Abstract
Building a quantum secure internet is one of the most important challenges in the field of quantum technologies [1,2]. It would ensure worldwide information-theoretically secure communication. The idea of quantum repeaters [3–5] gives hope that this dream will come true. However, the level of quantum security proposed originally in a seminal article by Bennett and Brassard [6] seems to be insufficient due to the fact that on the way between an honest manufacturer and an honest user, an active hacker can change with the inner workings of a quantum device, making it totally insecure [7]. Indeed, the hardware Trojan-horse attacks on random number generators are known [8], and the active hacking on quantum devices became a standard testing approach since the seminal attack by Makarov [9]. The idea of device-independent (DI) security overcomes this obstacle [7,10] (see also [11] and references therein). Although difficult to be done in practice, it has been demonstrated quite recently in several recent experiments [12–14]. In parallel, the study of the limitations of this approach in terms of upper bounds on the distillable key has been put forward [15–18]. However, these approaches focus on pointto-point quantum device-independent secure communication. In this paper we introduce the upper bounds on the performance of the device-independent conference key agreement (DI-CKA) [19,20]. The task of the conference agreement is to distribute to N > 2 honest parties the same secure key for one-time-pad encryption. A protocol achieving this task in a device-independent manner has been shown in Ref. [20]. We set an upper bound on the performance of such protocols in a network setting. We focus on physical behaviors with N users (for arbitrary N > 2), where each user is both the sender and receiver of the behavior treated as a black box. This situation is a special case of a network describable with a multiplex quantum channel where inputs and outputs are classical with quantum phenomena going inside the physical behavior [21]. All N trusted parties have the role of both the sender to and receiver from the channel and their goal is to obtain a secret key in a device-independent way against a quantum adversary. Aiming at upper bounds on the device-independent key, we narrow the consideration to the independent and identically distributed case. In this scenario, the honest parties share n identical devices. All the N parties set (classical) inputs x = (x1,..., xN ) to each of the n shared devices P(a|x) and receive (classical) outputs a = (a1,..., aN ) from each of them. We restrict our consideration to quantum devices. Such devices are realized by certain measurements M ≡ ⊗N i=1Mxi ai on quantum states ρA1,...,AN ≡ ρN(A). We define these devices (ρN(A),M) = Tr[ρN(A) ⊗N i=1 Mxi ai ]. In this work we provide upper bounds on the deviceindependent conference key distillation rates for arbitrary multipartite states. As the first main result, we introduce a multipartite generalization of the cc-squashed entanglement provided in Ref. [22] and developed in Ref. [18]. With a little abuse of notation with respect to that used in Refs. [16,18], for the sake of the reader, we will omit the fact that the measure is multipartite as well as reduce the abbreviation cc in its name and here call it just reduced c-squashed entanglement,
