# Device-independent quantum key distribution from generalized CHSH
inequalities

Pavel Sekatski  Department of Physics, University of Basel, Klingelbergstrasse
82, 4056 Basel, Switzerland  Jean-Daniel Bancal  Department of Applied
Physics, University of Geneva, Chemin de Pinchat 22, 1211 Geneva, Switzerland
Xavier Valcarce  Université Paris-Saclay, CEA, CNRS, Institut de physique
théorique, 91191, Gif-sur-Yvette, France  Ernest Y.-Z. Tan  Institute for
Theoretical Physics, ETH Zürich, 8093 Zürich, Switzerland  Renato Renner
Institute for Theoretical Physics, ETH Zürich, 8093 Zürich, Switzerland
Nicolas Sangouard  Department of Physics, University of Basel,
Klingelbergstrasse 82, 4056 Basel, Switzerland  Université Paris-Saclay, CEA,
CNRS, Institut de physique théorique, 91191, Gif-sur-Yvette, France

(April 12, 2021)

###### Abstract

Device-independent quantum key distribution aims at providing security
guarantees even when using largely uncharacterised devices. In the simplest
scenario, these guarantees are derived from the CHSH score, which is a simple
linear combination of four correlation functions. We here derive a security
proof from a generalisation of the CHSH score, which effectively takes into
account the individual values of two correlation functions. We show that this
additional information, which is anyway available in practice, allows one to
get higher key rates than with the CHSH score. We discuss the potential
advantage of this technique for realistic photonic implementations of device-
independent quantum key distribution.

##  1 Introduction

The aim of quantum key distribution (QKD) is to give two parties — Alice & Bob
— the possibility to generate a secret key when they share a quantum channel.
For instance, in the implementation proposed by Ekert [1], the channel
consists of a source producing entangled particles that are distributed to
Alice & Bob. At each round, each of Alice & Bob measure one particle by
choosing one out of several measurement settings. The claim that Alice’s
measurement results are secure, i.e. unknown to any third party – Eve – who
may control the quantum channel, is guaranteed by inferring (from Alice and
Bob’s measurement results) that the source emits states close to pure
bipartite entangled states. This ensures at the same time that Bob’s results
are correlated to Alice’s ones if he chooses an appropriate measurement
setting, i.e. Alice and Bob’s measurement results can form a secret key.

Ekert suggested that the information about the key that may be available to an
adversary can be quantified by choosing settings allowing Alice & Bob to
violate a Bell inequality. This idea was later progressively formalised and
led to what is now called device-independent QKD (DIQKD). In its simplest
version, DIQKD is implemented by letting Alice choose randomly between two
measurement settings at each round, $A_{x}$ where $x\in\\{0,1\\}$, while Bob’s
measurement includes three possible settings, $B_{y}$ where $y\in\\{0,1,2\\}.$
For settings $x,y\in\\{0,1\\},$ the results – which can possibly take many
values – are post-processed locally and turned into binary values
$\textsf{{A}}_{x},\textsf{{B}}_{y}\in\\{-1,+1\\}$. After several iterations,
Alice and Bob communicate classically to estimate the _CHSH score_

$S=\langle{A_{0}\otimes(B_{0}+B_{1})+A_{1}\otimes(B_{0}-B_{1})}\rangle$ (1)

where $\langle A_{x}\otimes
B_{y}\rangle=p(\textsf{{A}}_{x}=\textsf{{B}}_{y}|x,y)-p(\textsf{{A}}_{x}\neq\textsf{{B}}_{y}|x,y)$
quantifies the correlation between the outcomes for measurement choices $x$
and $y$, respectively. The remaining measurement setting $y=2$ is chosen to
generate an outcome $\textsf{{B}}_{2}$ that minimises the uncertainty with
respect to $\textsf{{A}}_{0}$. Alice then forms the raw key from the outcomes
$\textsf{{A}}_{0}$ of the pairs that Bob measured with respect to $y=2$.

We consider $n$ such rounds, over which the source produces a tripartite state
$|\Psi_{ABE}\rangle$ shared between Alice, Bob and Eve. Ref. [2] showed that
Eve’s information is the same as in the case where the devices have no memory
and behave identically and independently in each communication round of the
protocol, up to corrections vanishing with $n$. In particular, we can write
$|\Psi_{ABE}\rangle=|\psi\rangle_{ABE}^{\otimes n}$ where $|\psi\rangle_{ABE}$
is the tripartite state of a single round and consider the case where
measurements are done successively on the state $|\psi\rangle_{ABE}.$

In the asymptotic limit of large $n$, the number of secret bits per round
obtained after one-way error correction and privacy amplification (i.e. the
key rate) is then given by [3]

$r=H(\textsf{{A}}_{0}|E)-H(\textsf{{A}}_{0}|\textsf{{B}}_{2}),$ (2)

where $H$ is the von Neumann entropy. Ref. [4] showed that the conditional
entropy $H(\textsf{{A}}_{0}|E)$ optimized over all states $\psi_{ABE}$ and
measurements $A_{x},B_{y}$ compatible with the observed CHSH score $S$ is
lower bounded by

$H(\textsf{{A}}_{0}|E)\geq 1-h\left(\frac{1+\sqrt{(S/2)^{2}-1}}{2}\right)$ (3)

where $h$ denotes the binary entropy. This provides a lower bound on the key
rate, as the conditional entropy $H(\textsf{{A}}_{0}|\textsf{{B}}_{2})$ can be
estimated directly from Alice and Bob measurement results associated to
setting choices $A_{0}$ and $B_{2}.$ Interestingly, this bound is obtained
_device-independently_ , i.e. without assumptions on the dimension of quantum
states and the calibration of measurements. This is not the case for standard
(non-device independent) QKD protocols which are not based on the violation of
a Bell inequality and whose security guarantees rely on the assumption that
the source and measurements carry out precisely the operations foreseen by the
protocol. This assumption is hard to meet in practice and leads to
vulnerabilities, as demonstrated by hacking experiments [5, 6, 7, 8]. The
robustness of device-independent quantum key distribution against these
attacks makes it appealing, and a race between several experimental groups is
ongoing to report the first proof-of-principle distribution of a key with a
fully device-independent security. Measurement-DIQKD, a precursor of DIQKD
where device-independence only applies to the measurement devices, but not to
those used for state preparation [9, 10], already admits a number of
experimental implementations [11, 12, 13, 14, 15].

Let us note that the proof leading to the bound given in Eq. (3) only uses the
knowledge of the CHSH score. This score is computed as a linear combination of
the correlation functions $\langle A_{x}B_{y}\rangle$, but the additional
information provided by considering these correlations individually – which is
anyway available in practice – might help to facilitate a realisation of
device-independent quantum key distribution. This motivation is at the core of
this work.

Concretely, we consider the individual values of two terms appearing in the
CHSH score, namely

$\begin{split}\text{X}&=\langle{A_{0}\otimes(B_{0}+B_{1})}\rangle,\\\
\text{Y}&=\langle{A_{1}\otimes(B_{0}-B_{1})}\rangle.\end{split}$ (4)

The use of values of X and Y proved to be useful for device-independent state
certification by improving the certified fidelity from the CHSH score [16]. It
is also expected to be useful in DIQKD, as the knowledge of X and Y allows one
to differentiate the contributions of the key generating measurement $A_{0}$
from the ones associated with $A_{1}$, from which no key is generally
extracted (see [17] for a noticeable exception). Finally, in implementations
of DIQKD with non-unit detection efficiencies where no-detection events are
attributed a fixed value $\pm 1$, no-detections on Bob’s side can only
contribute to one of these two correlation functions (X or Y). The goal of the
following sections is to derive a tight bound on Eve’s entropy in terms of the
expected values X and Y, like the bound in Eq. (3) is a function of the CHSH
score $S$. The main result of this work is to confirm the intuition that the
use of individual values of X and Y improves the bounds on Eve’s information
derived from the CHSH score, and hence the key rate of DIQKD. We also apply
the new bound to a concrete setup using a photon pair source based on
spontaneous parametric down conversion (SPDC) and photon detections and show
that it leads to a subtantial improvement of the key rate, at least for high
detection efficiency.

##  2 Formulation of the problem

##### Generalization of the CHSH test–

We are interested in bounding Eve’s conditional entropy
$H(\textsf{{A}}_{0}|E)$ appearing in Eq. (2) as a direct function of observed
quantities X and Y. Formally, this can be accomplished by considering all
possible quantum models ($\psi_{ABE},A_{x},B_{y}$) that satisfy
$\text{X}_{\text{model}}\geq\text{X}$ and
$\text{Y}_{\text{model}}\geq\text{Y}$. However, it is clear that the set of
points (X,Y) for which Eve’s conditional entropy is bounded from below by some
constant is convex: two quantum models giving some amount of information to
Eve can be joined into a new model on which Eve’s conditional entropy is
bounded by the weighted sum of entropy bounds associated to the individual
models. It is thus equivalent to bound Eve’s conditional entropy with linear
constraints of the form

$\frac{\cos(\Omega)}{2}\text{X}_{\text{model}}+\frac{\sin(\Omega)}{2}\text{Y}_{\text{model}}\geq\beta,$
(5)

where $\beta$ is deduced from the observed quantities X and Y from the
following formula

$\beta=\frac{1}{2}\left(\cos\left(\Omega\right)\text{X}+\sin\left(\Omega\right)\text{Y}\right).$
(6)

(Further in the text, we will use a compact notation for sine
$\textrm{S}_{\Omega}=\sin(\Omega)$ and cosine
$\textrm{C}_{\Omega}=\cos(\Omega)$.) Obviously, $\Omega=\pi/4$ reduces back to
the CHSH constraint (up to normalization). Just like the CHSH score can be
seen as the result of a test of the CHSH inequality, we can associate $\beta$
to the test of a Bell inequality – a generalisation of the CHSH inequality –
that is characterized in Ref. [18]. This characterization is also done below
for the sake of completeness.

##### Reduction to qubits–

The score $\beta$ given in Eq. (6) is estimated when Alice and Bob choose the
measurement $A_{x}$, $B_{y}$, $x,y=0,1$, which are observables with
eigenvalues $\pm 1.$ Jordan’s lemma [19, 20] tells us that such observables
can be jointly block diagonalised with blocks of size $2\times 2$, i.e.

$A_{x}=\bigoplus_{k}A_{x,k}\qquad
B_{y}=\bigoplus_{k^{\prime}}B_{y,k^{\prime}}\;,$ (7)

where, without loss of generality, we can assume the restriction to each qubit
block to be a real Pauli measurement satisfying $A_{x,k}^{2}=\mathds{1}_{k}$
and $B_{y,k^{\prime}}^{2}=\mathds{1}_{k^{\prime}}$. This means that in each
block labelled by $k$ and $k^{\prime}$ respectively, the measurement is
characterized by unit vectors ${\bf a}_{x}^{k}$, ${\bf b}_{y}^{k^{\prime}}$
such that

$A_{x,k}={\bf a}_{x}^{k}\cdot\binom{\sigma_{z}}{\sigma_{x}}\qquad
B_{y,k^{\prime}}={\bf
b}_{y}^{k^{\prime}}\cdot\binom{\sigma_{z}}{\sigma_{x}}\quad$ (8)

where $\sigma_{z}$ and $\sigma_{x}$ are Pauli operators.

The state $\left|{\psi}\right\rangle_{ABE}$ can be enforced to take the form

$\left|{\psi}\right\rangle_{ABE}=\bigoplus_{k,k^{\prime}}\sqrt{p_{(k,k^{\prime})}}\left|{\psi}\right\rangle_{ABE}^{(k,k^{\prime})},$
(9)

where $p_{(k,k^{\prime})}$ is a probability distribution and
$\left|{\Psi}\right\rangle_{ABE}^{(k,k^{\prime})}\in\mathds{C}^{2}_{A}\otimes\mathds{C}^{2}_{B}\otimes\mathcal{H}^{(4)}_{E},$
see Refs [21, 22] for detailed discussions. Given models with such
measurements and state, the quantity of interest can be expressed as

$H(\textsf{{A}}_{0}|E)=\sum_{k,k^{\prime}}p_{(k,k^{\prime})}H_{(k,k^{\prime})}(\textsf{{A}}_{0}|E)$
(10)

where $H_{(k,k^{\prime})}(\textsf{{A}}_{0}|E)$ is Eve’s conditional entropy
for four-qubit models (including the two qubits from Eve’s purification)
involving real Pauli measurements. If the minimization of
$H_{(k^{\prime},k)}(\textsf{{A}}_{0}|E)$ over such models satisfying
$\frac{\cos(\Omega)}{2}\text{X}_{\text{model, k,
k'}}+\frac{\sin(\Omega)}{2}\text{Y}_{\text{model, k, k'}}\geq\beta$ provides a
convex function of $\beta,$ this function can be used directly as a lower
bound on the quantity $H(\textsf{{A}}_{0}|E)$ through Eq. (10). If it is not
convex, it can be convexified so as to apply to all possible mixtures of state
and measurement, and thus again apply to Eq. (10). This convexity property
allows us to reduce the general problem of finding the minimum of Eve’s
conditional entropy over all possible models to a minimization over four-qubit
models with real Pauli measurements. We will come back to this convexification
requirement later.

##### Noisy preprocessing–

We consider a simple post-processing of the raw key, known as _noisy pre-
processing_ [23, 24, 25], which has been shown to be beneficial to reduce the
requirement on the detection efficiency in photonic implementations of device-
independent quantum key distribution [22]. Once the raw key is obtained, Alice
is instructed to generate a new raw key $\widehat{\textsf{{A}}}_{0}$ by
flipping each bit of the initial raw key with a probability $p.$ (This can be
described using a POVM that is a mixture of the original measurement and a
measurement with the outcome labels flipped.) Note that we will often
parametrise the amount of noise that Alice adds with a parameter
$q=(1-2p)^{2}$.

##### Symmetrization–

In order to simplify the analysis, it is convenient to consider a
symmetrization step in which both parties, Alice and Bob, flip the outcomes of
the key generating measurements depending on a public random bit string. This
guarantees that bits of the raw key are random, i.e.
$H(\textsf{{A}}_{0})=H(\widehat{\textsf{{A}}}_{0})=1$. Importantly, one can
show the equivalence of protocols with and without symmetrization, meaning
that the symmetrization does not need to be implemented in practice, see [22]
for a complete description of the symmetrization step in the presence of noisy
preprocessing.

##### Reduction to Bell diagonal states–

If the constraints appearing in the minimization problem do not depend on the
marginal probabilities $p(\textsf{{A}}_{x}|x)$ and $p(\textsf{{B}}_{y}|y)$ of
Alice and Bob respectively, the symmetrization step previously presented
reduces the model of the state to a Bell-diagonal structure

$\left|{\psi}\right\rangle_{ABE}=\sum_{i=1}^{4}\sqrt{L_{i}}\left|{\Phi^{i}}\right\rangle_{AB}\left|{i}\right\rangle_{E}$
(11)

where
$\left|{\Phi_{i}}\right\rangle=\\{\Phi^{+},\Psi^{-},\Phi^{-},\Psi^{+}\\}_{i=1}^{4}$,
and without loss of generality, a partial ordering of the eigenvalues
$L_{1}\geq L_{2}$ and $L_{3}\geq L_{4}$ can be imposed [21]. Note that the
superscripts $k,k^{\prime}$ are omitted in the tripartite state appearing in
Eq. (11), i.e.
$\left|{\psi}\right\rangle_{ABE}\rightarrow\left|{\psi}\right\rangle_{ABE}^{(k,k^{\prime})}.$
Until the end of this section and in the next section which is dedicated to
the resolution of the optimization presented in Eq. (24), we remove the index
$k,k^{\prime}$ for making the notation simpler and ask the reader to keep in
mind that we consider the restriction to four qubit models with real Pauli
measurements in this two sections.

##### Eve’s conditional entropy–

Eve’s conditional entropy can be expressed as

$\small
H(\widehat{\textsf{{A}}}_{0}|E)=H(\widehat{\textsf{{A}}}_{0})-H(\rho_{E})+\sum_{\hat{a}=\pm
1}p(\hat{a})H(\rho_{E|\hat{a}})$ (12)

where $\rho_{E}$ is the reduced state of Eve and $\hat{\rho}_{E|\hat{a}}$
corresponds to Eve’s state conditioned on Alice’s noisy key bit
$\widehat{\textsf{{A}}}_{0}$ being equal to $\hat{a}$, which occurs with
probability $p(\hat{a})$. The equivalence of the protocol with the symmetrized
one allows us to take $H(\widehat{\textsf{{A}}}_{0})=1$ and
$p(\hat{a})=\frac{1}{2}$.

$H(\rho_{E})$ is given by the entropy $H({\bf L})$ of the probability vector
${\bf L}=(L_{1},\ldots,L_{4})$, while for the $H(\rho_{E|\hat{a}})$ terms we
have

$\displaystyle\rho_{E|\hat{a}=+1}=$ (13)
$\displaystyle{\small\left(\begin{array}[]{cccc}L_{1}&0&\textrm{C}_{\phi}\sqrt{L_{1}L_{3}q}&\textrm{S}_{\phi}\sqrt{L_{1}L_{4}q}\\\
0&L_{2}&\textrm{S}_{\phi}\sqrt{L_{2}L_{3}q}&-\textrm{C}_{\phi}\sqrt{L_{2}L_{4}q}\\\
\textrm{C}_{\phi}\sqrt{L_{1}L_{3}q}&\textrm{S}_{\phi}\sqrt{L_{2}L_{3}q}&L_{3}&0\\\
\textrm{S}_{\phi}\sqrt{L_{1}L_{4}q}&-\textrm{C}_{\phi}\sqrt{L_{2}L_{4}q}&0&L_{4}\\\
\end{array}\right),}$ (18)

where $\phi$ labels Alice measurement
$A_{0}=\cos(\phi)\sigma_{z}+\sin(\phi)\sigma_{x}$ (we use the notation
$\textrm{C}_{\phi}=\cos(\phi)$ and $\textrm{S}_{\phi}=\sin(\phi)$). The two
states $\rho_{E|\hat{a}=\pm 1}$ are related by a simple unitary transformation
and therefore have the same entropy, see App.A.2 for details. The expressions
of these entropic quantities provide an explicit way to compute
$H(\widehat{\textsf{{A}}}_{0}|E)$ as a function of the parameters $\bf L$ and
$\phi.$ Let us now turn our attention to the constraints.

##### Quantum correlations in the (X,Y) plane –

As mentioned earlier, we are considering quantum models with the values of
correlators X and Y given by Eq. (4). Without loss of generality, we can
assume $\text{X},\text{Y}\geq 0$, which can always be attained by relabelling
the measurement outcomes of $A_{1},B_{0}$ and $B_{1}$ (i.e. without touching
the angle $\phi$).

In this positive quadrant of the plane, the local strategies are delimited by
the CHSH inequality $\text{X}+\text{Y}\leq 2$, i.e. the line connecting the
deterministic strategies $(\text{X},\text{Y})=(2,0)$ and
$(\text{X},\text{Y})=(0,2)$. This implies the following local bounds for the
generalized CHSH tests

$\frac{1}{2}\textrm{C}_{\Omega}\text{X}+\frac{1}{2}\textrm{S}_{\Omega}\text{Y}\leq
B_{\Omega}^{L}=\max(\textrm{C}_{\Omega},\textrm{S}_{\Omega}).$ (19)

To identify the upper limit of the quantum set, we consider the expected
values of the generalized CHSH operator

$\mathcal{B}_{\Omega}=\left\langle\frac{\textrm{C}_{\Omega}}{2}A_{0}\otimes(B_{0}+B_{1})+\frac{\textrm{S}_{\Omega}}{2}A_{1}\otimes(B_{0}-B_{1})\right\rangle.$
(20)

To find its maximum value, we use the qubit parametrization of measurements
$A_{y},B_{y}$ and parametrize the measurement angles on Bob’s side as

$\displaystyle B_{0}+B_{1}$ $\displaystyle=$ $\displaystyle({\bf b}_{0}+{\bf
b}_{1})\cdot\binom{\sigma_{z}}{\sigma_{x}}=2\textrm{C}_{\theta}\,{\bf
c}\cdot\binom{\sigma_{z}}{\sigma_{x}}\ \ \ $ (21) $\displaystyle B_{0}-B_{1}$
$\displaystyle=$ $\displaystyle({\bf b}_{0}-{\bf
b}_{1})\cdot\binom{\sigma_{z}}{\sigma_{x}}=2\textrm{S}_{\theta}\,{\bf
c}_{\perp}\cdot\binom{\sigma_{z}}{\sigma_{x}}\ \ \ $ (22)

with two arbitrary perpendicular unit vectors $\bf c$ and ${\bf c}_{\perp}$,
and $\cos(2\theta)={\bf b}_{0}\cdot{\bf b}_{1}$. From the diagonalization of
the operator on the right hand side of Eq. (20), one finds the quantum bound

$\mathcal{B}_{\Omega}^{Q}=1$ (23)

attained at $(\text{X},\text{Y})=(2\cos(\Omega),2\sin(\Omega))$ by a maximally
entangled two qubit state and measurement settings ${\bf a}_{0}\cdot{\bf
a}_{1}=0$ and ${\bf b}_{0}\cdot{\bf b}_{1}=\cos(2\Omega)$. It follows that
Eve’s information is constrained by the part of the quantum set lying between
the line $\text{X}+\text{Y}=2$ and the circle $\text{X}^{2}+\text{Y}^{2}=4$.
At this point, we can already conclude that any quantum model with (X,Y) lying
on the circle satisfies $H(\hat{\textsf{{A}}}_{0}|E)=1$ (except for the two
points with X+Y$=2$), since the underlying state of Alice and Bob has to be
pure. This is a straightforward improvement over the CHSH bound.

##### Formulation of the problem to solve–

The reductions introduced so far invite us to first solve the following
optimization

$\small\begin{split}I(\beta;\Omega,q)=\max_{\bf{L},\phi,{\bf a}_{1},{\bf
b}_{0},{\bf b}_{1}}&\,H({\bf L})-H(\rho_{E|\hat{a}=+1})\\\ \text{s.t.}\ \ \ \
&\,\mathcal{B}_{\Omega}({\bf L},\phi,{\bf a}_{1},{\bf b}_{0},{\bf
b}_{1})\geq\beta\end{split}$ (24)

and then consider directly the solution $I(\beta;\Omega,q)$ if it is concave
in $\beta$ or construct a concave function $\widehat{I}(\beta;\Omega,q)\geq
I(\beta;\Omega,q)$ to bound Eve’s uncertainty using

$H(\widehat{\textsf{{A}}}_{0}|E)\geq
1-\min_{\Omega}\widehat{I}\left(\frac{\textrm{C}_{\Omega}\text{X}+\textrm{S}_{\Omega}\text{Y}}{2};\Omega,q\right).$
(25)

Note that from the symmetries of the goal function $H({\bf
L})-H(\rho_{E|\hat{a}=+1})$ and the constraint $\mathcal{B}_{\Omega},$ we can
assume $\phi\in[0,\frac{\pi}{4}]$ for the key generating setting and
$L_{1}-L_{2}\geq L_{3}-L_{4}$ in addition to $L_{1}\geq L_{2}$ and $L_{3}\geq
L_{4}$ for the state, see App.A.1 for the details. Further note that we will
often use a parametrisation of the tripartite state given by the following 3
component vector

$\left(\begin{array}[]{c}T_{z}\\\ T_{x}\\\
T_{p}\end{array}\right)=\left(\begin{array}[]{c}L_{1}-L_{2}+L_{3}-L_{4}\\\
L_{1}-L_{2}-L_{3}+L_{4}\\\ L_{1}+L_{2}-L_{3}-L_{4}\end{array}\right),$ (26)

with $0\leq T_{x}\leq T_{z}\leq 1$ and $T_{z}+T_{x}-1\leq T_{p}\leq
1-(T_{z}-T_{x})$.

##  3 Bounding Eve’s information with generalized CHSH tests

We are now ready to compute a bound on Eve’s information as a function of the
generalized CHSH score given in Eq. (6) by solving the optimisation problem
given in Eq. (24). Among the parameters of the model in Eq. (24), the
measurement setting ${\bf a}_{1},{\bf b}_{0}$ and ${\bf b}_{1}$ only influence
the constraint but not the goal function. Furthermore, it is shown in Ref.
[22] that $H(\rho_{E|\hat{a}=+1})$ is a monotonic function in the key
generating setting $\phi\in[0,\frac{\pi}{4}]$. We can thus decompose the
maximization problem in two steps. First, for a fixed state $\bf L,$ we find
the lowest angle $\phi$ allowing to satisfy the constraint

$\displaystyle\phi_{*}({\bf L},\beta,\Omega)=\min$ $\displaystyle\ \ \phi$
(27) s.t. $\displaystyle\max_{{\bf a}_{1},{\bf b}_{0},{\bf
b}_{1}}\mathcal{B}_{\Omega}({\bf L},\phi,{\bf a}_{1},{\bf b}_{0},{\bf
b}_{1})\geq\beta.$

Second, we fix $\phi=\phi_{*}({\bf L},\beta,\Omega)$ to the optimal value for
Eve, and maximize her information with respect to the state, that is, we solve

$\small I(\beta;\Omega,q)=\max_{\bf{L}}H({\bf
L})-H(\rho_{E|\hat{a}=+1};\phi_{*}({\bf L},\beta,\Omega)).$ (28)

We solve Eq. (27) in App. A.3. The expression of the optimal angle $\phi_{*}$
depends on whether the parameter $\Omega$ exceeds $\frac{\pi}{4}$. We treat
the two cases $\Omega\leq\frac{\pi}{4}$ and $\Omega>\frac{\pi}{4}$ separately.

###  3.1 The simple case with $\Omega\leq\frac{\pi}{4}$

For the Bell tests satisfying $\Omega\leq\frac{\pi}{4}$, which include the
CHSH test, the observed score $\beta$ does not constrain the key generating
setting $\phi$ but only the state $\bf L$, see App. A.3 for details. As a
result, there always exists a realization with the optimal angle $\phi_{*}=0$
as long as the state is such that the Bell score can be attained, i.e. if

$\textrm{C}_{\Omega}^{2}T_{z}^{2}+\textrm{S}_{\Omega}^{2}T_{x}^{2}\geq\beta_{\Omega}^{2}.$
(29)

In other words, the optimization Eq. (27) yields $\phi_{*}=0$, and the
maximization of the entropy becomes possible: the conditional state
$\rho_{E|\hat{a}=+1}$ is then block diagonal and its entropy has a simple
closed-form expression. Such a maximization has been done for the CHSH case
($\Omega=\frac{\pi}{4}$) in Ref. [22], but Ref. [26] pointed out that the
analytical bounds on conditional entropies given in this reference assume
qubit attacks. The same bounds were derived using a different approach in
[26], where it is also proved that these bounds are convex. The convexity
results of [26], together with Jordan’s lemma, imply that the obtained qubit
bounds are in fact valid for any dimensions. The same convexity proof applies
to the current situation with $\Omega\leq\pi/4$. For the sake of completeness,
we provide in App. A.5 an alternative proof of convexity, which directly
applies to the present case and to [22]. We show in particular (see App. A.4)
that

$\begin{split}I(\beta;\Omega,q)=h_{q}(z)&=h(z)-h(n_{q}(z))\\\ \text{with}\quad
n_{q}(z)&=\frac{1+\sqrt{1-4\,(1-q)\,z(1-z)}}{2}\\\ \text{and\ \ \ \ \ \,}\quad
z&=\frac{1}{2}\left(\frac{\sqrt{\beta^{2}-\textrm{C}_{\Omega}^{2}}}{\textrm{S}_{\Omega}}+1\right),\end{split}$
(30)

where $h$ is the binary entropy. The concavity of $I(\beta;\Omega,q)$ and
hence the convexity of Eve’s entropy $H(\widehat{\textsf{{A}}}_{0}|E)$ follows
from (see App. A.5)

$\frac{d^{2}}{d\beta^{2}}h_{q}\big{(}z(\beta)\big{)}=h_{q}^{\prime\prime}(z)\big{(}z^{\prime}(\beta)\big{)}^{2}+h_{q}^{\prime}(z)z^{\prime\prime}(\beta)\leq
0.$ (31)

Finally, it remains to determine the optimal inequality to use for a given
point (X,Y). $h_{q}(z)$ being a monotonic function of $z$, we want to maximize
its argument

$\displaystyle z$ $\displaystyle=$
$\displaystyle\frac{1}{2}\left(\frac{\sqrt{(\frac{\textrm{C}_{\Omega}\mathrm{X}+\textrm{S}_{\Omega}\mathrm{Y}}{2})^{2}-\textrm{C}_{\Omega}^{2}}}{\textrm{S}_{\Omega}}+1\right)$
$\displaystyle=$
$\displaystyle\frac{1}{4}\sqrt{\frac{4\,\mathrm{Y}^{2}}{4-\mathrm{X}^{2}}-(4-\mathrm{X}^{2})\left(\cot(\Omega)-\frac{\mathrm{XY}}{4-\mathrm{X}^{2}}\right)^{2}}+\frac{1}{2},$

with respect to $\Omega$ in the range where the argument of the square root is
positive (which means that the value for the Bell test exceeds the local
bound). Manifestly, the expression has a global maximum at

$\cot(\Omega)=\frac{\mathrm{X}\mathrm{Y}}{4-\mathrm{X}^{2}}.$ (33)

Now, we have to verify that the optimal test we found satisfies
$\Omega\leq\frac{\pi}{4}$. One finds that this is the case for

$\frac{4-\text{X}^{2}}{\text{XY}}\leq 1,$ (34)

providing a bound on Eve’s entropy as a direct function of the correlators X
and Y:

$\quad
z_{\text{opt}}=\frac{1}{2}\left(\frac{\text{Y}}{\sqrt{4-\text{X}^{2}}}+1\right).$
(35)

One easily verifies that this bound is indeed better than the CHSH formula
[22]

$\quad
z_{\text{CHSH}}=\frac{1}{2}\left(1+\sqrt{\left(\frac{\text{X}+\text{Y}}{2}\right)^{2}-1}\right)$
(36)

if $\frac{4-\text{X}^{2}}{\text{XY}}<1$.

###  3.2 The complicated case with $\Omega>\frac{\pi}{4}$

####  3.2.1 Bounding Eve’s information from a numerical optimization

For the remaining Bell tests, with $\Omega>\frac{\pi}{4}$, the situation is
different. Here, the generalized CHSH score $\beta$ does not only constraint
the state $\bf L$ but also the setting of the key generating measurement. We
therefore adopt a strategy in two steps. First, we develop a method that can
efficiently compute a bound on Eve’s information, either heuristically or
under a set of well-defined ansatz. Second, we provide a numerical method able
to certify formally the validity of a given bound.

Considering the parameters when $\Omega>\frac{\pi}{4}$, we find that there are
two different regions. First, for the states falling in the range

$\mathds{S}(\beta,\Omega)=\\{{\bf
L}|(\textrm{C}_{\Omega}^{2}T_{z}^{2}+\textrm{S}_{\Omega}^{2}T_{x}^{2})\leq\beta^{2}\leq(\textrm{C}_{\Omega}^{2}T_{x}^{2}+\textrm{S}_{\Omega}^{2}T_{z}^{2})\\},$
(37)

the constraint $\mathcal{B}_{\Omega}\geq\beta$ can be satisfied with the
measurement angle $\phi\geq\phi_{*}({\bf L},\Omega,\beta)$, where
$\cos^{2}(\phi_{*})=c_{*}^{2}({\bf L},\Omega,\beta)$ is given by

$c_{*}^{2}({\bf
L},\Omega,\beta)=\frac{(\beta^{2}-\textrm{S}_{\Omega}^{2}T_{x}^{2})(\textrm{C}_{\Omega}^{2}T_{x}^{2}+\textrm{S}_{\Omega}^{2}T_{z}^{2}-\beta^{2})}{\textrm{C}_{\Omega}^{2}(T_{z}^{2}-T_{x}^{2})(\textrm{S}_{\Omega}^{2}T_{z}^{2}+\textrm{S}_{\Omega}^{2}T_{x}^{2}-\beta^{2})}.$
(38)

The constraint on the angle only becomes trivial, $c_{*}^{2}=1$, on the
boundary of the region $\mathds{S}$, where
$(\textrm{C}_{\Omega}^{2}T_{z}^{2}+\textrm{S}_{\Omega}^{2}T_{x}^{2})=\beta^{2}$.

Second, in the region where
$(\textrm{C}_{\Omega}^{2}T_{z}^{2}+\textrm{S}_{\Omega}^{2}T_{x}^{2})>\beta^{2}$
the Bell score $\beta$ can also be attained with $\phi=0$. However, there
models provide less information to Eve as compared to these on the boundary
$(\textrm{C}_{\Omega}^{2}T_{z}^{2}+\textrm{S}_{\Omega}^{2}T_{x}^{2})=\beta^{2}$,
see the discussion at the end of App. A.4. So we can safely ignore this
region.

To find the best strategy for Eve, it thus remains to solve

$I(\beta;\Omega,q)=\max_{{\bf L}\in\mathds{S}(\Omega,\beta)}H({\bf
L})-H(E|\hat{a}=+1;c_{*}^{2}({\bf L},\Omega,\beta)).$ (39)

This optimization only involves an analytic function of three parameters on a
compact domain. It can be easily and time-efficiently solved heuristically by
standard numerical methods, e.g using fmincon on MATLAB, NMaximize on
Mathematica, or scipy.optimize on Python. We now give an ansatz on the
solution of the optimization given in Eq. (39), which allows one to speed up
its numerical resolution even further.

####  3.2.2 Ansatz

First, we observe that the vector ${\bf L}$ saturating Eve’s information only
has two non-zero coefficients $L_{1}=1-L_{3}$ and $L_{2}=L_{4}=0$, or
$T_{z}=1$ and $T_{x}=T_{p}$. With this observation, the previous optimization
problem becomes a scalar optimization, that is

$\begin{split}\tilde{I}_{\text{anz}}(\beta;\Omega,q)=&\max_{\frac{\beta^{2}-\textrm{S}_{\Omega}^{2}}{\textrm{C}_{\Omega}^{2}}\leq
T_{x}^{2}\leq\frac{\beta^{2}-\textrm{C}_{\Omega}^{2}}{\textrm{S}_{\Omega}^{2}}}\,h\left(\frac{1+T_{x}}{2}\right)\\\
&-h\left(\frac{1+\sqrt{T_{x}^{2}+c_{*}^{2}q(1-T_{x}^{2})}}{2}\right).\end{split}$
(40)

Second, we see that the bound $\tilde{I}_{\text{anz}}(\beta;\Omega,q)$ is not
concave for small $\beta$. However, we observe that its concave roof can be
obtained by drawing a line which passes through the point

$\begin{split}\beta&=\mathcal{B}_{\Omega}^{L}=\sin(\Omega)\\\
I_{L}(q)&=I(\mathcal{B}_{\Omega}^{L};\Omega,q)=1-h\left(\frac{1+\sqrt{q}}{2}\right)\end{split}$
(41)

which is tangent to the curve $\tilde{I}_{\text{anz}}(\beta;\Omega,q)$. The
value of the generalized CHSH score at the tangent point can be found by
solving

$\beta_{*}=\underset{\beta}{\text{argmin}}\frac{I_{L}(q)-\tilde{I}_{\text{anz}}(\beta;\Omega,q)}{\beta-\sin(\Omega)}.$
(42)

Labeling $I_{*}(\Omega,q)=\tilde{I}_{\text{anz}}(\beta_{*};\Omega,q)$, this
leads to the concave roof

$\widehat{I}_{\text{anz}}(\beta;\Omega,q)=\begin{cases}\frac{I_{*}(\Omega,q)(\beta-\sin(\Omega))-I_{L}(q)(\beta-\beta_{*})}{\beta_{*}-\sin(\Omega)}&\beta<\beta_{*}\\\
\tilde{I}_{\text{anz}}(\beta;\Omega,q)&\beta\geq\beta_{*}.\end{cases}$ (43)

At this stage, we further observe that the optimal value of $T_{x}^{2}$ for
values of $\beta\geq\beta_{*}$ coincides with its maximum possible value
$T_{x}^{2}=\frac{\beta^{2}-\textrm{C}_{\Omega}^{2}}{\textrm{S}_{\Omega}^{2}}$
(implying $c_{*}=1$). We thus define $I_{\text{anz}}(\beta;\Omega,q)$
accordingly. Interestingly, this expression coincides with the solution given
in Eq. (30) for the case $\Omega\leq\frac{\pi}{4}$, meaning in particular that
the optimal value of $\Omega$ for $I_{\text{anz}}$ is given by Eq. (33). In
the Eqs. (42) and (43) we can now replace
$\tilde{I}_{\text{anz}}(\beta;\Omega,q)$ with
$I_{\text{anz}}(\beta;\Omega,q)$, which does not involve any nonlinear
optimization.

While we believe this expression to be the true bound, we do not have a formal
proof. Anyway, this conjectured expression helps to solve the optimization of
interest.

####  3.2.3 Certified numerical solution

As mentioned before, the optimization in Eq. (39) can be easily solved by
standard numerical methods. However, to provide a strict security guarantee to
an actual implementation of DIQKD, such a numerical optimization would need to
be done in a certified manner, with a formal proof that the obtained numbers
lower bound Eve’s conditional entropy on the whole domain. Below we present an
algorithm which allows one to do such a certified optimisation based on the
Lipshitz continuity of the goal function. The algorithm is rather time-costly,
but it only has to be used once the optimal experimental parameters are fixed
through an ad hoc maximization of Eq. (39), cf. below.

Concretely, we present in this section an algorithm that approximates the set
of possible strategies of Eve, delimited by the bound
$\widehat{I}(\beta,\Omega,q)$, from the outside. To avoid the issue of
concavity posed by Eq. (24), we rewrite the problem in the dual form in which
we look for the tangent lines

$\begin{split}&f(t;\Omega,q)=\max_{{\bf
L},\phi}\,H(\rho_{E})-H(\rho_{E}|\hat{\textsf{{A}}_{0}})+t\,\beta_{\text{max}}({\bf
L,}\phi;\Omega)\\\ &\beta_{\text{max}}({\bf L},\phi;\Omega)=\max_{{\bf
a}_{1},{\bf b}_{0},{\bf b}_{1}}\mathcal{B}_{\Omega}({\bf L},\phi,{\bf
a}_{1},{\bf b}_{0},{\bf b}_{1}),\end{split}$ (44)

to the curve $\widehat{I}(\beta,\Omega,q)$ with different slopes $t$. In Eq.
(44) we used the fact that it is only the Bell score that depends on the
measurement setting ${\bf a}_{1},{\bf b}_{0},{\bf b}_{1}$, so it can be
maximized straightforwardly to define $\beta_{\text{max}}({\bf
L},\phi;\Omega)$, see App. A.6 for its closed form expression.

Before giving the details on the way we solve this dual form, let us shortly
discuss on how it shall be used. We consider an actual implementation of DIQKD
with fixed values of $\text{X}_{*}$,$\text{Y}_{*}$ and $q_{*}$ and for which
there is an optimal value $\Omega_{*}$ which saturates the minimum in Eq. (25)

$H(\hat{\textsf{{A}}_{0}}|E)\geq 1-\widehat{I}(\beta_{*};\Omega_{*},q_{*}),$
(45)

with
$\beta_{*}=\frac{1}{2}(\textrm{C}_{\Omega_{*}}\text{X}_{*}+\textrm{S}_{\Omega_{*}}\text{Y}_{*})$.
Therefore, an optimal security guarantee for this particular implementation
only requires the knowledge of the function
$\widehat{I}(\beta_{*},\Omega_{*},q_{*})$ on a single point. The same lower
bond on Eve’s conditional entropy can be obtained from the value of the dual
bound $f(t;\Omega_{*},q_{*})$ in Eq. (44) on a single point. Indeed, the
concavity of $\widehat{I}(\beta;\Omega,q)$ ensures that there exists a value
$t_{*}$ for which the inequality

$f(t_{*};\Omega_{*},q_{*})\geq\widehat{I}(\beta;\Omega_{*},q_{*})+t_{*}\beta$
(46)

is saturated at $\beta=\beta_{*}$ where
$f(t_{*};\Omega_{*},q_{*})=\widehat{I}(\beta;\Omega_{*},q_{*})+t_{*}\beta_{*}.$
Using Eq. (44), we deduce that

$\begin{split}H(\hat{\textsf{{A}}_{0}}|E)&\geq
1-f(t_{*};\Omega_{*},q_{*})+t_{*}\beta_{*}\\\
&=1-\widehat{I}(\beta_{*};\Omega_{*},q_{*}).\end{split}$ (47)

Hence, for a fixed experimental implementation of the protocol, it is
sufficient to certify a single value of the function
$f(t_{*};\Omega_{*},q_{*})$ in order to provide a strict and optimal security
guarantee. Furthermore, the value $t_{*}$ is straightforward to find from the
knowledge of $\Omega_{*},\beta_{*},q_{*}$ and the function
$\widehat{I}(\beta;\Omega,q)$.

We can now comment on the algorithm to provably upper bound the quantity in
Eq. (44). The basic idea is a branch and bound approach relying on the
Lipschitz continuity of the goal function. Concretely, we first derive a
parametrization of the set $({\bf L},\phi)$ for which the goal function in Eq.
(44) is Lipshitz continuous with a constant that we compute. Then, we obtain
an upper bound on its value on the whole domain by computing the value of the
function on a grid of points. Finally, the algorithm subsequently refines the
grid around the points where the value of the function is large in order to
approach, step by step, the global maximum. Additional details are given in
the next three sections.

We remark that another algorithm for solving this optimisation was recently
developed in a separate work [17], which we believe could be adapted to our
situation as well. The basic idea in that work is somewhat different – for
fixed measurement angles for Alice and Bob, they find a semidefinite
programming (SDP) relaxation for the minimization of Eve’s entropy with
respect to the state. This SDP is then solved on a grid of angles, and
continuity of the goal function with respect to the angles is used to certify
that the bound is secure. One advantage of the approach we propose here is
that it provably converges to a tight bound, whereas the SDP relaxation in
[17] is not known to be tight111Note that after the publication of this
manuscript, some of the authors have shown how to perform an SDP relaxation
that converges to a tight bound as well, see [27]..

##### Lipshitz continuity of the entropy with respect to the angle –

A key ingredient in the practical implementation of the desired certified
algorithm is that the von Neumann entropy $H(\rho)$ has a bounded rate of
change with respect to the angular distance between the two states $\rho$ and
$\sigma$ (see App. B.1),

$A(\rho,\sigma)=\arccos(F(\rho,\sigma)),$ (48)

where the fidelity is defined as
$F(\rho,\sigma)=\text{tr}|\sqrt{\rho}\,\sqrt{\sigma}|$. This angle is a metric
on the set of states [28]. We show that for $n$-dimensional quantum states,
the entropy satisfies

$\frac{\left|H(\rho)-H(\sigma)\right|}{A(\rho,\sigma)}<\begin{cases}\frac{4\sqrt{r_{1}(1-r_{1})}}{\ln(2)}\sqrt{n-1}&n\leq
4\\\ 2\log(n)&n\geq 5.\end{cases}$ (49)

where $r_{1}\approx 0.203$ (see Eq. (162) below for details). This contrasts
with the trace distance, another metric on the set of quantum states, for
which the entropy has infinite rate of change around non-full-rank states.

##### Bounding the gradient of the goal function–

To apply the continuity bound above to the goal function in Eq. (44), we use
the following parametrization of the state

$\sqrt{{\bf L}}=\left(\begin{array}[]{c}\cos(\alpha)\cos(\mu)\\\
\cos(\alpha)\sin(\mu)\\\ \sin(\alpha)\cos(\xi)\\\
\sin(\alpha)\sin(\xi)\end{array}\right),$ (50)

so that the quantum models are described by four angles

${\bf x}=(\alpha,\mu,\xi,\phi),$ (51)

with ${\bf x}\in[0,\frac{\pi}{4}]^{\times 3}\times[0,\frac{\pi}{2}]$. Here,
the condition $\mu,\xi\leq\frac{\pi}{4}$ follow from $L_{1}\geq L_{2}$,
$L_{3}\geq L_{4}$. The bound $\alpha\leq\frac{\pi}{4}$ is a consequence of
$L_{1}+L_{2}\geq L_{3}+L_{4}$, which can be imposed on the states as an
alternative to $L_{1}-L_{2}\geq L_{3}-L_{4}$, see App. A.1.

To obtain a bound on the gradient of the goal function

$G({\bf x})=H({\bf L})-H(\rho_{E}|\hat{a}=+1)+t\,\beta_{\text{max}}({\bf
L,}\phi;\Omega)$ (52)

we bound the gradient of each term independently, as described in App. B.2 and
B.3. For the entropic terms, we use Eq. (49), while the computation of the
maximal gradient is quite straightforward for the CHSH score. Combining the
three terms, we obtain a general bound

$|\nabla_{\bf x}G|\leq 12.7+7\,t$ (53)

on the whole domain of $\bf x$.

With this global bound on the gradient, a certified maximization of the
function $G({\bf x})$ can be obtained with a branch and bound approach. In
order to do so, we extended the code developed in Ref. [29] to include global
optimization. A detailed description of this code can be found in the App.
B.4. A python implementation as well as an example for our case of interest,
can be found on Gitlab222https://gitlab.com/plut0n/bcert.

##  4 Results

##### Improved bound on Eve’s conditional entropy–

In order to demonstrate the advantage of considering the pair of variables
$(\text{X},\text{Y})$ when bounding Eve’s conditional entropy, we compute the
bound on $H(\widehat{\textsf{{A}}}_{0}|E)$ for different values of X, Y and
$p$ and compare it to the bound obtained from the CHSH score [22]. Because of
the two regimes identified earlier, we compute both the optimal bound assuming
$\Omega\leq\pi/4$ and the one assuming $\Omega>\pi/4$ for each value of X and
Y, and keep the best one. In the case $\Omega\leq\pi/4$, the optimal choice of
$\Omega$ is readily given by Eq. (33). In the other case, we optimize the
bound over $\Omega\in(\pi/4,\pi/2]$. The difference between this optimal bound
on $H(\widehat{\textsf{{A}}}_{0}|E)$ given $X$ and $Y$ and Eq. (3) is shown in
Fig. 1. It shows that our bound on $H(\widehat{\textsf{{A}}}_{0}|E)$ is better
than the one derived from the CHSH score, except along the line satisfying
$\text{X}(\text{X}+\text{Y})=4$. We emphasise that our derivation of the bound
is constructive, that is we find the optimal attack that gives
$H(\widehat{\textsf{{A}}}_{0}|E)$ to Eve. The final bound is thus tight, up to
the precision of the numerical algorithms for $\Omega>\frac{\pi}{4}$.

Figure 1: Difference between the bound on Eve’s conditional entropy
$H(\widehat{\textsf{{A}}}_{0}|E)$ computed as a function of X and Y, and as a
function of the CHSH quantity $S=\text{X}+\text{Y}$, for $p=0$. In the
presence of noisy preprocessing (i.e. $p>0$), the advantage follows a similar
distribution, but is smaller in magnitude. The CHSH bound is only optimal
along the curve $\text{X}(\text{X}+\text{Y})=4$. The advantage on the right-
hand side of this curve is obtained with $\Omega<\pi/4$, and on the left-hand
side with $\Omega>\pi/4$. The yellow (red) curve shows the trajectory in the
X-Y plane which optimizes the key rate in an optical implementation of DIQKD
for low (high) detection efficiencies. At the efficiency $\eta=0.923$, it is
better to switch from one curve to the other one (at the transition between
full and dashed curves). The points with $\Omega>\pi/4$ were computed both
with the heuristic method and with the ansatz described in Sec. 3.2.

##### Implication for a practical realization of DIQKD–

We now study the potential impact of our bound on practical realizations of
DIQKD. In the limit of asymptotically many repetitions, an implementation is
uniquely characterized by its key rate $r,$ which is given in Eq. (2). In our
case, this key rate is determined from three quantities: X, Y and Bob’s
uncertainty about Alice’s key generating bit as a function of the noisy
preprocessing parameter, given by
$H(\widehat{\textsf{{A}}}_{0}|\textsf{{B}}_{2})$. Hence, in order to find the
optimal design for an experimental implementation of DIQKD, we express the
quantities

$\text{setup}\simeq\big{(}\text{X},\text{Y},H(\hat{\textsf{{A}}_{0}}|\textsf{{B}}_{2})\big{)}$
(54)

as a function of the model’s parameters. Then, we maximize the key rate over
these parameters:

$\small\begin{split}\check{r}&=\max_{\text{setup},\Omega,q}H(\widehat{\textsf{{A}}}_{0}|E)-H(\widehat{\textsf{{A}}}_{0}|\textsf{{B}}_{2})\\\
&=\max_{\text{setup},\Omega,q}1-\widehat{I}\left(\frac{\textrm{C}_{\Omega}\text{X}+\textrm{S}_{\Omega}\text{Y}}{2};\Omega,q\right)-H(\hat{\textsf{{A}}_{0}}|\textsf{{B}}_{2})\end{split}$
(55)

Solving this maximization gives a bound on the key rate $\check{r}$, the
values
$\big{(}\text{X}_{*},\text{Y}_{*},H(\widehat{\textsf{{A}}}_{0}|\textsf{{B}}_{2})\big{)}$
expected for a given implementation, as well as the optimal values of the
parameters $\Omega_{*}$ and $q_{*}$ for this implementation.

##### SPDC-based implementation of DIQKD–

Photonic experiments using a source based on spontaneous parametric down
conversion (SPDC) are one of the most promising setups for implementing DIQKD,
as shown by recent experiments reporting on the violation of a Bell inequality
without the fair sampling assumption [30, 31, 32, 33, 34, 35]. We consider
such a setup in which an SPDC source is used to create and distribute
polarization entanglement between distant parties who perform measurements as
requested here in the proposed protocol. The main limitation in this setup is
the overall detection efficiency, i.e. the possibility of losing a photon at
any point between its creation at the source and its final detection. To
reflect photon losses and non-unit detection efficiency, the transmission
channel between the source and the parties is modeled as a lossy channel with
an overall transmission $\eta$. It is also important to include the statistics
of an SPDC source which does not produce a two-qubit state, but a state that
contains vacuum and multiple photon components. We invite the reader to look
at Ref. [22] to get explicit expressions of the exact statistics created by
this source as well as a description of tunable parameters.

When computing the key rate for an SPDC source with a security determined by
the CHSH score, any values of X and Y with the same sum impose the same bound
on Eve’s conditional entropy $H(\widehat{\textsf{{A}}}_{0}|E)$. In a Eberhard-
like scenario where a significant fraction of the entangled particles can be
lost before yielding their measurement result, it is advantageous for Alice to
use two measurement settings with different overlap with her Schmidt basis in
order to maximize the CHSH quantity [36]. It is then easier for Bob to guess
the outcome of one of the two measurements (the one best aligned with the
Schmidt basis). When the key rate is extracted from this measurement to
minimize the cost of error correction (see Ref. [22] for more details), the
value of the X quantity is then larger than Y, as shown in Fig. 1. But in this
case, the (X,Y) values are very close to the line
$\text{X}(\text{X}+\text{Y})=4$, for which there is no advantage. Therefore,
we only expect a small improvement in the key rate here.

Given the values shown in Fig. 1, a better bound on Eve’s information would be
obtained if the same CHSH value was obtained with the contributions from X and
Y being inverted, i.e. with $\text{Y}>\text{X}$. However, this requires Alice
to define her key-generating measurement as being the one less aligned with
the Schmidt basis, hence leading to an increase of the error correction cost.
In this case, both conditional entropies $H(\widehat{\textsf{{A}}}_{0}|E)$ and
$H(\widehat{\textsf{{A}}}_{0}|{\textsf{{B}}}_{2})$ are larger, and we need to
check which one increases the most in order to infer a possible gain on the
key rate. As it turns out, the tradeoff between these two entropies increase
depends on the detection efficiency.

Figure 2: Key rate achievable with a photonic setup as a function of the
symmetric detection efficiency $\eta$. The dashed blue curve corresponds to
the key rate achieved with noisy preprocessing and a security based on the
CHSH quantity alone; it is nonzero for efficiencies above $\sim$0.828 [22].
The continuous red curve bases its security on the values of both X and Y (and
also includes noisy preprocessing). A significant increase of the key rate is
possible for efficiencies above $\eta>0.923$. At $\eta=1$, the obtained key
rate is 0.346 instead of 0.252.

Namely, there are two regimes, as shown in Fig. 2. When the detection
efficiency is larger than $\sim 0.923$, relabelling the measurements in order
to enter the region with $\text{Y}>\text{X}$ (where inequalities with
$\Omega>\pi/4$ significantly improve the bound on
$H(\widehat{\textsf{{A}}}_{0}|E)$) is advantageous, because the increase in
Bob’s uncertainty $H(\widehat{\textsf{{A}}}_{0}|\textsf{{B}}_{2})$ is smaller.
The red curve in Fig. 1 shows the corresponding trajectory in the X-Y plane.
When $\eta<0.923$, the cost of error correction become prohibitive compared to
the potential increase in Eve’s uncertainty, and it is better to stay in the
region $\text{X}>\text{Y}$, as represented by the yellow curve in Fig. 1.
There, a small increase of the key rate is still found because the
correlations do not satisfy $\text{X}(\text{X}+\text{Y})=4$ exactly. However,
this condition is only slightly violated, resulting in an increase in key rate
smaller than $\sim 10^{-4}$, which is practically negligible. The critical
detection efficiency then also remains at $\sim 83\%$, unchanged compared to a
bound based on CHSH alone.

##### Comparison of qubit vs SPDC bounds–

To illustrate the impact of the photon statistics of SPDC sources on DIQKD, we
now consider a simpler model in which the state shared between Alice and Bob
is a two-qubit state:

$\left|{\psi}\right\rangle=\cos(\theta)\left|{00}\right\rangle+\sin(\theta)\left|{11}\right\rangle.$
(56)

We are not aware of physical setups allowing one to produce a state with
$\theta=\pi/4$ but not allowing for a different value of $\theta$. Still, for
the sake of the discussion, we distinguish between the cases where the state
can be either constrained to be maximally entangled, i.e. $\theta=\pi/4$, or
can have an arbitrary parameter $\theta\in[0,\pi/4]$.

Keyrate formula | Singlet | Qubit | SPDC
---|---|---|---
$1-I(\beta;\frac{\pi}{4},0)-h(Q)$ | 0.923 | 0.893 | 0.927
$1-I(\beta;\frac{\pi}{4},0)-H(\textsf{{A}}_{0}|\textsf{{B}}_{2})$ | 0.908 | 0.865 | 0.909
$1-I(\beta;\frac{\pi}{4},q)-H(\textsf{{A}}_{0}|\textsf{{B}}_{2})$ | 0.903 | 0.826 | 0.826
$1-I(\beta;\Omega,q)-H(\textsf{{A}}_{0}|\textsf{{B}}_{2})$ | 0.900 | 0.826 | 0.826

Table 1: Critical detection efficiencies for various states and protocols.
Here, $Q$ is the quantum bit error rate (QBER). These thresholds are compared
in Fig. 3.

In Tab. 1, see also Fig. 3, we report the critical detection efficiencies
corresponding to various security analyses applied on these implementations.
Like for the SPDC model, no advantage on the critical detection efficiency is
found when using arbitrary two-qubit systems. A small advantage is however
present when restricting to measurements on the singlet state. Still, this
model is not optimal and it remains of course better to use partially
entangled states. In fact, even partially entangled states produced by an SPDC
source perform better.

In this respect, it is worth noticing here that the performance of an SPDC
source is essentially comparable to that of an arbitrary two-qubit state once
noisy preprocessing is taken into consideration, i.e. the requirement on the
detection efficiency is very similar. In the case without noisy preprocessing,
the state produced by these physical sources do not have a better tolerance to
losses than measurements on a maximally entangled state. This suggests that
noisy preprocessing is a key ingredient for a first proof of principle
implementation with an SPDC source [22].

Figure 3: Comparison of the critical detection efficiencies for several setup
models. Blue markers are for SPDC statistics, yellow ones for measurement on a
maximally entangled two-qubit state, and red ones for measurement on an
arbitrary two-qubit state. The four protocols of Tab. 1 are considered here:
the security of (a) is based on the CHSH value following Eq. (3) and error
correction based on the QBER [21], (b) Eq. (3) with error correction based on
conditional entropy $H(A|B)$ [37], (c) security from CHSH with noisy
preprocessing and error correction based on $H(A|B)$ following [22], (d)
security from X and Y with noisy preprocessing and error correction based on
$H(A|B)$.

##  5 Discussion

In this paper, we introduced a refinement of the usual CHSH-based analysis of
DIQKD experiments: Instead of projecting the measurement statistics onto a
single line giving the CHSH score $\text{X}+\text{Y}$, we kept the information
about the individual values of X and Y throughout the whole security analysis.
We found that this refined analysis gives a more restrictive bound on the
information available to the eavesdropper for almost all values X and Y in the
quantum set.

When applying our results to photonic implementations of DIQKD with a SPDC
source, we found that the key rate is improved by a factor going up to 37% for
unit detection efficiency. On the other hand, we could not find any
improvement for the critical detection efficiency as compared to the CHSH
protocol with noisy processing presented in Ref. [22]. However, we focused on
a given photonic implementation, and the question of the most favorable
optical setup combining squeezing operations, displacement operations, linear
optical elements and photon counting techniques is still open. Advanced
techniques using automated design of quantum experiments based on
reinforcement learning which already proved to be useful to optimize the CHSH
score [38] are inspiring. Applying them to the proposed protocol in order to
reduce the required detection efficiency for implementing DIQKD appears to be
promising for future work.

Finally, we would like to remark that the certified numerical techniques we
proposed also open up the possibility of bounding Eve’s information reliably
when more correlators, or even the full measurement statistics, are taken into
account.

##  6 Note added

While writing this manuscript, we became aware of another manuscript [26]
reporting on similar results.

##  7 Acknowledgments

We thank Stefano Pironio for pointing out that the convexity argument provided
in [22] was not complete, see the discussion in Sec. 3.1 and App. A.5. We
acknowledge funding by the Swiss National Science Foundation (SNSF), through
the Grants PP00P2-179109 as well as via the National Center for Competence in
Research for Quantum Science and Technology (QSIT).

## References

  * [1] Artur K. Ekert  “Quantum cryptography based on Bell’s theorem”  In _Phys. Rev. Lett._ 67 American Physical Society, 1991, pp. 661–663  DOI: 10.1103/PhysRevLett.67.661
  * [2] Rotem Arnon-Friedman et al.  “Practical device-independent quantum cryptography via entropy accumulation”  In _Nature Communications_ 9.1 Nature Publishing Group, 2018, pp. 459  DOI: 10.1038/s41467-017-02307-4
  * [3] Igor Devetak and Andreas Winter  “Distillation of secret key and entanglement from quantum states”  In _Proc. R. Soc. Lond. A_ 461, 2005, pp. 207–235  DOI: 10.1098/rspa.2004.1372
  * [4] Antonio Acín, Nicolas Gisin and Lluis Masanes  “From Bell’s Theorem to Secure Quantum Key Distribution”  In _Phys. Rev. Lett._ 97 American Physical Society, 2006, pp. 120405  DOI: 10.1103/PhysRevLett.97.120405
  * [5] Yi Zhao et al.  “Quantum hacking: Experimental demonstration of time-shift attack against practical quantum-key-distribution systems”  In _Phys. Rev. A_ 78 American Physical Society, 2008, pp. 042333  DOI: 10.1103/PhysRevA.78.042333
  * [6] Lars Lydersen et al.  “Hacking commercial quantum cryptography systems by tailored bright illumination”  In _Nature Photonics_ 4, 2010, pp. 686–689  DOI: 10.1038/nphoton.2010.214
  * [7] Henning Weier et al.  “Quantum eavesdropping without interception: an attack exploiting the dead time of single-photon detectors”  In _New Journal of Physics_ 13.7 IOP Publishing, 2011, pp. 073024  DOI: 10.1088/1367-2630/13/7/073024
  * [8] Juan Carlos Garcia-Escartin, Shihan Sajeed and Vadim Makarov  “Attacking quantum key distribution by light injection via ventilation openings”  In _preprint arXiv:1910.08152_ , 2019
  * [9] Samuel L. Braunstein and Stefano Pirandola  “Side-Channel-Free Quantum Key Distribution”  In _Phys. Rev. Lett._ 108 American Physical Society, 2012, pp. 130502  DOI: 10.1103/PhysRevLett.108.130502
  * [10] Hoi-Kwong Lo, Marcos Curty and Bing Qi  “Measurement-Device-Independent Quantum Key Distribution”  In _Phys. Rev. Lett._ 108 American Physical Society, 2012, pp. 130503  DOI: 10.1103/PhysRevLett.108.130503
  * [11] A. Rubenok et al.  “Real-World Two-Photon Interference and Proof-of-Principle Quantum Key Distribution Immune to Detector Attacks”  In _Phys. Rev. Lett._ 111 American Physical Society, 2013, pp. 130501  DOI: 10.1103/PhysRevLett.111.130501
  * [12] T. Silva et al.  “Proof-of-principle demonstration of measurement-device-independent quantum key distribution using polarization qubits”  In _Phys. Rev. A_ 88 American Physical Society, 2013, pp. 052303  DOI: 10.1103/PhysRevA.88.052303
  * [13] Yang Liu et al.  “Experimental Measurement-Device-Independent Quantum Key Distribution”  In _Phys. Rev. Lett._ 111 American Physical Society, 2013, pp. 130502  DOI: 10.1103/PhysRevLett.111.130502
  * [14] Zhiyuan Tang et al.  “Experimental Demonstration of Polarization Encoding Measurement-Device-Independent Quantum Key Distribution”  In _Phys. Rev. Lett._ 112 American Physical Society, 2014, pp. 190503  DOI: 10.1103/PhysRevLett.112.190503
  * [15] L. Comandar, M. Lucamarini and B. et al. Fröhlich  “Quantum key distribution without detector vulnerabilities using optically seeded lasers”  In _Nature Photon_ 10, 2016, pp. 312–315  DOI: 10.1038/nphoton.2016.50
  * [16] Xavier Valcarce, Julian Zivy, Nicolas Sangouard and Pavel Sekatski  “Self-testing two-qubit maximally entangled states from generalized CHSH tests”  In _preprint arXiv:2011.03047_ , 2020
  * [17] Rene Schwonnek et al.  “Robust Device-Independent Quantum Key Distribution”  In _preprint arXiv:2005.02691_ , 2020
  * [18] Antonio Acín, Serge Massar and Stefano Pironio  “Randomness versus Nonlocality and Entanglement”  In _Phys. Rev. Lett._ 108 American Physical Society, 2012, pp. 100402  DOI: 10.1103/PhysRevLett.108.100402
  * [19] Camille Jordan  “Essai sur la géométrie à $n$ dimensions”  In _Bulletin de la Société mathématique de France_ 3, 1875, pp. 103–174
  * [20] Ivan Šupić and Joseph Bowles  “Self-testing of quantum systems: a review”  In _Quantum_ 4 Verein zur Forderung des Open Access Publizierens in den Quantenwissenschaften, 2020, pp. 337  DOI: 10.22331/q-2020-09-30-337
  * [21] Stefano Pironio et al.  “Device-independent quantum key distribution secure against collective attacks”  In _New Journal of Physics_ 11.4 IOP Publishing, 2009, pp. 045021  DOI: 10.1088/1367-2630/11/4/045021
  * [22] M. Ho et al.  “Noisy Preprocessing Facilitates a Photonic Realization of Device-Independent Quantum Key Distribution”  In _Phys. Rev. Lett._ 124 American Physical Society, 2020, pp. 230502  DOI: 10.1103/PhysRevLett.124.230502
  * [23] Renato Renner, Nicolas Gisin and Barbara Kraus  “Information-theoretic security proof for quantum-key-distribution protocols”  In _Physical Review A_ 72.1 APS, 2005, pp. 012332  DOI: 10.1103/PhysRevA.72.012332
  * [24] B. Kraus, N. Gisin and R. Renner  “Lower and Upper Bounds on the Secret-Key Rate for Quantum Key Distribution Protocols Using One-Way Classical Communication”  In _Phys. Rev. Lett._ 95 American Physical Society, 2005, pp. 080501  DOI: 10.1103/PhysRevLett.95.080501
  * [25] Joseph M. Renes and Graeme Smith  “Noisy Processing and Distillation of Private Quantum States”  In _Phys. Rev. Lett._ 98 American Physical Society, 2007, pp. 020502  DOI: 10.1103/PhysRevLett.98.020502
  * [26] Erik Woodhead, Antonio Acín and Stefano Pironio  “Device-independent quantum key distribution based on asymmetric CHSH inequalities”  In _preprint arXiv:2007.16146_ , 2020
  * [27] Ernest Y-Z Tan et al.  “Improved DIQKD protocols with finite-size analysis”  In _arXiv preprint arXiv:2012.08714_ , 2020
  * [28] Michael A. Nielsen and Isaac L. Chuang  “Quantum Computation and Quantum Information: 10th Anniversary Edition”  USA: Cambridge University Press, 2011
  * [29] Xavier Valcarce et al.  “What is the minimum CHSH score certifying that a state resembles the singlet?”  In _Quantum_ 4 Verein zur Förderung des Open Access Publizierens in den Quantenwissenschaften, 2020, pp. 246  DOI: 10.22331/q-2020-03-23-246
  * [30] Marissa Giustina et al.  “Bell violation using entangled photons without the fair-sampling assumption”  In _Nature_ 497.7448 Nature Publishing Group, 2013, pp. 227  DOI: 10.1038/nature12012
  * [31] BG Christensen et al.  “Detection-loophole-free test of quantum nonlocality, and applications”  In _Physical review letters_ 111.13 APS, 2013, pp. 130406  DOI: 10.1103/PhysRevLett.111.130406
  * [32] Lynden K Shalm et al.  “Strong loophole-free test of local realism”  In _Physical review letters_ 115.25 APS, 2015, pp. 250402  DOI: 10.1103/PhysRevLett.115.250402
  * [33] Marissa Giustina et al.  “Significant-loophole-free test of Bell’s theorem with entangled photons”  In _Physical review letters_ 115.25 APS, 2015, pp. 250401  DOI: 10.1103/PhysRevLett.115.250401
  * [34] Lijiong Shen et al.  “Randomness extraction from bell violation with continuous parametric down-conversion”  In _Physical review letters_ 121.15 APS, 2018, pp. 150402  DOI: 10.1103/PhysRevLett.121.150402
  * [35] Yang Liu et al.  “Device-independent quantum random-number generation”  In _Nature_ 562.7728 Nature Publishing Group, 2018, pp. 548  DOI: 10.1038/s41586-018-0559-3
  * [36] Philippe H. Eberhard  “Background level and counter efficiencies required for a loophole-free Einstein-Podolsky-Rosen experiment”  In _Phys. Rev. A_ 47 American Physical Society, 1993, pp. R747–R750  DOI: 10.1103/PhysRevA.47.R747
  * [37] Xiongfeng Ma and Norbert Lütkenhaus  “Improved Data Post-Processing in Quantum Key Distribution and Application to Loss Thresholds in device independent QKD”  In _Quantum Inf. Comput._ 12, 2012, pp. 203–214  DOI: https://doi.org/10.26421/QIC12.3-4
  * [38] Alexey A. Melnikov, Pavel Sekatski and Nicolas Sangouard  “Setting Up Experimental Bell Tests with Reinforcement Learning”  In _Phys. Rev. Lett._ 125 American Physical Society, 2020, pp. 160401  DOI: 10.1103/PhysRevLett.125.160401
  * [39] Erik Woodhead  “Tight asymptotic key rate for the Bennett-Brassard 1984 protocol with local randomization and device imprecisions”  In _Phys. Rev. A_ 90 American Physical Society, 2014, pp. 022306  DOI: 10.1103/PhysRevA.90.022306
  * [40] L. Mirsky  “A trace inequality of John von Neumann”  In _Monatshefte für Mathematik_ 79.4 Springer ScienceBusiness Media LLC, 1975, pp. 303–306  DOI: 10.1007/bf01647331

##  Appendix A Analytical results

###  A.1 Parametrization of two-qubit models

Following the logic of [21], we assume, without loss of generality that after
the qubit reduction, the state shared by Alice, Bob and Eve is of the form

$\left|{\Psi}\right\rangle_{ABE}=\sum_{i=1}^{4}\sqrt{L_{i}}\left|{\Phi^{i}}\right\rangle_{AB}\left|{i}\right\rangle_{E}$
(57)

where we
$\left|{\Phi_{i}}\right\rangle=\\{\Phi^{+},\Psi^{-},\Phi^{-},\Psi^{+}\\}_{i=1}^{4}$,
with nonnegative $L_{1}\geq L_{2}$ and $L_{3}\geq L_{4}$, and the measurements
$A_{x}$, $B_{y}$ appearing in the constraint are in the x-z plane

$A_{x}={\bf a}_{x}^{T}\binom{\sigma_{z}}{\sigma_{x}}\qquad B_{y}={\bf
b}_{y}^{T}\binom{\sigma_{z}}{\sigma_{x}}.$ (58)

The key generating setting is explicitly parametrized by an angle $\phi$

${\bf a}_{0}=\binom{\textrm{C}_{\phi}}{\textrm{S}_{\phi}}.$ (59)

(As mentioned in the main text we use a compact notation
$\textrm{C}_{\phi}=\cos(\phi)$ and $\textrm{S}_{\phi}=\sin(\phi)$ throughout
the paper.) One notes that the application of a unitary transformation
$\sigma_{Z}$ on Alice’s system is equivalent to changing the state and the
measurements as

$\begin{split}(L_{1},L_{2},L_{3},L_{4})&\to(L_{3},L_{4},L_{1},L_{2})\\\ {\bf
a}_{x}&\to\sigma_{z}{\bf a}_{x}\\\ {\bf b}_{y}&\to{\bf b}_{y}.\end{split}$
(60)

The two situations are completely equivalent for our purpose, so our
parametrization of quantum models is actually redundant. To avoid this, we can
introduce an order relation between the pairs of coefficients $(L_{1},L_{2})$
and $(L_{3},L_{4})$ (permuted by a basis transformation). In particular, we
will impose

$L_{1}-L_{2}\geq L_{3}-L_{4}$ (61)

below, but will also use $L_{1}+L_{2}\geq L_{3}+L_{4}$ for the certified
numerical algorithm.

We also introduce a different parametrization of the probability simplex $\bf
L$ with a vector ${\bf T}=(T_{z},T_{x},T_{p})$ given by

$\begin{cases}T_{z}=(L_{1}-L_{2})+(L_{3}-L_{4})\\\
T_{x}=(L_{1}-L_{2})-(L_{3}-L_{4})\\\
T_{p}=L_{1}+L_{2}-L_{3}-L_{4}.\end{cases}$ (62)

The conditions $L_{1}\geq L_{2},L_{3}\geq L_{4}$ and $L_{1}-L_{2}\geq
L_{3}-L_{4}$ enforce

$\begin{split}0\leq T_{x}&\leq T_{z}\leq 1\\\ T_{z}+T_{x}-1\leq&\ T_{p}\leq
1-(T_{z}-T_{x}).\end{split}$ (63)

###  A.2 Entropies of $\rho_{E|\hat{a}=\pm 1}$

Having introduced a parametrization of quantum models, we now express the
quantities of interest $H(\rho_{E}),H(\rho_{E}|\hat{\textsf{{A}}_{0}})$ and
$B_{\Omega}$ as functions of the distribution $\bf L$ describing the state
$\left|{\Psi}\right\rangle_{ABE}$ and the measurement settings ${\bf
a}_{x},{\bf b}_{y}$. The marginal state of Eve is straightforward to write
down:

$\rho_{E}=\left(\begin{array}[]{cccc}L_{1}&&&\\\ &L_{2}&&\\\ &&L_{3}&\\\
&&&L_{4}\end{array}\right).$ (64)

For the conditional states, we have

$\rho_{E|\hat{a}=+1}=2\,\text{tr}_{AB}\frac{1+\hat{A}_{0}}{2}\otimes\mathds{1}_{BE}\mathinner{|{\Psi}\rangle}\\!\\!\mathinner{\langle{\Psi}|}_{ABE}=\left(\begin{array}[]{cccc}L_{1}&0&\textrm{C}_{\phi}\sqrt{L_{1}L_{3}q}&\textrm{S}_{\phi}\sqrt{L_{1}L_{4}q}\\\
0&L_{2}&\textrm{S}_{\phi}\sqrt{L_{2}L_{3}q}&-\textrm{C}_{\phi}\sqrt{L_{2}L_{4}q}\\\
\textrm{C}_{\phi}\sqrt{L_{1}L_{3}q}&\textrm{S}_{\phi}\sqrt{L_{2}L_{3}q}&L_{3}&0\\\
\textrm{S}_{\phi}\sqrt{L_{1}L_{4}q}&-\textrm{C}_{\phi}\sqrt{L_{2}L_{4}q}&0&L_{4}\\\
\end{array}\right),$ (65)

where the factor of two arises because the probability to observe the outcome
$\hat{\textsf{{A}}_{0}}=1$ is simply $\frac{1}{2}$. The conditional state for
the other outcome $\hat{\textsf{{A}}_{0}}=-1$ can be easily obtained by
noticing that the two outcomes are interchanged by a mapping
$\hat{A}_{0}\to-\hat{A}_{0}$, i.e. with the inversion of the vector
$\binom{\textrm{C}_{\phi}}{\textrm{S}_{\phi}}\to-\binom{\textrm{C}_{\phi}}{\textrm{S}_{\phi}}.$
Consequently, we have

$\rho_{E|\hat{a}=-1}=\left(\begin{array}[]{cccc}1&&&\\\ &1&&\\\ &&-1&\\\
&&&-1\end{array}\right)\rho_{E|\hat{a}=1}\left(\begin{array}[]{cccc}1&&&\\\
&1&&\\\ &&-1&\\\ &&&-1\end{array}\right).$ (66)

It follows that the entropies of both conditional states are equal and

$H(\rho_{E}|\hat{\textsf{{A}}_{0}})=\frac{1}{2}H(\rho_{E|\hat{a}=+1})+\frac{1}{2}H(\rho_{E|\hat{a}=-1})=H(\rho_{E|\hat{a}=+1}).$
(67)

Analogously to Eq. (66), there are unitary transformations (with different
positions of $1$ and $-1$ on the diagonal) that correspond to the
transformations
$\binom{\textrm{C}_{\phi}}{\textrm{S}_{\phi}}\to\binom{-\textrm{C}_{\phi}}{\textrm{S}_{\phi}}$
and
$\binom{\textrm{C}_{\phi}}{\textrm{S}_{\phi}}\to\binom{\textrm{C}_{\phi}}{-\textrm{S}_{\phi}}$.
This implies that $H(\rho_{E}|\hat{\textsf{{A}}_{0}})$ and
$H(\hat{\textsf{{A}}_{0}}|E)$ do not depend on these sign changes, i.e. they
are only functions of $\textrm{C}_{\phi}^{2}$ and $\textrm{S}_{\phi}^{2}$.

###  A.3 Optimal key generating setting ${\bf a}_{0}$

In this section, we give the minimal angle $\phi$ for which constraint
$\mathcal{B}_{\Omega}\geq\beta$ can be fulfilled for a given $\bf L$. We first
focus on the possible values of $\phi.$ The expected Bell score is
straightforward to compute:

$\begin{split}\mathcal{B}_{\Omega}&=\frac{1}{2}\text{tr}\left(\left(\left(\textrm{C}_{\Omega}A_{0}\otimes(B_{0}+B_{1})+\textrm{S}_{\Omega}A_{1}\otimes(B_{0}-B_{1})\right)\otimes\mathds{1}_{E}\right)\mathinner{|{\Psi}\rangle}\\!\\!\mathinner{\langle{\Psi}|}_{ABE}\right)\\\
&=\frac{1}{2}\textrm{C}_{\Omega}\,{\bf
a}_{0}^{T}\left(\begin{array}[]{cc}T_{z}&\\\ &T_{x}\end{array}\right)({\bf
b}_{0}+{\bf b}_{1})+\frac{1}{2}\textrm{S}_{\Omega}\,{\bf
a}_{1}^{T}\left(\begin{array}[]{cc}T_{z}&\\\ &T_{x}\end{array}\right)({\bf
b}_{0}-{\bf b}_{1})\end{split}$ (68)

From this expression we notice that any of the following transformations of
the key generating setting:

${\bf a}_{0}\to\left(\begin{array}[]{cc}(-1)^{s_{1}}&\\\
&(-1)^{s_{2}}\end{array}\right){\bf a}_{0},$ (69)

with $s_{1},s_{2}\in\\{0,1\\}$ can be compensated by applying the same
transformation to the remaining settings ${\bf a}_{1}$, ${\bf b}_{y}$ to give
the same Bell score $\mathcal{B}_{\Omega}$. Furthermore, we have seen that
this transformation does not change Eve’s conditional entropy
$H(\hat{\textsf{{A}}_{0}}|E)$. Therefore we can always restrict ${\bf a}_{0}$
to the positive quadrant of the circle

$\phi\in[0,\frac{\pi}{2}]$ (70)

without loss of generality. We now express the Bell score with Bob’s settings
parametrized as in Eq. (21):

$\mathcal{B}_{\Omega}=\left\langle\textrm{C}_{\Omega}\textrm{C}_{\theta}\,{\bf
a}_{0}\cdot\binom{Z}{X}\otimes{\bf
c}\cdot\binom{Z}{X}+\textrm{S}_{\Omega}\textrm{S}_{\theta}\,{\bf
a}_{1}\cdot\binom{Z}{X}\otimes{\bf c}_{\perp}\cdot\binom{Z}{X}\right\rangle.$
(71)

Computing the expected value of the operators on our Bell diagonal state gives

$\mathcal{B}_{\Omega}=\textrm{C}_{\Omega}\textrm{C}_{\theta}\,{\bf
a}_{0}^{T}\left(\begin{array}[]{cc}T_{z}&\\\ &T_{x}\\\ \end{array}\right){\bf
c}+\textrm{S}_{\Omega}\textrm{S}_{\theta}\,{\bf
a}_{1}^{T}\left(\begin{array}[]{cc}T_{z}&\\\ &T_{x}\\\ \end{array}\right){\bf
c}_{\perp}.$ (72)

We introduce an angle $\gamma$ to parametrize the vectors ${\bf c}$ and ${\bf
c}_{\perp}$:

${\bf c}=\binom{\textrm{C}_{\gamma}}{\textrm{S}_{\gamma}},\quad{\bf
c}_{\perp}=\binom{-\textrm{S}_{\gamma}}{\textrm{C}_{\gamma}}.$ (73)

The maximization with the second setting of Alice is straightforward, that is

$\max_{{\bf a}_{1}}\,\textrm{S}_{\theta}{\bf
a}_{1}^{T}\left(\begin{array}[]{cc}T_{z}&\\\ &T_{x}\\\ \end{array}\right){\bf
c}_{\perp}=\|\textrm{S}_{\theta}\left(\begin{array}[]{cc}T_{z}&\\\ &T_{x}\\\
\end{array}\right){\bf
c}_{\perp}\|=|\textrm{S}_{\theta}|\sqrt{T_{z}^{2}\textrm{S}_{\gamma}^{2}+T_{x}^{2}\textrm{C}_{\gamma}^{2}}.$
(74)

The Bell score (optimized with respect to ${\bf a}_{1}$) becomes

$\mathcal{B}_{\Omega}=\textrm{C}_{\Omega}\textrm{C}_{\theta}\,\binom{\textrm{C}_{\phi}}{\textrm{S}_{\phi}}^{T}\\!\\!\left(\begin{array}[]{cc}T_{z}&\\\
&T_{x}\\\
\end{array}\right)\binom{\textrm{C}_{\gamma}}{\textrm{S}_{\gamma}}+\textrm{S}_{\Omega}|\textrm{S}_{\theta}|\sqrt{T_{z}^{2}\textrm{S}_{\gamma}^{2}+T_{x}^{2}\textrm{C}_{\gamma}^{2}}.$
(75)

Since $T_{z},T_{x}\geq 0$ and $\phi,\Omega\in[0,\frac{\pi}{2}]$, we can also
restrict the angle $\theta$ and $\gamma$ to the interval $[0,\frac{\pi}{2}]$
without loss of generality, and drop the absolute value:
$|\textrm{S}_{\theta}|=\textrm{S}_{\theta}$. The constraint
$\mathcal{B}_{\Omega}\geq\beta$ takes the form

$\textrm{C}_{\Omega}\,\binom{\textrm{C}_{\phi}}{\textrm{S}_{\phi}}^{T}\\!\\!\left(\begin{array}[]{cc}T_{z}&\\\
&T_{x}\\\
\end{array}\right)\binom{\textrm{C}_{\gamma}}{\textrm{S}_{\gamma}}\geq\frac{\beta-\textrm{S}_{\Omega}\textrm{S}_{\theta}\sqrt{T_{z}^{2}\textrm{S}_{\gamma}^{2}+T_{x}^{2}\textrm{C}_{\gamma}^{2}}}{\textrm{C}_{\theta}}.$
(76)

Recall that we wish to find the minimal $\phi$ for which this inequality can
be fulfilled for at least one value of the free parameters $\theta$ and
$\gamma$. We observe that if the right hand side (RHS) can become zero or
negative by some choice of $\theta$ and $\gamma$, the constraint becomes
trivial. Since $T_{z}\geq T_{x}$, this is possible for

$\beta^{2}\leq\textrm{S}_{\Omega}^{2}T_{z}^{2}\implies\phi_{*}=0.$ (77)

In the following we assume that this is not the case, i.e.
$\beta^{2}>\textrm{S}_{\Omega}^{2}T_{z}^{2}$. The angle $\theta$ only appears
on the right of the inequality, so to satisfy the inequality our best choice
is to minimize the RHS with respect to $\theta$. The expression

$\frac{\beta-\textrm{S}_{\Omega}\textrm{S}_{\theta}\sqrt{T_{z}^{2}\textrm{S}_{\gamma}^{2}+T_{x}^{2}\textrm{C}_{\gamma}^{2}}}{\textrm{C}_{\theta}}$
(78)

either has a local minimum that can be found by setting its derivative to
zero, or there is no local minimum and the expression is minimal at the
boundary $\theta=0$ since it diverges for $\theta\to\frac{\pi}{2}.$
Differentiating the expression with respect to theta, we find that a local
minumum does exist at

$\textrm{S}_{\theta}=\frac{\textrm{S}_{\Omega}\sqrt{T_{z}^{2}\textrm{S}_{\gamma}^{2}+T_{x}^{2}\textrm{C}_{\gamma}^{2}}}{\beta},$
(79)

(recall the assumption above). Plugging this value into Eq. (76) allows us to
rewrite the constraint as

$\textrm{C}_{\Omega}\,\binom{\textrm{C}_{\phi}}{\textrm{S}_{\phi}}^{T}\\!\\!\left(\begin{array}[]{cc}T_{z}&\\\
&T_{x}\\\
\end{array}\right)\binom{\textrm{C}_{\gamma}}{\textrm{S}_{\gamma}}\geq\sqrt{\beta^{2}-\textrm{S}_{\Omega}^{2}(T_{z}^{2}\textrm{S}_{\gamma}^{2}+T_{x}^{2}\textrm{C}_{\gamma}^{2})},$
(80)

which we rewrite as

$\binom{\textrm{C}_{\phi}}{\textrm{S}_{\phi}}^{T}{\bf v}_{\gamma}\geq
1,\qquad\text{with}\qquad{\bf
v}_{\gamma}=\frac{\textrm{C}_{\Omega}}{\sqrt{\beta^{2}-\textrm{S}_{\Omega}^{2}(T_{z}^{2}\textrm{S}_{\gamma}^{2}+T_{x}^{2}\textrm{C}_{\gamma}^{2})}}\binom{T_{z}\textrm{C}_{\gamma}}{T_{x}\textrm{S}_{\gamma}}.$
(81)

Now it becomes simple to check if the constraint can be satisfied at all. The
vector ${\bf v}_{\gamma}$ belongs to the positive quadrant of the plane with
${\bf v}_{0}\parallel\binom{1}{0}$ and ${\bf v}_{\pi/2}\parallel\binom{0}{1}$,
hence the inequality ${\bf a}_{0}\cdot{\bf v}_{\gamma}\geq 1$ can be satisfied
if and only if the length of the vector ${\bf v}_{\gamma}$ reaches 1, i.e.

$|{\bf
v}_{\gamma}|^{2}=\frac{\textrm{C}_{\Omega}^{2}(T_{z}^{2}\textrm{C}_{\gamma}^{2}+T_{x}^{2}\textrm{S}_{\gamma}^{2})}{\beta^{2}-\textrm{S}_{\Omega}^{2}(T_{z}^{2}\textrm{S}_{\gamma}^{2}+T_{x}^{2}\textrm{C}_{\gamma}^{2})}\geq
1$ (82)

for some $\gamma$. We rewrite this inequality as

$\frac{1}{2}\left(T_{z}^{2}+T_{x}^{2}+(T_{z}^{2}-T_{x}^{2})\textrm{C}_{2\gamma}\textrm{C}_{2\Omega}-2\beta^{2}\right)\geq
0.$ (83)

Given that $T_{z}^{2}\geq T_{x}^{2}$, the left hand side (LHS) is maximal for
$\gamma=0$ if $\Omega\leq\frac{\pi}{4}$ and for $\gamma=\frac{\pi}{2}$ if
$\Omega>\frac{\pi}{4}$. Hence, $\mathcal{B}_{\Omega}\geq\beta$ can be
fulfilled if and only if

$\boxed{\begin{split}&\text{for}\,\Omega\leq\frac{\pi}{4},\qquad\textrm{C}_{\Omega}^{2}T_{z}^{2}+\textrm{S}_{\Omega}^{2}T_{x}^{2}\geq\beta^{2}\\\
&\text{for}\,\Omega>\frac{\pi}{4},\qquad\textrm{S}_{\Omega}^{2}T_{z}^{2}+\textrm{C}_{\Omega}^{2}T_{x}^{2}\geq\beta^{2}.\end{split}}$
(84)

Consider the first case $\boxed{\Omega\leq\frac{\pi}{4}}$. Setting $\gamma=0$
one verifies that if the constraint can be fulfilled, then it can be fulfilled
with $\phi=0$:

$\binom{1}{0}^{T}{\bf
v}_{0}=\frac{\textrm{C}_{\Omega}T_{z}}{\sqrt{\beta^{2}-\textrm{S}_{\Omega}^{2}T_{x}^{2}}}\geq
1\ \ \iff\ \
\textrm{C}_{\Omega}^{2}T_{z}^{2}+\textrm{S}_{\Omega}^{2}T_{x}^{2}\geq\beta^{2}.$
(85)

Hence, in this case the minimal possible angle is $\phi_{*}=0$ as long as the
Bell score can be attained as formalized by Eq. (84).

The other case $\boxed{\Omega>\frac{\pi}{4}}$ is less trivial. Assume that the
constraint can be satisfied,
$\textrm{S}_{\Omega}^{2}T_{z}^{2}+\textrm{C}_{\Omega}^{2}T_{x}^{2}\geq\beta^{2}$.
We first check if $\phi=0$ is a solution

$\left(\binom{1}{0}^{T}{\bf
v}_{\gamma}\right)^{2}=\frac{\textrm{C}_{\Omega}^{2}\textrm{C}_{\gamma}^{2}T_{z}^{2}}{\beta^{2}-\textrm{S}_{\Omega}^{2}(T_{z}^{2}\textrm{S}_{\gamma}^{2}+T_{x}^{2}\textrm{C}_{\gamma}^{2})}\geq
1\ \ \iff\ \
\textrm{C}_{\gamma}^{2}(\textrm{C}_{\Omega}^{2}T_{z}^{2}+\textrm{S}_{\Omega}^{2}T_{x}^{2}-\textrm{S}_{\Omega}^{2}T_{z}^{2})+\textrm{S}_{\Omega}^{2}T_{z}^{2}\geq\beta^{2}.$
(86)

As
$\textrm{S}_{\Omega}^{2}T_{z}^{2}+\textrm{C}_{\Omega}^{2}T_{x}^{2}\geq\beta^{2}\geq\textrm{S}_{\Omega}^{2}T_{z}^{2}$,
the LHS is maximal for $\gamma=0$. Therefore $\phi_{*}=0$ iff

$\textrm{C}_{\Omega}^{2}T_{z}^{2}+\textrm{S}_{\Omega}^{2}T_{x}^{2}\geq\beta^{2}.$
(87)

We now assume

$\textrm{S}_{\Omega}^{2}T_{z}^{2}+\textrm{C}_{\Omega}^{2}T_{x}^{2}\geq\beta^{2}>\textrm{C}_{\Omega}^{2}T_{z}^{2}+\textrm{S}_{\Omega}^{2}T_{x}^{2},$
(88)

such that the constraint can be fulfilled but not with $\phi=0$. To find the
minimal $\phi$ that allows to do so we look on the dependence of the length of
the vector ${\bf v}_{\gamma}$ on $\gamma$. We compute

$\frac{d}{d\gamma}|{\bf
v}_{\gamma}|^{2}=\frac{(T_{z}^{2}-T_{x}^{2})\textrm{C}_{\Omega}^{2}\textrm{S}_{2\gamma}}{(\beta^{2}-(T_{z}^{2}\textrm{S}_{\gamma}^{2}+T_{x}^{2}\textrm{C}_{\gamma}^{2})\textrm{S}_{\Omega}^{2})^{2}}((T_{z}^{2}+T_{x}^{2})\textrm{S}_{\Omega}^{2}-\beta^{2}),$
(89)

here
$(T_{z}^{2}+T_{x}^{2})\textrm{S}_{\Omega}^{2}\geq\textrm{S}_{\Omega}^{2}T_{z}^{2}+\textrm{C}_{\Omega}^{2}T_{x}^{2}\geq\beta^{2}$.
Thus the derivative is positive and the length of ${\bf v}_{\gamma}$ is
increasing with $\gamma$.

We can now give a simple geometrical interpretation to our problem of finding
the minimal $\phi$: for each value $\phi$ such that

$\binom{\textrm{C}_{\phi}}{\textrm{S}_{\phi}}^{T}{\bf v}_{\gamma}\geq 1$ (90)

a line tangent to the unit circle at
$\binom{\textrm{C}_{\phi}}{\textrm{S}_{\phi}}$ is also crossing the curve
${\bf v}_{\gamma}$. So for the minimal value $\phi_{*}$ there is a line
tangent to both ${\bf v}_{\gamma}$ and the unit circle at
$\binom{\textrm{C}_{\phi_{*}}}{\textrm{S}_{\phi_{*}}}$. The equation of the
line tangent to ${\bf v}_{\gamma}$ reads ${\bm{\ell}}(\lambda)={\bf
v}_{\gamma}+\lambda{\bf v}_{\gamma}^{\prime}$. This line is tangent to the
unit circle if and only if the equation

$|{\bf v}_{\gamma}+\lambda{\bf v}_{\gamma}^{\prime}|^{2}=1$ (91)

has only one solution, where the derivative is with respect to $\gamma$. This
is a quadratic equation

$\lambda^{2}|{\bf v}_{\gamma}^{\prime}|^{2}+2\lambda{\bf
v}_{\gamma}^{\prime}\cdot{\bf v}_{\gamma}+|{\bf v}_{\gamma}|^{2}-1=0,$ (92)

which has a unique solution iff its determinant is zero

$\left({\bf v}_{\gamma}^{\prime}\cdot{\bf v}_{\gamma}\right)^{2}=|{\bf
v}_{\gamma}^{\prime}|^{2}\left(|{\bf v}_{\gamma}|^{2}-1\right).$ (93)

With

${\bf
v}_{\gamma}^{\prime}=\frac{\textrm{C}_{\Omega}}{(\beta^{2}-\textrm{S}_{\Omega}^{2}(T_{x}^{2}\textrm{C}_{\gamma}^{2}+T_{z}^{2}\textrm{S}_{\gamma}^{2}))^{3/2}}\binom{T_{z}\textrm{S}_{\gamma}(T_{z}^{2}\textrm{S}_{\Omega}^{2}-\beta^{2})}{-T_{x}\textrm{C}_{\gamma}(T_{x}^{2}\textrm{S}_{\Omega}^{2}-\beta^{2})}$
(94)

lengthy but straightforward algebra gives

$\textrm{S}_{\gamma}^{2}=-\frac{T_{x}^{2}(\beta^{2}-T_{x}^{2}\textrm{S}_{\Omega}^{2})(\beta^{2}-(T_{z}^{2}+T_{x}^{2})\textrm{S}_{\Omega}^{2})}{(T_{z}^{2}-T_{x}^{2})\left(\beta^{4}+\textrm{S}_{\Omega}^{2}(T_{x}^{2}T_{z}^{2}-2\beta^{2}(T_{x}^{2}+T_{z}^{2}))+\textrm{S}_{\Omega}^{4}(T_{x}^{4}+T_{z}^{4})\right)}.$
(95)

To find that the minimal angle $\phi_{*}$ note that for the tangent line
$\binom{\textrm{C}_{\phi_{*}}}{\textrm{S}_{\phi_{*}}}\cdot{\bf
v}_{\gamma}^{\prime}=0$, and therefore
$\binom{-\textrm{S}_{\phi_{*}}}{\textrm{C}_{\phi_{*}}}=\frac{{\bf
v}_{\gamma}^{\prime}}{|{\bf v}_{\gamma}^{\prime}|}$. Plugging in the above
equations we find

$c_{*}^{2}({\bf L},\Omega,\beta)=\cos^{2}\big{(}\phi_{*}({\bf
L},\Omega,\beta)\big{)}=\frac{(\beta^{2}-\textrm{S}_{\Omega}^{2}T_{x}^{2})(\textrm{C}_{\Omega}^{2}T_{x}^{2}+\textrm{S}_{\Omega}^{2}T_{z}^{2}-\beta^{2})}{\textrm{C}_{\Omega}^{2}(T_{z}^{2}-T_{x}^{2})(\textrm{S}_{\Omega}^{2}T_{z}^{2}+\textrm{S}_{\Omega}^{2}T_{x}^{2}-\beta^{2})}.$
(96)

###  A.4 Eve’s maximum information for $\Omega\leq\frac{\pi}{4}$

We here give details on the derivation of the formula (30) in the main text
which corresponds to Eve’s maximum information in the case
$\Omega\leq\frac{\pi}{4}.$ For these inequalities we have seen that the
constraint
$\textrm{C}_{\Omega}^{2}\,T_{z}^{2}+\textrm{S}_{\Omega}\,T_{x}^{2}\geq\beta^{2}$
can be fulfilled with $c^{2}_{*}({\bf L},\beta)=1$. It has been shown in Ref.
[22] that $H(\rho_{E|\hat{a}=+1})$ is a monotonic function in the key
generating setting $\phi\in[0,\frac{\pi}{4}]$. The wost case (optimal attack
for Eve) thus consists in setting the measurement angle $\textrm{C}_{\phi}=1$,
which implies a simple form for the state

$\rho_{E|\hat{a}=+1}=\left(\begin{array}[]{cccc}L_{1}&0&\sqrt{L_{1}L_{3}q}&0\\\
0&L_{2}&0&-\sqrt{L_{2}L_{4}q}\\\ \sqrt{L_{1}L_{3}q}&0&L_{3}&0\\\
0&-\sqrt{L_{2}L_{4}q}&0&L_{4}\\\ \end{array}\right),$ (97)

with a closed form expression for its eigenvalues implying

$H(\rho_{E|\hat{a}=1})=H\Big{(}{\bf
p}=\left(\begin{array}[]{c}\frac{1}{2}\left(L_{1}+L_{3}+\sqrt{4L_{1}L_{3}q+\left(L_{1}-L_{3}\right){}^{2}}\right)\\\
\frac{1}{2}\left(L_{1}+L_{3}-\sqrt{4L_{1}L_{3}q+\left(L_{1}-L_{3}\right){}^{2}}\right)\\\
\frac{1}{2}\left(L_{2}+L_{4}+\sqrt{4L_{2}L_{4}q+\left(L_{2}-L_{4}\right){}^{2}}\right)\\\
\frac{1}{2}\left(L_{2}+L_{4}-\sqrt{4L_{2}L_{4}q+\left(L_{2}-L_{4}\right){}^{2}}\right)\end{array}\right)\Big{)}.$
(98)

The constraint on the generalized CHSH score leads to the following constraint
on the vector $\bf L$

$\binom{T_{Z}^{2}}{T_{X}^{2}}\cdot\binom{\textrm{C}_{\Omega}^{2}}{\textrm{S}_{\Omega}^{2}}=2\left(L_{3}-L_{4}\right)\left(L_{1}-L_{2}\right)\textrm{C}_{2\Omega}+\left(L_{1}-L_{2}\right){}^{2}+\left(L_{3}-L_{4}\right){}^{2}\geq\beta^{2}.$
(99)

Our goal is thus to find the components of the vector $\bf L$ maximizing
$H(\bf L)-H(\bf p)$ and satisfying the previous constraint. Inspired by Ref.
[22], we first introduce the following parametrization

$\begin{split}L_{1}&=Px\\\ L_{3}&=P(1-x)\\\ L_{2}&=(1-P)y\\\
L_{4}&=(1-P)(1-y).\end{split}$ (100)

The partial ordering of the $\bf L$ coefficients implies

$(1-P)y\leq Px\leq(1-P)y+2P-1$ (101)

which requires $P\geq\frac{1}{2}.$ The advantage of this parametrization comes
from the fact that our figure of merit can be nicely rewritten as

$\begin{split}H({\bf L})-H({\bf p})&=Ph_{q}(x)+(1-P)h_{q}(y)\\\
h_{q}(z)&=h(z)-h(n_{q}(z))\\\
n_{q}(z)&=\frac{1+\sqrt{1-4\,(1-q)\,z(1-z)}}{2}\\\ \end{split}$ (102)

where $h(z)=-z\log(z)-(1-z)\log(1-z)$ is the binary entropy function with the
logarithm in base 2, while the constraint on the expected value of the
generalized CHSH operator is given by

$\textrm{S}_{\Omega}\,(2P(x+y-1)-2y+1)^{2}+\textrm{C}_{\Omega}\,(1-2P)^{2}\geq\beta^{2}$
(103)

For a fixed $P,$ the curve in the $(x,y)$-plan that corresponds to a constant
value $\beta$ satisfies $P\,dx=(1-P)\,dy$. This remark allows one to maximize
$H({\bf L})-H({\bf p})$ along this curve and find that it is optimal for Eve
to set $x+y=1$, see appendix C2 in Ref. [22] for the detailed argument. The
symmetry of the function $h_{q}(x)=h_{q}(1-x)$ allows us to write the problem
as

$\begin{split}\max_{x,P}&\ \,H({\bf L})-H({\bf p})=h_{q}(x)\\\ \text{s.t.}&\
\,(2P-1)^{2}\textrm{C}_{\Omega}^{2}+(1-2x)^{2}\textrm{S}_{\Omega}^{2}\geq\beta^{2}.\end{split}$
(104)

As the goal function $h_{q}(x)$ does not depend on $P$, we can set its value
to $P=1$ because this is the value maximizing the LHS of the constraint
inequality and allowing the largest possible interval for the remaining
variable $x$. We thus get

$\begin{split}\max_{x,P}&\ \,H({\bf L})-H({\bf p})=h_{q}(x)\\\ \text{s.t.}&\
\,(1-2x)^{2}\geq\frac{\beta^{2}-\textrm{C}_{\Omega}^{2}}{\textrm{S}_{\Omega}^{2}}.\end{split}$
(105)

Finally, as $h_{q}(x)$ is a monotonically decreasing function of $x$ (see Ref.
[22]), it is optimal to set $x$ to the least possible value compatible with
the constraint. This implies

$\boxed{\begin{split}I(\beta;\Omega,q)&=h_{q}(z)\\\ \text{with}\
\,z&=\frac{1}{2}\left(\frac{\sqrt{\beta^{2}-\textrm{C}_{\Omega}^{2}}}{\textrm{S}_{\Omega}}+1\right).\end{split}}$
(106)

Let us now recall that the situation with $c^{2}_{*}({\bf L},\beta)=1$ and
$\textrm{C}_{\Omega}^{2}\,T_{z}^{2}+\textrm{S}_{\Omega}\,T_{x}^{2}\geq\beta^{2}$
also occurs in the case $\Omega>\frac{\pi}{4}$. The above proof guarantees
that it is optimal for Eve to use strategies where the inequality is saturated
$\textrm{C}_{\Omega}^{2}\,T_{z}^{2}+\textrm{S}_{\Omega}\,T_{x}^{2}=\beta^{2}$.
Hence in the optimization problem for $\Omega>\frac{\pi}{4}$ we can ignore all
the strategies with
$\textrm{C}_{\Omega}^{2}\,T_{z}^{2}+\textrm{S}_{\Omega}\,T_{x}^{2}>\beta^{2}.$

###  A.5 Concavity of $h_{q}\circ z(\beta)$

Recall that in order to use the bound $I(\beta;\Omega,q)$ derived for two-
qubit strategies in the previous section as a universal bound (valid for
strategies in any dimension), we have to show that this function is concave.
In this case, for any mixture of qubit strategies (enforced by the Jordan’s
lemma) with an average score $\bar{\beta}=\sum_{i}p_{i}\beta_{i}$, Eve’s
information satisfies

$\bar{I}(\beta;\Omega,q)=\sum_{i}p_{i}I(\beta_{i};\Omega,q)\leq
I(\bar{\beta};\Omega,q).$ (107)

The concavity of $I(\beta;\Omega,q)=h_{q}(z(\beta))$ follows from the fact
that its second derivative is negative

$\frac{d^{2}}{d\beta^{2}}h_{q}\big{(}z(\beta)\big{)}=h_{q}^{\prime\prime}(z)\big{(}z^{\prime}(\beta)\big{)}^{2}+h_{q}^{\prime}(z)z^{\prime\prime}(\beta)\leq
0,$ (108)

which we are going to show below. In this section we will use the natural
algorithm instead of logarithm in base 2. The function $h_{q}(z)$ takes a
positive real factor upon changing the base of the algorithm, so it is
irrelevant for its concavity. Note first that $z(\beta)\in[\frac{1}{2},1]$ and

$\sqrt{\beta^{2}-\textrm{C}_{\Omega}^{2}}=\textrm{S}_{\Omega}(2z-1).$ (109)

Then consider the following identities

$\begin{split}(z^{\prime}(\beta))^{2}&=\frac{\beta^{2}}{4\textrm{S}_{\Omega}^{2}(\beta^{2}-\textrm{C}_{\Omega}^{2})}=\frac{\textrm{S}_{\Omega}^{2}(2z-1)^{2}+\textrm{C}_{\Omega}^{2}}{4\textrm{S}_{\Omega}^{4}(2z-1)^{2}}\\\
z^{\prime\prime}(\beta)&=\frac{-\textrm{C}_{\Omega}^{2}}{2\textrm{S}_{\Omega}(\beta^{2}-\textrm{C}_{\Omega}^{2})^{3/2}}=\frac{-\textrm{C}_{\Omega}^{2}}{2\textrm{S}_{\Omega}^{4}(2z-1)^{3}}.\end{split}$
(110)

The identity (31) that we want to prove thus becomes

$\frac{h_{q}^{\prime\prime}(z)(2z-1)(\textrm{S}_{\Omega}^{2}(2z-1)^{2}+\textrm{C}_{\Omega}^{2})-2h_{q}^{\prime}(z)\textrm{C}_{\Omega}^{2}}{4\textrm{S}_{\Omega}^{4}(2z-1)^{3}}\leq
0.$ (111)

Multiplying by a positive fraction
$\frac{4\textrm{S}_{\Omega}^{4}(2z-1)^{3}}{\textrm{C}_{\Omega}^{2}}$ it can be
straightforwardly simplified to the form

$h_{q}^{\prime\prime}(z)(2z-1)(\text{T}_{\Omega}^{2}(2z-1)^{2}+1)-2\,h_{q}^{\prime}(z)\leq
0.$ (112)

As $h_{q}^{\prime\prime}(z)\leq 0$ was proven in [22, 39], we have the
inequality

$h_{q}^{\prime\prime}(z)(2z-1)^{2}\,\text{T}_{\Omega}^{2}\leq 0.$ (113)

We use it to relax the inequality in Eq. (112) to

$h_{q}^{\prime\prime}(z)(z-\frac{1}{2})-h_{q}^{\prime}(z)\leq 0.$ (114)

At the point $z=\frac{1}{2}$ the left hand side becomes zero, since
$h_{q}^{\prime}(\frac{1}{2})=0$ and
$|h_{q}^{\prime\prime}(\frac{1}{2})|<\infty,$ see below. From now on, we thus
exclude the point $z=\frac{1}{2}$ and consider $z\in(\frac{1}{2},1]$. Now we
can divide the whole expression by a strictly positive factor
$(z-\frac{1}{2})^{2}$. We obtain

$\frac{1}{2}\frac{h_{q}^{\prime\prime}(z)(z-\frac{1}{2})-h_{q}^{\prime}(z)(z-\frac{1}{2})^{\prime}}{(z-\frac{1}{2})^{2}}\leq
0,$ (115)

or

$\frac{1}{2}\left(\frac{h_{q}^{\prime}(z)}{z-\frac{1}{2}}\right)^{\prime}=\left(\frac{h_{q}^{\prime}(z)}{2z-1}\right)^{\prime}\leq
0.$ (116)

In other words we want to show that the function

$(\ast)\,\frac{d}{dz}\left(\frac{h_{q}^{\prime}(z)}{2z-1}\right)\leq 0$ (117)

on the interval $z\in(\frac{1}{2},1]$. Let us now compute this function:

$\frac{h_{q}^{\prime}(z)}{2z-1}=\frac{h^{\prime}(z)}{2z-1}-h^{\prime}(n_{q}(z))\frac{n_{q}^{\prime}(z)}{2z-1}.$
(118)

The last fraction can be simplified to

$\frac{n_{q}^{\prime}(z)}{2z-1}=\frac{(2z-1)(1-q)}{(2z-1)\sqrt{1-4\,(1-q)\,z(1-z)}}=\frac{1-q}{2n_{q}(z)-1}.$
(119)

Therefore

$\frac{h_{q}^{\prime}(z)}{2z-1}=\frac{h^{\prime}(z)}{2z-1}-(1-q)\frac{h^{\prime}(n_{q}(z))}{2n_{q}(z)-1}=g(z)-(1-q)g\big{(}n_{q}(z)\big{)},$
(120)

where

$g(z)=\frac{h^{\prime}(z)}{2z-1}=-\frac{\log(\frac{z}{1-z})}{2z-1}.$ (121)

To complete the proof we thus need to show that

$(\ast)\quad
g^{\prime}(z)-(1-q)g^{\prime}\big{(}n_{q}(z)\big{)}n_{q}^{\prime}(z)\leq 0.$
(122)

From Eq. (119), we have

$n_{q}^{\prime}(z)=(1-q)\frac{2z-1}{2n_{q}(z)-1},$ (123)

so the inequality to be shown can be rewritten as

$\frac{g^{\prime}(z)}{2z-1}-(1-q)^{2}\frac{g^{\prime}(n_{q}(z))}{2n_{q}(z)-1}\leq
0.$ (124)

For $q=0$ we have $(1-q)=1$ and $n_{q}(z)=z$ so the two terms are equal. The
identity to be shown can then be expressed as

$\begin{split}(\ast)\qquad\ \ \ f(z,0)&-f(z,q)\leq 0\\\ \text{with}\quad
f(z,q)&=(1-q)^{2}u(n_{q}(z))\\\
u(z)&=\frac{g^{\prime}(z)}{2z-1}=\frac{\frac{1}{z-1}+\frac{1}{z}+2\log\left(\frac{z}{1-z}\right)}{(2z-1)^{3}},\end{split}$
(125)

which holds for $q=0$ trivially. To show that it holds for all $q$ it is
sufficient to demonstrate that the function $f(z,q)$ is increasing with $q$,
i.e.

$(*)\qquad\frac{d}{dq}f(z,q)\geq 0,$ (126)

which we are going to show now.
Using

$\begin{split}\frac{d}{dq}n_{q}(z)=\frac{(1-z)z}{\sqrt{1-4(1-q)(1-z)z}}=\frac{n_{q}(z)(1-n_{q}(z))}{(1-q)(2n_{q}(z)-1)}\end{split}$
(127)

we obtain

$\begin{split}\frac{d}{dq}f(z,q)&=-2(1-q)u\big{(}n_{q}(z)\big{)}+(1-q)^{2}u^{\prime}\big{(}n_{q}(z)\big{)}\frac{d}{dq}n_{q}(z)\\\
&=-2(1-q)u(n)+(1-q)u^{\prime}(n)\frac{n(1-n)}{2n-1}\end{split}$ (128)

for $n>\frac{1}{2}$, which is positive iff $q=1$ or

$(\ast)\qquad u^{\prime}(n)n(1-n)-2u(n)(2n-1)\geq 0.$ (129)

In the case $q<1$, straightforward algebra allows to find a simple expression
of the left hand side and rewrite the condition as

$\begin{split}&\frac{6n^{2}-4n^{3}-1+4(n^{4}-2n^{3}+2n^{2}-n)\log\left(\frac{n}{1-n}\right)}{(2n-1)^{4}n(1-n)}\geq
0\\\ \iff\ \
&6n^{2}-4n^{3}-1+4(n^{4}-2n^{3}+2n^{2}-n)\log\left(\frac{n}{1-n}\right)\geq
0\end{split}$ (130)

Changing the variable to $x+1=\frac{n}{1-n}$ with $x\geq 0$ we express the
above inequality as

$\begin{split}&\frac{x(x^{2}+6x+6)}{(x+2)^{3}}-4\frac{(x+1)(x^{2}+3x+3)}{(x+2)^{4}}\log(x+1)\geq
0\\\ \iff\ \
&\log(1+x)\leq\frac{x(x+2)(x^{2}+6x+6)}{4(x+1)(x^{2}+3x+3)}.\end{split}$ (131)

To prove this relation note that there is equality for $x=0$, but the LHS
increases slower than the RHS

$\begin{split}&\log^{\prime}(1+x)\leq\left(\frac{x(x+2)(x^{2}+6x+6)}{4(x+1)(x^{2}+3x+3)}\right)^{\prime}\\\
\iff\ \
&\frac{1}{1+x}\leq\frac{1}{4}\left(\frac{9(x+1)}{(x(x+3)+3)^{2}}+\frac{1}{(x+1)^{2}}+\frac{3}{x(x+3)+3}+1\right)\\\
\iff\ \ &\frac{x^{4}(x+2)^{2}}{4(x+1)^{2}(x(x+3)+3)^{2}}\geq 0,\end{split}$
(132)

which concludes the proof.

##### Properties of $h_{q}^{\prime}(\frac{1}{2})$ and
$h_{q}^{\prime\prime}(\frac{1}{2})$

We start with the first derivative and want to show that
$h_{q}^{\prime}(\frac{1}{2})=1/2.$ We have

$h_{q}^{\prime}(z)=\Big{(}h(z)-h(n_{q}(z))\Big{)}^{\prime}=h^{\prime}(z)-h^{\prime}(n_{q}(z))n_{q}^{\prime}(z)$
(133)

The binary entropy hits a maximum at $z=1/2$ so $h^{\prime}(\frac{1}{2})=0$.
For the second term, we use (123) to get

$h^{\prime}(n_{q}(z))n_{q}^{\prime}(z)=-(1-q)\frac{2z-1}{2n_{q}(z)-1}\log\left(\frac{n_{q}(z)}{1-n_{q}(z)}\right),$
(134)

$(2z-1)=0$ at $z=\frac{1}{2}$, while

$\left|\left.\frac{1-q}{2n_{q}(z)-1}\log\left(\frac{n_{q}(z)}{1-n_{q}(z)}\right)\right|_{z=1/2}\right|=\left|\frac{(1-q)\log\left(\frac{1+\sqrt{q}}{1-\sqrt{q}}\right)}{\sqrt{q}}\right|.$
(135)

Changing the variable to $x+1=\frac{1+\sqrt{q}}{1-\sqrt{q}}$ with $x\geq 0$
yields for the last expression

$\left|\frac{4(x+1)\log(x+1)}{x(x+2)}\right|<\infty.$ (136)

It is obviously bounded for $x>\epsilon$ with any $\epsilon$, and the fact
that the limit $x\to 0$ exists can be seen by straightforward application of
l’Hôpital’s rule. Hence,

$h_{q}^{\prime}\left(\frac{1}{2}\right)=0.$ (137)

We also wish to show that the second derivative
$h_{q}^{\prime\prime}(\frac{1}{2})$ is bounded. To do so we compute

$h_{q}^{\prime\prime}\left(\frac{1}{2}\right)=\frac{2(1-q)\log\left(\frac{1+\sqrt{q}}{1-\sqrt{q}}\right)}{\sqrt{q}}-4.$
(138)

But as we have just shown that

$\left|\frac{(1-q)\log\left(\frac{1+\sqrt{q}}{1-\sqrt{q}}\right)}{\sqrt{q}}\right|<\infty,$
(139)

the desired result

$\left|h_{q}^{\prime\prime}\left(\frac{1}{2}\right)\right|<\infty$ (140)

follows.

###  A.6 Maximization of the generalized CHSH score with respect to auxiliary
settings

In the goal function

$H(\rho_{E})-H(\rho_{E}|\hat{a}_{0}(q))+t\,\mathcal{B}_{\Omega}({\bf
L},\phi,{\bm{a}}_{1},{\bm{b}}_{0},{\bm{b}}_{1})$ (141)

that a priori appears in Eq. (44), it is only the Bell score which depends on
the auxiliaty measuremnt settigns ${\bm{a}}_{1},{\bm{b}}_{0}$ and
${\bm{b}}_{1}$. As $t$ is always positive we can straigtforwardly maximise the
score with respect to these settings. We thus define

$\beta_{\text{max}}({\bm{L}},\phi)=\max_{{\bm{a}}_{1},{\bm{b}}_{0},{\bm{b}}_{1}}\mathcal{B}_{\Omega}({\bf
L},\phi,{\bm{a}}_{1},{\bm{b}}_{0},{\bm{b}}_{1}),$ (142)

which actually appears in Eq. (44).

Let us now compute this expression starting from Eq. (72), that we put in the
form

$\mathcal{B}_{\Omega}=\binom{\textrm{C}_{\theta}}{\textrm{S}_{\theta}}\cdot\left(\begin{array}[]{c}\textrm{C}_{\Omega}\,{\bf
a}_{0}^{T}\binom{T_{z}\textrm{C}_{\gamma}}{T_{x}\textrm{S}_{\gamma}}\\\
\textrm{S}_{\Omega}\,{\bf
a}_{1}^{T}\binom{-T_{z}\textrm{S}_{\gamma}}{T_{x}\textrm{C}_{\gamma}}\end{array}\right).$
(143)

This form makes the maximization with respect to $\theta$ and ${\bf a}_{1}$
straightforward

$\begin{split}\max_{\theta,{\bf a_{1}}}\mathcal{B}_{\Omega}&=\max_{{\bf
a}_{1}}\sqrt{\left(\textrm{C}_{\Omega}\,{\bf
a}_{0}^{T}\binom{T_{z}\textrm{C}_{\gamma}}{T_{x}\textrm{S}_{\gamma}}\right)^{2}+\left(\textrm{S}_{\Omega}\,{\bf
a}_{1}^{T}\binom{-T_{z}\textrm{S}_{\gamma}}{T_{x}\textrm{C}_{\gamma}}\right)^{2}}\\\
&=\sqrt{\textrm{C}_{\Omega}^{2}\left(\textrm{C}_{\phi}T_{z}\textrm{C}_{\gamma}+\textrm{S}_{\phi}T_{x}\textrm{S}_{\gamma}\right)^{2}+\textrm{S}_{\Omega}^{2}\left(T_{z}^{2}\textrm{S}_{\gamma}^{2}+T_{x}^{2}\textrm{C}_{\gamma}^{2}\right)}.\end{split}$
(144)

To find the maximum with respect to $\gamma$ or ${\bf
c}=\binom{\textrm{C}_{\gamma}}{\textrm{S}_{\gamma}}$ it is convenient to write
the expression inside the square root as

$\left(\max_{\theta,{\bf a_{1}}}\mathcal{B}_{\Omega}\right)^{2}={\bf
c}^{T}\left(\begin{array}[]{cc}\textrm{C}_{\Omega}^{2}\textrm{C}_{\phi}^{2}T_{z}^{2}+\textrm{S}_{\Omega}^{2}T_{x}^{2}&\textrm{C}_{\Omega}^{2}\textrm{C}_{\phi}\textrm{S}_{\phi}T_{z}T_{x}\\\
\textrm{C}_{\Omega}^{2}\textrm{C}_{\phi}\textrm{S}_{\phi}T_{z}T_{x}&\textrm{C}_{\Omega}^{2}\textrm{S}_{\phi}^{2}T_{x}^{2}+\textrm{S}_{\Omega}^{2}T_{z}^{2}\end{array}\right){\bf
c}.$ (145)

It is now obvious that the value is maximal if ${\bf c}$ is aligned with the
eigenvector of the matrix which corresponds to the maximal eigenvalue.
Therefore

$\small\begin{split}\beta_{\text{max}}({\bm{L}},\phi)&=\max_{\theta,\gamma,{\bf
a}_{1}}\mathcal{B}_{\Omega}({\bf
L},\phi,{\bm{a}}_{1},{\bm{b}}_{0},{\bm{b}}_{1}),\\\
&=\sqrt{\text{Eig}_{+}\left(\begin{array}[]{cc}\textrm{C}_{\Omega}^{2}\textrm{C}_{\phi}^{2}T_{Z}^{2}+\textrm{S}_{\Omega}^{2}T_{x}^{2}&\textrm{C}_{\Omega}^{2}\textrm{C}_{\phi}\textrm{S}_{\phi}T_{z}T_{x}\\\
\textrm{C}_{\Omega}^{2}\textrm{C}_{\phi}\textrm{S}_{\phi}T_{z}T_{x}&\textrm{C}_{\Omega}^{2}\textrm{S}_{\phi}^{2}T_{x}^{2}+\textrm{S}_{\Omega}^{2}T_{z}^{2}\end{array}\right)}\\\
&=\frac{1}{\sqrt{2}}\left(\textrm{C}_{\Omega}^{2}(\textrm{C}_{\phi}^{2}T_{z}^{2}+\textrm{S}_{\phi}^{2}T_{x}^{2})+\textrm{S}^{2}_{\Omega}(T_{z}^{2}+T_{x}^{2})+\sqrt{(\textrm{C}_{\Omega}^{2}(\textrm{C}_{\phi}^{2}T_{z}^{2}-\textrm{S}_{\phi}^{2}T_{x}^{2})-\textrm{S}^{2}_{\Omega}(T_{z}^{2}-T_{x}^{2}))^{2}+4(\textrm{C}_{\Omega}^{2}\textrm{C}_{\phi}\textrm{S}_{\phi}T_{z}T_{x})^{2}}\right)^{1/2}.\end{split}$
(146)

##  Appendix B Numerical tool

###  B.1 Lipshitz continuity of von Neumann entropy

Consider two states $\rho$ and $\sigma$ on an $n$-dimensional Hilbert space,
that are close in fidelity:

$F(\rho,\sigma)=\text{tr}\left|\sqrt{\rho}\sqrt{\sigma}\right|=f.$ (147)

Given the monotonicity of $\arccos$ in the range $[0,1]$, this condition can
be equivalently written in terms of the angle
$A(\rho,\sigma)=\arccos(F(\rho,\sigma))$

$A(\rho,\sigma)=a=\arccos(f).$ (148)

The angle is a metric on the space of density operators [28], in particular it
satisfies the triangle inequality.

Next, note that the angle between two states is lower bounded by the angle
between the ordered vectors made of their ordered eigenvalues

$a=A(\rho,\sigma)\geq A({\bf p},{\bf q})=\arccos\left({\sqrt{\bf
p}\cdot\sqrt{\bf q}}\right),$ (149)

with ${\bf p}=\text{Eig}^{\downarrow}(\rho)$, ${\bf
q}=\text{Eig}^{\downarrow}(\sigma)$ such that $p_{1}\geq p_{2}\geq\dots$ This
inequality follows from

$F(\rho,\sigma)=\text{tr}|\sqrt{\rho}\sqrt{\sigma}|=\max_{U}\text{tr}\sqrt{\rho}\,(\sqrt{\sigma}U)\leq\sqrt{\bf
p}\cdot\sqrt{\bf q},$ (150)

where in second line we used the so-called von Neumann trace inequality [40].
This bound is useful because the entropies of the states match the entropies
of the probability distributions

$H(\rho)=H({\bf p})\ ,\qquad H(\sigma)=H({\bf q}).$ (151)

Let us now bound their difference

$\Delta H=\left|H(\rho)-H(\sigma)\right|=\left|H({\bf p})-H({\bf q})\right|.$
(152)

To do so, note that for any two unit vectors $\sqrt{\bf p}$ and $\sqrt{\bf q}$
on the $n$-sphere there exist a path $\bm{\gamma}$ connecting the two and such
that the integral along the path satisfies

$\int_{\sqrt{\bf p}}^{\sqrt{\bf q}}dA=A({\bf p},{\bf q})\leq a.$ (153)

Let us bound the variation of the entropy along the path. To this end, we
associate a probability distribution ${\bf r}$ to each vector ${\bf v}$ on the
path $\bm{\gamma}$, with $r_{i}=(v^{(i)})^{2}$ (note that the vectors along
the curve remain in the positive part of the $n$-sphere $v^{(i)}\geq 0$). A
step $dA$ from $\bf v$ along the path corresponds to some deformation of the
vector given by

${\bf v}_{dA}\to{\bf v}+{\bf v}_{\perp}dA,$ (154)

with ${\bf v}\cdot{\bf v}_{\perp}=0$. To simplify the following computations
we introduce the “natural” entropy

$H_{e}(\rho)=-\mathrm{tr}\rho\ln(\rho)=\ln(2)\,H(\rho),$ (155)

as the von Neumann entropy computed with the natural logarithm (recall that
the $\log$ in $H(\rho)$ was taken in base 2). From

$H_{e}({\bf r})=-\sum_{i}(v^{(i)})^{2}\ln((v^{(i)})^{2})$ (156)

we compute the entropy variation for an infinitesimal increment of the angle

$\begin{split}\left|\frac{dH_{e}}{dA}\right|&=2|\sum_{i}v^{(i)}v_{\perp}^{(i)}(\ln((v^{(i)})^{2})+1)|\\\
&=2|\sum_{i}v_{\perp}^{(i)}\,v^{(i)}\ln((v^{(i)})^{2})|\\\ &=2\,|{\bf
v}_{\perp}\cdot{\bf w}|\leq 2||{\bf w}||\end{split}$ (157)

where we defined a vector $\bf w$ as
$w_{i}=v^{(i)}\ln((v^{(i)})^{2})=\sqrt{r_{i}}\ln(r_{i})$. Hence we obtain

$\left|\frac{dH_{e}}{dA}\right|\leq 2\sqrt{\sum_{i}r_{i}\ln^{2}(r_{i})},$
(158)

and it remains to bound the expression on the RHS. To do so, we will construct
a concave upper bound on the function

$c(r)=r\ln^{2}(r)$ (159)

defined on $[0,1]$. By computing the second derivative

$c^{\prime\prime}(r)=2\frac{1+\ln(r)}{r}$ (160)

we see that the function is concave $c^{\prime\prime}\leq 0$ on the interval
$r\in[0,\frac{1}{e}]$, and convex $c^{\prime\prime}\geq 0$ on the complement.
To get a concave upper-bound we thus look for a line passing by $r=1$ and
$c(1)=0$ and tangent to $c(r)$. In the $(r,c)$-plane the equation of a line
tangent to $c(r)$ at $r$ is given by

${\bm{\ell}}_{r}(\lambda)=\binom{r}{c(r)}+\binom{1}{c^{\prime}(r)}\lambda.$
(161)

It passes through the point ${\bm{\ell}}_{r}(\lambda)=(1,0)$ iff

$\displaystyle\begin{cases}r+\lambda=1\\\ c(r)+\lambda
c^{\prime}(r)=0\end{cases}$ $\displaystyle\implies$ $\displaystyle
c(r)+(1-r)c^{\prime}(r)=0$ $\displaystyle\implies$
$\displaystyle\ln(r)(2-2r+\ln(r))=0$ $\displaystyle\implies$
$\displaystyle\begin{cases}r_{1}=-\frac{1}{2}W_{0}(-\frac{2}{e^{2}})\approx
0.203\\\ r_{2}=1\end{cases},$ (162)

where $W_{0}$ is the principal branch of the Lambert $W$-function, and the
trivial solution $r_{2}=1$ is irrelevant. Knowing $r_{1}$ we can construct a
concave upper bound

$c(r)\leq\hat{c}(r)=\begin{cases}c(r)&r\leq r_{1}\\\
c(r_{1})\frac{1-r}{1-r_{1}}&r>r_{1}.\end{cases}$ (163)

Note that $r_{1}<\frac{1}{e}$. Furthermore, $r_{1}$ is the solution of the
equation $2-2r_{1}+\ln(r_{1})=0$. This allows us to simplify

$c(r_{1})=r_{1}\ln^{2}(r_{1})=4\,r_{1}(1-r_{1})^{2},$ (164)

and

$\hat{c}(r)=\begin{cases}r\ln^{2}(r)&r\leq r_{1}\\\
4\,r_{1}(1-r_{1})(1-r)&r>r_{1}.\end{cases}$ (165)

Finally with the concave bound $\hat{c}$ it is easy to obtain

$\begin{split}\sum_{i}r_{i}\ln^{2}(r_{i})&=\sum_{i}c(r_{i})\\\
&\leq\sum_{i}\hat{c}(r_{i})=n\sum_{i}\frac{1}{n}\hat{c}(r_{i})\\\ &\leq
n\,\hat{c}\left(\sum_{i}\frac{r_{i}}{n}\right)=n\,\hat{c}\left(\frac{1}{n}\right).\end{split}$
(166)

So for entropy susceptibility we get

$\left|\frac{dH_{e}}{dA}\right|\leq
2\sqrt{n\,\hat{c}\left(\frac{1}{n}\right)}$ (167)

For $n\leq 4$, we have $r_{1}<\frac{1}{n}$, so from Eq. (165) we get

$n\leq 4:\qquad n\,\hat{c}\left(\frac{1}{n}\right)=4\,r_{1}(1-r_{1})(n-1).$
(168)

For $n\geq 5$, we instead have $r_{1}>\frac{1}{n}$, so we are in the other
“part” of the function in Eq. (165) and get a simpler expression:

$n\geq 5:\qquad n\,\hat{c}\left(\frac{1}{n}\right)=\ln^{2}(n).$ (169)

Finally, combining the two and recalling that
$H(\rho)=\frac{H_{e}(\rho)}{\ln(2)}$ we get the expression

$\boxed{\left|\frac{dH}{dA}\right|\leq\begin{cases}\frac{4\sqrt{r_{1}(1-r_{1})}}{\ln(2)}\sqrt{n-1}&n\leq
4\\\ 2\log(n)&n\geq 5\end{cases}}.$ (170)

For later use, we evaluate the constant for the $n=4$ case in particular:

$\left|\frac{dH}{dA}\right|\leq\frac{4\sqrt{r_{1}(1-r_{1})}}{\ln(2)}\sqrt{3}<4.023.$
(171)

To bound the entropy difference for non-infinitesimal distances, we simply
integrate along the curve $\bm{\gamma}$; e.g. for $n=4$ this yields

$\Delta H\leq\int_{\sqrt{\bf p}}^{\sqrt{\bf
q}}\left|\frac{dH}{dA}\right|\,dA\leq 4.023\,A(\rho,\sigma).$ (172)

###  B.2 Continuity of the goal function

##### The entropy term –

To apply the continuity bound previously described to our situation, let
$\rho,\rho^{\prime}$ be the states on $\hat{A}_{0}E$ produced by measurements
along angles $\phi,\phi^{\prime}$ on the states
$\left|{\Psi}\right\rangle_{ABE}$ with the weight ${\bf L},{\bf L}^{\prime}$
respectively. Our aim is to bound
$\left|H(\hat{A}_{0}|E)_{\rho}-H(\hat{A}_{0}|E)_{\rho^{\prime}}\right|.$ We
use

$\begin{split}\left|H(\hat{A}_{0}|E)_{\rho}-H(\hat{A}_{0}|E)_{\rho^{\prime}}\right|&=\left|H(\rho_{E})-H(E|\hat{A}_{0})_{\rho}-H(\rho^{\prime}_{E})+H(E|\hat{A}_{0})_{\rho^{\prime}}\right|\\\
&\leq\left|H(\rho_{E})-H(\rho^{\prime}_{E})\right|+\left|H(E|\hat{A}_{0})_{\rho}-H(E|\hat{A}_{0})_{\rho^{\prime}}\right|\end{split}$
(173)

and bound the two last terms independently. For the first term involving
$H(\rho_{E})_{\rho}$, things are straightforward. The states of Eve
$\rho_{E}=\text{diag}({\bf L})$ are 4-dimensional and independent of $\phi$,
so

$|H(\rho_{E})_{\bf L}+H(\rho_{E})_{\bf L^{\prime}}|\leq 4.023\arccos(\sqrt{\bf
L}\cdot\sqrt{\bf L^{\prime}}).$ (174)

For the other term, we note

$\begin{split}\left|H(E|\hat{A}_{0})_{\rho}-H(E|\hat{A}_{0})_{\rho^{\prime}}\right|&=\left|H(\hat{A}_{0}E)_{\rho}-H(\hat{A}_{0}E)_{\rho^{\prime}}\right|\\\
&=\left|H(\rho)-H(\rho^{\prime})\right|\end{split}$ (175)

as $H(\hat{A}_{0})=1$. Since $\hat{A}_{0}E$ is 8-dimensional we get

$\left|H(E|\hat{A}_{0})_{\rho}-H(E|\hat{A}_{0})_{\rho^{\prime}}\right|\leq
2\log(8)\,A(\rho,\rho^{\prime})=6\,A(\rho,\rho^{\prime}).$ (176)

Given that $\rho=\rho({\bf L},\phi)$ and $\rho^{\prime}=\rho({\bf
L}^{\prime},\phi^{\prime})$, we can use the triangle inequality to write

$A(\rho,\rho^{\prime})\leq A(\rho({\bf L},\phi),\rho({\bf
L}^{\prime},\phi))+A(\rho({\bf L}^{\prime},\phi),\rho({\bf
L}^{\prime},\phi^{\prime})).$ (177)

For $A(\rho({\bf L},\phi),\rho({\bf L}^{\prime},\phi))$ we note that both
states result from the action of the same CPTP map on two initial state
$\left|{\Psi({\bf L})}\right\rangle_{ABE}$ and $\left|{\Psi({\bf
L}^{\prime})}\right\rangle_{ABE}$. By the data-processing inequality
(inherited by the angle from the fidelity $F$) we have

$\begin{split}A(\rho({\bf L},\phi),\rho({\bf L}^{\prime},\phi))&\leq
A(\left|{\Psi({\bf L})}\right\rangle_{ABE},\left|{\Psi({\bf
L}^{\prime})}\right\rangle_{ABE})\\\ &=A({\bf L},{\bf L^{\prime}})\\\
&=\arccos(\sqrt{\bf L}\cdot\sqrt{\bf L^{\prime}}).\end{split}$ (178)

To bound the other term $A(\rho({\bf L}^{\prime},\phi),\rho({\bf
L}^{\prime},\phi^{\prime}))$ we note that if we apply a channel that performs
a $Z$ measurement followed by noisy preprocessing to the state $\left(e^{i\phi
Y_{A}/2}\otimes\mathds{1}_{BE}\right)\left|{\Psi}\right\rangle_{ABE}$, this
produces exactly the state $\rho$ on $\hat{A}_{0}E$; analogously, applying the
same channel to the state
$\left(e^{i\phi^{\prime}Y_{A}/2}\otimes\mathds{1}_{BE}\right)\left|{\Psi}\right\rangle_{ABE}$
produces the state $\rho^{\prime}$. Therefore the data-processing inequality
implies $F\left(\rho,\rho^{\prime}\right)$ is lower-bounded by

$\begin{split}F\left(\left(e^{i\phi
Y_{A}/2}\otimes\mathds{1}_{BE}\right)\left|{\Psi}\right\rangle,\left(e^{i\phi^{\prime}Y_{A}/2}\otimes\mathds{1}_{BE}\right)\left|{\Psi}\right\rangle\right)=&\left|\left\langle{\Psi}\right|\left(e^{i(\phi^{\prime}-\phi)Y_{A}/2}\otimes\mathds{1}_{BE}\right)\left|{\Psi}\right\rangle\right|\\\
=&\left|\cos\frac{\phi^{\prime}-\phi}{2}+i\sin\frac{\phi^{\prime}-\phi}{2}\left\langle{\Psi}\right|\left(Y_{A}\otimes\mathds{1}_{BE}\right)\left|{\Psi}\right\rangle\right|\\\
\geq&\left|\cos\frac{\phi^{\prime}-\phi}{2}\right|,\quad\text{since
$\left\langle{\Psi}\right|\left(Y_{A}\otimes\mathds{1}_{BE}\right)\left|{\Psi}\right\rangle\in\mathbb{R}$.
}\end{split}$ (179)

Putting these together, we conclude that (for $|\phi^{\prime}-\phi|<\pi$)

$\displaystyle A(\rho({\bf L}^{\prime},\phi),\rho({\bf
L}^{\prime},\phi^{\prime}))\leq\frac{|\phi^{\prime}-\phi|}{2}.$ (180)

Combining everything together, we get

$\left|H(\hat{A}_{0}|E)_{\rho}-H(\hat{A}_{0}|E)_{\rho^{\prime}}\right|\leq
10.023\,\arccos(\sqrt{\bf L}\cdot\sqrt{\bf
L^{\prime}})+3\,|\phi-\phi^{\prime}|$ (181)

##### The Bell score –

Next we wish to bound the increment $|d\beta_{\text{max}}({\bf
L,a_{0}},\Omega)|$ for infinitesimal changes of the parameters $(d{\bf
L},d\phi)$. It is actually straightforward to bound the gradient of the Bell
score before the maximization with respect to ${\bf a}_{0},{\bf b}_{0},{\bf
b}_{1}$, so we just need to be careful to apply this bound on
$\beta_{\text{max}}$.

First, note that $\mathcal{B}_{\Omega}({\bf L},\phi,{\bf a}_{1},{\bf
b}_{0},{\bf b}_{1})$ is a positive smooth infinitely differential function of
all its parameters. For a fixed $\Omega$, let us group these parameters in two
vectors ${\bf x}=(\bf a_{1},b_{0},b_{1})$ and ${\bf y}=(T_{z},T_{x},{\bf
a_{0}}).$ We then formally define

$\begin{split}f({\bf x,y})&=\mathcal{B}_{\Omega}({\bf L},\phi,{\bf a}_{1},{\bf
b}_{0},{\bf b}_{1})\\\ g({\bf y})&=\max_{\bf x}f({\bf
x,y})=\beta_{\text{max}}({\bf L,a_{0}},\Omega).\end{split}$ (182)

We are interested in bounding $|dg({\bf y})|$ as a function of $d{\bf y}$.
Consider two values of the parameter, ${\bf y}_{1}$ and ${\bf y_{2}}$, and
define

$\begin{split}\bar{\bf x}_{1}&=\text{argmax}_{\bf x}f({\bf x},{\bf y}_{1})\\\
\bar{\bf x}_{2}&=\text{argmax}_{\bf x}f({\bf x},{\bf y}_{2}),\end{split}$
(183)

such that $g({\bf y}_{1})=f(\bar{\bf x}_{1},{\bf y}_{1})$ and $g({\bf
y}_{2})=f(\bar{\bf x}_{2},{\bf y}_{2})$. Without loss of generality we assume
$g({\bf y}_{1})\geq g({\bf y}_{2})$ and consider the difference

$\begin{split}|g({\bf y_{1}})-g({\bf y_{2}})|&=|f(\bar{\bf x}_{1},{\bf
y_{1}})-f(\bar{\bf x}_{2},{\bf y_{2}})|\\\ &\leq|f(\bar{\bf x}_{1},{\bf
y_{1}})-f(\bar{\bf x}_{1},{\bf y_{2}})|\\\ &\leq\max_{{\bf x}}|f({\bf x},{\bf
y_{1}})-f({\bf x},{\bf y_{2}})|\end{split}$ (184)

Taking the limit ${\bf y_{2}}\to{\bf y}_{1}$ we get

$|dg\bf(y)|\leq\max_{\bf x}|\nabla_{\bf y}f({\bf x},{\bf y})\cdot d{\bf y}|.$
(185)

Using the expression (72) for $\mathcal{B}_{\Omega}({\bf L},\phi,{\bf
a}_{1},{\bf b}_{0},{\bf b}_{1})$ we then get

$|d\beta_{\text{max}}({\bf L},\phi)|\leq\left(\begin{array}[]{c}1\\\ 1\\\
\textrm{C}_{\Omega}\end{array}\right)\cdot\left(\begin{array}[]{c}|dT_{z}|\\\
|dT_{x}|\\\ |d\phi|\end{array}\right).$ (186)

###  B.3 Gradient of the goal function

We will now combine all the elements to upper bound the gradient of the goal
function

$G({\bf
L},\phi;\Omega,q)=H(\rho_{E})-H(E|\hat{a}_{0}(q))+t\beta_{\text{max}}({\bf
L},\phi).$ (187)

We parametrize the vector $\bf L$ with the help of the angles as in Eq. (50),
such that the “model” is described by four angles

$({\bf L},\phi)\simeq{\bm{\omega}}=(\alpha,\mu,\xi,\phi).$ (188)

We will bound the gradient of the goal function with respect to this
parametrization.

We start with the gradient of the angle. It satisfies

$dA=|A({\bf L}({\bm{\omega}}),{\bf L}({\bm{\omega}+{\bf
n}d\omega}))|\leq|\nabla A({\bm{\omega}})|d\omega,$ (189)

with a unit vector ${\bf n}=(n_{\alpha},n_{\mu},n_{\xi},0)$. For the fidelity
one finds

$\begin{split}F({\bf L}({\bm{\omega}}),{\bf L}({\bm{\omega}+{\bf
n}d\omega}))&=\sqrt{\bf L(\bm{\omega})}\cdot\sqrt{\bf
L(\bm{\omega}+d\bm{\omega}_{i})}\\\ &\geq
1-\frac{3}{4}d\omega^{2}+O(d\omega^{3})\end{split}$ (190)

for $d\omega_{i}=d\alpha,d\mu$ or $d\xi$, one easily finds

$|\nabla A({\bm{\omega}})|\leq\sqrt{\frac{3}{2}}.$ (191)

We thus get from Eq. (181)

$\begin{split}|d(H(\rho_{E})-H(E|\hat{a}_{0}(q)))|\leq
10.023\sqrt{\frac{3}{2}}\sqrt{d\alpha^{2}+d\mu^{2}+d\xi^{2}}+3d\phi\end{split}$
(192)

and

$\begin{split}|\nabla(H(\rho_{E})-H(E|\hat{a}_{0}(q))|\leq\sqrt{10.023^{2}\frac{3}{2}+9}<12.7\end{split}$
(193)

For the gradient of the Bell score contribution
$|\nabla\beta_{\text{max}}({\bf L},\phi)|$ we note that

$|dT_{z}|,|dT_{x}|\leq 2\Big{(}|d\alpha|+|d\mu|+|d\xi|\Big{)},$ (194)

which implies form (186) that

$|\nabla\beta_{\text{max}}({\bf L},\phi)|\leq t\sqrt{3\times
4^{2}+\textrm{C}_{\Omega}^{2}}\leq 7t$ (195)

Finally, for the goal function

$\boxed{|\nabla G|\leq 12.7+7\,t}.$ (196)

###  B.4 Lipschitz function certified maximization on a compact space

##### General approach –

In this section section we explain how we obtain a certified maximum of a
Lipschitz function $f:\mathbb{R}^{n}\to\mathbb{R}$ with a Lipschitz constant
$\Lambda$, i.e. a bounded gradient $|\nabla f|\leq\Lambda$, on a closed domain

$\mathcal{D}=\\{{x}=\begin{pmatrix}x_{1}\\\ \vdots\\\
x_{n}\end{pmatrix}\in\mathbb{R}^{n}\;|\;x_{i}\in[\tau_{i},\mu_{i}],\;\forall\,i\\}.$
(197)

We start by meshing $\mathcal{D}$ into an hypercube grid graph $G(s)$ with
element of size $s$. If possible, we take $s$ so that $s$ evenly divides
$\mu_{i}-\tau_{i}$ for all $i$. We label the center of each hypercube
$\vec{c}$ so that each first neighbor in a given direction is separated by
$s$, e.g. for $\vec{c}$ and its neighbor $\vec{c^{\prime}}$ in the direction
$+\vec{e_{1}}$

$\vec{c^{\prime}}=\begin{pmatrix}c_{1}^{\prime}\\\ c_{2}^{\prime}\\\ \vdots\\\
c_{n}^{\prime}\end{pmatrix}=\vec{c}+s.\vec{e_{1}}=\begin{pmatrix}c_{1}+s\\\
c_{2}^{\prime}\\\ \vdots\\\ c_{n}^{\prime}\end{pmatrix}.$ (198)

A hypercube of center $\vec{c}$, $h(\vec{c})$, element of G, is thus defined
as

$h(\vec{c})=\\{x\in\mathbb{R}^{n}|c_{i}-\frac{s}{2}\leq x_{i}\leq
c_{i}+\frac{s}{2},\,\forall i\in\\{1,\ldots,n\\}\\}.$ (199)

Given the Lipschitz constant $\Lambda$, the function $f$ in a given hypercube
$h(\vec{c})$ is upper bounded by

$f(x)\leq f(\vec{c})+\frac{\sqrt{n}\Lambda}{2}s,\quad\forall x\in h(\vec{c}).$
(200)

Trivially, an upper bound on the maximum of $f$ over $\mathcal{D}$ is given
by,

$\max_{x\in\mathcal{D}}f(x)\leq\max_{\vec{c}\in
G(s)}f(\vec{c})+\frac{\sqrt{n}\Lambda}{2}s.$ (201)

The maximum of $f$ over $\mathcal{D}$ can thus be obtained by taking the
smallest possible step, i.e.

$\max_{x\in\mathcal{D}}f(x)=\lim_{s\to 0}\left(\max_{\vec{c}\in
G(s)}\left(f(\vec{c})+\frac{\sqrt{n}\Lambda}{2}s\right)\right).$ (202)

##### Numerical realisation –

While Eq. (202) gives the optimal maximum on $f$, it is however impracticable
using numerical resources, due to the obvious need of discretization. A first
naive approach is to relax the problem by setting a lower bound on $s$. This
is, with the lower bound $s\geq\varepsilon$,

$\max_{x\in\mathcal{D}}f(x)\leq\lim_{s\to\varepsilon}\left(\max_{\vec{c}\in
G(s)}\left(f(\vec{c})+\frac{\sqrt{n}\Lambda}{2}s\right)\right).$ (203)

Resource wise, this method is cumbersome. Indeed, setting $\varepsilon$ to a
small value compared to the domain space, i.e.
$\varepsilon\ll\min_{i}(\tau_{i}-\mu_{i})$, will result in a high number of
hypercubes to explore. Furthermore, for a given step $s$, the number of
hypercubes scales exponentially with the dimension $n$.

##### Speed-up using a guess on the maximum –

Providing a guess on the maximum of $f$ may significantly speed up the
previous method. Such a maximum can be found using an optimization algorithm
without guarantees of optimality (BFGS, CMA, and others…). Denote such a
maximum as $\nu$.
We start by setting a not-too-small step, $s_{0}$, so that the number of
hypercubes composing the grid graph, $G_{0}(s_{0})$, is reasonnable. For each
hypercube $h_{0}(\vec{c})$ we start by computing the potential maximum,

$\xi^{0}(\vec{c})=f(\vec{c})+\frac{\sqrt{n}\Lambda}{2}s_{0}.$ (204)

We then compare this value to $\nu$. In the case where $\nu>\xi^{0}(\vec{c})$,
we pass to the next hypercube since the guessed maximum is higher than the
potential maximum value of $f$ in $h_{0}(\vec{c})$. Otherwise, we mesh
$h_{0}(\vec{c})$ into a new hypercube grid graph $G_{1}(s_{1})$ of element of
size $s_{1}=s_{0}/2$. For all of the new generated hypercubes,
$h_{1}(\vec{c})\in G_{1}(s_{1})$, we compute the potential maximum
$\xi^{1}(\vec{c})$ using Eq. (204). This method is applied recursively until
either all new hypercubes of graph $G^{k}_{m}$ satisfy $\nu>h_{m}(\vec{c})$,
or we reach the minimum step $s_{m}\leq\varepsilon$. An upper bound of $f$ is
thus given by the maximum $\xi^{m}(\vec{c})$

$\max(\xi^{m}(\vec{c}))=f(\vec{c})+\frac{\sqrt{n}\Lambda}{2}s_{m}$ (205)

where $s_{m}=s_{0}/2^{m}$.