# Anonymous conference key agreement in linear quantum networks

Jarn de Jong<EMAIL_ADDRESS>Electrical Engineering and Computer
Science, Technische Universität Berlin, 10587 Berlin, Germany  Frederik Hahn
Electrical Engineering and Computer Science, Technische Universität Berlin,
10587 Berlin, Germany  Dahlem Center for Complex Quantum Systems, Freie
Universität Berlin, 14195 Berlin, Germany  Jens Eisert  Dahlem Center for
Complex Quantum Systems, Freie Universität Berlin, 14195 Berlin, Germany
Nathan Walk  Dahlem Center for Complex Quantum Systems, Freie Universität
Berlin, 14195 Berlin, Germany  Anna Pappa  Electrical Engineering and Computer
Science, Technische Universität Berlin, 10587 Berlin, Germany

###### Abstract

Sharing multi-partite quantum entanglement between parties allows for diverse
secure communication tasks to be performed. Among them, conference key
agreement (CKA) – an extension of key distribution to multiple parties – has
received much attention recently. Interestingly, CKA can also be performed in
a way that protects the identities of the participating parties, therefore
providing _anonymity_. In this work, we propose an anonymous CKA protocol for
three parties that is implemented in a highly practical network setting.
Specifically, a line of quantum repeater nodes is used to build a linear
cluster state among all nodes, which is then used to anonymously establish a
secret key between any three of them. The nodes need only share maximally
entangled pairs with their neighbours, therefore avoiding the necessity of a
central server sharing entangled states. This repeater setup makes our
protocol an excellent candidate for implementation in future quantum networks.
We explicitly prove that our protocol protects the identities of the
participants from one another and perform an analysis of the key rate in the
finite regime, contributing to the quest of identifying feasible quantum
communication tasks for network architectures beyond point-to-point.

##  1 Introduction

The goal of _conference key agreement_ (CKA) protocols is to provide a shared
key between parties that do not use trusted means of communication. This
primitive can be seen as an extension of key agreement to include more than
two parties. In the quantum domain, different quantum states have been
proposed to accomplish this task [1], aimed at developing new schemes of
quantum cryptography [2, 3] and communication [4] beyond bi-partite key
distribution. Particularly useful are $\mathrm{GHZ}$ states [5] which can be
employed as a resource for CKA protocols due to their obvious correlation when
measured in the computational basis [1, 6, 7]. Other states that have been
used are so-called $W$ states, albeit only allowing to create a conference key
probabilistically [8]. Both of these resources are symmetric in what concerns
the correlations between the participants of the protocol, and it is assumed
that they are created and shared by a central node.

In recent years, the need for privacy and anonymity has led researchers to
develop anonymous versions of protocols that implement important cryptographic
primitives [9, 10, 11]. In the case of CKA, the goal would be to establish a
key between a number of participants, while keeping their identities hidden
from the other non-participating parties, and in instances even from each
other. Using shared GHZ states, anonymous protocols have been proposed [12,
13] and implemented [14] that also provide an advantage in keyrate compared to
sharing bi-partite entanglement [13]. However, GHZ states are highly loss-
prone and cannot be easily exchanged over long distances. Moreover, most
previous approaches using these states require a central server to distribute
the state.

In this work, we address and answer the question of how to achieve anonymous
CKA within a minimal and in several ways experimentally feasible nearest
neighbour architecture. Specifically, we assume a line of quantum repeater
nodes, and study how to anonymously share a secret key between three of them.
These three participants (also referred to as Alice, Bob and Charlie) use
shared bi-partite entanglement with their neighbours to establish a linear
cluster state [15, 16, 17] that ‘connects’ the three of them and all the nodes
in between. This linear cluster state is further used to anonymously establish
a three-partite maximally entangled state between Alice, Bob and Charlie,
which is used to run a conference key agreement protocol and share a key with
provable security. Our new protocol is one of the few cryptographic
demonstrations where non-maximally entangled states are used for practical
tasks. It highlights the flexibility that multi-partite entanglement provides
for cryptographic tasks involving more than two parties and complements known
results supporting this approach [12, 13, 18, 19, 20].

This work is structured as follows. In Subsection 1.1 we provide the necessary
preliminaries and definitions to subsequently introduce the protocol in
Section 2. Section 3 contains an analysis and explanation of the protocol and
its performance, specifically how anonymity and security are achieved, as well
as how the (finite) key rate is calculated. Section 4 contains a general
discussion. Some details of the protocol, as well as the proofs of security
and anonymity have been deferred to Appendices A, B and C, respectively.

###  1.1 Preliminaries and definitions

Throughout this work, we denote with
$\mathcal{N}=\\{N_{1},N_{2},\ldots,N_{n-1},N_{n}\\}$ the collection of all
nodes in a linear network (Fig. 1). We fix a set of three nodes
$\mathcal{P}=\\{N_{a},N_{b},N_{c}\\}\subset\mathcal{N}$ such that $a<b<c$ and
call them Alice, Bob and Charlie, respectively. The goal of these three
parties is to establish a secret key between them, without revealing their
identities to everyone else. We will refer to them as the participants and to
all other nodes
$\bar{\mathcal{P}}\mathrel{\mathop{:}}=\mathcal{N}\setminus\mathcal{P}$ as the
non-participants of our anonymous conference key agreement protocol.

Figure 1: Participants
$\mathcal{P}=\\{{\color[rgb]{0.55,0.71,0.0}\definecolor[named]{pgfstrokecolor}{rgb}{0.55,0.71,0.0}N_{a}},{\color[rgb]{0.2421875,0.57421875,0.80078125}\definecolor[named]{pgfstrokecolor}{rgb}{0.2421875,0.57421875,0.80078125}N_{b}},{\color[rgb]{0.9296875,0.0625,0.4609375}\definecolor[named]{pgfstrokecolor}{rgb}{0.9296875,0.0625,0.4609375}N_{c}}\\}$
and non-participants $\bar{\mathcal{P}}$ are connected by a linear network.
The position of Alice, Bob and Charlie are not known by any other node in the
network.

Alice, Bob and Charlie know each other’s position within the network and can
identify the communication from each $N_{i}$ with its index $i$. Moreover,
they have access to a pre-shared secret key; note that our scheme is a key-
expansion scheme, like all known quantum key distribution and CKA protocols.
We assume that the participants are cooperating: neither do they reveal each
other’s identity nor do they reveal the created secret key. However, we allow
the non-participants to be dishonest and to actively deviate from the protocol
– as long as they do not collude with each other. This means that non-
participants can perform arbitrary maps and measurements in deviating bases or
disclose false measurement outcomes, but they cannot, jointly with other non-
participants, perform a coordinated attack.

Regarding initial resources, we assume that all nodes share one copy of an
entangled (potentially noisy) Bell pair – i.e.
$(\ket{0,0}+\ket{1,1})/\sqrt{2}$ – with each of their neighbours: node $N_{i}$
therefore holds two qubits with labels $\tau_{i}$ and $\omega_{i}$. Qubit
$\tau_{i}$ is entangled with qubit $\omega_{i+1}$ from node $N_{i+1}$ while
qubit $\omega_{i}$ is entangled with qubit $\tau_{i-1}$ from $N_{i-1}$. Since
nodes $N_{1}$ and $N_{n}$ both have a single neighbour, they only have a qubit
$\tau_{1}$ and $\omega_{n}$, respectively. These Bell pairs are used to create
three linear cluster states between the nodes. For a set of qubits
$\\{1,2,\dots,n\\}$, we define the $n$-qubit linear cluster state vector

$\ket{\mathrm{L}_{1,\dots,n}}\mathrel{\mathop{:}}=\prod_{i=1}^{n-1}CZ_{i,i+1}\ket{+}^{\otimes
n},$ (1)

where $\ket{+}^{\otimes
n}\mathrel{\mathop{:}}=\bigotimes_{i=1}^{n}\ket{+}_{i}$ and $CZ_{i,i+1}$ is
the controlled-$Z$ quantum gate that is applied between neighbouring qubits
labelled $i$ and $i+1$. Finally, from the linear cluster state, a three-
partite $\mathrm{GHZ}$ state with state vector

$\ket{\mathrm{GHZ}_{3}}=\frac{1}{\sqrt{2}}\left(\ket{0,0,0}+\ket{1,1,1}\right)$
(2)

is extracted in an anonymous fashion. Fig. 2 depicts a visualization of our
protocol. For clarity, throughout this work, we denote a unitary Pauli
operation with a capital letter, where a superscript indicates a real power
(e.g. $Z^{b}$ is a unitary $Z$ operation for $b=1$ and $I$ for $b=0)$. To
indicate measurement bases, we use the $\sigma$-notation, where a superscript
indicates the qubit (i.e. $\sigma_{x}^{i}$ refers to a measurement of qubit
$i$ in the Hadamard basis).

##  2 Protocol

Our protocol is divided into three parts – the preparation of the required
multi-partite states from the Bell pairs (2.1), the anonymous extraction of
the $\mathrm{GHZ}_{3}$ states from the multi-partite states (2.2), and the
subsequent key generation with post-processing (2.3).

Figure 2: Top: Bell pairs shared between nodes $N_{i}$ and $N_{i+1}$. Qubit
$\tau_{i}$ (dark gray) of $N_{i}$ and $\omega_{i+1}$ (light gray) of $N_{i+1}$
are entangled. The three qubits to be part of the $\mathrm{GHZ}$ state are
colored green, blue and pink. Middle: In Protocol 2.1, the Bell resources are
used to create three linear cluster states via Bell state projection. Alice
and Charlie do not perform the projection. Bottom: In Protocol 2.2 the network
states $\ket{\mathcal{N}}$ are transformed into $\ket{\mathrm{GHZ}_{3}}$
states between $N_{a}$, $N_{b}$ and $N_{c}$.

###  2.1 Preparation of linear cluster states

From the Bell resources, we create the network state vector
$\ket{\mathcal{N}}\mathrel{\mathop{:}}=\ket{\mathrm{L}_{\mathrm{l}}}\otimes\ket{\mathrm{L}_{\mathrm{m}}}\otimes\ket{\mathrm{L}_{\mathrm{r}}},$
where $\ket{\mathrm{L}_{\mathrm{l}}}$, $\ket{\mathrm{L}_{\mathrm{m}}}$ and
$\ket{\mathrm{L}_{\mathrm{r}}}$ – with $\mathrm{l,m,r}$ denoting left, middle
and right – are linear cluster states on the qubits labelled
$\\{\tau_{1},\tau_{2},\dots,\tau_{a-1},\omega_{a}\\}$,
$\\{\tau_{a},\tau_{a+1},\dots,\tau_{c-1},\omega_{c}\\}$ and
$\\{\tau_{c},\tau_{c+1},\dots,\tau_{n-1},\omega_{n}\\}$, respectively (Fig. 2
top and middle), by performing Protocol 2.1 for State preparation.

Protocol 2.1 is divided into three steps. Some nodes execute only a subset of
the steps and a small selection of nodes execute a variant of Step $2a$,
listed as Step $2b$. These considerations are reflected in Tab. 2.1, which
indicates which nodes perform which steps.

Protocol 1: State preparation
---
Input. Bell pairs between nodes $N_{i}$ and $N_{i+1}$.
Goal. Prepare the network state vector $\ket{\mathcal{N}}$. All $N_{i}$
perform the following steps consecutively: 1. Receive $o_{i-1}$. If and only
if $o_{i-1}=1$ apply $Z$ on $\omega_{i}$. 2a. Perform $CZ$ between $\tau_{i}$
and $\omega_{i}$. Measure $\sigma_{x}^{\tau_{i}}$ and record measurement
outcome bit as $o_{i}$. 2b. Draw uniformly random bit $o_{i}$. If and only if
$o_{i}=1$ apply $Z$ on $\tau_{i}$. Apply $H$ on $\tau_{i}$. 3. Send $o_{i}$ to
$N_{i+1}$.

tableProtocol 2.1 Overview

Not all steps of Protocol 2.1 are performed by every node. This table
indicates which steps are performed by which nodes.

After discarding all measured qubits, each node but Alice and Charlie holds
only one qubit. Therefore, we can rename $\tau_{i}\rightarrow i$ for all
$N_{i}\in\mathcal{N}\setminus\\{N_{a},N_{c},N_{n}\\}$ and
$\omega_{n}\rightarrow n$. For Alice and Charlie we rename $\tau_{a}$ and
$\omega_{c}$ to $a$ and $c$ as part of $\ket{\mathrm{L}_{\mathrm{m}}}$ and
$\omega_{a}$ and $\tau_{c}$ to $\tilde{a}$ and $\tilde{b}$ as part of
$\ket{\mathrm{L}_{\mathrm{l}}}$ and $\ket{\mathrm{L}_{\mathrm{r}}}$,
respectively. From the network state we will now show how to anonymously
extract a $\mathrm{GHZ}_{3}$ state for Alice, Bob and Charlie.

###  2.2 Anonymous extraction of $\mathrm{GHZ}$ states

After the $n$ network nodes have created $L$ network states as presented in
Protocol 2.1, each of these states is used to anonymously establish a
$\ket{\mathrm{GHZ}_{3}}$ state between Alice, Bob and Charlie via Protocol 2.2
for GHZ extraction, as visualized in Fig. 2.

Protocol 2: $\mathbf{GHZ}$ extraction
---
Input. Network state vector $\ket{\mathcal{N}}$ from Protocol 2.1.
Goal. Anonymous $\ket{\mathrm{GHZ}_{3}}$ for $N_{a},N_{b},N_{c}$. All $N_{i}$
perform the following steps consecutively: 1. Receive bit $\beta_{i-1}$ and
compute $\beta_{i}=\beta_{i-1}\oplus 1$. 2a. Measure $\sigma_{x}^{i}$ or
$\sigma_{y}^{i}$ if $\beta_{i}$ is $0$ or $1$, respectively. Record the
measurement outcome bit $m_{i}$. 2b. Draw a uniformly random bit $m_{i}$. If
$i\in\mathcal{P}{}$: apply configuration correction $C^{i}$. 3. Communicate
$\beta_{i}$ to node $N_{i+1}$.

tableProtocol 2.2 Overview

$N_{1}$ draws a uniformly random bit $\beta_{0}$ instead of receiving it;
$N_{n}$ does not perform Step $3$.

Protocol 2.2 is divided into three steps as well; some nodes only execute a
subset of the steps and for Step $2$ there are again two different options;
this is reflected in Tab. 2.2. After a given amount of time for everyone to
measure their qubit, all nodes broadcast their measurement outcome $m_{i}$.
The participants $\mathcal{P}$ then perform local unitary corrections on their
own qubits based on the number of nodes between Alice, Bob and Charlie as well
as the collection of measurement outcomes
$\\{m_{i}\\}_{i\in\bar{\mathcal{P}}}$, resulting in $L$ $\mathrm{GHZ}_{3}$
states shared between them. These corrections can be found in App. A and
consist of Clifford operations only. Importantly, the corrections invoked by
the measurement outcomes can be accounted for in post-processing, so that all
actions of the protocol can be carried out simultaneously; this ensures no
quantum memories are necessary. The final steps that enable secure anonymous
conference key agreement are explained in the next section.

###  2.3 Measurements and post-processing

The participants now use a fraction $p$ of the $L$ $\mathrm{GHZ}_{3}$ states
to check for eavesdropping and the rest to generate conference keys. Using
$L\cdot h_{2}(p)$ bits of the pre-shared key – where

$h_{2}(p)\mathrel{\mathop{:}}=-p\log_{2}(p)-(1-p)\log_{2}(1-p)$

is the binary entropy of $p$ – Alice, Bob, and Charlie coordinate their
measurements to be in either the $\sigma_{z}$-basis (for KeyGen rounds) or
$\sigma_{x}$-basis (for Verification rounds). During the latter, $\langle
m\rangle\mathrel{\mathop{:}}=L\cdot p$ states are measured to estimate the
$\sigma_{x}$-basis error rate

$Q_{X}^{m}\mathrel{\mathop{:}}=\frac{1}{2}\left(1-\langle\sigma_{x}^{a}\sigma_{x}^{b}\sigma_{x}^{c}\rangle\right),$

that is the relative number of erroneous (i.e. odd-parity) measurements. Every
party announces a uniformly random bit after every KeyGen and every
Verification round – with the exception of Bob and Charlie who announce their
measurement outcome after each Verification round; this allows Alice to
calculate $Q^{m}_{X}$. When Alice determines that $Q^{m}_{X}$ is above a
predetermined tolerance threshold $Q_{\mathrm{tol}}$, she sets her abort bit
to $1$ to abort the protocol.

The other $\langle k\rangle\mathrel{\mathop{:}}=L-\langle
m\rangle=L\cdot\left(1-p\right)$ states are used to generate conference keys
by Alice, Bob, and Charlie measuring in the $\sigma_{z}$-basis. This results
in $k$ bits of raw key for each participant which is then post-processed with
error correction and privacy amplification.

To perform error correction, Alice applies a publicly known error-correcting
code to her raw key and encrypts the resulting error syndrome with a one-time
pad using a portion of the pre-shared key. Alice now announces the encrypted
syndrome, while everyone else announces a string of random bits of the same
length. Bob and Charlie decrypt Alice’s error syndrome using their pre-shared
key and then perform error correction on their respective keys using the
publicly known error-correcting code.

To verify the error correction, all participants apply a hash function
$h_{\mathrm{EC}}$ to their corrected key; Alice announces her outcome after
encrypting it with a one-time pad using part of the pre-shared key, while
everyone else announces a uniformly random bit string instead. Bob and Charlie
now both decrypt Alice’s announced output and verify the error correction by
comparing their output of $h_{\mathrm{EC}}$ with Alice’s. If either Bob or
Charlie find a discrepancy, they abort by setting their abort bit to $1$; this
ensures that the key they share is correct.

To potentially abort the protocol, the participants each announce their abort
bit, which is $1$ if and only if they want to abort, while the non-
participants all announce random bits. The participants encrypt again by one-
time padding their bit each with a separate single bit of the pre-shared key,
using another $3$ bits in total.

Finally, the participants perform privacy amplification to remove any
correlation between the key and a potential eavesdropper, thereby reducing the
length of the key. To this end, they apply another hash function
$h_{\mathrm{PA}}$; after subtracting the necessary key to replenish the pre-
shared key for communication in subsequent rounds, this results results in a
secure and correct key $s$ of length $\ell$ (see App. B) shared by Alice, Bob,
and Charlie if the protocol was not aborted.

##  3 Analysis of the protocol

Our nearest neighbour state preparation ensures that no central server is
needed to provision resources. First, the parties create the linear cluster
state by exchanging Bell pairs with their nearest neighbours, performing an
entangling operation between their two qubits and subsequently measuring one.
The non-participants then measure their remaining qubit in order to establish
a $\mathrm{GHZ}_{3}$ state between the participants.111Note that the $CZ$
operation and the two subsequent measurements of each non-participant can be
viewed as a measurement in the Bell-state basis, i.e. as a Bell-state
projection, and therefore can be performed in one step by a quantum repeater.
The resulting corrections to obtain the $\mathrm{GHZ}_{3}$ are non-trivial
only for Alice and Charlie: The correction for Alice depends only on the
number of non-participants between Alice and Bob and the measurement outcomes
$\\{m_{i}\\}_{i=a+1}^{b-1}$ of these nodes, while the correction for Charlie
can be constructed by analogy. Importantly, the part of the correction that
depends on the measurement results generates only Pauli corrections, so all
these corrections can be considered as post-processing of KeyGen and
Verification rounds of Alice and Charlie; this means that the participants do
not have to wait for announcements from non-participants before performing
their measurements.

###  3.1 Anonymity of the protocol

The alternating $\sigma_{x}$-$\sigma_{y}$ measurement pattern of Step 2a in
Protocol 2.2 only works when Alice and Charlie are at the respective ends of
the linear cluster state. It is for this reason that we designed our
extraction of the $\mathrm{GHZ}$ state to effectively only use the middle
state $\ket{\mathrm{L}_{\mathrm{m}}}$. Since all non-participants perform
steps that are independent of the position of Alice, Bob, and Charlie, the
nodes $\\{N_{1},\dots,N_{a-1}\\}$ and $\\{N_{c+1},\dots,N_{n}\\}$ generate the
linear cluster states $\ket{\mathrm{L}_{\mathrm{l}}}$ and
$\ket{\mathrm{L}_{\mathrm{r}}}$ as a byproduct. Alice and Charlie not
performing the Bell projection creates the tri-separable network state
$\ket{\mathcal{N}}\mathrel{\mathop{:}}=\ket{\mathrm{L}_{\mathrm{l}}}\otimes\ket{\mathrm{L}_{\mathrm{m}}}\otimes\ket{\mathrm{L}_{\mathrm{r}}}.$
While this could make their actions distinguishable from those of all other
nodes, it is easy to see that the reduced quantum state of each node $N_{i}$
is maximally mixed – even given all announced measurement results. In
particular, this means that the reduced state of each node does not contain
information about the identity of any other node in the network.

For noiseless scenarios, these announced measurement results
$\\{o_{i}\leavevmode\nobreak\ |\leavevmode\nobreak\
N_{i}\in\mathcal{N}\setminus\\{N_{a},N_{c},N_{1}\\}$ are all uniformly random
and uncorrelated – see App. C for a proof. To mask their identity, the other
three nodes therefore announce uniformly random bits $o_{a}$, $o_{c}$ and
$o_{1}$. For noisy scenarios, the announced measurement bits remain uniformly
random, if there is no noise bias in the $\sigma_{x}$ or $\sigma_{y}$ basis,
as for e.g. depolarizing noise. If there were such a bias, it could however
reveal some information about the participants’ identities, as the announced
measurement results would be distinguishable from the uniformly random
announcements of the participants. This can be avoided if the latter introduce
some bias to their source of randomness, and hence mimic the non-uniformity of
the announced measurement results of the non-participants; see Sec. 4 for more
discussion. Furthermore, the neighbours to-the-right of the participants are
not aware that the latter announce randomly chosen bits and will therefore
perform $Z$ corrections conditioned on them (i.e. Step $1$ in Protocol 2.1);
hence Step $2b$ of the protocol works as anti-correction performed by $N_{a}$,
$N_{c}$ and $N_{1}$ on their part of the Bell pair.

Similar to Protocol 2.1, during Protocol 2.2 all non-participants
$\bar{\mathcal{P}}$ (except $N_{1}$ and $N_{n}$) measure and announce their
outcomes $\\{m_{i}\leavevmode\nobreak\ |\leavevmode\nobreak\
N_{i}\in\bar{\mathcal{P}}{},i\notin\\{1,n\\}\\}$, which are uniformly random
and uncorrelated – see App. C for a proof. To hide their identity, the
participants $\mathcal{P}$ as well as $N_{1}$ and $N_{n}$ announce a uniformly
randomly drawn bit (in case of biased noise, the same considerations and
solution as in Protocol 2.1 apply).

In approaches where anonymity is of no concern, an error syndrome can be
announced publicly. However, this syndrome might not be uniformly random and
could potentially disclose Alice’s identity. Hence Alice one-time-pad encrypts
the error syndrome so that her communication is indistinguishable from all
other parties; the same reasoning applies to all other communication of the
post-processing (i.e. the verification and abort), too.

###  3.2 Security and performance of the protocol

In principle, all resulting $\mathrm{GHZ}_{3}$ states could be used for key
generation by each participant measuring in the $\sigma_{z}$ basis. However,
it is of utmost importance that the states are verified, which is achieved by
having all participants measure their qubit in the $\sigma_{x}$ basis instead.
Crucially, the Verification rounds are selected such that potentially
malicious non-participants do not learn of their selection. This is achieved
by coordinating the Verification rounds in advance between Alice, Bob, and
Charlie using secret communication. There are $m=L\cdot p$ Verification rounds
and we therefore need $L\cdot h_{2}(p)$ bits to coordinate their choices. As
the $k$ bits of the raw conference key resulting from the $L\cdot(1-p)$ KeyGen
rounds are neither perfectly correlated nor secret, error correction and
privacy amplification are required.

#### Error correction.

To make the key $\epsilon_{\mathrm{c}}$-correct – i.e. the probability that
Alice’s key is different from Bob’s or Charlie’s is smaller than
$\epsilon_{\mathrm{c}}$ (see App. B for details) – they use a publicly known
error-correcting code (e.g., a _low-density parity-check_ code as in Ref.
[21]) with an error syndrome of length
$l_{\mathrm{EC}}\mathrel{\mathop{:}}=k\cdot h_{2}(Q_{z})$. Here,
$Q_{z}=\max_{i=B,C}\frac{1}{2}(1-\langle\sigma_{z}^{a}\sigma_{z}^{i}\rangle)$
is the maximum pairwise $\sigma_{z}$-basis error rate between Alice and Bob or
Alice and Charlie; it is estimated in advance and thus regarded as a given
parameter. Since the error syndrome is one-time padded, the participants use
up $l_{\mathrm{EC}}$ of the pre-shared key. To verify the error correction,
the participants apply a hash function $h_{\mathrm{EC}}$, which is drawn from
a family of two universal hash functions using a seed $s_{\mathrm{hEC}}$. This
seed is sourced from the pre-shared key222It should be noted that unlike the
other uses of the pre-shared key, the same seed can be used in subsequent runs
of the protocol and therefore it only needs to be determined once. and has
length $k-\log_{2}(\epsilon_{\mathrm{c}})-1$, which ensures an
$\epsilon_{\mathrm{c}}$-correct key. The output of the hash function
$h_{\mathrm{EC}}$ is a bitstring of length
$\log_{2}(\frac{2}{\epsilon_{\mathrm{c}}})$; the same amount is used from the
pre-shared key to encrypt the outcome using one-time pad before Alice
announces it.

#### Privacy amplification.

Privacy amplification works in a similar fashion: Alice, Bob and Charlie apply
a hash function $h_{\mathrm{PA}}$ drawn from a family of two-universal hash
functions using a seed $s_{\mathrm{hPA}}$ of length $k+l_{\mathrm{PA}}-1$
sourced from the pre-shared key${}^{\text{\ref{doublefootnote}}}$, where
$l_{\mathrm{PA}}\mathrel{\mathop{:}}=k\cdot\left(1-h_{2}(Q_{\mathrm{tol}}+\mu\left(\frac{\varepsilon_{\mathrm{s}}-\varepsilon}{2}\right))\right)+2-2\log_{2}(\varepsilon)$
is the length of the output of the hash function. Here, $\mu$ is a statistical
correction and $\varepsilon_{\mathrm{s}}$ is the security parameter, while
$\varepsilon>0$ is a free parameter (see App. B for details). Note that in
other approaches [7], privacy amplification also affects the
$l_{\mathrm{EC}}$-parity bits that are transmitted during error correction.
Since these have been encrypted with the pre-shared key in our approach, no
leakage is possible and thus no privacy amplification is needed for these
bits.

####

Finally, the unencrypted announcement of the – not uniformly random – abort
bits could reveal the identities of the participants. This is solved by all
participants encrypting their abort bits with one-time pads; each participant
uses a single bit of their pre-shared key to hide the correlation of the abort
bits. In order to obtain an accurate key rate, we need to replenish the pre-
shared key used as a one-time pad in the various communications: coordinating
the verification rounds, the error correction’s syndrome and its verification,
and the three bits for the abort communication, obtaining the secret key
length $\ell$ (see App. B). Dividing by the number of rounds $L$, we obtain
the key rate $r\mathrel{\mathop{:}}=l/L$ with

$r=(1-p)\left[1-h_{2}\left(Q_{\mathrm{tol}}+\mu\left(\frac{\varepsilon_{\mathrm{s}}-\varepsilon}{2}\right)\right)-h_{2}(Q_{z})\right]-h_{2}(p)+\frac{1}{L}\left(\log_{2}\left(\varepsilon^{2}\varepsilon_{c}\right)-2\right),$

where $\mu\left(\frac{\varepsilon_{\mathrm{s}}-\varepsilon}{2}\right)$ is a
statistical correction (see App. B) and $\varepsilon>0$ is a free parameter.
Note that for fixed $\varepsilon_{\mathrm{s}}>0$ and
$\varepsilon_{\mathrm{c}}>0$ and given $Q_{\mathrm{tol}}$, $Q_{z}$ and $L$,
one can optimise over $p$ and $\varepsilon$. In the asymptotic limit (i.e.
$L\rightarrow\infty$), not only the $L$-dependent terms of Eq. (3.2) vanish,
but so do $p$ and $\mu$. We refer to Tab. 3.2 for a representation of the
performance of the protocol in terms of the required number $L$ of network
states for a fixed key length $\ell$, while Fig. 3 contains the achievable
finite key rate $r$ as a function of $L$.

table The number of network states $L$ necessary to obtain various secret key
lengths $\ell$, for different $\sigma_{x}$-basis error rates $Q_{x}^{m}$
($Q_{\mathrm{tol}}$ has been fixed at this value). Here, $Q_{z}$ is fixed at
two thirds of $Q^{m}_{x}$ to simulate white noise. The security parameters
$\varepsilon_{\mathrm{c}}$ and $\varepsilon_{\mathrm{s}}$ have both been fixed
at $10^{-8}$ and the rates are optimised over $p$ and $\varepsilon$.

Figure 3: Finite key rate $r$ as a function of the total number of network
states $L$. Here, $Q_{\mathrm{tol}}$ is fixed at various values of $Q_{x}^{m}$
and $Q_{z}$ is fixed at two thirds of this value to simulate white noise. The
blue dotted line is the asymptotic key rate for the minimum $Q_{x}^{m}$ shown.
Security parameters $\varepsilon_{\mathrm{c}}$ and $\varepsilon_{\mathrm{s}}$
have both been fixed at $10^{-8}$; the rates are optimised over $p$ and
$\varepsilon$.

##  4 Discussion

In this work, we have investigated how to anonymously establish a secret key
between three participants in a line of nearest-neighbour quantum repeater
nodes. We find that by sharing maximally entangled pairs that are then
projected into linear cluster states, a secret key can be obtained without
revealing the identity of the participants. This contrasts with previous
approaches to anonymous conference key agreement [12, 13], which directly
distribute large $\mathrm{GHZ}$ states that are not only error-prone but also
rely on a central server.

Although in this work we explicitly show how the three-partite GHZ state is
generated using linear cluster states, this is in fact equivalent to
performing Bell-state projections, as is for example common in quantum
repeater schemes. There are other ways to extract smaller GHZ states from Bell
pairs [22], however, these might not be as straightforward to perform
anonymously on a quantum repeater. We also note that our method of generating
the linear cluster state connecting the three participants, is not unique: in
fact, any scheme that anonymously generates a linear cluster state from Alice
to Charlie can be used, and from there, our proposed method for generating the
conference key can be further applied.

With respect to non-trusted participants, if they were allowed to collaborate
with adversary who controls the entanglement sources and who does not care
about protocol termination can perform a trivial attack by distributing an
eigenstate of a to-be-measured observable to one or more of the parties. Since
participants and non-participants behave differently and the protocol contains
announcements, albeit encrypted ones, the attacker can at least
probabilistically learn the roles of the parties in the protocol. This attack
can in principle be circumvented by first performing randomized verification
of the shared entanglement as in Ref. [11, 12]; however, this would require
access to sufficiently good quantum memories and/or would drastically decrease
the keyrate. In the absence of such countermeasures, anonymity can only be
guaranteed against the non-trusted participants assuming they cannot
collaborate with an all powerful eavesdropper. However, we emphasise that the
security, as opposed to the anonymity, does hold in a fully adversarial model
where all non-trusted participants and the eavesdropper collaborate (see
Appendix B).

As mentioned in Section 3.1, the measurement outcomes that are announced
throughout the protocol could, in the presence of noise, be distinguishable
from the chosen (uniformly random) announced bits of the nodes that do not
perform a measurement; this would be detrimental to their anonymity, even if
the non-trusted participants are not collaborating with an eavesdropper, since
they could potentially learn about noise characteristics in the network via
measurements announced in the current (or previous) runs of the protocol. To
mitigate this risk, these nodes can add a bias to their random announcements
that is consistent with the noise of their detectors. If they want to mimic
the exact bias that their detectors have, they could – in an adjusted protocol
– postpone all announcements until all $L$ rounds of measurements have taken
place. Such a protocol would be modified such that $N_{1}$ and the
participants can secretly estimate their bias, by performing additional
measurements in the bases that they would have had to perform if it wasn’t for
their special role. After all measurements have taken place everyone can then
announce their (potentially fabricated) bits. Since these secret measurements
are in place of the actual measurements that need to be performed, the
corresponding round cannot be used for either verification or key generation.
As such, this approach would slightly diminish the keyrate.

We leave the generalization of our protocol to more than three participants as
an open question: the extraction of higher order $\mathrm{GHZ}$ states from
linear cluster states is possible (see Ref. [23] and upcoming work), and our
post-processing is independent of the number of participants. It should be
noted, however, that the anonymous extraction of larger GHZ states from linear
cluster states is not straightforward, and closed-form expressions for post-
processing corrections are likely to be difficult to obtain. Our work
contributes to the growing body of multi-partite quantum cryptographic schemes
that live up to stringent security requirements in protocols that go beyond
point-to-point protocols. It is the hope that this work further stimulates
theoretical and experimental research towards understanding notions of secure
quantum communication in multi-partite settings.

##  5 Acknowledgements

We thank Stefanie Barz, Jakob Budde, Lukas Rückle and Christopher Thalacker
for fruitful discussions during our ongoing collaboration on experimentally
implementing our protocol. J. de Jong and A. Pappa acknowledge support from
the Emmy Noether DFG grant No. 418294583. F. H. acknowledges support from the
German Academic Scholarship Foundation and J. E. from the BMBF (Q.Link.X and
QR.X), J. E. and A. P. also acknowledge support from the Einstein Research
Unit on Quantum Devices, for which this is an inter-node project.

##  Appendix A Corrections for Alice, Bob and Charlie during Protocol 2.2

Alice and Charlie need to perform a correction to obtain the
$\mathrm{GHZ}_{3}$ state with Bob, whereas Bob never has to perform a non-
trivial rotation. The corrections for Alice and Charlie are structurally
similar; we first introduce those for Alice. In order to achieve this, we
define the following quantities.

  * •

$\delta_{ab}\mathrel{\mathop{:}}=b-a-1$, the number of non-participants
between Alice and Bob.

  * •

$p_{ab}\mathrel{\mathop{:}}=\delta_{ab}\mod 4$, the mod-four value of
$\delta_{ab}$

  * •

$g_{ab}\mathrel{\mathop{:}}=\frac{\delta_{ab}-p_{ab}}{4}$, the integer number
of groups of four that fit between Alice and Bob.

For Charlie, $\delta_{cb},g_{cb}$ and $p_{cb}$ are defined in a similar
fashion. We refer to Fig. 4 for two potential configurations of the network
that exemplifies these definitions.

Figure 4: Two exemplary configurations. Top: $\delta_{ab}=7$ (with
$p_{ab}{}=3$ and $g_{ab}{}=1$) and $\delta_{cb}=6$ (with $p_{cb}=2$ and
$g_{cb}=1$). Bottom: $\delta_{ab}=10$ (with $p_{ab}{}=2$ and $g_{ab}{}=2$) and
$\delta_{cb}=3$ (with $p_{cb}=3$ and $g_{cb}=0$).

Alice now performs the following correction steps:

  1. 1.

Apply a configuration correction $C_{ab}$ depending on $p_{ab}$ and $g_{ab}$,
as shown in Tab. 1, picking the left (brown, $\beta_{a}=1$) or right (green,
$\beta_{a}=0$) table.

  2. 2.

Divide all the measurement outcomes $\\{m_{i}\\}_{a+1}^{b-1}$ into a set
$\\{m_{i}\\}_{a+1}^{a+1+p_{ab}}$ and a set $\\{m_{i}\\}_{a+2+p_{ab}}^{b-1}$ –
where it is to be understood that if $p_{ab}=0$, the first set is empty.

  3. 3.

From the outcomes in the first set, they calculate the bits $k_{x}$ and
$k_{z}$ using Tab. 1.

  4. 4.

From the outcomes in the second set, out of every pair of four they select the
measurement outcomes as described in Tab. 2 and add them all together to
calculate $l_{x}$ and $l_{z}$, respectively (e.g. if $\beta_{a}=1$, Alice
selects every odd element of the second set to calculate $l_{x}$, and every
second, third and fourth out of four to calculate $l_{z}$).

  5. 5.

They apply an $X$ operation on their qubit if and only if $k_{x}\oplus
l_{x}=1$.

  6. 6.

They apply a $Z$ operation on their qubit if and only if $k_{z}\oplus
l_{z}=1$.

Table 1: Local corrections that Alice needs to perform to obtain the
$\mathrm{GHZ}$ state with Bob and Charlie after the non-participants measured
their qubits. The left table shows the corrections if the non-participant
$a+1$ after Alice measured in the $\sigma_{x}$-basis ($\beta_{a}=1$), the
right table the corrections if it was in the $\sigma_{y}$-basis
($\beta_{a}=0$). The $\mathbf{C_{1}}$ column contains the configuration
correction which only depends on the number of non-participants $\delta_{ab}$
between Alice and Bob – note that
$g_{ab}\mathrel{\mathop{:}}=\lfloor{\delta_{ab}}/{4}\rfloor$. The
$\mathbf{k_{x}}$ column contains the measurement outcomes that add to $k_{x}$,
which induce together with $l_{x}$ a correction $X^{k_{x}\oplus l_{x}}$;
similarly the $\mathbf{k_{z}}$ column contains the measurement outcomes that
create $k_{z}$. Table 2: Selection of measurement outcomes out of every pair
of four from the second set to calculate $l_{x}$ and $l_{z}$, respectively.
For example, when $\delta_{ab}=7$ and $\beta_{a}=1$, $l_{x}=m_{a+4}\oplus
m_{a+6}$ and $l_{z}=m_{a+5}\oplus m_{a+6}\oplus m_{a+7}$.

Note that all three corrections (i.e. the configuration correction, the $X$
correction and the $Z$ correction) can be contracted into a single Clifford
operation. However, since the measurement-outcome dependent corrections are
only Pauli operators, they will at most flip the measurement outcomes for
Alice in the subsequent steps of the protocol – and need not be physically
implemented. This also means that the participants can perform their KeyGen or
Verification measurements before the measurement outcomes of the non-
participants are announced. By having all nodes $\\{N_{a+1},\dots,N_{b-1}\\}$
perform their measurements and Alice subsequently perform the aforementioned
corrections, the linear cluster state is contracted towards a
$\ket{\mathrm{L}_{a,b,b+1,\dots,c-1,c}}$ linear cluster state. Hence, Charlie
can perform the same steps (while using the measurement outcomes
$\\{m_{c-1},m_{c-2},\dots,m_{b+1}\\}$, $\delta_{bc}\mathrel{\mathop{:}}=c-b-1$
and its redefined derivatives) to contract the state towards a three-partite
linear cluster state $\ket{\mathrm{L}_{a,b,c}}$. Two final $H$ gates for Alice
and Charlie result in the desired $\mathrm{GHZ}_{3}$ state between Alice, Bob
and Charlie.

###  A.1 Calculating the corrections

Using the stabiliser formalism, it is straightforward to show that, starting
from a linear cluster state $\ket{\mathrm{L}_{a,a+1,\dots,c-1,c}}$, a
measurement on node $N_{a+1}$ in the $\sigma_{x}$\- or $\sigma_{z}$-basis
results in $\ket{\mathrm{L}_{a,a+2,\dots,c-1,c}}$ up to a local correction
$C_{ab}^{a+1}$ for Alice, where this correction depends on both the
measurement basis $\beta_{a+1}$ and outcome $m_{a+1}$ as

$\displaystyle
C_{ab}^{a+1}(m_{a+1},\beta_{a+1})=P_{z}^{(2m_{a+1}+\beta_{a+1})}H=HP_{x}^{(2m_{a+1}+\beta_{a+1})},$
(3)

where $P_{z}\mathrel{\mathop{:}}=R_{z}\left(\frac{\pi}{2}\right)$ is a half-
rotation around the $Z$-axis and $P_{x}$ is defined similarly. Note that
either identity (i.e. the $Z$\- or $X$-based rotation) can be used.

A series of multiple measurements then introduces a concatenation of these
corrections, where the corrections are performed in order from $N_{a+1}$ to
$N_{b-1}$. They do not necessarily commute, but by using the $X$\- and
$Z$-based correction interchangeably (and thus cancelling out the $H$
operations), and using the identity $Z^{m_{i}}P_{x}=P_{x}X^{m_{i}}Z^{m_{i}}$
(and likewise for $P_{z}$) one can group all the corrections that are not
measurement outcome based together as the first corrections; this allows to
partition the complete correction into a ‘configuration’ correction and an
outcome-based correction.

Specifically, for the alternating pattern of $\sigma_{x}$ and $\sigma_{y}$
measurements, each group of four consecutive measurements together introduces
only Pauli corrections. For example, for any group of four consecutive nodes
$\\{N_{1},N_{2},N_{3},N_{4}\\}$ (note that these labels resemble any set of
four consecutive nodes) these corrections are

$\displaystyle X^{(m_{1}+m_{3})}Z^{(m_{2}+m_{3}+m_{4})}X,$ ($\beta_{a}=1$)
$\displaystyle X^{(m_{1}+m_{2}+m_{3})}Z^{(m_{2}+m_{4})}Z.$ ($\beta_{a}=0$)

Up to an irrelevant global phase, all these operators commute with each other.
Therefore, starting from the last measured node (i.e. $N_{b-1}$) an integer
multiple of four can be ‘stitched together’. Since there are
$g_{ab}{}\mathrel{\mathop{:}}=\lfloor{\delta_{ab}}/{4}\rfloor$ of such groups,
the correction becomes

$\displaystyle\prod_{i=0}^{g_{ab}-1}X^{\left(m_{b-4i-4}\oplus
m_{b-4i-2}\right)}Z^{\left(m_{b-4i-3}\oplus m_{b-4i-2}\oplus
m_{b-4i-1}\right)}X=X^{l_{x}}Z^{l_{z}}X^{g_{ab}},$ ($\beta_{a}=1$)
$\displaystyle\prod_{i=0}^{g_{ab}-1}X^{\left(m_{b-4i-4}\oplus m_{b-4i-3}\oplus
m_{b-4i-2}\right)}Z^{\left(m_{b-4i-3}\oplus
m_{b-4i-1}\right)}X=X^{l_{x}}Z^{l_{z}}Z^{g_{ab}},$ ($\beta_{a}=0$)

where $l_{x}$ is defined as

$\displaystyle l_{x}\mathrel{\mathop{:}}=$
$\displaystyle\bigoplus_{i=0}^{g_{ab}-1}m_{b-4i-4}\oplus m_{b-4i-2},$
($\beta_{a}=1$) $\displaystyle l_{x}\mathrel{\mathop{:}}=$
$\displaystyle\bigoplus_{i=0}^{g_{ab}-1}m_{b-4i-4}\oplus m_{b-4i-3}\oplus
m_{b-4i-2},$ ($\beta_{a}=0$)

and $l_{z}$ is defined as

$\displaystyle l_{z}\mathrel{\mathop{:}}=$
$\displaystyle\bigoplus_{i=0}^{g_{ab}-1}m_{b-4i-3}\oplus m_{b-4i-2}\oplus
m_{b-4i-1},$ ($\beta_{a}=1$) $\displaystyle l_{z}\mathrel{\mathop{:}}=$
$\displaystyle\bigoplus_{i=0}^{g_{ab}-1}m_{b-4i-3}\oplus m_{b-4i-1}.$
($\beta_{a}=0$)

The corrections for the measurements of the nodes $N_{a+1},\dots,N_{a+p_{ab}}$
(i.e. the first $p_{ab}$ measurements) are then also grouped together; by
splitting them into a measurement-outcome dependent and -independent part,
they can be written as $X^{k_{x}}Z^{k_{z}}C_{ab}$, where $C_{ab}$, $k_{x}$ and
$k_{z}$ can be read from Tab. 1. Note that the $X^{g_{ab}}$ or $Z^{g_{ab}}$ in
Tab. 1 is technically not part of the correction here, but that they will
commute with $X^{k_{x}}Z^{k_{z}}$ and hence the total correction that Alice
needs to perform becomes (where now $C_{ab}$ is as in Tab. 1):

$X^{l_{x}}Z^{l_{z}}X^{k_{x}}Z^{k_{z}}C_{ab}\leavevmode\nobreak\
\hat{=}\leavevmode\nobreak\ X^{k_{x}\oplus l_{x}}Z^{k_{z}\oplus l_{z}}C_{ab},$
(4)

where $\hat{=}$ here indicates ‘up to an (irrelevant) global phase’. Since
these corrections only consider nodes between Alice and Bob, and since there
are actions that Bob needs to perform, the corrections for Charlie work in a
similar fashion and can be seen separately from these.

##  Appendix B Protocol statement and security proof

We now state the protocol and proof the security of the generated key. Note
that we have omitted the network state generation (i.e. Protocol 2.1) as it
does not affect security.

#### Input:

  * •

$L$ network states $\ket{\mathcal{N}}$ connecting $\\{N_{i}\\}_{i=1}^{n}$,
including $N_{a}$, $N_{b}$ and $N_{c}$.

  * •

Desired secrecy parameter $\varepsilon_{\mathrm{s}}>0$, which determines a
correlation threshold $Q_{\mathrm{tol}}$, and correctness parameter
$\varepsilon_{\mathrm{c}}>0$.

  * •

A random string $s_{\mathrm{b}}$ of length $L\cdot h_{2}(p)$ secretly pre-
shared between the participants to randomly choose $m$ out of the $L$ cluster
states to be measured in the $\sigma_{x}$-basis for parameter estimation where
$p=m/L$, leaving $k\mathrel{\mathop{:}}=L-m$ measurements in the
$\sigma_{z}$-basis for key generation.

  * •

An estimate of the expected bit error rate $Q_{z}$ in the $\sigma_{z}$-basis
between Alice and Bob and Alice and Charlie. The worst of these will be used
to select an error-correcting code that requires an error syndrome of length
$\ell_{\mathrm{EC}}\mathrel{\mathop{:}}=k\cdot h_{2}(Q_{z})$ to be announced.

  * •

A pre-shared secret random string $s_{\mathrm{EC}}$ of length
$\ell_{\mathrm{EC}}$ to be used to one-time pad the error reconciliation
announcements, another pre-shared string $s_{\mathrm{hEC}}$ of length
$\ell_{\mathrm{hEC}}\mathrel{\mathop{:}}=\log_{2}(2/\varepsilon_{\mathrm{c}})$
to one-time pad the error correction verification announcements, and three
bits of pre-shared key to communicate aborting by the participants.

  * •

Two pre-shared random strings, $s_{\mathrm{h}}$ and $s_{\mathrm{hEC}}$, of
lengths $k+\ell_{\mathrm{PA}}-1$ and $k+\ell_{\mathrm{hEC}}-1$ respectively to
be used as the seeds for hashing, where $\ell_{\mathrm{PA}}$ is the output of
the privacy amplification hashing as defined below. The string
$s_{\mathrm{h}}$ is used for privacy-amplification of the private key, while
$s_{\mathrm{hEC}}$ is used to verify the error correction step has succeeded.
Note that unlike the previous seeds, these can be used indefinitely and need
not be replenished after each run of the protocol.

#### Output:

A key of length $\ell$ shared anonymously between Alice, Bob and Charlie that
is $\epsilon_{\mathrm{s}}$-secret and $\epsilon_{\mathrm{c}}$-correct.

  1. 1.

For $i=1,\ldots,n$:

    1. (a)

Node $N_{i}$ receives bit $\beta_{i-1}$ and computes
$\beta_{i}=1-\beta_{i-1}$, except for $N_{1}$ who draws a random bit
$\beta_{0}$ instead.

      1. i.

If $N_{i}\in\bar{\mathcal{P}}$, they measure the operator $\sigma_{x}^{i}$ or
$\sigma_{y}^{i}$ if $\beta_{i}=0$ or $\beta_{i}=1$, respectively. They
broadcast the measurement outcome $m_{i}$.

      2. ii.

If $N_{i}\in\mathcal{P}{}$, they announce a uniform randomly drawn bit
$m_{i}$.

    2. (b)

Node $N_{i}$ sends bit $\beta_{i}$ to neighbour $N_{i+1}$, except for node
$N_{n}$.

  2. 2.

The participants perform corrections on their qubits to rotate the post-
measurement state to the desired $\mathrm{GHZ}$ state.

    1. (a)

Alice and Charlie apply their configuration corrections $C_{a}$ and $C_{c}$,
respectively (cf. Tab. 1).

    2. (b)

Alice $(i=a)$ and Charlie $(i=c)$ both calculate their parameters
$l^{i}_{x},k^{i}_{x}$ and $l^{i}_{z},k^{i}_{z}$ from the measurement outcomes
of the non-participants (cf. Tabs. 1 and 2) and each apply $X^{l_{x}\oplus
k_{x}}$ and $Z^{l_{z}\oplus k_{z}}$ to their qubit.

    3. (c)

Alice and Charlie each apply a Hadamard operation $H$ to their qubit to obtain
the final desired $\mathrm{GHZ}$ state.

  3. 3.

Using the pre-shared string $s_{b}$, the participants coordinate their
measurements of all $L$ $\mathrm{GHZ}$ states into $m$ Verification rounds
(i.e. $\sigma_{x}$-basis) and $k$ KeyGen rounds (i.e. $\sigma_{z}$-basis).
Everyone announces after each measurement a random bit $m_{i}$, except for Bob
and Charlie, who announce their measurement outcomes for the Verification
rounds.

  4. 4.

Alice, who can locate Bob’s and Charlie’s measurement outcomes from the
Verifi- cation rounds, estimates the $\sigma_{x}$-basis error rate
$Q_{X}^{m}=\frac{1}{2}(1-\langle\sigma_{x}^{a}\sigma_{x}^{b}\sigma_{x}^{c}\rangle)$.
If this is above the tolerance $Q_{\mathrm{tol}}$, she aborts by setting her
abort bit to $1$.

  5. 5.

Alice computes the necessary information for error correction – the error
syndrome of length $\ell_{\mathrm{EC}}$ – and then one-time pad encrypts this
information with the string $s_{\mathrm{EC}}$. All other players announce
uniform random strings of length $\ell_{\mathrm{EC}}$.

  6. 6.

Bob and Charlie use their copies of $s_{\mathrm{EC}}$ to obtain
$l_{\mathrm{EC}}$ and correct their $k$ $\sigma_{z}$ measurement strings, i.e.
their raw key. Alice, Bob and Charlie then hash their string using the seed
$s_{\mathrm{hEC}}$. Alice encrypts her output using her copy of
$s_{\mathrm{hEC}}$. Using their copy, Bob and Charlie each decrypt Alice’s
hash outcome and compare it to their own; if they do not align, they abort by
setting their abort bit to $1$.

  7. 7.

Alice, Bob and Charlie, using another three bits of the pre-shared key,
encrypt their abort bit – which is equal to $1$ if and only if they want to
abort – and announce it, while all other parties announce uniformly random
bits instead. If any participants announced a $1$, everyone aborts (meaning
they will not use the generated key).

  8. 8.

Finally, the participants hash their measurement results with the seed
$s_{\mathrm{hPA}}$ to produce the final key $s$ of length

$l_{\mathrm{PA}}\mathrel{\mathop{:}}=k\left[1-h_{2}(Q_{\mathrm{tol}}+\mu\left(\frac{\varepsilon_{\mathrm{s}}-\varepsilon}{2}\right))\right]+2-2\log_{2}(\varepsilon)=\ell+\ell_{\mathrm{EC}}+\ell_{\mathrm{hEC}}+L\cdot
h_{2}(p)+3.$

However, to fairly evaluate performance the parties should replenish their
stock of secret-shared key so as to be able to perform subsequent CKA
protocols. Subtracting off the non-reusable shared randomness results in a
string of length $\ell$ that is available for applications.

We now prove the security of our protocol in the scope of an even more general
adversary model than the one introduced in the main text, so that we can
resort to a powerful machinery that has been developed in the literature [24,
25] and we can build on the strategy of proof laid out in Ref. [7]; the
security of our protocol within our adversary model then follows readily.
However, there are some variations to the tools necessary to preserve the
anonymity of the participants which is key to the present work. We briefly
explain some critical quantities and definitions. Let
$\rho_{S_{A}S_{B}S_{C}E^{\prime}}$ be the joint classical-quantum state
between the final keys of the participants and an eavesdropper conditioned on
passing all checks. Note that the eavesdroppers system, $E^{\prime}=ER$, is
made up of a quantum system, $E$, that completely purifies the pre-measurement
state $\rho_{ABC}$ (and is, therefore, assumed to include system of the non-
participating player) and a classical register $R$ that contains all of the
information announced during the protocol. A protocol is called
$\varepsilon_{\mathrm{rob}}$-robust if it passes the correlation and the error
correction checks with probability $1-\varepsilon_{\mathrm{rob}}$. Defining a
uniformly distributed state as

$\displaystyle\rho_{\mathbf{U}}\equiv\sum_{s\in\mathcal{S}}\frac{1}{|\mathcal{S}|}|s\rangle\langle
s|$ (5)

with $\mathcal{S}$ the set of possible secret keys we have the following
definition [7].

######  Definition 1 (Approximate robustness and secrecy)

A CKA protocol that is $\varepsilon_{\mathrm{rob}}$-robust is
$\varepsilon_{c}$-correct if

$\displaystyle\left(1-\varepsilon_{\mathrm{rob}}\right)\operatorname{Pr}\left[S_{A}\neq
S_{B}\lor S_{A}\neq S_{C}\right]\leqslant\varepsilon_{c}$ (6)

and $\varepsilon_{s}$-secret if

$\displaystyle\left(1-\varepsilon_{\mathrm{rob}}\right)\frac{1}{2}\left\|\rho_{S_{A}E^{\prime}}-\rho_{\mathrm{U}}\otimes\rho_{E^{\prime}}\right\|\leqslant\varepsilon_{s}$
(7)

is called $(\varepsilon_{s}+\varepsilon_{c})$-secure if it is
$\varepsilon_{c}$-correct and $\varepsilon_{c}$ secret.

Turning first to multi-partite error correction we have the following
statement.

######  Theorem 1 (Theorem 2 in Ref. [7])

Given a probability distribution $P_{X_{A},B_{1},B_{2},\dots,B_{N}}$, between
Alice and $n$ other players there exists a one-way error-correction protocol
for all $n$ players that is: $\varepsilon_{c}$-correct, and
$2(n-1)\varepsilon^{\prime}$ -robust on $P_{X_{A},B_{1},B_{2},\dots,B_{n}},$
and has leakage

$\displaystyle\ell_{\mathrm{EC}}\leqslant\max_{i}H_{0}^{\varepsilon^{\prime}}\left(X_{A}|B_{i}\right)+\log_{2}\frac{2(n-1)}{\varepsilon_{c}}.$
(8)

In terms of secrecy the critical results are leftover hashing against quantum
side-information, an entropic uncertainty relation for smoothed min- and max-
entropies, applied to our protocol, states the following.

######  Lemma 1 (Leftover hashing against quantum side information in Refs.
[26, 24])

Let $\varepsilon^{\prime}\geq 0$ and $\rho_{Z_{A}E}$ be a classical-quantum
state where $Z_{A}$ is defined over a discrete-valued and finite alphabet, $E$
is a quantum system and $R$ is a register containing the classical information
learnt by Eve during information reconciliation. If Alice applies a hash
function, drawn at random from a family of two-universal hash functions that
maps $\rho_{Z_{A}E}$ to $\rho_{S_{A}E}$ and generates a string of length
$\ell$, then

$\displaystyle\frac{1}{2}\left\|\rho_{S_{A}ER}-\rho_{\mathrm{U}}\otimes\rho_{ER}\right\|\leqslant
2^{-\frac{1}{2}(H_{\mathrm{min}}^{\varepsilon^{\prime}}(Z_{A}|ER)-\ell-2)}+2\varepsilon^{\prime},$
(9)

where $H_{\min}^{\varepsilon^{\prime}}\left(Z_{A}|ER\right)$ is the
conditional smooth min-entropy of the raw measurement data given Eve’s quantum
system and the leakage of the information reconciliation.

This leads to the following corollary.

######  Corollary 1 (Secret string extraction)

For an $\varepsilon_{\mathrm{rob}}$-robust protocol an
$\varepsilon_{s}$-secret string of length

$\displaystyle\ell=H_{\min}^{\varepsilon^{\prime}}\left(Z_{A}|ER\right)+2-2\log_{2}\frac{1}{\varepsilon}$
(10)

can be extracted for any $\varepsilon_{s},\varepsilon,\varepsilon^{\prime}\geq
0$ such that

$\displaystyle\varepsilon_{s}\geq\varepsilon+2\varepsilon^{\prime}$ (11)

where $H_{\min}^{\varepsilon^{\prime}}\left(Z_{A}|ER\right)$ is the
conditional smooth min-entropy of the raw measurement data given Eve’s quantum
system and the information reconciliation leakage conditioned on the protocol
not aborting.

Proof: Note that if we choose

$\displaystyle\ell=H_{\min}^{\varepsilon^{\prime}}\left(Z_{A}|ER\right)+2-2\log_{2}\frac{(1-\varepsilon_{\mathrm{rob}})}{\varepsilon},$
(12)

then the right hand side of (9) is equal to
$\varepsilon/(1-\varepsilon_{\mathrm{rob}})+2\varepsilon^{\prime}$. Comparing
with (7) in Definition 1 we see we want this expression to satisfy
$\varepsilon/(1-\varepsilon_{\mathrm{rob}})+2\varepsilon^{\prime}\leq\varepsilon_{s}/(1-\varepsilon_{\mathrm{rob}})$
so our security condition is satisfied for any
$\varepsilon_{s}\geq\varepsilon+2(1-\varepsilon_{\mathrm{rob}})\varepsilon^{\prime}$
which is true for any $\varepsilon_{s}\geq\varepsilon+2\varepsilon^{\prime}$
where we used that $(1-\varepsilon_{\mathrm{rob}})\leq 1$. Noting further that
$\log_{2}(1-\varepsilon_{\mathrm{rob}})\leq 0$ yields (10). This means that,
provided the constraint in (11) is satisfied, the positive constant
$\varepsilon$ can be optimised over. Typically this makes little difference to
the final performance and and they are commonly chosen as
$\varepsilon=\varepsilon_{s}/2$.

Now we see that the problem has condensed to determining Eve’s conditional
smooth min-entropy for $Z_{A}^{k}$ (in the following we will suppress the $k$
superscript), the variable describing the outcome of Alice’s $\sigma_{z}$
measurements on the $k$ key-generating qubits. To begin with, consider the
situation before any information reconciliation is exchanged (there is no
register $R$) so we simply have $H_{\mathrm{min}}(Z_{A}|E)$. Since Eve’s state
is taken to include that of all the non-participating players we can assume
without loss of generality that there is an overall pure tripartite state
between Alice, the remaining participants (which we denote $B_{i}$), and Eve.
The required bound for this situation has been derived by applying an entropic
uncertainty relation [26] for the smoothed min- and max-entropies specialised
to the case of observables made up of the $k$-fold tensor product of either
$\sigma_{z}$ and $\sigma_{x}$ measurements, (i.e. the observables
$Z_{A}=\sigma_{z}^{1}\otimes\sigma_{z}^{2}\otimes\cdots\otimes\sigma_{z}^{k}$
and
$X_{A}=\sigma_{x}^{1}\otimes\sigma_{x}^{2}\otimes\cdots\otimes\sigma_{x}^{k}$)
[24]

$\displaystyle
H_{\mathrm{min}}^{\varepsilon}(Z_{A}|E)+H_{\mathrm{max}}^{\varepsilon}(X_{A}|B_{i})$
$\displaystyle\geq$ $\displaystyle k,$ $\displaystyle\Rightarrow
H_{\mathrm{min}}^{\varepsilon}(Z_{A}|E)$ $\displaystyle\geq$ $\displaystyle
k-H_{\mathrm{max}}^{\varepsilon}(X_{A}|B_{i}),$ (13)

where we have used the data processing inequality,
$H_{\mathrm{max}}^{\varepsilon}(X_{A}|X_{B_{i}})\geq
H_{\mathrm{max}}^{\varepsilon}(X_{A}|X_{B_{i}})$, in the second line. Naively,
this bound cannot be evaluated since it is counterfactual, i.e. the $k$ qubits
are always measured in the $\sigma_{z}$-basis so we have no direct access to
$H_{\mathrm{max}}^{\varepsilon}(X_{A}|X_{B_{i}})$, which is the conditional
max-entropy of the participants given their Pauli measurements if Alice had
instead measured in the $\sigma_{x}$ in these $k$ rounds. However, since the
parameter estimation and key generation rounds were selected at random then it
has been shown that Serfling’s bound can be applied to statistically bound the
$\sigma_{x}$ correlation that would have been observed in the $k$ key
generation rounds based upon those that were actually observed in the
parameter estimation rounds. This is expressed in the following result.

######  Lemma 2 (Lemma 3 in Ref. [24])

Let $k$ be the number of key generation rounds, $m$ be the number of parameter
estimation rounds, $d_{0}$ a threshold on the number of errors that can be
observed during parameter estimation without the protocol aborting and
$\varepsilon^{\prime}>0$.

$\displaystyle H_{\mathrm{max}}^{\varepsilon^{\prime}}(X_{A}|X_{B_{i}})\leq
kh_{2}(d_{0}+\mu(\varepsilon^{\prime}(1-\varepsilon_{\mathrm{rob}}))),\hskip
5.69054ptwhere\hskip
5.69054pt\mu(\varepsilon):=\sqrt{\frac{m+k}{mk}\frac{m+1}{m}\ln\frac{1}{\varepsilon}}.$
(14)

Putting all of these results together we can prove the following security
statement.

######  Theorem 2 (Security statement)

If the anonymous CKA protocol defined above proceeds without aborting an
$(\max_{i\in\\{B,C\\}}\ell_{\mathrm{EC}}^{i},\varepsilon_{c})$ error
correction protocol and a two-universal hashing are successfully applied then
an $(\varepsilon_{s}+\varepsilon_{c})$-secure key of length

$\displaystyle\begin{split}\ell&=k\left[1-h_{2}\left(Q_{\mathrm{tol}}+\mu\left(\frac{\varepsilon_{\mathrm{s}}-\varepsilon}{2}\right)\right)\right]+2-2\log_{2}\frac{1}{\varepsilon}-\ell_{\mathrm{EC}}-\ell_{\mathrm{hEC}}-L\cdot
h_{2}(p)-3\\\
&=L\left[\left(1-p\right)\left[1-h_{2}\left(Q_{\mathrm{tol}}+\mu\left(\frac{\varepsilon_{\mathrm{s}}-\varepsilon}{2}\right)\right)-h_{2}\left(Q_{z}\right)\right]-h_{2}(p)\right]+\log_{2}(\varepsilon^{2}\varepsilon_{\mathrm{c}})-2\end{split}$
(15)

can be anonymously extracted.

Proof: At the conclusion of the protocol we can immediately apply Corollary 1
to the $k$ round classical-quantum state
$\rho^{k}_{Z_{A}E}=\mathrm{tr}_{B_{i}}(\ket{\Psi_{AB_{i}E}}\bra{\Psi_{AB_{i}E}})$
to extract an $\varepsilon_{s}$-secret key of length

$\displaystyle\ell=H_{\min}^{\varepsilon^{\prime}}\left(Z_{A}|ER\right)+2-2\log_{2}\frac{1}{\varepsilon}$
(16)

for positive constants satisfying

$\displaystyle\varepsilon_{s}\geq\varepsilon+2(1-\varepsilon_{\mathrm{rob}})\varepsilon^{\prime}.$
(17)

Now, because all of the communication involved in error reconciliation is one-
time padded to ensure anonymity we have that
$H_{\min}^{\varepsilon^{\prime}}\left(Z_{A}|E,R\right)=H_{\min}^{\varepsilon^{\prime}}\left(Z_{A}|E\right)$
by definition. This gives

$\displaystyle\ell$ $\displaystyle=$ $\displaystyle
H_{\min}^{\varepsilon^{\prime}}\left(Z_{A}|E\right)+2-2\log_{2}\frac{1}{\varepsilon}$
(20) $\displaystyle\begin{array}[]{cc}(\ref{eur})\\\ \geq\end{array}$
$\displaystyle
k-H_{\max}^{\varepsilon^{\prime}}\left(X_{A}|X_{B_{i}}\right)+2-2\log_{2}\frac{1}{\varepsilon}$
$\displaystyle\begin{array}[]{cc}(\ref{poscons})\\\ \geq\end{array}$
$\displaystyle
k-H_{\max}^{(\varepsilon_{s}-\varepsilon)/2/(1-\varepsilon_{\mathrm{rob}})}\left(X_{A}|X_{B_{i}}\right)+2-2\log_{2}\frac{1}{\varepsilon}$
(23) $\displaystyle\begin{array}[]{cc}(\ref{mubound})\\\ \geq\end{array}$
$\displaystyle
k-kh_{2}\left(Q_{\mathrm{tol}}+\mu\left(\frac{\varepsilon_{s}-\varepsilon}{2}\right)\right)+2-2\log_{2}\frac{1}{\varepsilon},$
(26)

where in the third line we have also used that
$H_{\mathrm{max}}^{\varepsilon_{1}}(X|Y)<H_{\mathrm{max}}^{\varepsilon_{2}}(X|Y)$
for $\varepsilon_{1}>\varepsilon_{2}$. This string is guaranteed to be
$\varepsilon_{s}$-secret and, by Theorem 1, if the error correction process
did not abort then the string is also $\varepsilon_{c}$-correct. However, this
is not a fair representation of the performance of the protocol, since we had
to use up the reservoir of pre-shared key for the basis choices and for one-
time padding the error reconciliation information. Thus, to get the length of
useable key we need to calculate how much remains after we have replenished
the pre-shared strings necessary for the next protocol implementation.
Subtracting off the seed for basis choices, $Lh_{2}(p)$, and the length of the
error correction information and verification, $\ell_{\mathrm{EC}}$ and
$\ell_{\mathrm{hEC}}$ and the $3$ bits for the abort step, gives (15).

##  Appendix C Probability distributions of the measurement outcomes

We will show that there are no correlations between any of the announced
measurement outcomes $\\{o_{i}\\}\cup\\{m_{i}\\}$, i.e., that the outcome
distribution is indistinguishable from that of the uniformly drawn
announcements of the nodes $N_{1},N_{a}$ and $N_{c}$ during Protocols 2.1 and
2.2. Since the state of the network always remains separable between the tri-
partition of the nodes to the left of (and including) Alice, the nodes to the
right of (and including) Charlie, and the nodes between (and including) Alice
and Charlie, it suffices to show that there are no correlations within the
measurement announcements associated with these three separate groups. We show
this absence of correlations only for the left set, since the argument applies
analogously to the other two sets.

Consider the stabilizer of the network state after all $CZ$ operations have
been performed in Step 2a of Protocol 2.1. It is generated by the following
collection of operators:

$\displaystyle\sigma_{x}^{\tau_{1}}\sigma_{z}^{\omega_{2}},$ (27)
$\displaystyle\sigma_{z}^{\tau_{1}}\sigma_{x}^{\omega_{2}}\sigma_{z}^{\tau_{2}},$
$\displaystyle\\{\sigma_{z}^{\tau_{i}}\sigma_{z}^{\omega_{i+1}}\\}_{i=2}^{a-2},$
$\displaystyle\\{\sigma_{z}^{\omega_{i}}\sigma_{x}^{\tau_{i}}\sigma_{x}^{\omega_{i+1}}\sigma_{z}^{\tau_{i+1}}\\}_{i=2}^{a-2},$
$\displaystyle\sigma_{z}^{\omega_{a-1}}\sigma_{x}^{\tau_{a-1}}\sigma_{x}^{\omega_{a}},$
$\displaystyle\sigma_{z}^{\tau_{a-1}}\sigma_{z}^{\omega_{a}}.$

The measurement operator of all measurement outcomes together depends on
$\beta_{1}$ as

$M=\begin{cases}\sigma_{x}^{\tau_{1}}\sigma_{y}^{\omega_{2}}\sigma_{x}^{\tau_{2}}\sigma_{x}^{\omega_{3}}\sigma_{x}^{\tau_{3}}\sigma_{y}^{\omega_{4}}\sigma_{x}^{\tau_{4}}\sigma_{x}^{\omega_{5}}\sigma_{x}^{\tau_{5}}\sigma_{y}^{\omega_{6}}\dots\sigma_{x}^{\tau_{a-1}},&(\beta_{1}=0)\\\
\sigma_{y}^{\tau_{1}}\sigma_{x}^{\omega_{2}}\sigma_{x}^{\tau_{2}}\sigma_{y}^{\omega_{3}}\sigma_{x}^{\tau_{3}}\sigma_{x}^{\omega_{4}}\sigma_{x}^{\tau_{4}}\sigma_{y}^{\omega_{5}}\sigma_{x}^{\tau_{5}}\sigma_{x}^{\omega_{6}}\dots\sigma_{x}^{\tau_{a-1}},&(\beta_{1}=1)\end{cases}$
(28)

where all ($\sigma_{x}$-)observables acting on $\\{\tau_{i}\\}_{i=2}^{a-1}$
are associated with the measurements of Protocol 2.1 (i.e. the outcomes
$\\{o_{i}\\}$) and all others are associated with Protocol 2.2 (i.e. the
outcomes $\\{m_{i}\\}$).

It is now our goal to show that all these measurement outcomes are uniformly
random, and that there are no correlations between the measurement outcomes
associated with any subset $S\subset Q$, where
$Q=\\{\tau_{1},\omega_{2},\tau_{2},\dots,\omega_{a-1},\tau_{a-1}\\}$ is the
set of qubits measured throughout both Protocol 2.1 and Protocol 2.2. Any such
$S$ has an associated observable

$M_{S}=\bigotimes_{i\in S}\sigma_{b(i)}^{i},$ (29)

where $b(i)\in\\{x,y\\}$ indicates the type of support on qubit $i$ as shown
in Eq. (28). If $M_{S}$ does not commute with at least one generator of the
stabiliser (i.e. any operator from Eq. (27)), by Gottesman-Knill simulation,
the measurement outcome for $M_{S}$ is uniformly random $0$ or $1$. If this
holds for any $S$, there cannot be any correlations between any of the
measurement outcomes. The uniform randomness of the individual measurement
outcomes follows readily for the case when $S$ contains only a single qubit.
We now show that any $M_{S}$ indeed always anti-commutes with at least a
single generator.

Suppose that $M_{S}$ does commute with all generators but is non-trivial. If
it has (non-trivial) support on $\tau_{a-1}$, this is necessarily with
$\sigma_{x}$. It will then not commute with
$\sigma_{z}^{\tau_{a-1}}\sigma_{z}^{\omega_{a}}$ (the last generator of Eq.
(27)) and hence cannot have support on $\tau_{a-1}$. Then, if $M_{S}$ has
(non-trivial) support on $\omega_{a-1}$, with either a $\sigma_{x}$ or
$\sigma_{y}$, it will not commute with the generator
$\sigma_{z}^{\omega_{a-1}}\sigma_{x}^{\tau_{a-1}}\sigma_{x}^{\omega_{a}}$ \-
thus it cannot have support on $\omega_{a-1}$ either.

We can inductively go through the rest of the qubits in $Q$ in reversed order,
i.e. from right to left through the observable from Eq. (28). For
$j\in\\{a-2,a-3,\dots,3,2\\}$:

  * Suppose $M_{S}$ has non-trivial support on $\tau_{j}$, it is of type $\sigma_{x}$. Since $M_{S}$ has by construction no support on any qubit to the right of $\tau_{j}$, it does not commute with the generator $\sigma_{z}^{\tau_{j}}\sigma_{z}^{\omega_{j+1}}$ \- hence $M_{S}$ cannot have support on $\tau_{j}$.

  * Suppose $M_{S}$ has non-trivial support on $\omega_{j}$, either of type $\sigma_{x}$ or $\sigma_{y}$. Since $M_{S}$ has by construction no support on any qubit to the right of $\omega_{j}$, it does not commute with the generator $\sigma_{z}^{\omega_{j}}\sigma_{x}^{\tau_{j}}\sigma_{x}^{\omega_{j+1}}\sigma_{z}^{\tau_{j+1}}$ – hence $M_{S}$ cannot have support on $\omega_{j}$.

Finally, $M_{S}$ cannot have support on $\tau_{1}$ either, as it would not
commute with the generator
$\sigma_{z}^{\tau_{1}}\sigma_{x}^{\omega_{2}}\sigma_{z}^{\tau_{2}}$. We
conclude that there is no $M_{S}$ with non-trivial support on at least a
single qubit that does not anti-commute with at least one generator.

From this, we can conclude that there are no correlations possible between any
set of measurement outcomes from $\\{o_{i}\\}$ and $\\{m_{i}\\}$, and that
they are thus uniformly random and uncorrelated. Moreover, it stays uniformly
random under any noise that does not add a bias in the used measurement bases
(i.e. $\sigma_{x}$ and $\sigma_{y}$).

## References

  * [1] Gláucia Murta, Federico Grasselli, Hermann Kampermann, and Dagmar Bruß.  Quantum conference key agreement: A review.  Advanced Quantum Technologies, 3:2000025, 2020.
  * [2] Stefano Pirandola, Ulrik L Andersen, Leonardo Banchi, Mario Berta, Darius Bunandar, Roger Colbeck, Dirk Englund, Tobias Gehring, Cosmo Lupo, Carlo Ottaviani, Jason L Pereira, Mohsen Razavi, J Shamsul Shaari, Marco Tomamichel, Vladyslav C Usenko, Giuseppe Vallone, Paolo Villoresi, and Petros Wallden.  Advances in quantum cryptography.  Advances in Optics and Photonics, 12:1012–1236.
  * [3] Antonio Acín, Immanuel Bloch, Harry Buhrman, Tommaso Calarco, Christopher Eichler, Jens Eisert, Daniel Esteve, Nicolas Gisin, Steffen J. Glaser, Fedor Jelezko, Stefan Kuhr, Maciej Lewenstein, Max F. Riedel, Piet O. Schmidt, Rob Thew, Andreas Wallraff, Ian Walmsley, and Frank K. Wilhelm.  The European quantum technologies roadmap.  New Journal of Physics, 20:080201, 2018.
  * [4] Sumeet Khatri and Mark M. Wilde.  Principles of quantum communication theory: A modern approach.  2011\.  arXiv:2011.04672.
  * [5] Daniel M. Greenberger, Michael A. Horne, and Anton Zeilinger.  Bell’s theorem, Quantum Theory, and Conceptions of the Universe.  Kluwer Dordrecht, 1989.
  * [6] Michael Epping, Hermann Kampermann, Chiara Macchiavello, and Dagmar Bruß.  Multi-partite entanglement can speed up quantum key distribution in networks.  New Journal of Physics, 19(9):093012, 2017.
  * [7] Federico Grasselli, Hermann Kampermann, and Dagmar Bruß.  Finite-key effects in multipartite quantum key distribution protocols.  New Journal of Physics, 20(11):113014, 2018.
  * [8] Federico Grasselli, Hermann Kampermann, and Dagmar Bruß.  Conference key agreement with single-photon interference.  New Journal of Physics, 21:123002, 2019.
  * [9] Zixin Huang, Siddarth Koduru Joshi, Djeylan Aktas, Cosmo Lupo, Armanda O. Quintavalle, Natarajan Venkatachalam, Sören Wengerowsky, Martin Lončarić, Sebastian Philipp Neumann, Bo Liu, et al.  Experimental implementation of secure anonymous protocols on an eight-user quantum key distribution network.  npj Quantum Information, 8:1–7, 2022.
  * [10] Yu-Guang Yang, Xiao-Xiao Liu, Shang Gao, Yi-Hua Zhou, Wei-Min Shi, Jian Li, and Dan Li.  Towards practical anonymous quantum communication: A measurement-device-independent approach.  Physical Review A, 104:052415, 2021.
  * [11] Anupama Unnikrishnan, Ian J. MacFarlane, Richard Yi, Eleni Diamanti, Damian Markham, and Iordanis Kerenidis.  Anonymity for practical quantum networks.  Physical Review Letters, 122(24):240501, 2019.
  * [12] Frederik Hahn, Jarn de Jong, and Anna Pappa.  Anonymous quantum conference key agreement.  PRX Quantum, 1:020325, 2020.
  * [13] Federico Grasselli, Gláucia Murta, Jarn de Jong, Frederik Hahn, Dagmar Bruß, Hermann Kampermann, and Anna Pappa.  Robust anonymous conference key agreement enhanced by multipartite entanglement.  arXiv preprint arXiv:2111.05363, 2021.
  * [14] Christopher Thalacker, Frederik Hahn, Jarn de Jong, Anna Pappa, and Stefanie Barz.  Anonymous and secret communication in quantum networks.  New Journal of Physics, 23(8):083026, 2021.
  * [15] Hans J. Briegel and Robert Raussendorf.  Persistent entanglement in arrays of interacting particles.  Physical Review Letters, 86:910, 2001.
  * [16] Robert Raussendorf and Hans J. Briegel.  A one-way quantum computer.  Physical Review Letters, 86:5188, 2001.
  * [17] Marc Hein, Jens Eisert, and Hans J. Briegel.  Multi-particle entanglement in graph states.  Physical Review A, 69:062311, 2004.
  * [18] Matthias Christandl and Stephanie Wehner.  Quantum anonymous transmissions.  In International conference on the theory and application of cryptology and information security, pages 217–235. Springer, 2005.
  * [19] Nathan Walk and Jens Eisert.  Sharing classical secrets with continuous-variable entanglement: Composable security and network coding advantage.  PRX Quantum, 2:040339, 2021.
  * [20] Damian Markham and Barry C. Sanders.  Graph states for quantum secret sharing.  Physical Review A, 78:042309, 2008.
  * [21] Massimiliano Proietti, Joseph Ho, Federico Grasselli, Peter Barrow, Mehul Malik, and Alessandro Fedrizzi.  Experimental quantum conference key agreement.  arXiv:2002.01491, 2020.
  * [22] Clément Meignant, Damian Markham, and Frédéric Grosshans.  Distributing graph states over arbitrary quantum networks.  Physical Review A, 100:052333, 2019.
  * [23] Frederik Hahn, Anna Pappa, and Jens Eisert.  Quantum network routing and local complementation.  npj Quantum Information, 5(1):1–7, 2019.
  * [24] Marco Tomamichel, Charles C. Wen Lim, Nicolas Gisin, and Renato Renner.  Tight finite-key analysis for quantum cryptography.  Nature Communications, 3:634, 2012.
  * [25] Christopher Portmann and Renato Renner.  Security in quantum cryptography.  arXiv preprint arXiv:2102.00021, 2021.
  * [26] Marco Tomamichel, Christian Schaffner, Adam Smith, and Renato Renner.  Leftover hashing against quantum side information.  IEEE Transactions on Information Theory, 57(8):5524–5535, 2011\.