random private bit (a private state with $d_{k}=2$ and arbitrary finite
dimensional shield part $d\otimes d<\infty$) there is

$R^{\rightarrow}(\rho,\rho)\leq 2E_{D}^{\rightarrow}(\rho)+2.$ (54)

###### Proof.

In what follows, for the ease of notation, we will refer to $d_{s}$, i.e. the
dimension of the shielding system of the key correlated state, as to $d$. We
will relax the upper bound given in Eq. (52) provided in the Corollary 52. Let
us recall first that $E_{max}(\rho):=\inf_{\sigma\in
SEP}\inf\\{\lambda\in{\mathrm{R}}:\rho\leq 2^{\lambda}\sigma\\}$. As a further
upper bound one can use the norm $||.||_{\infty}$. This is because
$E_{max}(\rho)\leq\log_{2}\left(d^{2}||\rho||_{\infty}\right)$. The latter
inequality can be easily seen from the fact that the maximally mixed state
$\mathds{1}\over d^{2}$ is separable, and it majorizes every state. We then
set $\sigma=\frac{\mathds{1}}{d^{2}}$ in the definition of $E_{max}$.If we
have then an upper bound on the maximal eigenvalue of $\rho$, denoted as
$\kappa_{max}$ the value $\lambda=\log_{2}(d^{2}\kappa_{max}))$ satisfies
$\rho\leq 2^{\lambda}\mathds{1}/d^{2}$, and hence
$E_{max}\leq\log_{2}(d^{2}\kappa_{max})$. It is known Marčenko and Pastur
(1967), that the maximal eigenvalue of a random state $\rho_{rand}$ of
dimension $d^{2}$ is upper bounded by

$\lambda_{max}(\rho_{rand})\leq{4\over d^{2}}.$ (55)

The key attacked state $\hat{\rho}$ of $\rho$ is of the form

$\hat{\rho}={1\over 2}|00\rangle\langle 00|\otimes\rho_{1}+{1\over
2}|11\rangle\langle 11|\otimes\rho_{2},$ (56)

where $\rho_{i}$ are also random states. Hence its maximal eigenvalue is upper
bounded by ${1\over 2d^{2}}$. We have then that
$E_{max}\leq\log_{2}(d^{2}\times({2\over d^{2}}))=1$, hence the assertion
follows. ∎

Numerical intuition for justification of setting
$\sigma=\frac{\mathds{1}}{d^{2}}$ in the proof of Theorem 54 to upper bound
$E_{max}$ for a random state is presented in Fig. 1. The top plot shows the
smallest eigenvalue of $2^{\lambda}\sigma-\rho$ for a fixed random $\rho$ of
order $d^{2}$ and $100$ randomly chosen $\sigma$ for dimensions $d=8,16,32$.
As $d$ increases, the eigenvalues become positive for $\lambda\geq 2$. To
drive the point on this intuition further, the bottom plot in Fig. 1 shows a
logarithmic plot of the absolute value of the maximum of these eigenvalues
over 100 randomly chosen $\sigma$ and $\lambda=2$ as a function of dimension
$d$.

Figure 1: Minimal eigenvalue of matrix $2^{\lambda}\sigma-\rho$ as a function
of $\lambda$ plotted for a fixed random $\rho$ of order $d^{2}$ and 100
randomly selected separable $\sigma$ (top) and a logarithmic plot of the
absolute value of the maximum of these eigenvalues over 100 randomly chosen
$\sigma$ and $\lambda=2$ as a function of dimension $d$ (bottom). As can be
seen, the plots seem to justify the intuition behind the assumption
$\lambda=2$ in the proof of Theorem 54.

The bound given in Eq. (54) is loose as it has a non-vanishing factor of $2$.
However, it is valid for any dimension of the shielding system of the state,
and this factor is independent of the dimension. It implies that no matter how
large is the shielding system of a key correlated state, generically, it
brings in at most 2 bits of the repeated key above the (twice) one-way
distillable entanglement.

It turns out, however, (see Corollary 3) that there is a tighter bound, which
can be obtained not from the upper bounding via relative entropy but squashed
entanglement, Christandl and Müller-Hermes (2017); Tucci (2002). In the next
section, we will show that the (half of) the mutual information of a random
private state does not exceed the minimal value, which is key by more than
$\frac{1}{4\ln 2}$. The bound will then follow from a trivial inequality
$R^{\rightarrow}(\rho,\rho)\leq R(\rho,\rho)\leq K_{D}(\rho)$ Bäuml  _et al._
(2015).

##  V Mutual information bound for the secure content of a random private bit

This section focuses on random private bits and provides an upper bound on the
distillable key. We perform the random choice of a private state differently
than it is done in Christandl  _et al._ (2020). There, the private state has
been first transformed via a one-way LOCC protocol to the form of the so-
called Bell-private bit of the form
$\frac{1}{2}\left(|\psi_{+}\rangle\langle\psi_{+}|\otimes\rho_{+}+|\psi_{-}\rangle\langle\psi_{-}|\otimes\rho_{-}\right)$.
Then the two states were defined as $\rho_{\pm}:=U\bar{\rho}_{\pm}U$, where
$\bar{\rho}_{\pm}$ is arbitrarily chosen state of the form
$\bar{\rho}_{+}:=\frac{Q}{TrQ}$ with $Q$ being a projector onto any $d^{2}/2$
dimensional subspace of $A^{\prime}B^{\prime}$ system, and
$\bar{\rho}_{-}:=\frac{Q^{\perp}}{TrQ^{\perp}}$. Our approach is different, as
it also applies to the smallest dimension of the shield $d_{s}=2$. We do not
transform a private bit into a Bell private bit. We rather observe that any
private bit is uniquely represented by a (not necessarily normal) operator $X$
of trace norm equal to 1. We then represent this operator as $U\sigma$ and
choose a random state $\sigma$ and random unitary $U$ according to the Haar
measure.

Let us start by introducing the notion of random private states. Looking at
Eq. (9) we have two objects that can be chosen at random: the unitaries
$U_{0},U_{1}$ and the shared state $\sigma_{A^{\prime}B^{\prime}}$. Due to the
unitary invariance of the ensemble of random quantum states, we can set one of
the unitaries $U_{0}=\mathds{1}$ and the second one to be chosen randomly,
denoted $U_{1}=U$. For simplicity, let us also introduce the notation
$X=U\sigma_{A^{\prime}B^{\prime}}$. Hence, we can rewrite Eq. (9) as

$\gamma_{ABA^{\prime}B^{\prime}}={1\over
2}\begin{pmatrix}\sqrt{XX^{\dagger}}&0&0&X\\\ 0&0&0&0\\\ 0&0&0&0\\\
X^{\dagger}&0&0&\sqrt{X^{\dagger}X}\end{pmatrix}.$ (57)

A short introduction into the properties of random unitaries and quantum
states can be found in Appendix B. Before statement of the main result, which
is the bound on the distillable key of a random private bit, let us first
state the following technical fact

######  Proposition 1.

Let $\gamma_{ABA^{\prime}B^{\prime}}$ be defined as in Eq. (57), let $X$ be an
arbitrary random matrix of dimension $d^{2}$ and let $\mu_{X}$ denote the
asymptotic eigenvalue density of $\sqrt{XX^{\dagger}}$. Then, as $d\to\infty$,
$\gamma$ has the eigenvalue density $\mu_{\gamma}$ given by

$\mu_{\gamma}=\frac{1}{2}\mu_{X}+\frac{1}{2}\delta(0).$ (58)

###### Proof.

From the form of $\gamma_{ABA^{\prime}B^{\prime}}$ we can conclude that half
of its eigenvalues are equal to zero. Therefore it suffices to focus on the
eigenvalues of the matrix

$\gamma^{\prime}=\frac{1}{2}\begin{pmatrix}\sqrt{XX^{\dagger}}&X\\\
X^{\dagger}&\sqrt{X^{\dagger}X}.\end{pmatrix}.$ (59)

First we note that for any $\ket{\psi}$ we have

$\gamma^{\prime}\begin{pmatrix}\ket{\psi}\\\
-X^{\dagger}(\sqrt{XX^{\dagger}})^{-1}\ket{\psi}\end{pmatrix}=0.$ (60)

Hence $\rank{\gamma^{\prime}}=d^{2}$, which gives us that half of the
eigenvalues of $\gamma^{\prime}$ are equal to zero. From the fact that the
Schur complement of the first block is
$\gamma^{\prime}/\sqrt{XX^{\dagger}}=0$, we recover that the remaining
eigenvalues of $\gamma^{\prime}$ are those of $\sqrt{XX^{\dagger}}$. ∎

Additionally, we will need the following fact regarding the entropy of random
quantum states sampled from the Hilbert-Schmidt distribution from Bengtsson
and Życzkowski (2017); Collins and Nechita (2011); Puchała  _et al._ (2016);
Życzkowski and Sommers (2001).

######  Proposition 2.

Let $\rho$ be a random mixed state of dimension $d$ sampled from the Hilbert-
Schmidt distribution. Then, for large $d$ we have

$\mathbb{E}\left(S(\rho)\right)=\log_{2}d-\frac{1}{2\ln
2}-O\left(\frac{\log_{2}d}{d}\right)$ (61)

###### Proof.

For large $d$ it can be shown Życzkowski and Sommers (2001) that

$\mathbb{E}(\operatorname{Tr}\rho^{k})=d^{1-k}\frac{\Gamma(1+2k)}{\Gamma(1+k)\Gamma(2+k)}\left(1+O\left(\frac{1}{d}\right)\right).$
(62)

What remains is to note that

$\mathbb{E}\left(S(\rho)\right)=-\lim_{k\to
1}\frac{\partial\operatorname{Tr}\rho^{k}}{\partial k},$ (63)

and the desired results follows from direct calculations. ∎

The main result of this section can be formulated as the following theorem

######  Theorem 5.

Let $\gamma_{ABA^{\prime}B^{\prime}}$ be a private state defined as in Eq.
(57), with the shielding system of dimension $d_{s}\otimes d_{s}$, let also
$X=U\sigma_{A^{\prime}B^{\prime}}$, where $U$ is a Haar unitary be an
arbitrary and $\rho$ is a random mixed state sampled from the Hilbert-Schmidt
distribution. Then as $d\to\infty$ we get

$I(AA^{\prime}:BB^{\prime})_{\gamma}\to 2+\frac{1}{2\ln 2}.$ (64)

###### Proof.

From Propositions 1 and 2 we have that the entropy of a random mixed state
$\rho$ of dimension $d_{s}$ asymptotically behaves as
$\log_{2}d_{s}-\frac{1}{2\ln 2}-O\left(\frac{\log_{2}d_{s}}{d_{s}}\right)$ we
have

$S(AA^{\prime}BB^{\prime})_{\gamma}=2\log_{2}d_{s}-\frac{1}{2\ln
2}-O\left(\frac{\log_{2}d_{s}}{d_{s}^{2}}\right).$ (65)

All is left is to consider the terms $S(AA^{\prime})_{\gamma}$ and
$S(BB^{\prime})_{\gamma}$. First we observe that

$\gamma_{AA^{\prime}}=\frac{1}{2}\begin{pmatrix}\operatorname{Tr}_{B}^{\prime}U\sigma_{A^{\prime}B^{\prime}}U^{\dagger}&0\\\
0&\operatorname{Tr}_{B}^{\prime}\sigma_{A^{\prime}B^{\prime}}\end{pmatrix},$
(66)

and similarly for $\gamma_{BB^{\prime}}$. As the ensemble of random quantum
states is unitarily invariant, $U\sigma_{A^{\prime}B^{\prime}}U^{\dagger}$ is
also a random quantum state. Based on the results from Nechita  _et al._
(2018) we have that the partial trace of a $d_{s}^{2}\times d_{s}^{2}$ random
quantum state is almost surely the maximally mixed state. Hence

$S(AA^{\prime})_{\gamma}=S(BB^{\prime})_{\gamma}=\log_{2}2d_{s}-o(1).$ (67)

Putting all of these facts together we obtain the desired result

$I(AA^{\prime}:BB^{\prime})_{\gamma}\to 2\log_{2}2+\frac{1}{2\ln 2}.$ (68)

∎

We have then immediate corollary

######  Corollary 3.

For a random private bit $\gamma_{2}$ of arbitrary large dimension of the
shield, in the limit of large $d_{s}\rightarrow\infty$, there is

$K_{D}(\gamma_{2})\leq\log_{2}2+\frac{1}{4\ln 2}$ (69)

###### Proof.

We use the bound by squashed entanglement
$E_{sq}(\rho):=\inf_{\rho_{ABE},Tr_{E}\rho_{ABE}=\rho_{AB}}\frac{1}{2}I(A:B|E)_{\rho_{ABE}}$
Christandl and Winter (2004), by noticing, that it is upper bounded by
$\frac{1}{2}I(A:B)$ (we consider half of the bound on the mutual information
given in (68)). ∎

For the private states, the above bound yields a tighter result, than the one
given in Theorem 54. Indeed, since $E_{D}^{\rightarrow}(\rho)\geq 0$, the
bound of Eq. (54) is at least $2$. However, the one-way repeater rate of a
bipartite state $\rho_{AB}$ can not be larger than the distillable key
$K_{D}(\rho_{AB})$ Bäuml  _et al._ (2015). This is a trivial bound: any key-
repeater protocol can be viewed as a particular LOCC protocol between $A$ and
$B$. As such, it can not increase the initial amount of key in the cut $A:B$.
We thus have for a generic private state $\gamma$ (not necessarily
irreducible) a trivial bound

$\displaystyle R^{\rightarrow}(\gamma_{2},\gamma_{2})\leq
K_{D}(\gamma_{2})\leq$ $\displaystyle 1+{1\over 4\ln 2}\approx 1+0.360674.$
(70)

Let us note here that the bound is far from being small in contrast with the
bound for the private state taken at random due to different randomization
procedures proposed in Christandl  _et al._ (2020). This is because our
technique does not immediately imply that the private state has Hermitian $X$,
nor that its positive and negative parts are random states. We believe,
however, that the above bound can be made tighter.

##  VI Localizable private randomness for a generic local independent state

In this section, we study the rates of private randomness that can be
distilled from a generic independent bit. We base on the following idea. While
(half of the) mutual information is merely a weak bound on the private key.
This function reports the exact amount of private randomness content of
quantum state in various scenarios Yang  _et al._ (2019).

Let us recall here, that the local independent bit (in bipartite setting) has
form

$\alpha_{AA^{\prime}B^{\prime}}=\sum_{i,j=0}^{1}{1\over 2}|i\rangle\langle
j|\otimes U_{i}\sigma_{A^{\prime}B^{\prime}}U_{j}^{\dagger}.$ (71)

where $U_{i}$ are unitary transformations acting on system
$A^{\prime}B^{\prime}$ and $\sigma$ is an arbitrary state on the latter
system. We assume that the system $A^{\prime}B^{\prime}$ is of dimension
$d_{s}\otimes d_{s}$. In the above we borrow the notation of Yang  _et al._
(2019) where $\alpha$ denotes the independent states, thus $\alpha$ should not
be confused with the parameter of the sandwiched R$\acute{e}$nyi relative
entropy given in Eq. (24). In the matrix form, it is as follows

$\alpha_{AA^{\prime}B^{\prime}}={1\over
2}\left(\begin{array}[]{cc}\sqrt{XX^{\dagger}}&X\\\
X^{\dagger}&\sqrt{X^{\dagger}X}\end{array}\right)$ (72)

where $X=U_{0}\sigma_{A^{\prime}B^{\prime}}U_{1}$. As it was observed in the
case of the private bit, we can safely assume that $U_{0}=\mathds{1}$, and
$U_{1}$ is arbitrary because $\sigma_{A^{\prime}B^{\prime}}$ will be taken at
random.

We give below the argument for the analysis of the entropy of system
$AA^{\prime}$, used in the proof of the next theorem.

######  Proposition 3.

Consider $\alpha_{AA^{\prime}B^{\prime}}$ as in Eq. (72). Then,
$\tr_{B^{\prime}}\alpha_{AA^{\prime}B^{\prime}}$ converges almost surely to
the maximally mixed state as $d\to\infty$

$\lim_{d\to\infty}\|2d\tr_{B^{\prime}}\alpha_{AA^{\prime}B^{\prime}}-I\|=0.$
(73)

Moreover, we have

$\|2d\tr_{B^{\prime}}\alpha_{AA^{\prime}B^{\prime}}-I\|=O(d^{-1})$ (74)

###### Proof.

We start by proving the limit. The explicit form of the partial trace reads

$\tr_{B^{\prime}}\alpha_{AA^{\prime}B^{\prime}}=\frac{1}{2}\begin{pmatrix}\tr_{B^{\prime}}\sigma_{A^{\prime}B^{\prime}}&\tr_{B^{\prime}}U_{0}\sigma_{A^{\prime}B^{\prime}}U_{1}^{\dagger}\\\
\tr_{B^{\prime}}U_{1}\sigma_{A^{\prime}B^{\prime}}U_{0}^{\dagger}&\tr_{B^{\prime}}U_{0}\sigma_{A^{\prime}B^{\prime}}U_{0}^{\dagger}\end{pmatrix}.$
(75)

We immediately note that the diagonal blocks are partial traces of independent
random states. Hence from Nechita  _et al._ (2018) we have that they almost
surely converge to the maximally mixed state. Formally we have (only for the
first block)

$\lim_{d\to\infty}\|d\tr_{B^{\prime}}\sigma_{A^{\prime}B^{\prime}}-I\|=0$ (76)

The remainder of this part of the proof follows from the proof of Proposition
1, substituting
$X=\tr_{B^{\prime}}U_{0}\sigma_{A^{\prime}B^{\prime}}U_{1}^{\dagger}$ in Eq.
(59) and following the reasoning shown there.

The result on convergence rate follows directly from considerations on the
variance of the average eigenvalue of
$\tr_{B^{\prime}}\alpha_{AA^{\prime}B^{\prime}}$, which are presented after
Eq. (26) in Nechita  _et al._ (2018). ∎

In what follows, we will show achievable rates of private randomness for a
randomly chosen ibit. They are encapsulated in the following theorem.

######  Theorem 6.

Let $\alpha_{AA^{\prime}B^{\prime}}$ given by Eq. (71) be the randomly
generated state by picking up random state $\sigma_{A^{\prime}B^{\prime}}$ and
a unitary transformation $U_{1}$ due to Haar measure. Let also
$R_{G}:=1+\frac{1}{2\ln 2}+O(\frac{\log d_{s}}{d_{s}^{2}})$. Then the
following bounds are achievable.

  1. 1.

for no communication and no noise,
$R_{A}\leq R_{G}-o(1)$, when
$\log d_{s}\geq\frac{1}{2\ln 2}+O(\frac{\log d_{s}}{d_{s}^{2}})-o(1)$ and
$R_{A}\leq 1+\log d_{s}$ otherwise,
$R_{B}\leq 1+\frac{1}{2\ln 2}-O(\frac{\log_{2}d_{s}}{d_{s}})$, when
$\log_{2}d_{s}\geq 1+\frac{1}{2\ln 2}+O(\frac{\log_{2}d_{s}}{d_{s}})$ and
$R_{B}\leq\log d_{s}$ otherwise.

  2. 2.

for free noise, but no communication,
$R_{A}\leq R_{G}-o(1)$,
$R_{B}\leq 1+\frac{1}{2\ln 2}-O(\frac{\log_{2}d_{s}}{d_{s}}).$

  3. 3.

for free noise and free communication,
$R_{A},R_{B}\leq R_{G}$

  4. 4.

for free communication but no noise,
$R_{A}\leq R_{G}$ when
$\log d_{s}\geq\frac{1}{2\ln 2}+O(\frac{\log_{2}d_{s}}{d_{s}^{2}})-o(1)$, and
$R_{A}\leq 1+\log d_{s}+o(1)$ otherwise.
$R_{B}\leq R_{G}$ when
$\log_{2}d_{s}\geq 1+\frac{1}{2\ln 2}+O(\frac{\log d_{s}}{d_{s}})$
$R_{B}\leq\log_{2}d_{s}-O(\frac{\log d_{s}}{d_{s}})$, otherwise.

###### Proof.

  1. 1.

By Theorem 2, case $1$, the rate of private randomness reads
$R_{A}=\log|AA^{\prime}|-\max\\{0,S(AA^{\prime}|B^{\prime})\\}$. This equals
$\log|AA^{\prime}|-\max\\{0,S(AA^{\prime}B^{\prime})-S(B^{\prime})\\}$. When
$S(B^{\prime})>S(AA^{\prime}B^{\prime})$, we have $R_{A}=\log 2d_{s}$, as the
analysis is the same as for the private state (see Eq. (66)). On the other
hand, if $S(B^{\prime})\leq S(AA^{\prime}B^{\prime})$ which happens for all
high enough dimensions $d_{s}$, there is

$\displaystyle R_{A}$ $\displaystyle=\log 2d_{s}-[(\log
d_{s}^{2}-\frac{1}{2\ln 2}$ (77) $\displaystyle-O(\frac{\log
d_{s}}{d_{s}^{2}}))-(\log d_{s}-o(1))]$ $\displaystyle=1+\frac{1}{2\ln
2}+O(\frac{\log d_{s}}{d_{s}})-o(1).$ (78)

In the above we have used the fact, that $S(AA^{\prime}B^{\prime})$ for an
independent state equals $S(AA^{\prime}BB^{\prime})$ for a corresponding
private bit (i.e. generated by the same twisting $\tau$ and from the same
state $\sigma$).

We have further
$R_{B}\leq\log|B^{\prime}|-\max\\{0,S(B^{\prime}|AA^{\prime})\\}=\log|B^{\prime}|-\max\\{0,S(AA^{\prime}B^{\prime})-S(AA^{\prime})\\}$.
Let us consider first the case when $S(AA^{\prime}B^{\prime})\geq
S(AA^{\prime})$ which holds for large enough $d_{s}$ i.e. whenever
$\log_{2}d_{s}\geq 1+\frac{1}{2\ln
2}+O(\frac{\log_{2}d_{s}}{d_{s}^{2}})+O(\frac{\log_{2}d_{s}}{d_{s}})$, which
is equivalent to $\log_{2}d_{s}\geq 1+\frac{1}{2\ln
2}+O(\frac{\log_{2}d_{s}}{d_{s}})$, due to the big O(.) notation. (If this
condition is not met there is clearly $R_{B}=\log d_{s}-O(\frac{\log
d_{s}}{d_{s}})$).

By asymptotic continuity of the von-Neumann entropy Winter (2016) and
Proposition 3 we have $|S(AA^{\prime})-\log_{2}2d_{s}|\leq
O(\frac{\log_{2}d_{s}}{d_{s}})+O(d_{s}^{-1})=O(\frac{\log_{2}d_{s}}{d_{s}})$
while $S(AA^{\prime}B^{\prime})=(\log_{2}d_{s}^{2}-\frac{1}{2\ln
2}-O(\frac{\log_{2}d_{s}}{d_{s}^{2}}))$ as argued above. To show
achievability, we need to use the lower bound:
$S(AA^{\prime})\geq\log_{2}2d_{s}-O(\frac{\log_{2}d_{s}}{d_{s}})$. We then
obtain that $R_{B}\leq 1+\frac{1}{2\ln
2}-O(\frac{\log_{2}d_{s}}{d_{s}}))\leq\log_{2}|B^{\prime}|-S(B^{\prime}|AA^{\prime})$
is an achievable rate. Here we have included term $O(\frac{\log
d_{s}}{d_{s}^{2}}))$ in term $O(\frac{\log_{2}d_{s}}{d_{s}}))$ due to the big
$O(.)$ notation.

  2. 2.

The second case reads the same bounds as the first just without additional
conditions on dimension $d_{s}$. This is because in the second case of Theorem
2, the bounds have $S(A|B)$ and $S(B|A)$ terms rather than the $S(A|B)_{+}$
and $S(B|A)_{+}$ in its formulation.

  3. 3.

The third case stems from an observation, that the global purity reads
$R_{G}=\log|AA^{\prime}B^{\prime}|-S(AA^{\prime}B^{\prime})=\log(2d_{s}^{2})-(2\log
d_{s}-\frac{1}{2\ln 2}-O(\frac{\log d_{s}}{d_{s}^{2}}))$. The rates $R_{A}$
and $R_{B}$ achive the same bound $R_{G}$ in this case.

  4. 4.

The last case is due to case $4$ of the Theorem 2:
$R_{A}\leq\log|AA^{\prime}B^{\prime}|-\max\\{S(B^{\prime}),S(AA^{\prime}B^{\prime})\\}$.
When $S(B^{\prime})>S(AA^{\prime}B^{\prime})$ i.e. $\log d_{s}<\frac{1}{2\ln
2}+O(\frac{\log_{2}d_{s}}{d_{s}^{2}})-o(1)$, there is $R_{A}\leq
1+2\log_{2}d_{s}-\log_{2}d_{s}+o(1)=1+\log_{2}d_{s}+o(1)$. When
$S(B^{\prime})\leq S(AA^{\prime}B^{\prime})$ there is $R_{A}\leq
1+2\log_{2}d_{s}-[2\log_{2}d_{s}-(\frac{1}{2\ln
2}+O(\frac{\log_{2}d_{s}}{d_{s}^{2}})])=1+\frac{1}{2\ln
2}+O(\frac{\log_{2}d_{s}}{d_{s}^{2}})$.

Finally we have
$R_{B}\leq\log|AA^{\prime}B^{\prime}|-\max\\{S(AA^{\prime}),S(AA^{\prime}B^{\prime})\\}$.
When $\log_{2}d_{s}\geq 1+\frac{1}{2\ln 2}+O(\frac{\log d_{s}}{d_{s}})$ we
have $S(AA^{\prime})\leq S(AA^{\prime}B^{\prime})$, and then $R_{B}\leq
R_{G}=1+2\log d_{s}-(2\log d_{s}-\frac{1}{2\ln 2}-O(\frac{\log
d_{s}}{d_{s}^{2}}))=1+\frac{1}{2\ln 2}+O(\frac{\log d_{s}}{d_{s}^{2}})$.
Otherwise (if. $S(AA^{\prime})>S(AA^{\prime}B^{\prime})$) there is $R_{B}\leq
1+2\log d_{s}-(\log 2d_{s}+O(\frac{\log d_{s}}{d_{s}}))=\log
d_{s}-O(\frac{\log d_{s}}{d_{s}})$.

∎

From the above Theorem we can see that in case of the system $A$, for
asymptotically large dimension $d_{s}$ the value of global purity
$1+\frac{1}{2\ln 2}+O(\frac{\log d_{s}}{d_{s}^{2}})$ can be reached in all
four cases. In the case of system $B$ we invoked only the (lower and upper)
bounds on the entropy of involved systems ($AA^{\prime}$), hence the bounds
are not tight, possibly less than the maximal achievable ones.

##  VII Discussion

We have generalized bound by M. Christandl and R. Ferrara Christandl and
Ferrara (2017) to the case of arbitrary key correlated states. We then show a
sequence of relaxation of this bound, from which it follows that the repeated
key of a key correlated state can not be larger from one-way distillable
entanglement than by twice the max-relative entropy of its attacked state.

We further ask how big is the key content of a random private bit, which need
not be irreducible Horodecki  _et al._ (2018). A not irreducible private bit
can have more distillable key than $1$. It turned out that the amount of key
is bounded by a constant factor independent of the dimension of the shielding
system. It is interesting if the constant $\approx 0.36$ can be improved. One
could also ask if this randomization technique also results in a state for
which the repeated key is vanishing with large dimension of the shield as it
was shown by a different technique of randomization in Christandl  _et al._
(2020). Recent results on private randomness generation Yang  _et al._ (2019)
let us also estimate the private randomness content of generic independent
bits. Generalizing this result for independent states of larger dimensions
would be the next important step.

We also show a bound on the distillable key based on the techniques developed
in this manuscript. The bound can not be better than the bound by $E_{R}$.
However, it can possibly report how the relative entropy distance deviates
from being a metric. Indeed, our bound is in terms of a ’proxy’ arbitrary
state. Indeed, we have two terms:
$\frac{\alpha}{1-\alpha}D(\rho||\rho^{\prime})$ and
${\tilde{D}}_{\alpha}(\rho^{\prime}||\sigma)$ where $\rho^{\prime}$ is some
intermediate state between $\rho$ and separable state $\sigma$. One could
believe that the bound is non-trivial, as the relative entropy functions
involved are not metrics. In particular, the triangle inequality reporting
that going via proxy state yields a larger result does not hold. However, we
know anyway that the bound can not be better than the one by $E_{R}$ itself,
hence, conversely, we can perhaps conclude from the bound, how far are the
relative entropy functions from being a metric.

Finally, we would like to stress that our approach is generic. That is, it
appears that any other strong-converse bound on the quantum distillable key
may give rise to a new, possibly tighter bound on the one-way quantum key
repeater rate. Hence recent strong-converse bound on quantum privacy
amplification Salzmann and Datta (2022) paves the way for future research in
this direction. It would be important to extend this technique for the two-way
quantum key repeater rate.

###### Acknowledgements.

KH acknowledges Roberto Ferrara, Siddhartha Das and Marek Winczewski for
helpful discussion. KH acknowledges the Fulbright Programm and Mark Wilde for
hospitality during the Fulbright scholarship at the School of Electric and
Computer Engineering of the Cornell University. We acknowledge Sonata Bis 5
grant (grant number: 2015/18/E/ST2/00327) from the National Science Center. We
acknowledge partial support by the Foundation for Polish Science (IRAP
project, ICTQT, contract no. MAB/2018/5, co-financed by EU within Smart Growth
Operational Programme). The ’International Centre for Theory of Quantum
Technologies’ project (contract no. MAB/2018/5) is carried out within the
International Research Agendas Programme of the Foundation for Polish Science
co-financed by the European Union from the funds of the Smart Growth
Operational Programme, axis IV: Increasing the research potential (Measure
4.3).

## References

  * Wootters and Zurek (1982) W. K. Wootters and W. H. Zurek, Nature 299, 802 (1982).
  * Dieks (1982) D. Dieks, Physics Letters A 92, 271 (1982).
  * Briegel  _et al._ (1998) H.-J. Briegel, W. Dür, J. I. Cirac, and P. Zoller, Physical Review Letters 81, 5932 (1998).
  * Wehner  _et al._ (2018) S. Wehner, D. Elkouss, and R. Hanson, Science 362, eaam9288 (2018).
  * Muralidharan  _et al._ (2016) S. Muralidharan, L. Li, J. Kim, N. Lütkenhaus, M. D. Lukin, and L. Jiang, Scientific Reports 6 (2016), 10.1038/srep20463.
  * Żukowski  _et al._ (1993) M. Żukowski, A. Zeilinger, M. A. Horne, and A. K. Ekert, Physical Review Letters 71, 4287 (1993).
  * Horodecki  _et al._ (2005) K. Horodecki, M. Horodecki, P. Horodecki, and J. Oppenheim, Physical Review Letters 94 (2005), 10.1103/physrevlett.94.160502.
  * Horodecki  _et al._ (2009a) K. Horodecki, M. Horodecki, P. Horodecki, and J. Oppenheim, IEEE Transactions on Information Theory 55, 1898 (2009a).
  * Bäuml  _et al._ (2015) S. Bäuml, M. Christandl, K. Horodecki, and A. Winter, Nature Communications 6 (2015), 10.1038/ncomms7908.
  * Christandl and Ferrara (2017) M. Christandl and R. Ferrara, Physical Review Letters 119 (2017), 10.1103/physrevlett.119.220506.
  * Bennett  _et al._ (1996) C. H. Bennett, D. P. DiVincenzo, J. A. Smolin, and W. K. Wootters, Physical Review A 54, 3824 (1996).
  * Christandl and Müller-Hermes (2017) M. Christandl and A. Müller-Hermes, Communications in Mathematical Physics 353, 821 (2017).
  * Yang  _et al._ (2019) D. Yang, K. Horodecki, and A. Winter, Physical Review Letters 123 (2019), 10.1103/physrevlett.123.170501.
  * Gurvits (2003) L. Gurvits, in  _STOC’03: Proceedings of the thirty-fifth annual ACM symposium on Theory of computing_ (ACM Press, 2003).
  * Wilde  _et al._ (2014) M. M. Wilde, A. Winter, and D. Yang, Comm. Math. Phys. 331, 593 (2014).
  * Müller-Lennert  _et al._ (2013) M. Müller-Lennert, F. Dupuis, O. Szehr, S. Fehr, and M. Tomamichel, J. Math. Phys. 54, 122203 (2013).
  * Datta (2009a) N. Datta, International Journal of Quantum Information 07, 475 (2009a).
  * Wilde  _et al._ (2017) M. M. Wilde, M. Tomamichel, and M. Berta, IEEE Transactions on Information Theory 63, 1792 (2017).
  * Das  _et al._ (2020) S. Das, S. Bäuml, and M. M. Wilde, Physical Review A 101 (2020), 10.1103/physreva.101.012344.
  * Das  _et al._ (2021) S. Das, S. Bäuml, M. Winczewski, and K. Horodecki, Physical Review X 11 (2021), 10.1103/physrevx.11.041016.
  * Datta (2009b) N. Datta, IEEE Trans. Inf. Theory 55, 2816 (2009b).
  * Sakarya  _et al._ (2020) O. Sakarya, M. Winczewski, A. Rutkowski, and K. Horodecki, Physical Review Research 2, 043022 (2020).
  * Christandl  _et al._ (2020) M. Christandl, R. Ferrara, and C. Lancien, IEEE Transactions on Information Theory 66, 4621 (2020).
  * Christandl and Winter (2004) M. Christandl and A. Winter, J. Math. Phys. 45, 829 (2004).
  * Horodecki  _et al._ (2018) K. Horodecki, P. Ćwikliński, A. Rutkowski, and M. Studziński, New Journal of Physics 20, 083021 (2018).
  * Devetak and Winter (2005) I. Devetak and A. Winter, Proceedings of the Royal Society A: Mathematical, Physical and Engineering Sciences 461, 207 (2005).
  * Piani (2009) M. Piani, Phys. Rev. Lett. 103, 160504 (2009), arXiv:0904.2705 [quant-ph] .
  * Buscemi and Datta (2010) F. Buscemi and N. Datta, IEEE Trans. Inf. Theory 56, 1447 (2010).
  * Wang and Renner (2012) L. Wang and R. Renner, Phys. Rev. Lett. 108 (2012), 10.1103/physrevlett.108.200501.
  * Hayashi (2017) M. Hayashi,  _Quantum Information Theory: Mathematical Foundation_ (Springer Berlin Heidelberg, 2017).
  * Horodecki  _et al._ (2009b) R. Horodecki, P. Horodecki, M. Horodecki, and K. Horodecki, Rev. Math. Phys. 81, 865 (2009b).
  * Zhu  _et al._ (2017) H. Zhu, M. Hayashi, and L. Chen, Journal of Physics A: Mathematical and Theoretical 50, 475303 (2017).
  * Horodecki  _et al._ (2020) K. Horodecki, R. P. Kostecki, R. Salazar, and M. Studziński, Physical Review A 102 (2020), 10.1103/physreva.102.012615.
  * Khatri and Wilde (2020) S. Khatri and M. M. Wilde, “Principles of quantum communication theory: A modern approach,” (2020), arXiv:2011.04672 [quant-ph] .
  * Vedral and Plenio (1998) V. Vedral and M. B. Plenio, Physical Review A 57, 1619–1633 (1998).
  * Winter (2016) A. Winter, Communications in Mathematical Physics 347, 291–313 (2016).
  * Marčenko and Pastur (1967) V. A. Marčenko and L. A. Pastur, Mathematics of the USSR-Sbornik 1, 457 (1967).
  * Tucci (2002) R. R. Tucci, arXiv e-prints , quant-ph/0202144 (2002), arXiv:quant-ph/0202144 [quant-ph] .
  * Bengtsson and Życzkowski (2017) I. Bengtsson and K. Życzkowski,  _Geometry of quantum states: an introduction to quantum entanglement_ (Cambridge university press, 2017).
  * Collins and Nechita (2011) B. Collins and I. Nechita, The Annals of Applied Probability 21, 1136 (2011).
  * Puchała  _et al._ (2016) Z. Puchała, Ł. Pawela, and K. Życzkowski, Physical Review A 93 (2016), 10.1103/physreva.93.062112.
  * Życzkowski and Sommers (2001) K. Życzkowski and H.-J. Sommers, Journal of Physics A: Mathematical and General 34, 7111 (2001).
  * Nechita  _et al._ (2018) I. Nechita, Z. Puchała, Ł. Pawela, and K. Życzkowski, Journal of Mathematical Physics 59, 052201 (2018).
  * Salzmann and Datta (2022) R. Salzmann and N. Datta, arXiv e-prints , arXiv:2202.11090 (2022), arXiv:2202.11090 [quant-ph] .
  * Ginibre (1965) J. Ginibre, Journal of Mathematical Physics 6, 440 (1965).
  * Tao and Vu (2008) T. Tao and V. Vu, Communications in Contemporary Mathematics 10, 261 (2008).
  * Życzkowski and Kuś (1994) K. Życzkowski and M. Kuś, Journal of Physics A: Mathematical and General 27, 4235 (1994).
  * Jarlskog (2005) C. Jarlskog, Journal of Mathematical Physics 46, 103508 (2005).
  * Mezzadri (2007) F. Mezzadri, Notices of the American Mathematical Society 54, 592 (2007).
  * Wootters (1990) W. K. Wootters, Foundations of Physics 20, 1365 (1990).
  * Sommers and Życzkowski (2004) H.-J. Sommers and K. Życzkowski, Journal of Physics A: Mathematical and General 37, 8457 (2004).
  * Zhang  _et al._ (2017) L. Zhang, U. Singh, and A. K. Pati, Annals of Physics 377, 125 (2017).
  * Zhang (2017) L. Zhang, Journal of Physics A: Mathematical and Theoretical 50, 155303 (2017).

##  Appendix A Bound for distillable key

We derive now a novel form of a bound on the distillable key in terms of
relative entropy functions. Although the bound reduces to a well-known bound
$K_{D}\leq E_{R}$ Horodecki  _et al._ (2005, 2009a), we state it due to its
novelty. The novelty comes from the fact that it involves the relative entropy
distance from arbitrary, not necessarily separable, quantum state. The main
result is encapsulated in Theorem 86 below.

We first focus on the analogue of Lemma 1 and Lemma 2 for the key distillation
rather than repeated key distillation. The abstract version of the Lemma 1
reads

######  Lemma 3.

For a bipartite state of the form
$\tilde{\sigma}:=\operatorname{Tr}_{A^{\prime}B^{\prime}}\tau\sigma_{ABA^{\prime}B^{\prime}}\tau^{\dagger}$,
where $\sigma_{ABA^{\prime}B^{\prime}}$ is arbitrary state and $\tau$ is a
twisting, there is

$\operatorname{Tr}\tilde{\sigma}\psi_{+}^{\otimes m}\leq
2^{-(\frac{\alpha-1}{\alpha})[m-\tilde{E}_{\alpha}(\sigma)]},$ (79)

where $m\geq 1$ is a natural number, $\psi_{+}$ denotes the maximally
entangled state, and $\alpha\in(1,\infty)$.

###### Proof.

As in the proof of the Lemma 1, we directly use the proof of the strong-
converse bound for the distillable key of Das  _et al._ (2021) which is based
on Das  _et al._ (2020); Christandl and Müller-Hermes (2017). Let us suppose
$\operatorname{Tr}\tilde{\sigma}\psi_{+}^{\otimes m}=1-\epsilon$. Let us also
choose a state $\hat{\sigma}$, to be a twisted separable state of the form.
$\hat{\sigma}=\operatorname{Tr}_{A^{\prime}B^{\prime}}\tau\sigma_{AA^{\prime}:BB^{\prime}}^{\prime}\tau^{\dagger}$
with $\sigma^{\prime}$ being arbitrary separable state in
$(AA^{\prime}:BB^{\prime})$ cut. Since any such state has overlap with the
singlet state $\psi^{\otimes m}_{+}$ less than $\frac{1}{2^{m}}\equiv 1/K$
(see lemma 7 of Horodecki  _et al._ (2009a)), we have:

$D^{\epsilon}_{h}(\tilde{\sigma}||\hat{\sigma})\geq\log_{2}K=m$ (80)

and further for any $\alpha\in(1,\infty)$

$\displaystyle\tilde{D}_{\alpha}(\tilde{\sigma}||\hat{\sigma})+\frac{\alpha}{\alpha-1}\log_{2}(\frac{1}{1-\epsilon})=$
$\displaystyle\tilde{D}_{\alpha}(\operatorname{Tr}_{A^{\prime}B^{\prime}}\tau\sigma\tau^{\dagger}||\operatorname{Tr}_{A^{\prime}B^{\prime}}U\sigma^{\prime}_{A:B}\tau^{\dagger})+$
$\displaystyle\frac{\alpha}{\alpha-1}\log_{2}(\frac{1}{1-\epsilon})\geq m$
(81)

we can now relax $\tilde{\sigma}$ to $\sigma$ due to monotonicity of the
sandwich R$\acute{e}$nyi relative entropy distance under jointly applied
channel, so that

$\tilde{D}_{\alpha}(\sigma||\sigma^{\prime})+\frac{\alpha}{\alpha-1}\log_{2}(\frac{1}{1-\epsilon})\geq
m$ (82)

Since $\sigma^{\prime}$ is an arbitrary separable state, we can take also the
infimum over the set of separable states obtaining:

$\tilde{E}_{\alpha}(\sigma)+\frac{\alpha}{\alpha-1}\log_{2}(\frac{1}{1-\epsilon})\geq
m.$ (83)

We can now rewrite it as follows:

$1-\epsilon\leq 2^{-(\frac{\alpha-1}{\alpha})(m-E_{\alpha}(\sigma))}$ (84)

Since $1-\epsilon=\operatorname{Tr}\tilde{\sigma}\psi_{+}^{\otimes m}$, the
assertion follows. ∎

######  Lemma 4.

For a maximally entangled state $\psi_{+}^{\otimes m}$, a state
$\tilde{\sigma}:=\operatorname{Tr}_{A^{\prime}B^{\prime}}\tau\sigma\tau^{\dagger}$
where $\tau$ is a twisting, for every $\alpha\in(1,\infty)$, there is

$\displaystyle E_{R}^{\mbox{Cone}(\tilde{\sigma})}(\psi_{+}^{m})\equiv$
$\displaystyle\inf_{\sigma\in\mbox{Cone}(SEP,\tilde{\sigma})}D(\psi_{+}^{m}||\sigma_{n})\geq(\frac{\alpha-1}{\alpha})(m-E_{\alpha}(\sigma)).$
(85)

###### Proof.

The proofs goes in full analogy to the proof of Lemma 2. ∎

######  Theorem 7.

For every bipartite state $\rho\in{\cal B}({\cal C}^{d_{A}}\otimes{\cal
C}^{d_{B}})\equiv{\cal H}$, there is:

$K_{D}(\rho)\leq\inf_{\sigma\in{\cal
H},\alpha\in(1,\infty]}[\frac{\alpha}{\alpha-1}D(\rho||\sigma)+\tilde{E}_{\alpha}^{\infty}(\sigma)]$
(86)

###### Proof.

The proof goes along the line of the proof of the fact that $E_{R}$ is the
upper bound on distillable key $K_{D}$ Horodecki  _et al._ (2005, 2009a). Let
the LOCC protocol $\Lambda$ distill a state close by $\epsilon>0$ to a private
state $\gamma_{m}$ with $m$-qubit key part, when acting on $n$ copies of
$\rho$. Let us also denote $m=nR$ where $R>K_{D}(\rho)-\eta$ by some $\eta>0$.
We will show the chain of (in)equalities and comment them below:

$\displaystyle D(\rho||\sigma)={1\over n}D(\rho^{\otimes n}||\sigma^{\otimes
n})\geq$ (87) $\displaystyle{1\over
n}D(\Lambda(\rho^{\otimes})||\Lambda(\sigma^{\otimes n}))\geq$ (88)
$\displaystyle{1\over
n}D(\operatorname{Tr}_{A^{\prime}B^{\prime}}\tau\Lambda(\rho^{\otimes})\tau^{\dagger}||\operatorname{Tr}_{A^{\prime}B^{\prime}}\tau\Lambda(\sigma^{\otimes
n})\tau^{\dagger})\equiv$ $\displaystyle{1\over
n}D(\operatorname{Tr}_{A^{\prime}B^{\prime}}\tau\Lambda(\rho^{\otimes})\tau^{\dagger}||\sigma_{n})\geq$
(89) $\displaystyle{1\over n}\inf_{\tilde{\sigma}_{n}\in
Cone(SEP,\sigma_{n})}D(\tilde{\psi}_{+}^{\otimes m}||\tilde{\sigma}_{n})\geq$
(90) $\displaystyle\inf_{\tilde{\sigma}_{n}\in
Cone(SEP,\sigma_{n})}D(\psi_{+}^{\otimes m}||\tilde{\sigma}_{n})+{1\over
n}O(\epsilon+h(\epsilon))\geq$ (91) $\displaystyle{1\over
n}[n\frac{\alpha-1}{\alpha}(R-{1\over n}\tilde{E}_{\alpha}(\sigma^{\otimes
n})]+{1\over n}O(\epsilon+h(\epsilon))$ (92)

In the first step, we use the tensor property of the relative entropy. In the
next, we use the monotonicity of the relative entropy under $\Lambda$, and
further under a map which consists of the inverse to the operation twisting by
$\tau$ and tracing out system $A^{\prime}B^{\prime}$. The twisting $\tau$ is
defined by $\gamma_{m}$. We further relax relative entropy to infimum over
states from $Cone(SEP,\sigma_{n})$ to which $\sigma_{n}$ belongs, and use
asymptotic continuity of the relative entropy from a convex set. We then use
the analogue of Lemma 2.

Taking the limit of $n$ going to infinity, $\eta\rightarrow 0$ and
$\epsilon\rightarrow 0$ proves the thesis. ∎

######  Remark 1.

The bound of Eq. (86) has two extreme, however equivalent cases. First is when
we set $\sigma=\rho$. In that case the first term equals zero because
$D(\rho||\rho)=0$, and the second term equals $\tilde{E}_{\alpha}(\rho)$,
where $\alpha>1$. Taking limit $\alpha\rightarrow 1$, we obtain a known bound
$E_{R}(\rho)$ on distillable key. The second extreme is when we set $\sigma$
to be any separable state. Then the second term is zero as
$\tilde{E}_{\alpha}$ is the relative entropy divergence ”distance” from the
set of separable states. In that case, we can take the limit
$\alpha\rightarrow\infty$, and again obtain the bound $E_{R}(\rho)$.

##  Appendix B Random quantum objects

In this section we provide a short introduction into random matrices. The
scope is limited to concepts necessary in the understanding of our result.

###  B.1 Ginibre matrices

We start of by introducing the Ginibre random matrices ensemble Ginibre
(1965). This ensemble is at the core of a vast majority of algorithms for
generating random matrices presented in later subsections. Let
$(G_{ij})_{1\leq i\leq m,1\leq j\leq n}$ be a $m\times n$ table of independent
identically distributed (i.i.d.) random variable on $\mathbb{C}$. The field
$\mathbb{K}$ can be either of $\mathbb{R}$, $\mathbb{C}$ or $\mathbb{Q}$. With
each of the fields we associate a Dyson index $\beta$ equal to $1$, $2$, or
$4$ respectively. Let $G_{ij}$ be i.i.d random variables with the real and
imaginary parts sampled independently from the distribution
$\mathcal{N}(0,\frac{1}{\beta})$. Hence,
$G\in\mathrm{L}(\mathcal{X},\mathcal{Y})$, where matrix $G$ is

$P(G)\propto\exp(-\operatorname{Tr}GG^{\dagger}).$ (93)

This law is unitarily invariant, meaning that for any unitary matrices $U$ and
$V$, $G$, and $UGV$ are equally distributed. It can be shown that for
$\beta=2$ the eigenvalues of $G$ are uniformly distributed over the unit disk
on the complex plane Tao and Vu (2008).

###  B.2 Wishart matrices

Wishart matrices form an ensemble of random positive semidefinite matrices.
They are parametrized by two factors. First is the Dyson index $\beta$ which
is equal to one for real matrices, two for complex matrices and four for
symplectic matrices. The second parameter, $K$, is responsible for the rank of
the matrices. They are sampled as follows

  1. 1.

Choose $\beta$ and $K$.

  2. 2.

Sample a Ginibre matrix $G\in\mathrm{L}(\mathcal{X},\mathcal{Y})$ with the
Dyson index $\beta$ and $\mathrm{dim}(\mathcal{X})=d$ and
$\mathrm{dim}(\mathcal{Y})=Kd$.

  3. 3.

Return $W=GG^{\dagger}$.

Sampling this ensemble of matrices will allow us to sample random quantum
states. This process will be discussed in further sections. Aside from their
construction, we will not provide any further details on Wishart matrices, as
this falls outside the scope of this work.

###  B.3 Circular unitary ensemble

Circular ensembles are measures on the space of unitary matrices. Here, we
focus on the circular unitary ensemble (CUE), which gives us the Haar measure
on the unitary group. In the remainder of this section, we will introduce the
algorithm for sampling such matrices.

There are several possible approaches to generating random unitary matrices
according to the Haar measure. One way is to consider known parametrizations
of unitary matrices, such as the Euler Życzkowski and Kuś (1994) or Jarlskog
Jarlskog (2005) ones. Sampling these parameters from appropriate distributions
yields a Haar random unitary. The downside is the long computation time,
especially for large matrices, as this involves a lot of matrix
multiplications. We will not go into this further; instead, we refer the
interested reader to the papers on these parametrizations.

Another approach is to consider a Ginibre matrix $G\in\mathrm{L}(\mathcal{X})$
and its polar decomposition $G=UP$, where $U\in\mathrm{L}(\mathcal{X})$ is
unitary and $P$ is a positive matrix. The matrix $P$ is unique and given by
$\sqrt{G^{\dagger}G}$. Hence, assuming $P$ is invertible, we could recover $U$
as

$U=G(G^{\dagger}G)^{-\frac{1}{2}}.$ (94)

As this involves the inverse square root of a matrix, this approach can be
potentially numerically unstable.

The optimal approach is to utilize the QR decomposition of $G$, $G=QR$, where
$Q\in\mathrm{L}(\mathcal{X})$ is unitary and $R\in\mathrm{L}(\mathcal{X})$ is
upper triangular. This procedure is unique if $G$ is invertible and we require
the diagonal elements of $R$ to be positive. As typical implementations of the
QR algorithm do not consider this restriction, we must enforce it ourselves.
The algorithm is as follows

  1. 1.

Generate a Ginibre matrix $G\in\mathrm{L}(\mathcal{X})$,
$\mathrm{dim}(\mathcal{X})=d$

  2. 2.

Perform the QR decomposition obtaining $Q$ and $R$.

  3. 3.

Multiply the $i$th column of $Q$ by $r_{ii}/|r_{ii}|$.

This gives us a Haar distributed random unitary. For a detailed analysis of
this algorithm, see Mezzadri (2007). This procedure can be generalized in
order to obtain a random isometry. The only required change is the dimension
of $G$. We simply start with $G\in\mathrm{L}(\mathcal{X},\mathcal{Y})$, where
$\dim(\mathcal{X})\geq\dim(\mathcal{Y})$.

###  B.4 Random mixed quantum states

In this section, we discuss the properties and methods of generating mixed
random quantum states.

Random mixed states can be generated in one of two equivalent ways. The first
one comes from the partial trace of random pure states. Suppose we have a pure
state $\ket{\psi}\in\mathcal{X}\otimes\mathcal{Y}$. Then we can obtain a
random mixed as

$\rho=\tr_{\mathcal{Y}}\outerproduct{\psi}{\psi}.$ (95)

Note that in the case $\dim(\mathcal{X})=\dim(\mathcal{Y})$ we recover the
(flat) Hilbert-Schmidt distribution on the set of quantum states.

An alternative approach is to start with a Ginibre matrix
$G\in\mathrm{L}(\mathcal{X},\mathcal{Y})$. We obtain a random quantum state
$\rho$ as

$\rho=GG^{\dagger}/\operatorname{Tr}(GG^{\dagger}).$ (96)

It can be easily verified that this approach is equivalent to the one
utilizing random pure states. First, note that in both cases, we start with
$\dim(\mathcal{X})\dim(\mathcal{Y})$ complex random numbers sampled from the
standard normal distribution. Next, we only need to note that taking the
partial trace of a pure state $\ket{\psi}$ is equivalent to calculating
$AA^{\dagger}$ where $A$ is a matrix obtained from reshaping $\ket{\psi}$.

The properties of these states have been extensively studied. We will omit
stating all the properties here and refer the reader to Wootters (1990);
Życzkowski and Sommers (2001); Sommers and Życzkowski (2004); Puchała  _et
al._ (2016); Zhang  _et al._ (2017); Zhang (2017).