# Security of device-independent quantum key distribution protocols: a review

Ignatius W. Primaatmaja  Centre for Quantum Technologies, National University
of Singapore, Singapore  Koon Tong Goh  Department of Electrical & Computer
Engineering, National University of Singapore, Singapore  Ernest Y.-Z. Tan
Institute for Quantum Computing and Department of Physics and Astronomy,
University of Waterloo, Canada  John T.-F. Khoo  Department of Electrical &
Computer Engineering, National University of Singapore, Singapore  Department
of Computer Science, National University of Singapore, Singapore  Shouvik
Ghorai  Department of Electrical & Computer Engineering, National University
of Singapore, Singapore  Charles C.-W. Lim  Centre for Quantum Technologies,
National University of Singapore, Singapore  Department of Electrical &
Computer Engineering, National University of Singapore, Singapore

###### Abstract

Device-independent quantum key distribution (DI-QKD) is often seen as the
ultimate key exchange protocol in terms of security, as it can be performed
securely with uncharacterised black-box devices. The advent of DI-QKD closes
several loopholes and side-channels that plague current QKD systems. While
implementing DI-QKD protocols is technically challenging, there have been
recent proof-of-principle demonstrations, resulting from the progress made in
both theory and experiments. In this review, we will provide an introduction
to DI-QKD, an overview of the related experiments performed, and the theory
and techniques required to analyse its security. We conclude with an outlook
on future DI-QKD research.

###### Contents

  1. 1 Introduction
    1. 1.1 Basics of quantum key distribution
      1. 1.1.1 Generic setting
      2. 1.1.2 Security definition
      3. 1.1.3 Side-channels and quantum hacking
    2. 1.2 Device-independent security
      1. 1.2.1 Motivation
      2. 1.2.2 Towards the notion of device-independence
      3. 1.2.3 Beyond fully device-independent security
  2. 2 Assumptions
  3. 3 Experiments
    1. 3.1 Fully-photonic experiments
      1. 3.1.1 General features
      2. 3.1.2 Losses in fully-photonic experiments
      3. 3.1.3 Qubit amplifiers
      4. 3.1.4 Relevant experiments
    2. 3.2 Heralded entanglement experiments
      1. 3.2.1 General features
      2. 3.2.2 Relevant experiments
  4. 4 Protocols
    1. 4.1 The standard DI-QKD protocol
    2. 4.2 DI-QKD based on other constraints
    3. 4.3 DI-QKD with noisy pre-processing
    4. 4.4 DI-QKD with random key basis
    5. 4.5 DI-QKD with random post-selection
    6. 4.6 DI-QKD with advantage distillation
  5. 5 Security analyses
    1. 5.1 Classes of approaches
      1. 5.1.1 Jordan’s lemma
      2. 5.1.2 Hierarchy of semi-definite programs
    2. 5.2 Techniques based on Jordan’s lemma
      1. 5.2.1 Reduction to Bell-diagonal states
      2. 5.2.2 Entropic uncertainty relations
      3. 5.2.3 Numerical analyses via Jordan’s lemma
    3. 5.3 Techniques based on SDP hierarchies
      1. 5.3.1 Conditional min-entropy
      2. 5.3.2 Gibbs-Golden-Thompson method
      3. 5.3.3 Iterated mean divergences
      4. 5.3.4 Quasi-relative entropies
    4. 5.4 Upper bounds
      1. 5.4.1 Explicit attacks for specific protocols
      2. 5.4.2 Intrinsic information and intrinsic nonlocality
      3. 5.4.3 Explicit bounds from intrinsic information
      4. 5.4.4 Extensions via the cc-squashed entanglement
      5. 5.4.5 Other upper bounds on the DI-QKD key rate
  6. 6 Finite-key analyses
    1. 6.1 Entropy accumulation theorem
    2. 6.2 Other techniques
  7. 7 Outlook
    1. 7.1 Other frameworks for finite-key analyses
    2. 7.2 Finite-key analyses of some protocols
    3. 7.3 Protocol design: more inputs/more outputs
    4. 7.4 Trade-off between security and practicality

##  1 Introduction

Cryptosystems today are designed with the requirement that they should be
secure even if everything about the system is publicly known except for the
input key. This idea is known as _Kerckhoffs’s principle_ Petitcolas
(2011)111In Shannon’s seminal work on secrecy Shannon (1949), the same design
principle is expressed in the assumption “the enemy knows the system being
used”. . However, a sophisticated enemy today can do more than just _knowing
the system_ — the enemy could also exploit his system knowledge to create
side-channels through active engineering efforts. Indeed, these
vulnerabilities can be introduced through a wide variety of avenues, from
implementation flaws to supply chain attacks. The possibility of performing
cryptography with untrustworthy devices is a tantalising solution to these
challenges.

At first glance, this task seems impossible, since the security of
cryptography is typically analysed in very concrete terms, assuming secure and
characterised devices. Remarkably, it turns out the answer can be found in the
foundations of quantum theory. This approach, called _device-independent
quantum cryptography_ , uses _nonlocality_ Bell (1964) to certify the security
of cryptosystems. The basic idea is to randomly subject the quantum devices to
a _Bell test_ , where a Bell inequality is evaluated using the input-output
measurement data, and the degree of nonlocality is quantified by the observed
Bell inequality violation. The higher the violation, the lower the possible
degree of correlation with any other system due to the monogamy of nonlocality
Toner (2009). Importantly, this trade-off can be formalised, and one can
rigorously bound the adversary’s information about the devices using the
observed Bell violation.

The beauty of quantifying security using nonlocality is that the method is
agnostic to the physics of the devices. In particular, the only information
needed to evaluate the Bell inequality is the joint input-output probability
distribution of the devices. Therefore, the physics behind the distribution is
not relevant and the devices can be seen as black boxes that return some
output when given an input.

Device-independent quantum cryptography also has a nice physical
interpretation in the context of _self-testing_ Mayers and Yao (1998,
2004)222For a recent review of the subject, we refer the interested reader to
Šupić and Bowles (2020).. This is an elegant phenomenon where, from the input-
output distribution of a system alone, it can be deduced that the underlying
quantum system of an uncharacterised device is, up to some local isometries,
close to some ideal system. Indeed, when seen in this light, it is not
surprising that one can also perform cryptography with uncharacterised devices
— their input-output statistics can indicate that the actual system’s physics
is very close to the ideal secure system’s physics.333The connection between
self-testing and quantum cryptography was first proposed by Mayers & Yao in
Mayers and Yao (1998), where they proposed a self-testing approach for quantum
key distribution. Interestingly, the work of Mayers and Yao did not draw any
connection to nonlocality despite their similarities.

In this review article, the cryptographic task under consideration is the key
exchange problem, in which two honest users establish a shared secret key over
an insecure channel. The use of quantum cryptography to perform key exchange
is referred to as _quantum key distribution_ (QKD). Device-independent QKD
(DI-QKD) specifically uses the methods of device-independent quantum
cryptography to prove security, in contrast to conventional device-dependent
QKD (DD-QKD), which requires the faithfulness of its implementation to some
ideal specifications in order to be secure. Consequently, the possibility of
miscalibrations within a DD-QKD system, which would cause its devices to
deviate from their specifications, implies a larger attack surface that can be
exploited by the adversary. The device-independent approach to QKD eliminates
such concerns by accounting for the devices’ faithfulness organically within
its framework. This review paper aims to summarise recent theoretical
developments in DI-QKD, both in protocol design and in techniques for
analysing the security of QKD in the device-independent framework.

In the next two subsections, we shall give a brief introduction to QKD and the
device-independent framework. For a more in-depth overview of the security of
QKD, we refer the readers to Scarani et al. (2009); Xu et al. (2020).
Additionally, as the device-independent framework relies crucially on
nonlocality, the readers can refer to the detailed review of Bell nonlocality
in Brunner et al. (2014). A more pedagogical presentation of background
material can also be found in Tan (2021); Scarani (2019).

###  1.1 Basics of quantum key distribution

Quantum key distribution Scarani et al. (2009); Xu et al. (2020) is a key
exchange protocol between two remote users via an _insecure_ quantum channel,
where the adversary can perform arbitrary quantum operations on transmitted
quantum systems, and an _authenticated_ classical channel, where messages can
be read by the adversary but not modified. Under a well-defined set of
assumptions (Section 2), the secret keys exchanged using QKD can be proven to
be information-theoretically secure, which implies in particular that the
optimal strategy for an adversary with unbounded computational resources to
recover the exchanged key is a uniformly random guess. This means that the
security of QKD cannot be threatened by any technological advancement or new
algorithm, unlike classical cryptography, which relies on the computational
difficulty of solving certain problems. The analogous task in classical
cryptography, which is to establish an information-theoretically secure key
using an insecure classical channel and an authenticated classical channel, is
not possible. Such a key can be pre-agreed upon, for example by the parties
physically meeting up to exchange this key, but this pre-agreement itself
requires a secure classical channel, such as that of physical contact, which
makes its practical deployment rather cumbersome. Quantum cryptography is
strictly necessary to exchange an information-theoretically secure key over an
insecure channel, and offers a more practical means of achieving this ultimate
level of security.

In this review, we shall focus on QKD in the sense of key exchange between two
users only. The extension of QKD to three or more users is known as quantum
conference key agreement (CKA). For a review on this topic, we refer the
readers to Murta et al. (2020). Analogously, when the devices are treated as
black boxes, the task is known as device-independent CKA (DI-CKA) Ribeiro et
al. (2018); Grasselli et al. (2021). While this task would not be considered
in this review, many notions and techniques presented here are also relevant
in DI-CKA.

####  1.1.1 Generic setting

The first QKD protocols were in the form of the prepare-&-measure (P&M) scheme
Bennett and Brassard (1984) where one party (Alice) prepares and sends a
quantum state to the other party (Bob), who will measure the quantum state
received. The entanglement-based (EB) QKD scheme Ekert (1991); Bennett et al.
(1992) was introduced shortly after, where Alice and Bob each measure one part
of an entangled system. Subsequently, the measurement-device-independent (MDI)
QKD scheme Lo et al. (2012); Braunstein and Pirandola (2012) was developed,
where Alice and Bob each send a quantum state to an untrusted, and presumably
malicious, measurement device. While QKD protocols can take these various
forms, the security proofs of P&M- and MDI-QKD protocols are often performed
by reducing them to an equivalent EB-QKD protocol Bennett et al. (1992).
Hence, one can usually speak of the security definition of any QKD protocol in
the context of the EB-QKD scheme without loss of generality.

Figure 1: Various QKD schemes: Prepare-&-measure (P&M), entanglement-based
(EB) and measurement-device-independent (MDI) protocols.

Regardless of whether the protocol employs the P&M scheme, the EB scheme, or
the MDI scheme, a typical QKD protocol can be divided into two layers — the
quantum communication layer (in which quantum information is distributed via
the insecure quantum channels to form a pair of raw keys) and the classical
post-processing layer (in which the raw keys are converted into secure keys).
For the quantum communication layer, we consider a generic EB-QKD protocol
where Alice’s (resp. Bob’s) QKD device takes the inputs $\mathbf{X}$ (resp.
$\mathbf{Y}$) and gives the outputs $\mathbf{A}$ (resp. $\mathbf{B}$) by
making appropriate measurements (depending on their inputs) on the quantum
states distributed to the devices. In the most conservative scenario, the
adversary Eve holds a purification $E$ of the distributed quantum state. We
let the number of rounds (and hence, the length for the inputs and outputs of
each party) be $n$. From their local data and by communicating their inputs
for each round to perform sifting, Alice and Bob can then create their raw
keys, denoted by $\mathbf{S}$ and $\mathbf{S}^{\prime}$, respectively.

These raw keys can be thought of as two strings of random numbers that are
weakly correlated to each other, and to Eve’s quantum side information, $E$.
Alice and Bob then use an authenticated (but public) classical channel to
announce a random subset of their data for the purpose of estimating the
correlation444We do not specify the measure of correlation here. Many QKD
protocols use the quantum bit-error rate as a measure of correlation but other
measures of correlation are available. In the context of device-independent
QKD, a Bell violation is typically used to measure correlations. between their
data. This step is typically termed _parameter estimation_. Typically, the
rounds in which the data are announced for parameter estimation are called
“test rounds”, while the rounds in which the data are kept private (for
producing the secret key later) are called the “generation rounds”. Broadly
speaking, there are two ways to choose whether a given round is a test round
or a generation round. The first method is to fix the total number of test
rounds, and to have Alice and Bob randomly select that number of rounds from
their recorded data to serve as the test rounds. The second method is to
assign a fixed probability for each round in the protocol to be a test round,
and then to announce the data for the rounds which are tagged as test rounds
in the parameter estimation step. In either case, if the exchanged information
indicates that there is sufficient correlation between their data, they
continue the protocol; otherwise, they abort it.

If they decide to continue the protocol, they use the authenticated classical
channel again to perform _information reconciliation_ , which is often
convenient to analyse in two parts: _error correction_ (in which the parties
try to make their strings identical) and _error verification_ (in which they
check whether they succeeded). At the end of this step, they would share a
pair of identical strings, but these may still be correlated to Eve’s side-
information (which now also includes any public announcements that Alice and
Bob have made; we denote the transcript of the public classical communication
by $\mathbf{P}$). To finally obtain a pair of identical strings that are
secret (i.e. uniformly random from Eve’s perspective), Alice and Bob perform
privacy amplification. This can be achieved by randomly choosing a hash
function from a suitable family that maps their strings to shorter ones, which
we shall denote as $\mathbf{K}$ and $\mathbf{K}^{\prime}$ for Alice and Bob
respectively, each with length $\ell$. The secret key rate $r$ is then defined
as $r\coloneqq\ell/n$.

####  1.1.2 Security definition

The qualitative goal of QKD is to distribute a pair of keys securely between
two remote users. Given this, it is important to first formalise what
“security” means in the context of this task. To that end, let us first
consider what we might reasonably require from an “ideal” key distribution
protocol. Note that, for any physical QKD implementation, it is always
possible for Eve to perform a denial-of-service attack — an attack that
prevents the protocol from successfully producing the shared secret keys (e.g.
by always distributing completely insecure states, or by simply blocking the
communication channel). In light of this, when considering the ideal key
distribution protocol, we should allow some possibility of it aborting. That
aside, however, we can reasonably impose that whenever the ideal protocol does
not abort, its output to the honest parties should be a pair of identical
strings of a fixed length $\ell$, and Eve gets no usable information about
these strings.

A full formalisation of this notion in terms of a “real-versus-ideal-world”
paradigm can be found in e.g. Portmann and Renner (2014, 2021), which also
discusses its relationship to composable security: the requirement that a
protocol remains secure when composed with other protocols. Here, we shall
simply state the security condition arising from that formalism, which can be
seen to qualitatively correspond to the requirements sketched above. To begin
with, let us consider the output of a real QKD protocol carried out with
arbitrary states, supplied by Eve. Accounting for the fact that it may abort
with some probability (and using the convention that Alice and Bob both set
their keys to an abort symbol $\perp$ in that case), it would be in the form

$\rho_{\mathbf{K}\mathbf{K}^{\prime}\mathbf{P}E}={\lvert\perp,\perp\rangle\\!\langle\perp,\perp\rvert}_{\mathbf{K}\mathbf{K}^{\prime}}\otimes\tilde{\rho}_{\mathbf{P}E}^{\text{abort}}+\tilde{\tau}_{\mathbf{K}\mathbf{K^{\prime}}\mathbf{P}E},$
(1)

where $\tilde{\rho}^{\text{abort}}$, $\tilde{\tau}$ are sub-normalised states
corresponding to the protocol aborting and accepting respectively. The
normalisation of $\rho_{\mathbf{K}\mathbf{K}^{\prime}\mathbf{P}E}$ gives

$\begin{split}\mathrm{tr}[\tilde{\rho}_{\mathbf{P}E}^{\text{abort}}]&=\Pr[\text{abort}],\\\
\mathrm{tr}[\tilde{\tau}_{\mathbf{K}\mathbf{K^{\prime}}\mathbf{P}E}]&=\Pr[\text{accept}]=1-\Pr[\text{abort}],\end{split}$
(2)

and furthermore the latter state has the form

$\tilde{\tau}_{\mathbf{K}\mathbf{K^{\prime}}\mathbf{P}E}=\sum_{k,k^{\prime}\in\\{0,1\\}^{\ell}}{\lvert
k,k^{\prime}\rangle\\!\langle
k,k^{\prime}\rvert}_{\mathbf{K}\mathbf{K}^{\prime}}\otimes\tilde{\tau}^{k,k^{\prime}}_{\mathbf{P}E},$
(3)

where each $\tilde{\tau}^{k,k^{\prime}}$ is the sub-normalised state
conditioned on Alice and Bob having key values $k$ and $k^{\prime}$
respectively.

Then, for a fixed security parameter $\varepsilon\in(0,1)$, a QKD protocol is
$\varepsilon$-secure555This is sometimes instead referred to as
$\varepsilon$-sound in later works, e.g. Portmann and Renner (2014, 2021). if
Renner (2005)

$\frac{1}{2}\left\lVert\rho_{\mathbf{K}\mathbf{K}^{\prime}\mathbf{P}E}-\rho^{\text{ideal}}_{\mathbf{K}\mathbf{K}^{\prime}\mathbf{P}E}\right\rVert_{1}\leq\varepsilon,$
(4)

where $\rho^{\text{ideal}}_{\mathbf{K}\mathbf{K}^{\prime}\mathbf{P}E}$ is an
“ideal state”666Note that
$\rho^{\text{ideal}}_{\mathbf{K}\mathbf{K}^{\prime}\mathbf{P}E}$ is
constructed in terms of the real output state
$\rho_{\mathbf{K}\mathbf{K}^{\prime}\mathbf{P}E}$; we are not defining a
specific $\rho^{\text{ideal}}_{\mathbf{K}\mathbf{K}^{\prime}\mathbf{P}E}$ that
$\rho_{\mathbf{K}\mathbf{K}^{\prime}\mathbf{P}E}$ must be close to. Further
explanation of this definition choice can be found in Portmann and Renner
(2014, 2021).

$\rho^{\text{ideal}}_{\mathbf{K}\mathbf{K}^{\prime}\mathbf{P}E}\coloneqq{\lvert\perp,\perp\rangle\\!\langle\perp,\perp\rvert}_{\mathbf{K}\mathbf{K}^{\prime}}\otimes\tilde{\rho}_{\mathbf{P}E}^{\text{abort}}\\\
+\chi^{\ell}_{\mathbf{K}\mathbf{K^{\prime}}}\otimes\tilde{\tau}_{\mathbf{P}E},$
(5)

with

$\chi^{\ell}_{\mathbf{K}\mathbf{K^{\prime}}}\coloneqq\sum_{k\in\\{0,1\\}^{\ell}}2^{-\ell}{\lvert
k,k\rangle\\!\langle k,k\rvert}_{\mathbf{K}\mathbf{K^{\prime}}}$ (6)

being a uniformly distributed and perfectly correlated bit-string of length
$\ell$. In other words, the output of the real QKD protocol is
$\varepsilon$-close in trace distance to some “ideal state” that is (apart
from the abort component) perfectly correlated between Alice and Bob,
uniformly random, and independent from Eve’s side-information.

Noting that the abort components in
$\rho_{\mathbf{K}\mathbf{K}^{\prime}\mathbf{P}E}$ and
$\rho^{\text{ideal}}_{\mathbf{K}\mathbf{K}^{\prime}\mathbf{P}E}$ are exactly
the same, the condition (4) can also be written in the following equivalent
form:

$\frac{1}{2}\left\lVert\tilde{\tau}_{\mathbf{K}\mathbf{K^{\prime}}\mathbf{P}E}-\chi^{\ell}_{\mathbf{K}\mathbf{K^{\prime}}}\otimes\tilde{\tau}_{\mathbf{P}E}\right\rVert_{1}\leq\varepsilon,$
(7)

keeping in mind that $\tilde{\tau}$ is the _sub_ -normalised state conditioned
on the protocol accepting.777It is impossible to ensure that (7) holds with
the normalised conditional states instead — this is because Eve can always
trivially implement a “classical strategy” that gives her perfect knowledge of
the outputs, in which case the accept probability is typically exponentially
small, but the normalised state conditioned on accepting would still be very
far from the normalised “ideal term”
$\chi^{\ell}_{\mathbf{K}\mathbf{K}^{\prime}}\otimes\Pr[\text{accept}]^{-1}\tilde{\tau}_{\mathbf{P}E}$.
We stress that this security definition is for protocols where the key length
$\ell$ is a fixed parameter. For protocols with adaptive key length as a
function of the observed statistics, the security condition should be modified
to Ben-Or et al. (2005)

$\frac{1}{2}\left\lVert\tilde{\tau}_{\mathbf{K}\mathbf{K^{\prime}}\mathbf{P}E}-\sum_{\ell}\chi^{\ell}_{\mathbf{K}\mathbf{K}^{\prime}}\otimes\tilde{\tau}^{\ell}_{\mathbf{P}E}\right\rVert_{1}\leq\varepsilon,$
(8)

where $\tilde{\tau}^{\ell}$ is the sub-normalised state conditioned on the
protocol producing a key of length $\ell$. However, we will not discuss
protocols with adaptive key length in detail.

It is often convenient in security analyses to break down the security
condition (7) into two slightly simpler criteria: correctness and secrecy. We
shall discuss the correctness criterion first. A QKD protocol is said to be
$\varepsilon_{\text{cor}}$-correct if

$\Pr[\mathbf{K}\neq\mathbf{K}^{\prime}\text{ and protocol
accepts}]\leq\varepsilon_{\text{cor}}.$ (9)

Under the convention of setting $\mathbf{K}=\mathbf{K}^{\prime}=\perp$
whenever the protocol aborts, this can be rewritten equivalently in the more
succinct form
$\Pr[\mathbf{K}\neq\mathbf{K}^{\prime}]\leq\varepsilon_{\text{cor}}$. On the
other hand, for the secrecy criterion, a QKD protocol is
$\varepsilon_{\text{sec}}$-secret (with respect to Alice’s key) if

$\frac{1}{2}\left\lVert\tilde{\tau}_{\mathbf{K}\mathbf{P}E}-\chi^{\ell}_{\mathbf{K}}\otimes\tilde{\tau}_{\mathbf{P}E}\right\rVert\leq\varepsilon_{\text{sec}},$
(10)

where
$\chi^{\ell}_{\mathbf{K}}\coloneqq\mathrm{tr}_{\mathbf{K}^{\prime}}[\chi^{\ell}_{\mathbf{K}\mathbf{K}^{\prime}}]$
is a uniformly distributed bit-string of length $\ell$.

A protocol that is $\varepsilon_{\text{cor}}$-correct and
$\varepsilon_{\text{sec}}$-secret is also
$(\varepsilon_{\text{cor}}+\varepsilon_{\text{sec}})$-secure Portmann and
Renner (2014, 2021). Therefore, we can analyse the security of a QKD protocol
by proving its correctness and secrecy separately. In particular, it is not
necessary to explicitly analyse the secrecy of Bob’s key since it will be
taken care of by the correctness criterion.

We shall discuss in more detail how the correctness and secrecy conditions can
be proven in Section 6. To give a short overview here, the correctness
condition can usually be enforced straightforwardly by choosing an error
verification procedure based on two-universal hashing (although some early
works used other approaches). As for the secrecy condition, it can be ensured
by using an appropriate privacy amplification scheme in the protocol. For
example, one could use a family of two-universal hash functions in the privacy
amplification step. In this case, one could invoke the leftover hash lemma
against quantum side-information Tomamichel et al. (2011) to prove that the
secrecy condition is met as long as the output length $\ell$ of the protocol
is chosen to be slightly less than the conditional smooth min-entropy of the
raw key, which is defined as follows: for a given smoothing parameter
$\epsilon_{s}$ and a classical-quantum state $\rho_{XE}$, its conditional
smooth min-entropy is

$H_{\text{min}}^{\epsilon_{s}}(X|E)_{\rho_{XE}}=\max_{\sigma_{XE}\in\mathcal{B}_{\epsilon_{s}}(\rho_{XE})}H_{\text{min}}(X|E)_{\sigma_{XE}}.$
(11)

Here, the maximisation is taken over the set

$\mathcal{B}_{\epsilon_{s}}(\rho_{XE})=\left\\{\sigma_{XE}\in\mathrm{D}_{\leq}(\mathcal{H}_{XE}):\Delta_{p}(\sigma_{XE},\rho_{XE})\leq\epsilon_{s}\right\\},$

where $\mathrm{D}_{\leq}(\mathcal{H}_{XE})$ denotes the set of sub-normalised
states in the Hilbert space $\mathcal{H}_{XE}$. The definition of
$\mathcal{B}_{\epsilon_{s}}$ is based on the purified distance

$\Delta_{p}(\rho,\sigma)=\sqrt{1-F^{2}(\rho,\sigma)},$ (12)

where
$F(\rho,\sigma)=\mathrm{tr}[|\sqrt{\rho}\sqrt{\sigma}|]+\sqrt{(1-\mathrm{tr}[\sigma])(1-\mathrm{tr}[\rho])}$
is the generalised fidelity. Consequently, proving the secrecy of a QKD
protocol is often reduced to finding a lower bound on the smooth min-entropy
of the raw key conditioned on all the information gathered by Eve over the
course of the protocol. We defer further discussion of how such bounds are
derived to Section 6.

However, the security criterion (7) is not the only requirement for a QKD
protocol Portmann and Renner (2014, 2021). Recall that (7) is defined using
the sub-normalised states conditioned on accepting. As one consequence, a
protocol that always aborts would satisfy this criterion trivially. Since such
a protocol is undesirable, we also impose the requirement that the protocol
should succeed in producing a pair of secret keys with high probability, in
the presence of a realistic amount of noise. This is formalised as a
requirement of _completeness_ Portmann and Renner (2014, 2021): A protocol is
said to be $\varepsilon_{\text{com}}$-complete if the honest implementation
(which might be noisy) satisfies

$\Pr[\text{abort}]_{\text{honest}}\leq\varepsilon_{\text{com}}.$ (13)

Here, the probability of aborting under the honest behaviour, which we denote
by $\Pr[\text{abort}]_{\text{honest}}$, is calculated for a certain modelled
behaviour of the device, since it is just to ensure that the protocol accepts
with high probability when everything behaves as expected. This is unlike
$\Pr[\text{abort}]$ encountered previously, which depends on the real
behaviour of the implemented protocol that is subjected to Eve’s attacks (this
abort probability can, and _should_ , be high whenever Eve performs an attack
that gives her enough information to compromise the key).

We briefly remark that the above security definitions were originally
developed for the context of device-dependent QKD, where they also have
significant operational implications Portmann and Renner (2014, 2021). In the
context of DI-QKD, it is still possible to treat these as purely mathematical
conditions and prove that they are indeed fulfilled (as we shall discuss in
Section 6); however, their operational implications become more subtle due to
issues regarding device reuse Barrett et al. (2013); Portmann and Renner
(2021). Still, those issues are restricted entirely to the operational
interpretations (and there is ongoing work on resolving this point), so these
security definitions are still well-posed, and in this work we shall apply
them directly to DI-QKD.

####  1.1.3 Side-channels and quantum hacking

Although QKD provides information-theoretic security on paper, exploitable
side-channels could exist in its implementations. The security of practical
QKD systems depends not only on what Eve can do in the quantum channel but
also the _side-channels_ in their implementations: channels that are not
modelled in the security proof, but through which information can still be
leaked, compromising security. Hacking attacks can be performed in the quantum
communication layer, the classical post-processing of the protocol or even
after the keys have been produced. Side-channels from classical information
processing systems are also an issue in classical cryptography. However, the
fact that QKD is susceptible to hacking attacks in the quantum communication
layer (which we shall refer to as “quantum hacking”) might be surprising to
some, especially in the earlier days of QKD where the claim of “unconditional
security” was commonly touted. This has to be understood in the context of how
security is proven in QKD.

Typically, to prove the security of a QKD protocol, it is often necessary to
specifically model the devices (e.g., the measurement operators of Alice and
Bob in a EB-QKD protocol, the quantum states emitted by Alice’s source in a
P&M-QKD protocol, etc.) that are used in the protocol. Such a security proof
is device-dependent (DD); it depends on the assumption that the devices behave
according to the model. Quantum hacking consists of attacks that cause the
behaviour of the devices to deviate from the model that is used in the
security proof.

For example, to prove the security of many P&M QKD protocols, it is often
necessary to assume the quantum states being emitted by the source are well-
characterised. In the so-called Trojan horse attack Vakhitov et al. (2001);
Gisin et al. (2006), Eve makes use of the reflectivity of practical sources to
inject a bright light into the source used in the protocol, effectively
modifying the emitted signals, and extracts additional information about the
modulation from the reflected light. Another example of quantum hacking would
be the blinding attack Makarov (2009); Lydersen et al. (2010) which
invalidates the assumption that whether or not a measurement device registers
a click is independent of the basis choice. In this attack, Eve controls the
detector by sending bright light into the detector such that it would only
click if the receiver chooses the same basis that is chosen by Eve.

While these attacks can be mitigated using some ad hoc counter-measures, it is
hard to assess the effectiveness of these counter-measures against more
sophisticated attacks. Furthermore, there are side-channels that are opened
without any active attacks by Eve. For example, it is known that in high-speed
QKD systems, correlation in the modulation might arise between successive
rounds Nagamatsu et al. (2016); Yoshino et al. (2018); Pereira et al. (2020).
In such cases, the security proof, which typically assumes that the devices
behave identically888This should not be confused with assuming that Eve
attacks identically (and independently) in each round (i.e., she performs a
collective attack). When proving security of DD-QKD against general attacks,
Eve can perform any attack that she wants, but the devices of the legitimate
parties — which she does not control — are assumed to behave identically in
each round according to the specified model. for each round may not hold.

Giving an exhaustive list of possible quantum hacking attacks or side-channels
is not the goal of this review. For interested readers, a list of known
attacks and side-channels is given in a recent review paper Xu et al. (2020).
As we shall explain in the next section, the goal of device-independent QKD is
to eliminate all side-channels in the quantum communication layer in a
conclusive (i.e., robust against future discoveries of more sophisticated
attacks) and elegant way. As explained in this section, quantum hacking and
side-channels are consequences of our modelling of the devices when proving
the security of a QKD protocol. By devising a security proof that is agnostic
to the device modelling, device-independent QKD removes this vulnerability.

###  1.2 Device-independent security

####  1.2.1 Motivation

Given the possibility of compromising the security of QKD when the devices
that implement the protocol do not behave as advertised (due to an oversight
by the manufacturer, degradation of the devices, or quantum hacking by an
adversary), we may want to rule out these scenarios by devising a security
proof that is valid under minimal assumptions (which we list in detail in
Section 2). In particular, the device-independent framework aims to prove the
security of the protocol without specifying the states and measurements that
are used in the protocol (hence the term “device-independent”), and QKD
protocols that can be proven secure in this framework are referred to as
“device-independent QKD” protocols. With device-independent security, all
side-channels that can be formalised as the devices performing “incorrect”
measurements are eliminated999This does not mean that the protocol is immune
against all hacking, as we still need to make assumptions about the classical
post-processing step as well as the key management system. For more
information, see Section 2.. To achieve it, we rely on Bell nonlocality to
certify that the uncharacterised devices are producing outputs that are
genuinely “random” to an adversary. In light of this, Bell nonlocality is a
necessary condition101010Any local correlations, by definition, can be
explained by a local-hidden-variable model. An adversary is allowed to possess
a copy of these hidden variables, in which case she could then predict the
outputs of the QKD devices perfectly. for DI-QKD’s security, though recent
work suggests it may not be a sufficient condition Farkas et al. (2021);
Christandl et al. (2021).

####  1.2.2 Towards the notion of device-independence

The idea of using Bell nonlocality Bell (1964); Brunner et al. (2014) to
certify the security of a key distribution protocol first appeared in Ekert’s
re-invention of QKD Ekert (1991), although the notion of device-independence
was not emphasised there. It would later re-appear in the seminal work of
Mayers and Yao Mayers and Yao (1998, 2004) on _self-testing_ , where they
found that, when a specific nonlocal behaviour is observed, it is possible to
certify that, up to some local isometries, a quantum device consists of the
state ${\lvert\Phi^{+}\rangle}$ and the Pauli measurements, $\sigma_{Z}$ and
$\sigma_{X}$ (as well as a third measurement
$(\sigma_{Z}+\sigma_{X})/\sqrt{2}$), which can then be used to implement the
BBM92 protocol Bennett et al. (1992). However, the work of Mayers and Yao only
discussed the situation where the ideal statistics are observed, which would
never be the case in practice. The first step towards a security proof was
taken when Barrett et al. proposed a protocol and proved its security based
only on the no-signalling assumption Barrett et al. (2005).

The term “device-independence” was finally coined in the work of Acín et al.
Acín et al. (2007) with the emphasis that the security claim is decoupled from
the quantum states and measurements with which the protocol is implemented.
Security against collective attacks111111In device-dependent QKD, this means
that Eve distributes states of the form
$\rho_{AB}=(\rho_{A_{i}B_{i}})^{\otimes n}$, where $\rho_{A_{i}B_{i}}$ is the
state in any single round. In the context of device-independent QKD, we
further require the uncharacterised devices to behave independently and
identically in each round. in the asymptotic limit was then proven Acín et al.
(2007); Pironio et al. (2009). However, the collective attack assumption is
against the spirit of device-independence since it assumes that the devices
are working in an independent-and-identically-distributed (i.i.d.) manner.
Complete security proofs without the collective attack assumption were given
later Vazirani and Vidick (2014); Miller and Shi (2016); Jain et al. (2020);
Vidick (2017), though the asymptotic bounds were significantly less robust
against noise than the one obtained under the collective attack assumption. An
improved bound Arnon-Friedman et al. (2018, 2019) was then obtained via the
entropy accumulation theorem Dupuis et al. (2020); Dupuis and Fawzi (2019),
which achieves the same asymptotic key rate as the collective-attacks
scenario.

####  1.2.3 Beyond fully device-independent security

While DI-QKD offers information-theoretic security despite the protocol being
implemented using an uncharacterised source of quantum states and
uncharacterised measurement devices, its implementation is still extremely
challenging. Inspired by DI-QKD, several QKD protocols with different levels
of device characterisation have been proposed. Such protocols are commonly
referred to as “semi-device-independent” protocols, as their security does not
require full characterisation of the device, but they still rely on some
assumptions about the physical systems. For example, there are semi-device-
independent frameworks based on assumptions about the dimension of the Hilbert
space Woodhead and Pironio (2015); Woodhead (2016); Pawłowski and Brunner
(2011); Goh et al. (2016), energy of the source Van Himbeeck et al. (2017),
etc.

There have also been proposals for QKD protocols where the device (source or
measurement device) of one party is completely characterised while the other
party’s is not Tomamichel et al. (2012); Branciard et al. (2012); Walk et al.
(2016); Ioannou et al. (2021a, b). This framework is referred to as the “
_one-sided-device-independent_ ” scenario. MDI-QKD Lo et al. (2012) is a
related class of protocols where Alice and Bob both hold characterised sources
(or equivalently, a measurement device and a source of entangled states
Braunstein and Pirandola (2012)) and send their quantum states to a third
party — which can be assumed to be the eavesdropper. Note that in MDI-QKD, all
the honest parties hold fully characterised devices, although there have been
recent efforts to relax the characterisation requirements of the devices
Navarrete et al. (2021); Zhang et al. (2021a).

Finally, there have also been proposals to achieve device-independence from
computational assumptions Metger et al. (2021). In this scenario, in place of
the no-signalling scenario of the standard device-independent framework (see
Section 2), Alice and Bob’s quantum channel is part of their devices (that are
prepared by Eve) and not directly accessible by Eve. Further, the devices are
assumed to be computationally bounded, in the sense that they are not able to
break post-quantum cryptographic protocols (more precisely, the learning-with-
errors problem) during the execution of the protocol. Under these assumptions,
Eve is allowed to be entangled with Alice and Bob but she is not allowed to
help the devices to violate the computational assumption. If these assumptions
are satisfied, the generated key is information-theoretically secure even
against a computationally unbounded adversary.

In the spirit of device-independence, these protocols aim to minimise side-
channels introduced by our modelling of the devices that implement them, while
being more practically achievable than fully device-independent QKD. These
frameworks remain an active area of research. However, these protocols are not
the focus of this review and we shall devote the remainder of this review
paper to fully device-independent QKD protocols.

##  2 Assumptions

While the security of DI-QKD does not rely on the characterisation of the
quantum state and the measurement devices, some assumptions are still needed
to prove its security. In this section, we shall list these assumptions and
discuss their implications.

The assumptions are as follows:

  1. 1.

Quantum theory is correct.

  2. 2.

The honest parties operate within secured locations using only trusted devices
and adhering strictly to the protocol. The devices may be uncharacterised but
cannot maliciously broadcast their inputs and outputs.121212When considering
DI-QKD implementation with multiple pairs of devices, it was shown in Curty
and Lo (2019); Zapatero and Curty (2021) that DI-QKD can still be secure with
the aid of secret sharing if some but not all of the devices are malicious.

  3. 3.

The honest parties have access to an authenticated classical channel.

  4. 4.

The honest parties each have a trusted and private random number generator to
choose the inputs of their devices.

  5. 5.

The honest parties can perform any Bell test required by the protocol in a
manner that is free of various relevant loopholes Brunner et al. (2014);
Larsson (2014).

The first assumption is usually taken for granted as quantum theory is the
most accurate known scientific model for physical phenomena at the subatomic
scale to date. That being said, DI-QKD may also be feasible even if quantum
theory were to be superseded by another physical theory that respects the no-
signalling principle Barrett et al. (2005). As quantum theory’s validity
remains unchallenged today, it shall be assumed to be so for the rest of the
discussion in this paper.

Like any other cryptographic protocol, DI-QKD is no longer secure once the
private key is conceded to the adversary. Hence, the second assumption is
necessary to prevent private information pertaining to the secret key from
leaking to the adversary. While this private information must be stored
securely, it is also crucial to exclude any malicious elements within the
working spaces of the honest parties. This is in contrast to the initial
belief that DI-QKD could employ devices that “are entirely untrusted and
provided by the eavesdropper” Acín et al. (2007); Pironio et al. (2009). When
used in DI-QKD, such untrusted devices could broadcast obfuscated private key
information to the adversary through various avenues: side-channels, back-
doors Scarani et al. (2009) or even through the honest parties themselves
Barrett et al. (2013). Thus, the integrity of the DI-QKD protocol remains
intact when using uncharacterised devices but not with untrusted
devices131313Untrusted measurement devices can be employed securely in the
case of MDI-QKD because the security analysis allows the eavesdropper to hold
any information processed and produced by the measurement device. Any QKD
protocol proven secure under that condition is secure with the use of
untrusted measurement devices. (To achieve security in such a scenario, MDI-
QKD requires that the honest parties can instead perform trusted state
_preparation_ , rather than measurement.). As for the issue of ensuring the
devices do not broadcast the inputs, we briefly defer this until the loophole
discussion below.

The third assumption is crucial in preventing a possible man-in-the-middle
attack, where the adversary simply impersonates an honest party to retrieve
the secret key by following the QKD protocol. Fortunately, it is not too
difficult in principle to establish information-theoretically secure
authentication for a classical channel, by expending a small amount of pre-
shared key Carter and Wegman (1979); Wegman and Carter (1981). (From this
perspective, a QKD protocol using a channel authenticated this way would
technically be a protocol for key expansion, rather than a protocol for key
generation without pre-shared resources.)

The fourth assumption is necessary because trusted randomness is required in
DI-QKD protocols. Most DI-QKD protocols are executed in rounds, and in each
round, Alice and Bob must decide if it is a generation or a test round. In the
test rounds (and also in the generation rounds, for some protocols), Alice and
Bob need to choose inputs to their devices. For the purposes of the security
proof, these choices need to be independent of Eve, and (typically) also of
the outputs in previous rounds. To ensure this, we impose the condition that
these choices are made using trusted and private random number generators.
This point is also closely related to the issue of closing various loopholes,
as we shall now describe.

Finally, the fifth assumption concerns the fact that classical (local)
resources can be used to “fake” a Bell violation if several loopholes are not
addressed. Since DI-QKD protocols rely on Bell violations to certify quantum
behaviour, if these loopholes are not closed, these violations could be faked
and the protocols would no longer be secure. We briefly highlight, however,
that these loopholes manifest slightly differently in the context of Bell
tests as compared to DI security proofs — the former is concerned with what
can be achieved by purely classical resources in the presence of loopholes,
while the latter is concerned with what Eve can achieve using side-information
on quantum resources in the presence of loopholes. Still, without further
discussing this distinction, we shall broadly outline the most relevant
loopholes, namely the detection loophole, the measurement dependence loophole,
and the locality loophole Pearle (1970); Bell (2004); Brunner et al. (2014);
Larsson (2014).

The detection loophole refers to the fact that classical devices can fake a
Bell violation if, in some of the rounds, the measurement devices do not give
a conclusive outcome (the typical example of this would be a no-detection
event in a photonic setup) and one chooses to discard such rounds in the
security analysis. Fortunately, there are fairly straightforward methods to
handle this loophole — for instance, one can simply assign all inconclusive
outcomes to a fixed value (as determined by the protocol; it could be one of
the “standard” outcome values or a separate “null” symbol to be accounted for
in the statistical analysis).

As for the measurement dependence loophole and locality loophole, these are
somewhat related issues (though it is convenient to formalise them separately
in some proofs). The former concerns the question of whether the underlying
resource (shared randomness, entangled states, etc) could be correlated to the
inputs. The latter is the question of whether Alice’s input might be
communicated to Bob’s device before it has to produce an output (or vice
versa). If either of these loopholes is not closed, then the devices could
again fake a Bell violation without any entanglement. We hence see the
relation to the fourth assumption, in that one aspect of addressing these
loopholes is to require that the inputs are chosen using a sufficiently
trusted randomness source. Furthermore, in the context of Bell tests, the
issue of inputs leaking between the devices is usually addressed by ensuring
spacelike separation between the generation of one party’s input and the
generation of the other party’s output. In the context of DI protocols,
however, it is worth considering whether this approach is strictly necessary.
Given that we have already required (in the second assumption) that measures
have been taken to ensure the _outputs_ remain private, it may be reasonable
to suppose that these measures could also ensure the _inputs_ do not leak.
This would come down to a question of whether the level of
trust/characterisation of the devices in a particular setup is sufficient to
justify such an assumption.

##  3 Experiments

Compared to its device-dependent counterparts, implementing DI-QKD is
technically more demanding: it involves performing an adequately loophole-free
Bell test over a meaningfully large distance, while achieving a significant
Bell inequality violation and sufficiently low quantum bit-error
rate141414Roughly speaking, this is the probability that any given bit in the
honest parties’ raw keys differs between them. (QBER). Moreover, the devices
have to be operating at a decent clockrate to suppress the finite-size effect
to an acceptable level. While practical DI-QKD implementation is still a work-
in-progress, there have been numerous recent significant developments in
experimental DI-QKD Zhang et al. (2021b); Liu et al. (2021b); Nadlinger et al.
(2021), placing said goal in our sights.

As DI-QKD experiments were built upon loophole-free Bell tests experiments,
they can be divided into two broad groups: the fully-photonic systems Giustina
et al. (2015); Liu et al. (2021b, a, 2018b); Shalm et al. (2015); Zhang et al.
(2020b); Li et al. (2018, 2021); Bierhorst et al. (2018); Shalm et al. (2021);
Shen et al. (2018) and the heralded entanglement systems Hensen et al. (2015);
Rosenfeld et al. (2017); Nadlinger et al. (2021); Zhang et al. (2021b). Each
choice of system carries a unique set of advantages and bottlenecks towards
DI-QKD implementation.

To date, all existing loophole-free Bell experiments (including all DI-QKD
proof-of-principle demonstrations) are based on the CHSH (Clauser-Horne-
Shimony-Holt) inequality Clauser et al. (1969), where the following CHSH value
is measured:

$S\coloneqq\left\langle\mathsf{A}_{0}\mathsf{B}_{0}\right\rangle+\left\langle\mathsf{A}_{0}\mathsf{B}_{1}\right\rangle+\left\langle\mathsf{A}_{1}\mathsf{B}_{0}\right\rangle-\left\langle\mathsf{A}_{1}\mathsf{B}_{1}\right\rangle,$
(14)

where $\mathsf{A}_{x}$ and $\mathsf{B}_{y}$ are the measurement outcomes that
Alice and Bob obtain when Alice chooses the input $x\in\\{0,1\\}$ and Bob
chooses the input $y\in\\{0,1\\}$. We denote the corresponding self-adjoint
operators associated to these measurements by $A_{x}$ and $B_{y}$. As shown in
Clauser et al. (1969), all CHSH values achievable by local-hidden-variable
models must obey the inequality $S\leq 2$, but this inequality can be violated
by quantum devices. Hence, in this section, we shall focus on protocols that
use the CHSH value in their statistical tests. However, it is worth noting
that in certain cases, estimating other Bell inequalities in the parameter
estimation routine can lead to a better performance of the protocol Sekatski
et al. (2021); Woodhead and Pironio (2015) (see also Section 4).

If the secret key rate is considered as the figure-of-merit for QKD
implementations, any discussion on the performance of existing DI-QKD
experiments can be summarised in its QBER $Q$, CHSH value $S$ and clockrate.
However, as the existing DI-QKD experiments have been performed with different
distances between the honest parties, the distance is another figure-of-merit
that can be taken into account when comparing the experiments.

###  3.1 Fully-photonic experiments

####  3.1.1 General features

Fully-photonic loophole-free Bell experiments involve the preparation of
photon-pair with entangled degrees-of-freedom (usually polarisation via
spontaneous parametric down-conversion (SPDC) by pumping non-linear crystals)
and subsequently, distant parties Alice and Bob will each measure a part of
the entangled photons using single-photon detectors with high efficiencies
(usually superconducting nanowire single-photon detectors (SNSPDs)).

Adopting the fully-photonic system allows the user to enjoy high clockrate and
low QBER at the expense of a low CHSH value. For example, in a recent proof-
of-principle DI-QKD experiment Liu et al. (2021b), the experimental setup
could win the CHSH game with a probability of 0.7559 (or equivalently, a CHSH
value of $S\approx 2.0472$) across a transmission distance of 20 m was
reported. Indeed, any fully-photonic Bell experiment that is implemented by
measuring a pair of two-mode squeezed vacuum states with single-photon
detectors has its CHSH value limited by $S\lesssim 2.31$ Vivoli et al. (2015a,
b); Tsujimoto et al. (2018) even when ideal single-photon detectors (i.e.,
perfect detection efficiency and zero dark-count rate) are used. Clearly, the
contributions from channel noise and loss, coupling loss at each interface,
and imperfect detector efficiencies would account for such low CHSH values in
past experiments.

####  3.1.2 Losses in fully-photonic experiments

The main bottleneck of fully-photonic implementations of DI-QKD is the channel
loss (which translates to weaker nonlocal correlations). When simulating a
fully-photonic DI-QKD experiment, channel losses are typically modelled as a
beam-splitter with transmittivity $\eta$, corresponding to the overall
efficiency of the quantum channel.

Generally, channel losses can be classified into two categories: local losses
and transmission losses. With this classification, the overall transmittivity
of the channel is given by $\eta=\eta_{l}\eta_{t}$ where $\eta_{l}$ is the
local efficiency and $\eta_{t}$ is the transmission efficiency. Local losses
refer to those losses that are attributed to the local surroundings of the
legitimate parties. These include losses due to detector inefficiencies and
coupling losses. On the other hand, transmission losses refer to losses that
occur in the optical channel during the transmission between the source and
the receivers’ lab. When an optical fibre is used as a transmission medium,
the loss in the channel scales exponentially with distance. Hence, the
transmission efficiency $\eta_{t}$ is given by

$\eta_{t}=10^{-\xi L/10},$ (15)

where $L$ is the transmission length and $\xi$ is a coefficient that measures
how much the signal power is attenuated in the fibre. The attenuation also
depends on the wavelength of the signal. Standard optical fibres typically
have $\xi\approx 0.2$ dB/km at 1550 nm, but there are ultra-low-loss fibres
with lower $\xi$.

####  3.1.3 Qubit amplifiers

Due to the detection loophole, the no-click events that are typically
discarded in DD-QKD cannot be safely discarded in the case of DI-QKD. At the
heart of the detection loophole is violation of the fair-sampling assumption;
in the presence of a malicious attack, whether the detector would click or not
would depend on the random inputs given by the trusted parties. This is in
contrast to the honest implementation of the devices, where the main reason
the detectors do not click is due to the photons being lost in the channel.
Such a process is clearly consistent with the fair-sampling assumption. The
purpose of qubit amplifiers Gisin et al. (2010); Pitkanen et al. (2011); Curty
and Moroder (2011); Meyer-Scott et al. (2013); Seshadreesan et al. (2016);
Zapatero and Curty (2019); Kołodyński et al. (2020) is to herald the arrival
of a photon without disturbing its qubit state151515As such, an ideal qubit
amplifier simulates a quantum non-demolition measurement. However, practical
qubit amplifiers would introduce noise in the amplification process when there
are imperfections (in the optical circuits or in the detectors) or when the
input state contains multi-photon components., and hence allow post-selection
to be done securely.

To illustrate the idea, let us consider a normalised pure quantum state
${\lvert\psi\rangle}$ of the following form

${\lvert\psi\rangle}=\alpha{\lvert v\rangle}+\beta{\lvert\varphi\rangle},$
(16)

where ${\lvert v\rangle}$ denotes the vacuum state and
${\lvert\varphi\rangle}$ is a single-photon qubit state

${\lvert\varphi\rangle}=\left(\beta_{H}a_{H}^{\dagger}+\beta_{V}a_{V}^{\dagger}\right){\lvert
v\rangle}.$ (17)

Here, $a_{H}$ and $a_{V}$ are the annihilation operators for the horizontally
and vertically polarised-mode, respectively. The state ${\lvert\psi\rangle}$
is essentially a coherent superposition between the vacuum state and a single-
photon state defined across two orthogonal modes — which defines a qubit. A
qubit amplifier is an optical circuit that, conditioned on the heralding
signal (which is typically based on a Bell state measurement), transforms the
state ${\lvert\psi\rangle}$ into
${\lvert\psi^{\prime}\rangle}=\alpha^{\prime}{\lvert
v\rangle}+\beta^{\prime}{\lvert\varphi\rangle}$ such that the relative weight
for the qubit state is higher, i.e.,
$\left\lvert\beta^{\prime}\right\rvert^{2}>\left\lvert\beta\right\rvert^{2}$.
Importantly for DI-QKD applications, qubit amplifiers can also be used for
mixed quantum states.

The first qubit amplifier scheme based on teleportation with two single-photon
sources is presented by Gisin et al. Gisin et al. (2010) which builds on the
proposal of photon amplifiers Ralph and Lund (2009). It was noted that on-
demand single-photon sources would give better performance but heralded
single-photon sources are sufficient to implement the scheme. The original
scheme can be improved by adding two 50/50 beam-splitters to the optical
circuit Pitkanen et al. (2011). In particular, if only the vacuum and the
single-photon component is present in the input state, the modified amplifier
can perform perfect heralded projection to the single-photon space
(conditioned on the heralding signal, the amplitude of the vacuum component is
zero). Secondly, even in the presence of multi-photon components, the modified
amplifier can amplify the single-photon component at the expense of lower
success probability. Subsequently, schemes with entanglement-swapping relay
were proposed Curty and Moroder (2011); Meyer-Scott et al. (2013).
Importantly, these entanglement-swapping based qubit amplifiers can still be
useful even when implemented with SPDC sources instead of an ideal source of
entangled photon pairs. The analysis of the practical performance DI-QKD with
qubit amplifiers in the asymptotic limit was then presented for the two
single-photons architecture Kołodyński et al. (2020) and for the entanglement-
swapping relay architecture Seshadreesan et al. (2016). The finite-key
performance of the protocol using both architectures was also analysed
Zapatero and Curty (2019).

As a qubit amplifier allows us to simulate non-demolition projection onto the
single-photon subspace, the qubit amplifier allows us to safely discard rounds
in which the amplifier does not herald the arrival of the photon. Therefore,
qubit amplifiers minimise the effect of transmission losses, though the effect
of local losses is still present. Unfortunately, at the moment of writing, the
existing local losses are still prohibitively large for most DI-QKD
protocols161616With the random post-selection protocol Xu et al. (2021) and
the noisy pre-processing protocol Ho et al. (2020) being notable exceptions.
See Section 4 for more details. to be implemented even at a short distance.
Consequently, the use of qubit amplifiers is not yet relevant for DI-QKD with
the current level of detector efficiencies.

####  3.1.4 Relevant experiments

Unfortunately, the most well-studied DI-QKD protocol has extremely demanding
requirements on the overall losses ($\eta\gtrsim 88\%$ Brown et al. (2021a);
Tan (2021)) to obtain a positive secret key rate. Due to this, despite the
fact that there are a number of fully-photonic loophole-free Bell experiments
Giustina et al. (2015); Liu et al. (2021b, a, 2018b, 2018a); Shalm et al.
(2015); Zhang et al. (2020b); Li et al. (2018, 2021); Bierhorst et al. (2018);
Shalm et al. (2021); Shen et al. (2018) with some of them even achieving
sufficiently high CHSH values for device-independent randomness generation
Bierhorst et al. (2018); Li et al. (2021); Shen et al. (2018); Shalm et al.
(2021); Liu et al. (2018b, 2021a); Zhang et al. (2020b), a conclusive
demonstration of fully-photonic DI-QKD is still missing.

However, there is a recent proof-of-principle fully-photonic DI-QKD experiment
Liu et al. (2021b) which is asymptotically secure when Eve is restricted to
i.i.d. attacks. In this experiment, single-photon detectors with an efficiency
of $\gtrsim 87\%$ were used (higher than the detector efficiency in any of
previous fully-photonic loophole-free Bell experiments). Note that the
experiment was enabled by a specific DI-QKD protocol that has strong
robustness against channel losses Xu et al. (2021) (see Section 4).

###  3.2 Heralded entanglement experiments

####  3.2.1 General features

The heralded entanglement loophole-free Bell experiments involve each party
preparing an entangled state between a long-lived quantum system (e.g.,
trapped ions, atoms, NV-centre, etc) and a photon (typically in its
polarisation degree-of-freedom). The long-lived systems are stored in each
party’s laboratories while the photonic systems are then sent for a Bell-state
measurement. A successful Bell-state measurement then heralds a successful
entanglement swapping, after which the long-lived systems can then be
measured. The target state is typically the maximally-entangled qubit state
and the noise is well-approximated by the depolarising noise model.

As the detection efficiencies for these long-lived systems are typically very
high as compared to typical photon detectors, the fraction of no-detection
outcomes (which then need to be assigned to deterministic outcomes) is smaller
in the case of heralded entanglement systems (after post-selection on the
heralded events). Consequently, contrary to their fully-photonic counterparts,
heralded entanglement systems provide users with high CHSH value and low QBER,
though at the expense of low clockrate. For example, a recent DI-QKD
experiment using a trapped-ions-based heralded entanglement system Nadlinger
et al. (2021) reported a CHSH value of $S\approx 2.64$ and QBER of $Q\approx
1.8\%$ across a 2 m transmission distance. Similar to the case of fully-
photonic systems with qubit amplifiers, the effect of transmission loss can be
minimised in heralded entanglement systems. In heralded entanglement systems,
transmission loss would lower the probability of successful Bell state
measurement, but the Bell violation can still be high as long as the dark-
count rates of the detectors are low.

However, the main bottleneck of heralded entanglement systems is their
clockrates. For example, while the recent demonstration of fully-photonic DI-
QKD Liu et al. (2021b) operated at a 2 MHz repetition rate, the recent
trapped-ions-based heralded entanglement system Nadlinger et al. (2021)
performed $1.5\times 10^{6}$ rounds of the DI-QKD protocol over $7.9$ hours
(with a pause of 4.4 hours due to laser failure). This corresponds to a
clockrate of about 119 Hz even when the pause is neglected. Indeed, previous
efforts to increase the entangling rate in trapped-ions system Hucul et al.
(2015), and NV-centre systems Humphreys et al. (2018); Kalb et al. (2017)
result in lower fidelities to the point that no Bell violation was reported.

####  3.2.2 Relevant experiments

Due to its ability to exhibit high CHSH value, a heralded entanglement system
(based on NV-centre) was used for the first loophole-free Bell experiment
Hensen et al. (2015). Following that experiment, another loophole-free Bell
experiment using heralded entangled atoms Rosenfeld et al. (2017) was done,
exhibiting a CHSH value of $S\approx 2.221$. Despite these earlier loophole-
free Bell tests exhibiting significant Bell violation, the QBER is not
sufficiently low to demonstrate DI-QKD.

The above-mentioned experiment using heralded entanglement of trapped ions
Nadlinger et al. (2021) was able to generate secret keys secure against
general attacks with a security parameter of $\varepsilon=10^{-10}$. The
resulting key rate was estimated to be about 0.0639 per entanglement
generation event. Another proof-of-principle demonstration using heralded
entangled atoms was able to generate asymptotic secret key rate of about 0.07
per entanglement generation event over 400 m Zhang et al. (2021b). However,
the block size was too small to generate a secret key when finite-size effects
are considered.

##  4 Protocols

In this review article, we shall focus on the DI-QKD protocol proposed by Acín
et al. Acín et al. (2007); Pironio et al. (2009) as it is the most well-
studied DI-QKD protocol in the literature. We will also discuss some of its
variants which are designed to improve the robustness of the protocol against
noisy/lossy experimental implementations with minimal changes to the quantum
devices. Some of these modifications can also be combined and applied to other
protocols. We note that there are other DI-QKD protocols in the literature
which we do not discuss in detail here; to name a few: DI-QKD with local Bell
tests Lim et al. (2013), DI-QKD based on measurement inputs Rahaman et al.
(2015), and DI-QKD based on high-dimensional entangled states Brown et al.
(2021a); Gonzales-Ureta et al. (2021).

###  4.1 The standard DI-QKD protocol

The first DI-QKD protocol with a security proof specialised for quantum
(rather than no-signalling) adversaries, under a collective-attacks
assumption, was proposed in the seminal work of Acín et al. Acín et al.
(2007); Pironio et al. (2009), and was inspired by Ekert’s entanglement-based
protocol Ekert (1991). In this review paper, we shall refer to it as the
“standard” DI-QKD protocol. In each round of the standard protocol, the two
honest parties Alice and Bob receive the two parts of an entangled state in
each round. Alice then randomly chooses an input $x\in\\{0,1\\}$ while Bob
randomly chooses an input $y\in\\{0,1,2\\}$, corresponding to different
measurement choices. All measurements have binary outcomes labelled by
$a,b\in\\{-1,+1\\}$. For photonic implementations of the protocols where there
might be inconclusive outcomes due to no-detection or double-detection events,
it is customary to assign such inconclusive outcomes to a deterministic
outcome (e.g. $+1$) to ensure that the measurements are binary. Here, we
suppose that the protocol uses direct reconciliation, where Bob tries to guess
Alice’s key (based on her syndrome) in the error correction step.

In the generation rounds (i.e. those used to produce raw data for the secret
key), Alice chooses the setting $x=0$ and Bob chooses the setting $y=2$. The
error-correction step in the protocol is based on the value of the QBER $Q$

$Q=\Pr[\mathsf{A}_{0}\neq\mathsf{B}_{2}],$ (18)

where $\mathsf{A}_{x}$ and $\mathsf{B}_{y}$ denote the random variables
corresponding to Alice’s outcome with setting $x$ and Bob’s outcome with
setting $y$, respectively.171717As we shall discuss in Section 6, an
appropriately designed error-correction procedure can be based on the QBER of
the _honest implementation_ of the devices, though earlier versions required
Alice and Bob to estimate the QBER during the protocol itself. On the other
hand, in the test rounds, Alice and Bob use the inputs $x\in\\{0,1\\}$ and
$y\in\\{0,1\\}$ to estimate the CHSH value Clauser et al. (1969), i.e. the
quantity $S$ presented in Eq. (14).

An equivalent statistical test can be formulated in terms of the probability
$\omega$ of winning the CHSH game. In this game, in each test round, Alice
(resp. Bob) chooses between the input values $x=0$ and $x=1$ (resp. $y=0$ and
$y=1$) with uniform probability, and we re-label the outcomes $a,b$ from
$\\{-1,+1\\}$ to $\\{0,1\\}$. Then, Alice and Bob win the CHSH game if

$a\oplus b=x\cdot y$ (19)

where $\oplus$ denotes summation modulo 2. With this, the winning probability
is given by

$\omega=\frac{1}{4}\Big{(}\Pr[a=b|x=0,y=0]\\\ +\Pr[a=b|x=0,y=1]\\\
+\Pr[a=b|x=1,y=0]\\\ +\Pr[a\neq b|x=1,y=1]\Big{)}.$ (20)

The latter formulation is more suitable for security analysis via the entropy
accumulation theorem.

The original work Acín et al. (2007); Pironio et al. (2009) analysed the
asymptotic security of the protocol under the assumption of collective
attacks. The authors managed to discover an explicit attack that saturates
their bound, which implies that the bound derived for this protocol in these
works is tight. Security against general attacks in the finite-key regime was
then proven later Vazirani and Vidick (2014); Miller and Shi (2016). However,
in the asymptotic limit, those results have less noise tolerance than the one
derived using the collective attack assumption. A tighter bound that
asymptotically recovers the collective attack result was subsequently obtained
via the entropy accumulation theorem Arnon-Friedman et al. (2018).

###  4.2 DI-QKD based on other constraints

Interestingly, the state used in the optimal attack found in Pironio et al.
(2009) for the standard DI-QKD protocol exhibits an asymmetry with regards to
the correlators. For a given CHSH value $S$, the optimal attack yields the
following correlators

$\begin{split}\left\langle\mathsf{A}_{0}\mathsf{B}_{0}\right\rangle&=2/S,\\\
\left\langle\mathsf{A}_{0}\mathsf{B}_{1}\right\rangle&=2/S,\\\
\left\langle\mathsf{A}_{1}\mathsf{B}_{0}\right\rangle&=\frac{S^{2}/2-2}{S},\\\
\left\langle\mathsf{A}_{1}\mathsf{B}_{1}\right\rangle&=-\frac{S^{2}/2-2}{S},\end{split}$
(21)

which reflects the asymmetry in the standard protocol: the measurement $A_{0}$
is used for both key generation and testing, while the measurement $A_{1}$ is
only used for testing.

Based on this observation, one can modify the protocol to use a generalised
CHSH inequality that reflects this asymmetry as well Woodhead et al. (2021);
Sekatski et al. (2021):

$S_{\alpha}=\alpha\left\langle\mathsf{A}_{0}\mathsf{B}_{0}\right\rangle+\alpha\left\langle\mathsf{A}_{0}\mathsf{B}_{1}\right\rangle+\left\langle\mathsf{A}_{1}\mathsf{B}_{0}\right\rangle-\left\langle\mathsf{A}_{1}\mathsf{B}_{1}\right\rangle,$
(22)

where $\alpha\in\mathbb{R}$ is a free parameter that can be optimised
according to the expected behaviour of the devices. The quantum communication
layer of the protocol is identical to that of the standard DI-QKD protocol.
The difference lies in the parameter estimation step, where the asymmetric
CHSH value $S_{\alpha}$ is estimated in place of the usual CHSH value $S$.

The asymptotic security of the protocol against collective attacks has been
proven analytically Woodhead et al. (2021) and numerically Sekatski et al.
(2021). In both works, it was discovered that the improvement that one can
obtain from using this asymmetric CHSH inequality is more significant in
implementations where the noise can be modelled by depolarising channels.
However, for fully photonic implementations, one can only get a marginal
improvement in the critical detection efficiency181818This refers to the
minimal efficiency $\eta$ (assuming it is identical for all measurements) for
the protocol to produce non-zero key rate..

In the same spirit, one could also modify the protocol such that, for
parameter estimation, Alice and Bob estimate the full “behaviour”, i.e. all
the conditional probabilities

$P(a,b|x,y):=\Pr[\mathsf{A}=a,\mathsf{B}=b|X=x,Y=y]$ (23)

for all $a\in\mathcal{A},b\in\mathcal{B},x\in\mathcal{X},y\in\mathcal{Y}$.
Such constraints contain more fine-grained information compared to a single
Bell inequality, and hence might give a higher asymptotic secret key rate and
noise tolerance as compared to a DI-QKD protocol based on one Bell inequality.
It was shown that by using the full behaviour as constraints, the critical
detection efficiency for the fully-photonic implementations can be lower as
compared to the standard DI-QKD protocol which uses the CHSH value as a
constraint Tan et al. (2021); Brown et al. (2021a, b). A related approach is
to use a linear programming technique to choose a Bell inequality that is
maximally violated by the expected behaviour Datta et al. (2021).

###  4.3 DI-QKD with noisy pre-processing

In the context of DD-QKD, it is known that the robustness of some protocols to
experimental imperfections (such as channel loss or noise) can be improved by
randomly flipping some of the bits in the raw key before performing error
correction and privacy amplification — a step that is known as noisy pre-
processing Kraus et al. (2005); Renner et al. (2005). The reason for this is
that although such random flips reduce the correlation between Alice and Bob
(hence increasing the error correction cost), they would also increase Eve’s
uncertainty about the raw key. Importantly, in some parameter regimes, Eve is
“penalised” more than Bob, resulting in an overall increase in the key rate.

It was shown in Ho et al. (2020) that the same effect is present in DI-QKD,
and hence this method can be used to improve its key rates. More specifically,
consider a protocol with the same quantum layer as the standard DI-QKD
protocol. However, after estimating the CHSH value $S$ in the parameter
estimation step, Alice and Bob perform a noisy pre-processing step (if the
protocol did not abort). In this step, for each bit in her raw key, Alice will
randomly and independently flip the bit with probability $p$. After the noisy
pre-processing step, Alice and Bob will continue the protocol with information
reconciliation and privacy amplification. It was found in Ho et al. (2020)
that this noisy pre-processing yields significant improvements for the
photonic implementation of the protocol; for instance, in the case where there
is no additional noise in the channel, the critical detection efficiency in an
SPDC model is reduced from 90.9% (in the standard protocol) to 83.2% (in the
protocol with noisy pre-processing). Noisy pre-processing was also studied for
DI-QKD protocols employing the asymmetric CHSH inequality Woodhead et al.
(2021); Sekatski et al. (2021); Masini et al. (2021).

###  4.4 DI-QKD with random key basis

In the original proposal of the BB84 protocol, Alice and Bob use both $X$ and
$Z$-basis measurements to generate their raw keys Bennett and Brassard (1984).
There, each basis is chosen with probability $1/2$ and hence, the probability
of both parties choosing the same basis is also $1/2$. Since there is no
correlation when Alice and Bob measure different bases, these rounds are
discarded and hence half of the rounds in the original BB84 protocol are
discarded.

To improve the key rate, in most protocols, Alice and Bob single out one of
their measurements as a key generating measurement while the other
measurements are only used to test the channels Lo et al. (2005). In these
protocols, the key generating measurements are chosen with high probability
whereas the test measurements are chosen with low probability. In this way,
the proportion of rounds used for key generation is maximised.

However, for the standard DI-QKD protocol, the optimal attack discovered in
Pironio et al. (2009) has the interesting feature that (taking Alice’s key-
generating measurement to be $A_{0}$) we have

$H(\mathsf{A}_{0}|E)\leq H(\mathsf{A}_{1}|E).$ (24)

In other words, because the key generating measurement was fixed to be
$A_{0}$, Eve could focus on minimising her uncertainty about that measurement
at the expense of having higher uncertainty about the other measurement
$A_{1}$. Based on this observation, Schwonnek et al. modified the standard DI-
QKD protocol to one that uses both of Alice’s measurements to generate the raw
key Schwonnek et al. (2021), to exploit Eve’s uncertainty about
$\mathsf{A}_{1}$. (With this proposal, Bob needs to perform an additional
measurement to obtain outcomes that are better correlated to Alice’s second
measurement.)

In this protocol, Alice chooses a measurement setting $x\in\\{0,1\\}$ while
Bob chooses a measurement setting $y\in\\{0,1,2,3\\}$. To generate the raw
key, in each key generation round, Alice chooses $x=0$ with probability $p$
and $x=1$ with probability $1-p$. Similarly, Bob chooses $y=2$ with
probability $p$ and $y=3$ with probability $1-p$. They will subsequently apply
a sifting step in which they only keep the rounds in which $x=0$ and $y=2$, or
$x=1$ and $y=3$. Since there are essentially two pairs of generation inputs in
this case, there are hence two QBER values (which can potentially be
different) relevant for error correction:

$\begin{split}Q_{0}&=\Pr[\mathsf{A}_{0}\neq\mathsf{B}_{2}],\\\
Q_{1}&=\Pr[\mathsf{A}_{1}\neq\mathsf{B}_{3}].\end{split}$ (25)

As for parameter estimation in the test rounds, Alice and Bob estimate the
CHSH value $S$, the same as in Eq. (14).

Conditioned on the round being a key generation round, the overall key rate
suffers a factor of $p_{s}$ penalty due to sifting, where

$p_{s}=p^{2}+(1-p)^{2}.$ (26)

We note that when $p=1$, the protocol is reduced to the standard DI-QKD
protocol Acín et al. (2007); Pironio et al. (2009) and we have $p_{s}=1$. One
then expects that for sufficiently high CHSH value $S$, the penalty due to
sifting outweighs the benefit of increasing Eve’s uncertainty about the raw
key and hence it would be optimal to choose $p\rightarrow 1$. (Alternatively,
some techniques based on pre-shared keys have been proposed to bypass the
sifting factor; see Tan et al. (2020b); Bhavsar et al. (2021) for details.)

The use of the random key basis protocol is most suitable when the channel
noise is depolarising and hence $Q_{0}=Q_{1}$. In light of this, it is better
suited for the heralded entanglement implementation of DI-QKD. For fully-
photonic implementations, non-maximally-entangled states are normally used and
these states have strong correlations in one measurement basis and weaker
correlations in other bases. Accordingly, we have $Q_{0}>Q_{1}$ (or vice
versa) and the error correction cost for one of the measurement basis is
higher than the other, which seems to limit the improvement that one can
obtain by random key basis protocols in fully-photonic implementations.

The security of the protocol was first analysed numerically Schwonnek et al.
(2021) in the asymptotic limit, assuming collective attacks. An analytical
security bound for random key basis protocols under the same assumptions with
$p=1/2$ was then derived Masini et al. (2021). A detailed finite-key security
proof for the random key-basis protocol which also incorporates noisy pre-
processing and the generalised CHSH inequality was given in Tan et al.
(2020b). An implementation of the protocol was recently demonstrated Zhang et
al. (2021b).

###  4.5 DI-QKD with random post-selection

In DD-QKD, post-selection is a common practice as photons are occasionally
lost in the quantum channel and hence, in some rounds, the receiver’s
detectors would not click. These rounds are naturally discarded in these QKD
protocols as no secret correlation can be derived from these rounds.
Discarding these “no-click” rounds increases the correlation between Alice and
Bob and hence decreases the cost of error correction.

However, in DI-QKD, some care is needed when post-selection is employed, as
discarding some events might open up the detection loophole. For example, when
one naively discards the “no-click” events, it is possible to violate the CHSH
inequality using a classical strategy. In light of this, most DI-QKD protocols
would simply assign a deterministic outcome for rounds in which the detectors
do not click (instead of discarding these events). This would, in turn,
decrease the amount of the certified randomness produced by the measurement
and consequently poses a challenge to the implementation of photonic DI-QKD
between remote users without qubit amplifiers.

With this caveat in mind, a DI-QKD protocol with a random post-selection step
was proposed Xu et al. (2021); Liu et al. (2021b). Similar to the standard
protocol, Alice chooses between two binary-output measurements $A_{0}$ and
$A_{1}$ while Bob chooses between three binary-output measurements $B_{0}$,
$B_{1}$ and $B_{2}$. As usual, for both parties, should an inconclusive
outcome be obtained, they would map it to “$1$”. In the random post-selection
protocol, $A_{0}$ and $B_{2}$ are used both to generate the key and to test
for nonlocality while the other measurements are only used for testing, from
which the full behaviour $\\{P(a,b|x,y)\\}_{a,b,x,y}$ is estimated. Random
post-selection consists of the following step: for key generation rounds
(rounds in which $x=0$ and $y=2$ are chosen), if Alice obtains outcome “$1$”,
she will choose to discard the round with probability $1-p$, while she will
choose to keep all the rounds in which she obtains outcome “$0$”. Similarly,
Bob will independently apply the same post-selection strategy. A given round
is kept only if both parties agree to keep that round. Using this strategy, a
round is kept with probability

$P_{\mathcal{V}}=\sum_{a,b\in\\{0,1\\}}P(a,b|x=0,y=2)p^{a+b}.$ (27)

Note that to avoid complications from the detection loophole, none of the data
from the test rounds are discarded.

The security of the protocol against collective attacks is proven in the
asymptotic limit Xu et al. (2021); Liu et al. (2021b) using numerical
techniques based on the Navascués-Pironio-Acín (NPA) hierarchy Navascués et
al. (2007, 2008); Pironio et al. (2010) via conditional min-entropy Xu et al.
(2021) and the quasi-relative entropies method Liu et al. (2021b).
Interestingly, it was shown (with the collective attack caveat) that with an
ideal source of two-qubit entangled states and pure-loss channel, the critical
detection efficiency is as low as 68.5% Xu et al. (2021). An experimental
demonstration of the protocol (combined with noisy pre-processing) using
spontaneous parametric down-conversion (SPDC) and superconducting single-
photon detector of efficiency 87.49% was performed Liu et al. (2021b). It
manages to achieve an asymptotic key rate of 446 bit/s over 20 m of standard
fibre and an asymptotic key rate of 2.6 bit/s over 220 m. However, at the
moment of writing, a finite-key security analysis of the protocol against
general attacks is not available.

###  4.6 DI-QKD with advantage distillation

All of the protocols that we have listed so far use one-way classical post-
processing to convert their raw keys into a pair of secret key. However, in
some DD-QKD protocols, it is known that noise tolerance can be significantly
improved by adopting two-way classical communication Chau (2002); Gottesman
and Lo (2003); Ma et al. (2006); Bae and Acín (2007); Watanabe et al. (2007);
Khatri and Lütkenhaus (2017). Based on this, Tan et al. (2020a) studied the
so-called repetition code protocol under the assumption that Eve performs
collective attacks.

Consider a protocol where in each round, Alice randomly chooses a measurement
$A_{0},A_{1},...,A_{\left\lvert\mathcal{X}\right\rvert-1}$ while Bob randomly
chooses a measurement
$B_{0},B_{1},...,B_{\left\lvert\mathcal{Y}\right\rvert-1}$ with $A_{0}$ and
$B_{0}$ being the binary-output key-generating measurements. Now, after Alice
and Bob have gathered all their raw data from their devices, they divide the
outcomes from the key-generating rounds into $m$ blocks, each of size $k$.
Focusing on one block, denote the raw output strings in that block as
$\mathbf{A}_{0}$ and $\mathbf{B}_{0}$ respectively. Alice would randomly
generate a bit $C$ and send the message
$\mathbf{M}=\mathbf{A}_{0}\oplus(C,C,...,C)$. Here, $\oplus$ denotes bit-wise
summation modulo 2. Bob would reply with a bit $D$, where $D=1$ (indicating
the block is “accepted”) if
$\mathbf{B}_{0}\oplus\mathbf{M}=(C^{\prime},C^{\prime},...,C^{\prime})$ for
some bit $C^{\prime}$, and otherwise $D=0$ (indicating the block is
“rejected”) in which case they overwrite the values of $C,C^{\prime}$ with
some erasure symbol. Alice and Bob repeat this procedure for every block, thus
obtaining some strings $\mathbf{C}=(C_{1},C_{2},...,C_{m})$ and
$\mathbf{C}^{\prime}=(C^{\prime}_{1},C^{\prime}_{2},...,C^{\prime}_{m})$
respectively. These strings are then used to produce their final key, by
applying one-way error correction followed by privacy amplification.

When applied to the standard CHSH-based DI-QKD protocol under the depolarising
noise model, advantage distillation using the repetition code protocol
increases the optimal critical QBER to $Q_{\text{crit}}^{\text{AD}}\approx
9.1\%$ from $Q_{\text{crit}}^{\text{std}}\approx 7.1\%$ in the standard case.
As for the lossy photonic channel model with no additional noise, if the
states and measurements are chosen to maximise the CHSH value, the critical
detection efficiency for this advantage distillation protocol is
$\eta_{\text{crit}}^{\text{AD}}\approx 89.1\%$ Tan et al. (2020a), which is
better than the value of $90.7\%$ obtained by the standard protocol for those
parameters. However, it was later observed that if the states and measurements
are instead chosen to maximise the key rate directly, the value for the
standard protocol can in fact be improved to $88.4\%$ Brown et al. (2021a).
The critical value for advantage distillation in this case has not been
computed yet. See Tan (2021) for a listing of some of the known detection-
efficiency thresholds.

##  5 Security analyses

In this section, we review the techniques to find lower bounds on the
asymptotic key rates. As a starting point, we focus on the scenario of
collective attacks Devetak and Winter (2005); Tomamichel et al. (2009) (we
shall discuss the situation for general attacks afterward). For this scenario,
in every round there is a well-defined Alice-Bob quantum state $\rho_{AB}$ and
set of possible measurements that could be performed on it. Eve also has an
extension $E$ of the state $\rho_{AB}$ (conservatively, we allow this to be a
purification), which we refer to as her quantum side-information.191919In the
collective-attacks scenario, it does not really matter whether we assume the
IID structure on only the Alice-Bob states or require it for Eve’s
purification as well — this is because all purifications are isometrically
equivalent, hence given IID Alice-Bob states, we can focus only on an IID
purification without loss of generality. Note that throughout this section,
since we are focused on single-round analyses, we shall simplify notation by
omitting the indices that indicate the round associated to each register (e.g.
we write $A,B,E$ instead of $A_{i},B_{i},E_{i}$ for the $i$-th round
registers; this is in contrast with other sections where e.g. $E$ was used to
denote the side-information across all rounds). These indices are implicit for
all quantum and classical registers throughout this section but they would be
made explicit in the rest of the review article.

We shall simplify the overview further by focusing only on protocols where
each individual round has the following structure: some public announcements
$T$ are made over the classical channel (e.g. the basis choice of each party,
whether a given round is discarded or kept, etc.), and then Alice and Bob
generate raw key bits denoted by $\mathsf{S},\mathsf{S}^{\prime}$ (this should
be understood to refer to the values after any relevant pre-processing). After
all these single-round procedures are performed, Alice sends Bob a single
string $\mathbf{P}_{\text{EC}}$ for error correction and verification (note
that this string typically cannot be included in the single-round
announcements $T$, because it may depend on Alice’s entire raw key string),
which he uses to produce a guess for Alice’s raw bits; finally, they apply
privacy amplification to produce the final key. This covers most of the
protocols we have described above, with the exception of the advantage-
distillation protocol (which processes the data in blocks of multiple rounds).

For such protocols, the asymptotic key rate against collective attacks is
given by the Devetak-Winter bound Devetak and Winter (2005); Tomamichel et al.
(2009)

$r\propto H(\mathsf{S}|T,E)-H(\mathsf{S}|\mathsf{S}^{\prime},T),$ (28)

where the constant of proportionality depends on the probability that a given
round is kept, e.g. due to sifting or post-selection (alternatively, another
way to formalise such processes is to set $\mathsf{S},\mathsf{S}^{\prime}$ to
a deterministic value for all “discarded” rounds, in which case the sifting
factor is automatically included in the values of the entropies and the
proportionality factor can be set to 1). Strictly speaking, the original
Devetak-Winter formula was derived for a slightly different context where the
states are fully characterised. However, as we shall discuss later in Section
6, essentially the same formula works for DI-QKD, albeit with slight
differences in the interpretations of some terms.

Typically, the $H(\mathsf{S}|\mathsf{S}^{\prime},T)$ term in the formula is
fairly easy to analyse, because it only depends on Alice and Bob’s data (and
for appropriately designed protocols, can be based on the value in the honest
case only; see Section 6). Hence the main quantity of interest is the term
$H(\mathsf{S}|T,E)$202020In most protocols, the announced classical
information is the choice of bases, $X$ and $Y$. Then, the sifting process
typically accepts only the rounds in which the bases are “matched” (i.e., the
measurement outcomes are strongly correlated) — this allows Eve to deduce $Y$
from $X$ (for the sifted rounds). For protocols where the raw bit is
constructed based on Alice’s measurement outcome $\mathsf{A}$ without
additional processing, we then have
$H(\mathsf{S}|T,E)_{\rho}=p_{s}H(\mathsf{A}|X,E)_{\rho_{s}}$ where $p_{s}$ is
the sifting rate and $H(\mathsf{A}|X,E)$ is evaluated on the sifted state..
The security analysis basically comes down to solving the following
optimisation problem:

$\begin{split}\inf\quad&H(\mathsf{S}|T,E)\\\
\text{s.t.}\quad&\mathrm{tr}[\rho_{AB}\Gamma_{j}]=\gamma_{j},\quad\forall
j.\end{split}$ (29)

Here, each $\Gamma_{j}$ is a linear operator whose expectation value is
estimated in the protocol (e.g. in the standard protocol, there is a single
$\Gamma_{j}$, which is the CHSH operator), and each value $\gamma_{j}$ can be
informally interpreted as the corresponding estimated value (putting aside all
finite-statistics considerations). Typically, $\Gamma_{j}$ is a non-
commutative polynomial in the measurement operators. Recall that in the
device-independent setting, the quantum state and the measurements (and the
Hilbert spaces in which they are living) are all unknown and hence, the
infimum must be taken over all these. (Though as a small simplification, for
the purposes of this optimisation it usually suffices to restrict to
projective measurements only, by constructing a suitable joint Naimark
dilation — see e.g. Harris and Pandey (2016); Tan (2021).)

Remarkably, even though we have initially presented the optimisation (29) in
the context of collective attacks, an optimisation of basically the same form
is also the quantity of interest when proving security against general attacks
using the entropy accumulation theorem Dupuis and Fawzi (2019); Dupuis et al.
(2020); Arnon-Friedman et al. (2018, 2019). Hence solving this optimisation
also essentially suffices to handle general attacks as well — we shall discuss
further details in Section 6. That being said, there are also proof frameworks
that are not directly based on bounding the single-round conditional von
Neumann entropy (e.g. the quantum probability estimation framework Knill et
al. (2018); Zhang et al. (2020a, b)). For the remainder of this section,
though, our focus will be on bounding the optimisation (29).

###  5.1 Classes of approaches

####  5.1.1 Jordan’s lemma

The main challenge of analysing the security of DI-QKD is the fact that the
measurement devices, including their respective Hilbert space dimensions, are
uncharacterised. As such, we cannot exclude _a priori_ the possibility that it
would take an unbounded number of parameters to parameterise the measurements.
Interestingly, for DI-QKD protocols whose security relies only on two binary-
outcome measurements, one can reduce the calculations from an unknown Hilbert
space to the qubit setting. More precisely, let $A_{0}$ and $A_{1}$ be
Hermitian operators on an arbitrary Hilbert space $\mathcal{H}$ with
eigenvalues $\pm 1$. There exists a basis in which both $A_{0}$ and $A_{1}$
can be written as

$\begin{split}A_{0}=\bigoplus_{\alpha}\vec{a}_{0|\alpha}\cdot\vec{\sigma}\\\
A_{1}=\bigoplus_{\alpha}\vec{a}_{1|\alpha}\cdot\vec{\sigma}\\\ \end{split}$
(30)

where $\vec{\sigma}=(\mathds{1},\sigma_{X},\sigma_{Y},\sigma_{Z})$ is a vector
of Pauli matrices. Note that the argument can be applied separately to each
party.

In other words, they are block-diagonal, in blocks of dimension $2\times 2$.
This result is commonly referred to as Jordan’s lemma. A simple proof of the
lemma is given in the work of Pironio et al. Pironio et al. (2009). It is
worth noting that even when one party uses more than two binary-outcome
measurements (e.g., in the standard DI-QKD protocol, Bob has one measurement
to generate the key, and two measurements to estimate the CHSH value), the
lemma can still be useful if the security of the protocol (that is, the bound
on Eve’s uncertainty about $\mathsf{S}$) only relies on two binary-outcome
measurements for each party.

The block-diagonal structure of the measurement allows simplification of the
calculations to qubits, because one can interpret each measurement as
consisting of a projective measurement to determine which block is being
measured, followed by a qubit measurement in the appropriate block. We could
then conservatively assume that Eve is the one performing the initial
projective measurement herself. Since such a measurement removes the coherence
between different blocks, we can conclude that it is sufficient to assume that
Eve distributes states which are block-diagonal with blocks of dimension
$4\times 4$212121Applying Jordan’s lemma on each party’s measurements would
yield blocks of dimension $2\times 2$ for each party. Then, the tensor product
$A_{x}\otimes B_{y}$ would be block diagonal with each block having dimension
of $4\times 4$ as claimed.. Hence, one could imagine Eve sharing some common
random variable $\Lambda$ with Alice’s and Bob’s measurement devices, which
takes the value $\lambda$ with probability $p_{\lambda}$. Depending on the
value of $\lambda$, Eve distributes the two-qubit state $\rho^{\lambda}$ to
Alice and Bob, who perform the qubit measurements $A_{x}^{\lambda}$ and
$B_{y}^{\lambda}$, respectively.

Therefore, to prove the security of DI-QKD protocols in which Jordan’s lemma
applies, it is sufficient to analyse the case in which Alice and Bob are
measuring two-qubit states, and to find a convex lower bound on the single
round conditional von Neumann entropy $H(\mathsf{S}|T,E)$. The convexity
requirement arises from the fact that Jordan’s lemma allows Eve to adopt a
convex combination of qubit strategies instead of picking a single qubit
strategy. Thus, to complete the security proof via Jordan’s lemma, one has to
perform a convex analysis of the bound and/or convexify the bound by taking a
convex hull of the lower bound derived under the assumption that Alice and Bob
receive two qubit states.

While Jordan’s lemma can greatly simplify the security analyses of DI-QKD
protocols, its applicability is severely limited to protocols which only use
two binary-outcome measurements on each party for test rounds. At the time of
writing, there has been no extension of the lemma to cover the cases in which
more measurements are being performed or when the measurements produce more
than two outcomes. In the literature, Jordan’s lemma has been applied to
analyse the security of DI-QKD protocols both analytically Acín et al. (2007);
Pironio et al. (2009); Ho et al. (2020); Woodhead et al. (2021); Masini et al.
(2021) and numerically Schwonnek et al. (2021); Sekatski et al. (2021); Tan et
al. (2020b). A version of this qubit reduction suitable for multipartite DI
protocols was also developed in Grasselli et al. (2021).

####  5.1.2 Hierarchy of semi-definite programs

Performing an optimisation over quantum states and operators in the device-
independent scenario is a challenging task as its feasible set does not admit
a simple characterisation and the Hilbert space involved has potentially
unbounded dimension. In the context of DI-QKD, the purification of the quantum
state measured by the honest parties $\rho_{AB}$ is given to Eve and the joint
quantum state can be written as ${\lvert\psi\rangle}_{ABE}$ that resides in a
Hilbert space $\mathcal{H}$ of arbitrary dimension. Hence, we can define a set
of operators $\mathcal{O}\coloneqq\\{O_{k}\\}_{k}$ such that $O_{k}$ resides
in the same Hilbert space $\mathcal{H}$.

We consider optimisations that minimise (or maximise) a linear combination of
some _moments_ $\left\langle
O_{i}^{\dagger}O_{j}\right\rangle\coloneqq{\langle\psi\rvert}O_{i}^{\dagger}O_{j}{\lvert\psi\rangle}$
of these operators over all possible quantum state and operators. These
optimisations admit a relaxation to a semi-definite program (SDP), which can
then be solved using well-known solvers e.g. SeDuMi Sturm (1999), SDPT3 Toh et
al. (1999), MOSEK MOSEK (2015) etc. This formulation can be achieved by
defining a Gram matrix $\Gamma$ where $\Gamma_{ij}\coloneqq\left\langle
O_{i}^{\dagger}O_{j}\right\rangle,\,O_{k}\in\mathcal{O}$, which implies that
$\Gamma$ must be positive semi-definite, i.e. $\Gamma\succeq 0$. Hence, the
positive semi-definiteness of a matrix, whose elements represent various
moments of operators, imposes a necessary condition in the optimisation of
interest, thereby resulting in a relaxed optimisation over quantum states and
operators.

Exploiting the properties of this Gram matrix, the Navascués, Pironio and Acín
(NPA) hierarchy of SDPs provides a systematic framework to formulate
relaxations on optimisation over the set of quantum correlations Navascués et
al. (2007, 2008). The $n$-th level of the NPA hierarchy is defined by the
positive semi-definiteness of the Gram matrix222222In the case of the NPA
hierarchy, the matrix $\Gamma^{(n)}$ contains the moments (up to the $2n$-th
moment) of the operators in $\mathcal{M}$. As such, $\Gamma^{(n)}$ is often
referred to as the moment matrix. $\Gamma^{(n)}$ such that
$\Gamma^{(n)}_{ij}\coloneqq\left\langle
O_{i}^{\dagger}O_{j}\right\rangle,\,O_{k}\in\mathcal{O}_{n}$ where the set
$\mathcal{O}_{n}$ contains all products of $l$ measurement operators drawn
with replacement from the set
$\mathcal{M}\coloneqq\\{A_{i},B_{j},\dots\\}_{i,j,\dots}$ and the identity
operator $\mathds{1}$, with $1\leq l\leq n$. The measurement operators of
different parties are then constrained to be commuting operators as a
consequence of the tensor product structure. If a behaviour
$P(a,b,\dots|x,y,\dots)$ is compatible with some positive semi-definite
$\Gamma^{(n)}$, we say that $P(a,b,\dots|x,y,\dots)\in\mathcal{Q}_{n}$. Since
$\Gamma^{(n)}$ is a sub-matrix of $\Gamma^{(n+1)}$, the positive semi-
definiteness of the latter imposes at least as many constraints as the former,
which implies that $\mathcal{Q}_{n+1}\subseteq\mathcal{Q}_{n}\,\forall n$.
Moreover, it has been established that
$\lim_{n\rightarrow\infty}\mathcal{Q}_{n}=\mathcal{Q}^{\prime}$, the set of
behaviours compatible with quantum theory (the _quantum set_), under the
assumption that the measurement operators belonging to different parties are
commuting.

As a technicality aside, though, in the DI-QKD setting this review focuses on,
we are working with the set of quantum correlations for measurement operators
obeying a tensor product structure, which we shall denote as $\mathcal{Q}$ (in
contrast to the aforementioned set $\mathcal{Q}^{\prime}$ for commuting-
operator correlations). While it is easily seen that
$\mathcal{Q}\subseteq\mathcal{Q}^{\prime}$, it is known that (when infinite-
dimensional systems are allowed) $\mathcal{Q}\neq\mathcal{Q}^{\prime}$ in
general, and in fact $\bar{\mathcal{Q}}\subsetneq\mathcal{Q}^{\prime}$, where
$\bar{\mathcal{Q}}$ is the closure of $\mathcal{Q}$. Therefore, it is in
principle possible that for a given problem, the NPA hierarchy may converge to
a value that is separated by a constant amount from the value of interest in
our framework. This issue is discussed in detail in Navascués et al. (2012);
Coladangelo and Stark (2018); Ji et al. (2021), among other references. Still,
this only implies that the resulting bound might not be tight — by
construction, this approach will never give an “insecure” (i.e. over-
estimated) value for the entropy.

More generally, a similar hierarchy of SDP relaxations can be defined for an
arbitrary set of operators (not necessarily measurement operators).
Importantly, the SDP hierarchy also admits operator inequality constraints by
defining localising matrices Pironio et al. (2010). Therefore, the SDP
hierarchy can be used to lower bound optimisation problems of the following
form

$\begin{split}\min_{(\mathcal{H},{\lvert\psi\rangle},\vec{O})}\quad&{\langle\psi\rvert}p(\vec{O}){\lvert\psi\rangle}\\\
\text{s.t.}\qquad&q_{i}(\vec{O})\succeq 0,\quad\forall i\in\\{1,...,m\\}\\\
&{\langle\psi\rvert}r_{j}(\vec{O}){\lvert\psi\rangle}\leq 0,\quad\forall
j\in\\{1,\ldots,m^{\prime}\\},\end{split}$ (31)

where the optimisation is taken over all Hilbert spaces $\mathcal{H}$, all
bounded operators $\vec{O}=(O_{1},...,O_{k})$ in $\mathcal{H}$ and all
normalised states ${\lvert\psi\rangle}$ living in $\mathcal{H}$. The functions
$p(\vec{O})$, $q_{i}(\vec{O})$, and $r_{j}(\vec{O})$ are polynomials of the
operators $\vec{O}$. Similarly, operators that are related by tensor products
can be relaxed into commuting operators. Finally, the SDP hierarchy is shown
to converge to the solution of (31) if the polynomials $\\{q_{i}\\}_{i}$ that
define the operator inequality constraints satisfy the so-called Archimedean
property Pironio et al. (2010).

###  5.2 Techniques based on Jordan’s lemma

As mentioned previously, Jordan’s lemma allows us to analyse DI-QKD protocols
by deriving lower bounds on the conditional von Neumann entropy
$H(\mathsf{S}|T,E)$ assuming that Alice and Bob receive two-qubit states. One
then has to show that the resulting bound is convex or, if the derived bound
is found to be non-convex, take a convex hull to obtain a convex bound. Once a
convex lower bound on the conditional von Neumann entropy for qubit attacks is
obtained, by Jordan’s lemma, the bound is valid for any attacks involving
quantum systems of arbitrary dimension.

To obtain a lower bound on the conditional von Neumann entropy based on the
reduction to two-qubit systems, three methods have been presented in the
literature.

####  5.2.1 Reduction to Bell-diagonal states

This method is applicable for protocols whose security parameter is
independent of the marginal correlators (e.g. protocols which rely on the CHSH
(14) or the asymmetric CHSH value (22)). For these protocols, one could
consider that, without loss of generality, the marginal correlators are
unbiased, i.e.,
$\left\langle\mathsf{A}_{x}\right\rangle=\left\langle\mathsf{B}_{y}\right\rangle=0$.
This can be enforced by performing a symmetrisation step, where Alice and Bob
randomly perform coordinated bit-flips. However, the security of the protocol
is unchanged even if the symmetrisation step is omitted Scarani and Renner
(2008); Pironio et al. (2009); Ho et al. (2020).

For a given block (specified by $\Lambda=\lambda$), we are free to label the
axes of the Bloch sphere such that Alice’s and Bob’s measurement in that block
lie on the $(X,Z)$-plane of the Bloch sphere Pironio et al. (2009); Ho et al.
(2020); Sekatski et al. (2021). With this choice, the bit-flips in the
symmetrisation step can be seen as a coordinated Pauli-$Y$ such that we can
assume that Eve sends two-qubit states of the form

$\bar{\rho}^{\lambda}=\frac{1}{2}\left[\rho^{\lambda}+(\sigma_{Y}\otimes\sigma_{Y})\rho^{\lambda}(\sigma_{Y}\otimes\sigma_{Y})\right].$
(32)

States of this form are block-diagonal in the Bell basis with only two
independent non-zero off-diagonal terms. In particular, there is enough
freedom to choose the measurements such that 1) they lie in the $(X,Z)$-plane;
2) the off-diagonal terms in (32) are purely imaginary; and 3) we have

$\begin{split}\lambda_{\Phi^{+}}&\geq\lambda_{\Psi^{-}},\\\
\lambda_{\Phi^{-}}&\geq\lambda_{\Psi^{+}},\\\ \end{split}$ (33)

where $\\{\Phi^{+},\Phi^{-},\Psi^{+},\Psi^{-}\\}$ are the usual Bell states
and we denote
$\lambda_{\Phi^{\pm}}={\langle\Phi^{\pm}\rvert}\bar{\rho}^{\lambda}{\lvert\Phi^{\pm}\rangle}$
and
$\lambda_{\Psi^{\pm}}={\langle\Psi^{\pm}\rvert}\bar{\rho}^{\lambda}{\lvert\Psi^{\pm}\rangle}$.
Finally, since the state $\bar{\rho}^{\lambda}$ and its complex conjugate
$(\bar{\rho}^{\lambda})^{*}$ produce the same statistics for a fixed set of
measurements and give Eve the same information, we can assume that Eve
distributes states of the form

$\rho=\frac{1}{2}\left[\bar{\rho}^{\lambda}+(\bar{\rho}^{\lambda})^{*}\right],$
(34)

which is diagonal in the Bell basis with eigenvalues satisfying (33).

By showing that Bell-diagonal states suffice for Eve’s optimal attack and
focusing on them, we minimise the number of parameters, so that the
optimisation of Eve’s attack can be performed explicitly. This was done for
protocols based on the CHSH value Pironio et al. (2009); Ho et al. (2020) and
for protocols that use a class of asymmetric CHSH inequalities Sekatski et al.
(2021). However, the optimisation of Eve’s attack is still a non-trivial task
that may be difficult to solve analytically, as can be seen from the somewhat
involved analysis in Sekatski et al. (2021).

####  5.2.2 Entropic uncertainty relations

It is well known that to observe Bell nonlocality, it is necessary for some of
the underlying measurements to be incompatible. We can leverage this fact to
relate the commutativity of the measurements of the key-generating party to
the observed value of Bell violation. The pioneering work in this direction
was done by Seevinck and Uffink Seevinck and Uffink (2007), with the
assumption that the underlying quantum systems are qubits. A device-
independent relation between the local overlap of the measurements and the
achievable CHSH value was later derived by Lim et al. Lim et al. (2013) and
also independently by Tomamichel and Hänggi Tomamichel and Hänggi (2013). Once
the overlap of the measurements is bounded in terms of the CHSH value, one can
then apply entropic uncertainty relations Coles et al. (2017) to bound Eve’s
uncertainty about the outcome of one of the measurements Lim et al. (2013).

Extending this idea, given a measurement that generates the key, one can also
consider a virtual complementary measurement and bound the correlation between
the virtual measurement and the other party based on the observed Bell
violation Woodhead et al. (2021); Masini et al. (2021). A similar idea was
also presented in the work of Zhang et al. with focus on complementarity and
its extension to finite-key analysis Zhang et al. (2021c). In contrast to the
earlier methods where the uncertainty relations were applied on the actual
measurements, here, one does not need to bound the overlap of the
measurements, but rather bounds the hypothetical correlations that may arise
from a virtual complementary measurement.

For the simplest example, suppose that Alice generates the raw key using her
$A_{0}$ measurement, and no noisy pre-processing is applied. We have the
following uncertainty relation Masini et al. (2021)

$H(\mathsf{A}|X=0,E)\geq 1-\phi\left(\left\lvert\left\langle\bar{A}_{0}\otimes
B\right\rangle\right\rvert\right),$ (35)

where

$\phi(x)\coloneqq h_{2}\left(\frac{1+x}{2}\right)$ (36)

with the binary entropy function defined

$h_{2}(x)\coloneqq-x\log_{2}x-(1-x)\log_{2}(1-x).$ (37)

Here, $\bar{A}_{0}$ is a (virtual, i.e. not actually measured) Pauli operator
that is orthogonal to $A_{0}$, and $B$ is any $\pm 1$-observable on Bob’s
system, which can be optimised to maximise the key rate. Then, to obtain a
lower bound on the conditional von Neumann entropy, one has to lower bound
$\left\lvert\left\langle\bar{A}_{0}\otimes B\right\rangle\right\rvert$ subject
to the observed experimental statistics. As an illustration, when the CHSH
value is measured in the protocol, we have Masini et al. (2021)

$\left\lvert\left\langle\bar{A}_{0}\otimes
B\right\rangle\right\rvert\geq\sqrt{\frac{S^{2}}{4}-1}.$ (38)

Lower bounds of the correlation between Alice’s complementary measurement and
Bob’s virtual measurement for other Bell inequalities can also be derived
Masini et al. (2021).

Generally, security analysis via this method is modular, consisting of:

  1. 1.

Derivation of a lower bound on the appropriate measure of uncertainty in terms
of the correlation between Alice’s complementary measurement and Bob’s virtual
measurement. This bound depends only on how the raw key is generated (e.g.,
whether two bases are used to generate the key, whether noisy pre-processing
is applied, etc).

  2. 2.

Derivation of a lower bound on the correlation between Alice’s complementary
measurement and Bob’s virtual measurement. This bound depends only on the Bell
inequality that is used in the protocol.

  3. 3.

Convexity analysis to take into account convex combination of qubit attacks.
If necessary, the convex envelope of the qubit lower bounds computed at
discrete points is taken.

This technique is versatile due to its modular design, as it can be easily
adapted to different protocols that use different Bell inequalities or
protocols with modified raw key generation processes (e.g., with noisy pre-
processing or random key basis) Masini et al. (2021). The authors also derived
the correlation bounds in terms of both standard and asymmetric CHSH values. A
bound that incorporates the marginal correlator related to the key generating
measurement was also presented. Furthermore, the second step of the procedure
can be done numerically when analytical bounds on the correlation are hard to
obtain.

####  5.2.3 Numerical analyses via Jordan’s lemma

The two methods mentioned earlier aim to derive analytical solutions to the
optimisation of the conditional von Neumann entropy. However, such analytical
solutions can be hard to obtain and hence, the security analyses can be rather
involved. For DD-QKD, numerical approaches Winick et al. (2018); Coles et al.
(2016) are known to simplify the security analyses of DD-QKD and could (in
some cases) provide tighter bounds than the one provided by analytical
techniques. However, there are some roadblocks that have to be addressed
before we can apply these numerical methods to DI-QKD.

While Jordan’s lemma allows us to reduce the analysis to two-qubit states and
qubit measurements, the qubit measurements performed by Alice and Bob are
still unknown and hence the standard numerical techniques for DD-QKD Coles et
al. (2016); Winick et al. (2018) cannot be directly applied. This is because
these techniques are catered to solve an optimisation of the form

$\begin{split}\inf_{\rho}\quad&H(\mathsf{S}|T,E)\\\
\text{s.t.}\quad&\mathrm{tr}[\Gamma_{j}(M_{a|x},M_{b|y})\rho]=\gamma_{j}\end{split}$
(39)

for fixed sets of measurements $\\{M_{a|x}\\}_{a,x}$ and
$\\{M_{b|y}\\}_{b,y}$. Here, $\\{\Gamma_{j}\\}_{j}$ are functions of the
measurement operators of Alice and Bob (for example, the Bell operator) with
$\gamma_{j}$ being its expected value. On the other hand, the problem we are
trying to solve has the following form

$\begin{split}\inf_{\rho,\\{M_{a|x}\\}_{a,x},\\{M_{b|y}\\}_{b,y}}\quad&H(\mathsf{S}|T,E)\\\
\text{s.t.}\quad&\mathrm{tr}[\Gamma_{j}(M_{a|x},M_{b|y})\rho]=\gamma_{j}\end{split}$
(40)

which is more challenging as the measurements $\\{M_{a|x}\\}_{a,x}$ and
$\\{M_{b|y}\\}_{b,y}$ are now optimisation variables as well. In particular,
the $\mathrm{tr}[\Gamma_{j}(M_{a|x},M_{b|y})\rho]$ terms are now nonlinear in
the optimisation variables, making it harder to (for instance) express the
problem as a convex optimisation.

To approach this, one can begin by noting that a constrained optimisation is
always lower bounded by its Lagrange dual problem, which in this case takes
the form

$\sup_{\vec{\lambda}}\left(\inf_{\rho,\\{M_{a|x}\\},\\{M_{b|y}\\}}H(\mathsf{S}|T,E)\right)\\\
-\sum_{j}\lambda_{j}\left(\mathrm{tr}[\Gamma_{j}(M_{a|x},M_{b|y})\rho]-\gamma_{j}\right).$
(41)

Furthermore, in the context of DI-QKD, this lower bound is in fact typically
tight in a certain sense (see e.g. Tan et al. (2021) for further discussion).
In principle, to get the tightest possible bound, one would have to solve the
optimisation over the Lagrange multipliers $\vec{\lambda}$ in (41); however,
this may be challenging in practice. Instead, we can simply observe that since
the optimisation over $\vec{\lambda}$ is a supremum, any specific choice of
$\vec{\lambda}$ still yields a secure lower bound, and hence it is fine to
simply use heuristic methods to find a good choice of $\vec{\lambda}$. While
this might not yield a perfectly tight bound, it does have the convenient
property that each choice of $\vec{\lambda}$ yields a lower bound on the
conditional entropy $H(\mathsf{S}|T,E)$ that is affine (and hence, convex) in
$\vec{\gamma}$. Therefore, it can be directly used with Jordan’s lemma to
prove the security against attacks using quantum systems in arbitrary Hilbert
spaces.

To now apply the standard numerical techniques for DD-QKD to analyse the
security of DI-QKD protocols, one can use the following procedure Schwonnek et
al. (2021); Tan et al. (2020b):

  1. 1.

Apply Jordan’s lemma to reduce the calculations to two-qubit analysis.

  2. 2.

Parameterise the measurement of Alice and Bob. The following parameterisation
can always be adopted due to the freedom to label the Bloch sphere axes

$\begin{split}A_{0}&=\sigma_{Z},\quad
A_{1}=\cos(\alpha)\sigma_{Z}+\sin(\alpha)\sigma_{X},\\\
B_{0}&=\sigma_{Z},\quad
B_{1}=\cos(\beta)\sigma_{Z}+\sin(\beta)\sigma_{X},\end{split}$ (42)

for some $\alpha,\beta\in[0,\pi]$ with $\\{M_{a|x}\\}_{a,x}$ and
$\\{M_{b|y}\\}_{b,y}$ being their respective projectors.

  3. 3.

For a fixed set of measurement angles $(\alpha,\beta)$, use the standard
numerical techniques for DD-QKD Coles et al. (2016); Winick et al. (2018) to
find a reliable lower bound on the conditional von Neumann entropy. The
standard numerical techniques for DD-QKD Coles et al. (2016); Winick et al.
(2018) formulate this problem as a non-linear convex optimisation.
Alternatively, the problem can be re-cast as an SDP which could be more
efficiently solved but at the cost of the tightness of the bound Schwonnek et
al. (2021).

  4. 4.

For fixed $\alpha$, we optimise Bob’s measurement. For convenience, we could
write $b_{Z}\coloneqq\cos(\beta)$ and $b_{X}\coloneqq\sin(\beta)$. Then, for
fixed value of $\alpha$, we write the Bell operator in terms of
$\alpha,b_{Z},b_{X}$. The feasible region is then characterised by the semi-
circle

$\mathcal{S}_{\text{FR}}=\\{(b_{Z},b_{X})|b_{Z}^{2}+b_{X}^{2}=1,b_{X}\geq
0\\}.$

One could relax the above feasible region into a polytope that fully contains
the semi-circle $\mathcal{S}_{\text{FR}}$. Crucially, the objective function
is affine with respect to $(b_{Z},b_{X})$ and hence, the optimal solution of
the relaxed problem is attained at an extremal point of the polytope. A simple
algorithm is as follows Schwonnek et al. (2021). We start with a polytope
characterised by the following extremal points
$\mathcal{V}=\\{(1,0),(1,1),(-1,1),(-1,0)\\}$ and evaluate the conditional
entropy for each point using the method in Step 3 and then find the point
$b_{\min}$ that minimises the conditional entropy. We cut the polytope by
removing $b_{\min}$ and add a new edge which is tangential to the semi-circle
$\mathcal{S}_{\text{FR}}$. We iterate the process until the desired precision
is achieved.

  5. 5.

Optimise Alice’s measurement: we divide the interval $[0,\pi]$ into several
(not necessarily uniform) intervals
$\\{[\alpha_{j}-\delta_{j},\alpha_{j}+\delta_{j}]\\}_{j}$ and then apply a
continuity bound Schwonnek et al. (2021); Sekatski et al. (2021); Tan et al.
(2020b). Specifically, for $\delta\in[0,\pi]$, we want to find a monotonically
increasing function $\epsilon_{\text{con}}(\delta)$ that bounds the change in
the objective function if we change $\alpha$ by at most $\delta$.

At the end of this step, we want to obtain a lower bound of the form

$\min_{\alpha}f(\alpha)\geq\min_{j}f(\alpha_{j})-\epsilon_{\text{con}}(\delta_{j})$
(43)

where $f(\cdot)$ is the result of the optimisation in Step 4.

If Eq. (41) is solved directly for a fixed value of $\vec{\lambda}$, then the
resulting bound is affine and we are done. However, if one instead had to re-
formulate the problem, and has solved an auxiliary optimisation problem (e.g.
the approach in Schwonnek et al. (2021) was formulated in terms of a trace
norm instead of the conditional von Neumann entropy directly), additional
steps to obtain a convex bound would be necessary.

###  5.3 Techniques based on SDP hierarchies

Approaches that leverage Jordan’s lemma allow us to work with simple two-qubit
systems, but their applicability is limited the two-input-two-output
scenarios. Here, we present another approach for the security analysis of DI-
QKD, via the SDP hierarchy that we have introduced earlier. These techniques
are versatile, being applicable in any Bell scenario, but we have to formulate
the objective functions as linear functions of elements of the moment matrix.
Therefore, this first requires bounding the conditional von Neumann entropy
$H(\mathsf{S}|T,E)$ in terms of such functions.

####  5.3.1 Conditional min-entropy

We first consider protocols where the raw bit $\mathsf{S}$ is obtained by
simply taking Alice’s measurement outcome $\mathsf{A}$ (i.e., we do not
consider noisy pre-processing or random post-selection). A rather convenient
lower bound on the conditional von Neumann entropy (for a fixed state
$\rho_{\mathsf{A}XE}$ that depends on Eve’s attack) is the conditional min-
entropy232323If $\mathsf{A}$ is uniform and binary-valued, a tighter bound
$H(\mathsf{A}|X,E)\geq 2(1-P_{g}(\mathsf{A}|X,E))$ holds Briët and Harremoës
(2009).

$\displaystyle H(\mathsf{A}|X,E)$ $\displaystyle\geq
H_{\min}(\mathsf{A}|X,E)=-\log_{2}P_{g}(\mathsf{A}|X,E),$ (44)

where $P_{g}(\mathsf{A}|X,E)$ is the (maximal) guessing probability, defined
as

$P_{g}(\mathsf{A}|X,E)=\max_{\\{E_{a|x}\\}_{a,x}}\sum_{a,x}\nu_{x}P(a|x)\mathrm{tr}\left[E_{a|x}\rho_{E}^{(a,x)}\right],$
(45)

where $\nu_{x}$ is the probability of Alice choosing measurement setting $X=x$
conditioned on successful sifting (i.e., on Bob also choosing the appropriate
key-generating setting), $\rho_{E}^{(a,x)}$ is Eve’s quantum side information
conditioned on Alice choosing the setting $X=x$ and obtaining outcome
$\mathsf{A}=a$, and $\\{E_{a|x}\\}_{a,x}$ describes a projective measurement
by Eve that can depend on $x$. Note that the last point accounts for the fact
that Eve might adjust her measurement strategy depending on Alice’s
announcement. In particular, for protocols that generate keys from multiple
bases, Eve could keep her ancillae until Alice announces her basis choice and
adjust her measurement strategy accordingly.

Equivalently, we can express the guessing probability in terms of the
tripartite quantum state ${\lvert\psi\rangle}$ shared between Alice, Bob, and
Eve.

$P_{g}(\mathsf{A}|X,E)=\max_{\\{E_{a|x}\\}_{a,x}}\sum_{a,x}\nu_{x}{\langle\psi\rvert}M_{a|x}\otimes\mathds{1}\otimes
E_{a|x}{\lvert\psi\rangle}.$ (46)

The expression is clearly an expectation value of an operator polynomial, and
hence can be computed using the NPA hierarchy242424The SDP also simultaneously
solves the optimisation over Eve’s attack (the state being prepared as well as
Alice’s measurement)..

For protocols that incorporate noisy pre-processing Ho et al. (2020); Tan et
al. (2020b) (say, the raw bit is obtained by flipping the measurement outcome
with probability $p$), the guessing probability (assuming that
$\mathsf{A}\in\\{0,1\\}$) is given by

$P_{g}(\mathsf{S}|X,E)\\\
=\max_{\\{E_{a|x}\\}_{a,x}}\bigg{(}(1-p)\sum_{a,x}\nu_{x}{\langle\psi\rvert}M_{a|x}\otimes\mathds{1}\otimes
E_{a|x}{\lvert\psi\rangle}\\\
+p\sum_{a,x}\nu_{x}{\langle\psi\rvert}M_{a|x}\otimes\mathds{1}\otimes
E_{a\oplus 1|x}{\lvert\psi\rangle}\bigg{)}.$ (47)

Then, similarly, we can use the bound $H(\mathsf{S}|X,E)\geq
H_{\text{min}}(\mathsf{S}|X,E)=-\log_{2}P_{g}(\mathsf{S}|X,E)$.

For the random post-selection protocol discussed in Subsection 4.5, a simple
modification to the definition of the guessing probability can also be made.
Recall that in this protocol, Alice and Bob discard generation rounds with
outcome ‘1’ with probability $1-p$, while keeping all rounds with outcome ‘0’.
Denoting the event in which both parties agree to keep a round by
$\mathcal{V}$ and letting the key generating settings for Alice (resp. Bob) be
given by $x^{*}$ (resp. $y^{*}$), then the guessing probability is given by

$P_{g}(\mathsf{A}|X=x^{*},E,\mathcal{V})\\\
=\max_{\\{E_{a}\\}_{a}}\frac{1}{P_{\mathcal{V}}}\sum_{a,b\in\\{0,1\\}}p^{a+b}{\langle\psi\rvert}M_{a|x^{*}}\otimes
N_{b|y^{*}}\otimes E_{a}{\lvert\psi\rangle},$ (48)

where

$P_{\mathcal{V}}=\sum_{a,b\in\\{0,1\\}}P(a,b|x^{*},y^{*})p^{a+b}$ (49)

is the probability of keeping a given round.

####  5.3.2 Gibbs-Golden-Thompson method

While the lower bound via conditional min-entropy is extremely versatile and
can be used in any protocol in conjunction with the NPA hierarchy, the gap
between conditional von Neumann entropy and the conditional min-entropy can be
large in many situations. The work of Tan et al. (2021) aimed to provide
another versatile bound that is compatible with the NPA hierarchy and also
tighter than the conditional min-entropy.

Consider a protocol with a single key generating measurement (denoted by
$x^{*}$ and $y^{*}$, for Alice and Bob, respectively). Suppose that there is
no noisy pre-processing or postselection involved. Then, we are interested in
finding a lower bound on $H(\mathsf{A}|X=x^{*},E)$. Suppose further that the
quantities measured in the protocol can be represented as the expectation
values of operator polynomials $\\{\Gamma_{j}\\}_{j}$, with:

$\Gamma_{j}=\sum_{a,b,x,y}c^{(j)}_{abxy}M_{a|x}\otimes N_{b|y},$ (50)

for some constants $c^{(j)}_{abxy}$. Let $\gamma_{j}$ be the expected value
for the polynomial $\Gamma_{j}$ on the state $\rho_{AB}$.

Using Gibbs’ variational principle and a generalisation of the Golden-Thompson
inequality, it can be shown that the conditional von Neumann entropy
$H(\mathsf{A}|X=x^{*},E)$ is lower bounded by Tan et al. (2021)

$H(\mathsf{A}|X=x^{*},E)\geq\left\langle\Gamma\right\rangle_{\rho}-\ln\left\langle
K\right\rangle_{\rho},$ (51)

with $\Gamma=\sum_{j}\lambda_{j}\Gamma_{j}$ for some $\\{\lambda_{j}\\}_{j}$
and

$K=\mathcal{T}^{\dagger}\mathcal{T}\left[\int_{\mathbb{R}}\mathrm{d}t\,\beta(t)\prod_{j}\left\lvert
e^{\frac{1+it}{2}\lambda_{j}\Gamma_{j}}\right\rvert^{2}\right],$ (52)

where

$\displaystyle\mathcal{T}[\rho_{AB}]$
$\displaystyle=\sum_{a\in\mathcal{A}}\left(\sqrt{M_{a|x^{*}}}\otimes\mathds{1}_{B}\right)\rho_{AB}\left(\sqrt{M_{a|x^{*}}}\otimes\mathds{1}_{B}\right)^{\dagger}$
(53)

is the pinching channel associated to the key-generating measurement and

$\beta(t)=\frac{\pi/2}{\cosh(\pi t)+1}.$ (54)

As mentioned earlier, with a suitable Naimark dilation, the measurements can
be assumed to be projective, and consequently the pinching channel
$\mathcal{T}$ is both self-adjoint and idempotent. Thus,
$\mathcal{T}^{\dagger}\mathcal{T}[\rho]=\mathcal{T}[\rho]$. Furthermore, if
$\\{X_{k|l}\\}_{k,l}$ are projectors (not necessarily rank-1), we have

$\exp\left(\sum_{k}c_{k|l}X_{k|l}\right)=\sum_{k}e^{c_{k|l}}X_{k|l},$ (55)

and hence, $K$ from Eq. (52) can be simplified to

$K=\mathcal{T}\left[\int_{\mathbb{R}}\mathrm{d}t\,\beta(t)\left\lvert\prod_{xy}\sum_{ab}e^{\kappa_{abxy}}M_{a|x}\otimes
N_{b|y}\right\rvert^{2}\right],$ (56)

with

$\kappa_{abxy}=\frac{1+it}{2}\sum_{j}\lambda_{j}c^{(j)}_{abxy}.$ (57)

For fixed $\lambda_{j}$ and $c^{(j)}_{abxy}$, the integral can be evaluated in
closed form Tan et al. (2021) and hence maximising $\left\langle
K\right\rangle_{\rho}$ is a non-commutative polynomial optimisation which can
be evaluated using an SDP hierarchy. Once an upper bound on $\left\langle
K\right\rangle_{\rho}$ is obtained, we can plug it to Eq. (51). Note that we
have a freedom to choose the operator polynomial $\Gamma$ (which would in
turn, determine the operator polynomial $K$) and hence, we could optimise our
choice of $\Gamma$ to maximise $H(\mathsf{A}|X=x^{*},E)$.

One could also use the same bound for protocols that use multiple key-
generating basis Schwonnek et al. (2021). The idea is that for any
$\alpha_{x}>0$, we have

$\ln\left\langle K_{x}\right\rangle\leq\frac{\left\langle
K_{x}\right\rangle}{\alpha_{x}}+\ln\alpha_{x}-1.$ (58)

The right hand side is simply a tangent line of $\ln\left\langle
K_{x}\right\rangle$ at point $\left\langle K_{x}\right\rangle=\alpha_{x}$.

To obtain a lower bound on the conditional entropy

$H(\mathsf{A}|X,E)=\sum_{x}\nu_{x}H(\mathsf{A}|X=x,E),$

it is sufficient to evaluate the following instead

$\displaystyle H(\mathsf{A}|X,E)$
$\displaystyle\geq\sum_{x}\nu_{x}\left(\left\langle\Gamma\right\rangle_{\rho}-\ln\left\langle
K_{x}\right\rangle_{\rho}\right)$
$\displaystyle\geq\left\langle\Gamma\right\rangle_{\rho}-\left\langle\sum_{x}\frac{\nu_{x}}{\alpha_{x}}K_{x}\right\rangle_{\rho}$
$\displaystyle\hskip 85.35826pt-\sum_{x}\nu_{x}\ln\alpha_{x}+1.$ (59)

In the first line, we apply the Gibbs-Golden-Thompson method for each $x$,
assuming that the same operator polynomial $\Gamma$ is used for all settings.
Then, in the second line, we use the tangent bound (58). One could then use
the SDP hierarchy to maximise
$\left\langle\sum_{x}(\nu_{x}/\alpha_{x})K_{x}\right\rangle_{\rho}$. Again,
the choice of the operator polynomials $\Gamma$ and $K_{x}$ as well as the
tangent points $\alpha_{x}$ can be optimised to maximise the key rate.

####  5.3.3 Iterated mean divergences

While the Gibbs-Golden-Thompson method Tan et al. (2021) provides a promising
improvement over the conditional min-entropy method, it requires significantly
more computational resources. For example, in the simplest scenario (i.e.,
two-input-two-output), the Gibbs-Golden-Thompson method requires optimisation
of a sixth-degree polynomial whereas the conditional min-entropy method only
requires optimisation of a second-degree polynomial. Brown et al. Brown et al.
(2021a) proposed another bound on the conditional von Neumman entropy that can
be more efficiently computed than the one obtained via Gibbs-Golden-Thompson
method.

To that end, they defined the so-called iterated mean divergences
$D_{(\alpha_{k})}(\rho||\sigma)$ Brown et al. (2021a), which are a family of
Rényi divergences. These divergences are characterised by the constant

$\alpha_{k}\coloneqq 1+\frac{1}{2^{k}-1},\quad(k\in\mathbb{N}).$ (60)

For a given state $\rho\in\mathrm{D}(\mathcal{H}_{AB})$ (where
$\mathrm{D}(\mathcal{H}_{AB})$ is the set of normalised density matrices
living in the Hilbert space $\mathcal{H}_{AB}$), and a Rényi divergence
$\mathbb{D}$, we may define its associated conditional entropy

$\mathbb{H}^{\uparrow}(A|B)_{\rho}=-\sup_{\sigma_{B}\in\mathrm{D}(\mathcal{H}_{B})}\mathbb{D}(\rho_{AB}||\mathds{1}_{A}\otimes\sigma_{B}).$
(61)

For iterated mean divergences, the corresponding conditional entropies are
Brown et al. (2021a)

$H_{(\alpha_{k})}^{\uparrow}(A|B)_{\rho}=\frac{\alpha_{k}}{1-\alpha_{k}}\log_{2}Q_{(\alpha_{k})}^{\uparrow}(\rho),$
(62)

where $Q_{(\alpha_{k})}^{\uparrow}(\rho)$ is defined as

$\begin{split}\max_{\\{V_{i}\\}_{i=1}^{k}}\quad&\mathrm{tr}\left[\frac{(V_{1}+V_{1}^{\dagger})}{2}\rho\right]\\\
\text{s.t.
}\quad&\mathrm{tr}_{A}[V_{k}^{\dagger}V_{k}]\preceq\mathds{1}_{B}\\\
&V_{1}+V_{1}^{\dagger}\succeq 0\\\ &\begin{pmatrix}\mathds{1}&V_{i}\\\
V_{i}^{\dagger}&\frac{(V_{i+1}+V_{i+1}^{\dagger})}{2}\end{pmatrix}\succeq
0\quad\forall i<k\end{split}$ (63)

In the context of QKD, the quantum state that we are interested in is the
classical-quantum state $\rho_{\mathsf{A}E}=\sum_{a\in\mathcal{A}}{\lvert
a\rangle\\!\langle
a\rvert}_{\mathsf{A}}\otimes\mathrm{tr}_{A}[(M_{a|x^{*}}\otimes\mathds{1}_{E}){\lvert\psi\rangle\\!\langle\psi\rvert}_{AE}]$.
By writing $V_{i}=\sum_{a,a^{\prime}\in\mathcal{A}}{\lvert a\rangle\\!\langle
a^{\prime}\rvert}_{\mathsf{A}}\otimes V_{i}^{(a,a^{\prime})}$ and
$V_{i,a}=V_{i}^{(a,a)}$, we can upper bound
$Q^{\uparrow}_{(\alpha_{k})}(\rho)$ using some straightforward algebra as