On distilling secure key from reducible private states and (non)existence of entangled key-undistillable states

Hereunder, we study the class of irreducible private states that are private states from which all the secret content is accessible via measuring their key part. We provide the first protocol which distills key not only from the key part, but also from the shield if only the state is reducible. We prove also a tighter upper bound on the performance of that protocol, given in terms of regularized relative entropy of entanglement instead of relative entropy of entanglement previously known. This implies in particular that the irreducible private states are all strictly irreducible if and only if the entangled but key-undistillable states (‘entangled key-undistilable states’) exist. In turn, all the irreducible private states of the dimension 4 ⨂ 4 are strictly irreducible, that is, after an attack on the key part they become separable. Provided the bound key states exist, we consider different subclasses of the irreducible private states and their properties. Finally we provide a lower bound on the trace norm distance between key-undistillable states and private states, in sufficiently high dimensions.

Obtaining the classical secret key for data encryption via quantum states is one of the main contributions of quantum information theory towards security in the era of information [1].This goal has been achieved using the celebrated maximally entangled state [2][3][4].However, the quantum states which have a property that after the measurement one can get at least m bits of a secret secure key (against quantum eavesdropper) form a much broader class of states called private states [5].The maximally entangled state is an example of a private state.In general, a private state has two subsystems: the key part (AB) and the shield (A B ). From the key part one can obtain the secure key via von Neumann measurements on its local subsystems, while the shield is protecting the key part from the Eavesdropper who holds the purifying system of the total state.More precisely, any private state with at least m bits of key has the form where σ A B ≡ σ is an arbitrary state on A B and U i are unitary transformations.
Private states have been used to formalize quantitative relation between secrecy and entanglement.Namely, it has been shown that the classical secure key, is in, fact an entanglement measure denoted as K D [5,6].This led to upper bounds on the secure content of quantum states via relative entropy of entanglement [5][6][7] and squashed entanglement [8][9][10][11] and further generalizations for quantum channels via squashed entanglement of a quantum channel [12,13] and relative entropy of entanglement extended to quantum channel [14] (see also [15][16][17][18] in this context).Recently, there has been shown a related impossibility result that one cannot achieve nonnegligible amount of key [19] in the framework of quantum repeaters [20] using some certain approximate private states (a problem of quantum key-repeaters).
In general the importance of the class of private states follows from the fact that any quantum key distribution protocol (including the so-called quantum device independent ones [21,22]) is equivalent to a protocol whose output is a private state.Hence, in a coherent view on quantum mechanics, the output of any quantum key distribution protocol P has form of the state (close to) the one given in equation (1).Having γ ABA B as the output of P. The part AB, measured in computational basis, yields outcomes which are directly used for one-time-pad encryption.
By definition a private state has then directly accessible key in the key part while the shield system A B has been considered as a passive resource merely assuring security of the key part.Intuitively, however one might consider distillation of key from also from the shield system.The caveat though is that the latter distillation should not leak information about the key resting in the key part.The private states which have the property, that their whole secure content is accessible via measuring their key part in computational basis, i.e. for which K D (γ d k ) = log d k , where d k is the local dimension of A and B, are called irreducible.All other private states are called reducible.
The aim of this manuscript is then twofold: first, to characterize irreducible private states, and study their properties, the second, more importantly, to provide the protocol which distills key from not irreducible (i.e.reducible) private states at higher rate than the trivial one, equal to log d k .We then naturally encounter a hard problem of whether there exist entangled, but keyundistillable states, which appears to be tightly connected to the problem of characterization of irreducible private states.We therefore also study properties of the set of key-undistillable states.
Before stating the main result, we first describe an intuition, which motivates our approach.Let us suppose, that the state γ ⊗n ABA B has been attacked by a hacker Eve i.e. measured on AB part, and Eve has copied the outcomes.The leftover state is γ⊗n ABA B = ( i |ii ii| ⊗ U i σU † i ) ⊗n .Intuitively, if γ ABA B is irreducible, Eve has learned the whole key, as it was located in its key part.This implies, that the total state γ⊗n ABA B should not have distillable key.Now, having access to the "flags" |ii ii| AB Alice and Bob can sort the states σ i := U i σU † i on systems A B and get, by the typicality argument ≈ n d copies of state σ ≡ σ 0 ⊗ • • • ⊗ σ d−1 .Hence the state σ must be also key-undistillable, as obtained by local operations from the key-undistillable γABA B .We therefore arrive at the intuition that the following statement about irreducible private states is true: Negating the RHS of the above we obtain: Now, as the main result, we prove a much stronger, quantitative version of the above implication.Namely that for any private state γ ABA B , in particular a reducible one, there is: We prove this lower bound by providing explicitly a protocol achieving the rate of RHS of equation (4).
We then ask if the proposed protocol has an optimal rate.We prove a new upper bound on it of the form: where E ∞ r is the regularized relative entropy of entanglement (the previous upper bound [7,23] was in terms of i E ∞ r (σ i ) which is sometimes strictly larger than RHS).We observe however, that this bound may not be tight even for irreducible private states.This is because there may exist entangled key undistillable states.Indeed, since E ∞ r (ρ) > 0 iff ρ is entangled i.e. this measure is faithful, the RHS can differ from LHS in that case by arbitrary amount.
The problem of whether entangled key undistillable states exist appears to be non-trivial.We do not judge if the answer is "yes", such states exist or rather "no", they do not.In what follows, much in the spirit of the community of computer science approaching the P = N P problem, we check what are the possible consequences of the two answers.Namely, if the answer is "no" there are no entangled key undistillable states, then via equation (4) we have fully characterized the set of irreducible private states, and the bound (5) is tight.If however it is not the case, plenty of questions are ready to be asked.
We study consequences of the mentioned alternative from the perspective of the upper-bounds on distillable key of a private state in terms of measures of entanglement.If the world is such that entangled keyundistillable states do not exist, then as we noted, the only irreducible private states are strictly irreducible, which in fact satisfy K D (γ) = E r (γ), see Figure 1, where E r is the relative entropy of entanglement [24].If however, the world is reach enough, so that such states exist, there must exists a private state which is not strictly irreducible, that is outside of the set of states satisfying Apart from studying consequences of (non)existence of entangled key undistillable states, we study the properties of the set of key-undistillable states Z in general.It is known, that this set contains all separable i.e. disentangled states, as they can be made from product states (clearly having K D = 0) by public discussion [25].Separable states are far from the private states in the norm distance; for any private state, with the dimension of the shield part d s , it holds that [7,23]: where by SEP (d k ,ds) we denote the set of separable states in the cut AA : BB , and for any X ∈ M(d, C) by ||X|| 1 ≡ Tr √ XX † we define its trace norm.What we are further able to show, is an analogous statement for states from Z: It is much weaker than that from equation ( 6), but we pay a price for generality: we do not know the structure of all key undistillable states, and in derivation we can use only the fact that σ is key-undistillable.Let us note here, that the class of irreducible private states has not been characterized so far, except of its one subclass called in [26] as strictly irreducible states.Strictly irreducible states [27] are the private states satisfying that diagonal blocks of the matrix of a private states, σ i ≡ U i σU † i in Eq. (1) are separable for all i ∈ {0, . . ., d − 1}.These states appeared recently in the problem of quantum key-repeaters.We therefore discuss also possible further applications of our main result in this context.Namely M. Christandl and R. Ferrara have shown in [26] that strictly irreducible private states have the amount of one-way key-repeaters rate bounded On panel b) we present the situation when entangled key-undistillable states do not exist.This assumption implies that the set of strictly irreducible private states equals to the set of irreducible private states and as a consequence we have their full characterization in this manuscript.
from above by one-way distillable entanglement of γ ⊗ γ.It would be interesting to extend this result to all irreducible private states, and present the answer in terms of the amount of key achieved via key-repeaters (keyrepeater rate) and distillable entanglement of γ ⊗γ.Such result would answer the question of the role of private states in key-repeaters.The first important step in this direction, that we have done is proving that all key undistillable states are bounded away in trace norm from any private state, since the distance between separable and private states is crucial to the findings of [26].This problem seems to be hard, as there is no evidence that there even exist states with zero distillable key.
The paper is organized as follows.Section I provides definitions that are further used on.Section II contains the main result, which is a tighter lower bound on distillable key of private states.We present there a protocol of key distillation which uses both the key part and the shield of a private state.We also give an upper bound on its rate.Section III is devoted to some properties of the set of irreducible private states, including its partial characterization.In Section IV we provide a lower bound on distance of key-undistillable states from private states via the necessary condition of key-undistillability as well as show its applications to single copy quantum key repeaters.In Section V we study approximate irreducible states in the light of considerations of Section III.The last section is devoted to the discussion of the above results.

I. PRIVATE STATES AND IRREDUCIBLE PRIVATE STATES
In this section we introduce rigorous definitions of private states as well as irreducible and strictly irreducible private states which are crucial in further parts of this manuscript.One example of a private state is a basic private state ρ ABA B , acting on a Hilbert space where P + AB is a maximally entangled state between on where the state σ A B is an arbitrary state of subsystem A B , U i s are arbitrary unitary transformations and j=0 are local bases on A and B respectively, is called the private state or pdit.In the case of d = 2, the state in ( 9) is called -pbit.Further in the text we will use interchangeably the notation of the private state, i.e. γ d , γ ABA B or simply γ, and sometimes we will drop lower indices when there is no danger of confusion.
In what follows we will set {|e i ⊗ |f j } basis to be computational for simplicity, while all the facts hold for a general case of arbitrary product basis of a pdit.The part AB of a pdit is called the key part, while the subsystem A B its shield.For any pdit which is secure in the standard basis by σ i for i = 0, . . ., d − 1 we denote states which appear on the shield of the pdit, after obtaining an outcome |ii AB in the measurement performed in the standard basis on its key part.We call the states σ i the conditional states.
We now come to the central definition to all our further considerations: One of the most natural example of strictly irreducible private state is when we chose in the above definition σ = 1, where 1 is an identity operator on the shield part of γ.Next, a less trivial example of state within the set SIR is the "flower state" γ f lower [23], which was shown [28] to lock entanglement cost.We have that γ where σ = 1

II. THE MAIN RESULT: PROTOCOL OF DISTILLING KEY FROM PRIVATE STATES
Here, we will present the protocol which enables the characterization of irreducible private states.As announced, it can distill the key not only from the key part but also from the shield of a private state in the case where σ 0 ⊗ • • • ⊗ σ d−1 is key distillable.We first show its rate, which is the main result of this section and the core of our further reasoning in this manuscript.Here we state the result for bipartite private states, however analogues result holds as well for the case of multipartite private states [6], as we show in Appendix F.
The distillable key can be lower bounded as follows: Theorem 1.For a private state γ d , there is We achieve the above result via the following protocol defined by parameters m and k.The input to the protocol P (m, k) is γ ⊗(m×k) .This protocol depends on a threshold δ(m) which approaches 0 with increasing m.We fix the value of this threshold later, when study the rate of this protocol.
5. If necessary Alice and Bob trace out some of the states σ 0 , . . ., σ d leaving only 6.As a subprotocol, Alice and Bob perform on systems A B any optimal key distillation protocol of the state σ, acting on σ ⊗tmin(m) , with output close in the trace norm to the state γ A B A B .The state on systems AB from the item 3 and state on systems A B A B form one of the k input states for the final step 7 of the protocol.
7. On k output states of the k repetitions of items 2-6 (or items 2 − 3 if unsuccessful in item 3 respectively) Alice and Bob perform the Devetak-Winter protocol [29].
Sketch of the proof.The detailed proof of Theorem 1 is given in Appendix B.We also refer reader to Figure 2 on which we present the performance of our protocol for the finite and fixed number of input states.We provide here briefly the idea.First let us note, that if the state is key-undistillable, then there is obvious protocol of distilling log d of key from γ d : just via measuring its key part.Hence, in case K D ( σ) = 0, our bound is trivially satisfied.Thus, in what follows we will assume that K D ( σ) > 0. It is intuitive that given the key from key part has been used, there are remaining states on the shield part.The major obstacle is that these two parts are correlated.We overcome this problem in steps 2 − 4.
In the first step (item 2) the parties get to know the value of the key on key part.The next step (item 3) shows that our protocol is of the kind "all versus noting": if the key has atypical value (having too small number of some of the symbols 0, . . ., d − 1), the parties trace out the whole state, create the error flags and proceed with step 2 for the next of k blocks.This however occurs extremely rarely due to concentration property of independent, identically distributed random variables.Hence with probability almost one, the key value is typical, and Alice and Bob proceed with the main step of the protocol (item 4).
In the fourth step they decouple the key part and the shield by sorting conditional states on the shield part: all states labelled with 0 together, up to d − 1.The only correlations which survive between the system AB and A B are due to the type that is how many symbols 0's, 1's up to d − 1's are in the value of the key on system AB.
The next step (item 5) is provided for technical reasons, as it allows for easy calculation of the rate of the protocol.In the pre-last step Alice and Bob perform a key distillation protocol on t min (m) copies of the state which, by definition, ends up with a state close to some private state γ A B A B .The state on ABA B A B has now the perfect key on A B and the partially secure key on AB about which Eve knows the type that is a number of symbols in the string of the value of this key.Fortunately, this knowledge has very low entropy, sub-linear in m, and will not affect the total rate of the protocol.
After repeating steps 2 − 6 k times (or items 2 − 3 if unsuccessful in item 3 respectively), in the last step Alice and Bob perform the Devetak-Winter protocol on the subsystems AA BB of k such obtained states [29].It then remains to check that the rate of the Devetak-Winter protocol reads in this case approximately r(m, k The first term corresponds to m log d bits of initial ideal key on AB however it is lowered by the second term (m + d − 1) h( m m+d−1 ).The latter corresponds to Eve's knowledge of the type.Indeed, there are no more than of different types of strings of length m of symbols from d-ary alphabet [30].The third term t min (m)K D ( σ) is the rate of the protocol of key distillation from t min (m) copies of state σ.Hence, choosing properly value of δ(m) approaching 0 with m going to infinity (see Appendix B), we obtain that the rate of our protocol which is From theorem 1 we have immediate important corollary which is in fact a necessary condition for irreducibility: Corollary 1.For any irreducible private state γ of the FIG.2: On this figure we present performance of the protocol from Theorem 1 for n = 5 copies of the private pbit γ.Single private state γ is represented as a collection of four dots.By smaller green dots we denote qubits forming the key part of pbit and by larger yellow its respective shield part.At the beginning Alice and Bob measure their subsystems of the key part A and B in the secure basis of γ obtaining respective bit strings 00, 11, 00, 11, 00.Assuming that parties can proceed (3rd point from Theorem 1 is not fulfilled.),they perform control sorting depending on the value of the key by permuting states on the parts A B obtaining σ0 ⊗ σ0 ⊗ σ0 ⊗ σ1 ⊗ σ1, and eventually tracing out some of their subsystems.Having that, parties perform on systems A B any optimal key distillation protocol.Finally, after k repetitions of items 2-6 from the protocol, Alice and Bob perform the Devetak-Winter protocol on systems AA BB obtaining 1 + 1 2 KD(σ0 ⊗ σ1) of key. form there is In particular we have where σ i = U i σU † i .We note here that our protocol needs for a pdit γ d by definition a huge number of its copies: ks for some parameter s, s and k increasing asymptotically.It is really huge, in comparison with the fact that one can get log d of key from a single copy of γ d by measuring its key part.However, it shows what can be done in general, asymptotically, which allows to study the distillable key of reducible private states: so that it works, this number is larger than d 3/2 log d .
It is tempting to ask if the protocol that we proposed is optimal.In what follows we will improve the bounds on relative entropy of entanglement for private states which will show to what extend performance of our protocol is not tight.So far the following bound was known [7,23]: In the next theorem we present a bit tighter bound.The fact that it is tighter comes from the subadditivity of E r .
The proof of it is directly inspired by the protocol from the above section.

III. PROPERTIES OF THE SET OF IRREDUCIBLE PRIVATE STATES
Recall that by IR d,d we denote the set of irreducible private states with the dimension of key d ⊗ d and that of shield d ⊗ d .Not to overload notation, we will omit the dimensions writing IR if some fact holds for any fixed dimensions or the dimensions are known from the context.It is natural to imagine that the key obtained from two different states from IR is no greater than the sum of the keys from each of them.In what follows we will prove this for certain subsets of IR.
We are now going to show an important example where the above observation applies, firstly by formulating the following: Observation 1.The following sets are closed under the tensor product.
where E r is the relative entropy of entanglement, K D is the distillable key, and I sq is the squashed entanglement measure.
Because the tensor product of two private states is again a private state (up to a local unitary transformation [26]), by the above observation as an immediate consequence we have that R ir , R ir,∞ , and I ir which are intersections of the set of irreducibly private states IR with respective sets from Observation 1, are closed under the tensor product.
Moreover, the above sets are obviously non-empty, and have a non-empty intersections.Indeed, let us fix dimensions and consider: for any dimension d , where , that is a maximally entangled state and σ d is an arbitrary d 2dimensional separable state.In other words, all three sets have in their mutual intersection the set of basic private state with a separable shield.
Let us note here, that there is R ir (2, d ) = I ir (2, d ) for any dimension d .This is because the class of states "flower state" γ f which are pbits with 2 [31].

A. Irreducible private states vs existence of bound key states
We say that a quantum state ρ has the bound distillable key if K D (ρ) = 0 and ρ is entangled.It is a widely open problem if such states exist.If so, entanglement and secrecy would be different resources.We are far from solving it; we rather connect this with the problem of studying the irreducible private states.One might think, that existence of bound-key states implies that some irreducible private states are beyond the set R trivially (see Observation 1).Indeed, if bound key state exists, say ρ bk , then a basic pdit |ψ + ψ + | ⊗ ρ bk is example of such a state.There are however two issues: firstly it is not clear what is the lower bound on E r in this case, as this measure is subadditive.Secondly, and more importantly, it is not clear that K D of this state equals log d.This is because, in principle, the singlet state could act as a catalyst unblocking the key of ρ bk (key is by definition superadditive).Therefore it is not immediate to construct an irreducible private state outside of the set R which is irreducible, basing solely on the fact that there exists some bound key state, and even not easy to show that it exists.In what follows, however, we show that such a state must exists in that case.More precisely, if there are no bound key states, we have the full characterization of the set IR: Clearly, we have R ir ⊆ IR.We consider now the condition under which the converse inclusion holds.Proposition 1.The set R ir does not equal set of irreducibly private states if and only if there exists a state with the bound key.The same holds for the set R ir,∞ in place of R ir .
We have then immediate corollary characterizing the set of irreducible private states of arbitrary dimension of the key part d and qubit dimension d = 2 of the shield.Additionally, in the particular case of qubit key part, d = 2 we are able to calculate log-negativity of these states.
Corollary 2. The set of irreducible private bits IR d,2 consists of the strictly irreducible pdits, that is those states i for which there is: where Γ denotes the partial transposition and E N is the log-negativity entanglement measure.
The above corollary in particular holds for the strictly irreducible pbits, considered in [26].We note that the form of the matrix in (2) implies that all diagonal blocks of the matrix of a private bit from IR 2,2 are separable.
Remark 1.If Proposition 1 was true for some entanglement measure M and then was a state γ ∈ R M \R ir then it would imply existence of bound key state.Although we know that I ir = R ir , in the case of I sq the analogue of Proposition 1 is not true in general as the analogue of the bound (C2) does not hold e.g. for the mentioned flower state γ f .
To ensure that the state σ from ( 23) is separable after the action of an arbitrary unitary operations {U 0 , U 1 , . . ., U d−1 } is enough to take σ from the set of the absolutely separable states ASEP [32,33].Such an idea of the construction was proposed in [27], but without an explicit presentation of allowed classes of states.Here we construct an explicit class of above mentioned states in qubit-qubit case and we show by counterexample, which is different that previously known "flower state" γ f lower [23,28], that such class does not saturate all possible choices.
The problem of the absolute separability or the separability from the spectrum [34][35][36][37] asks for a characterization of the states ρ ∈ C d ⊗ C d , such that U ρU † is separable for all unitary matrices U .We know that such full characterization was done for the qubit-qubit [36] case and then it was generalized for the qubit-qudit case [37].Here, as we mentioned, we restrict ourselves to the case of the two qubits by recalling the following theorem from [36]: . ., 4} be a set of eigenvalues of ρ in a non-increasing order, then the state is absolutely separable if and only if its eigenvalues satisfy We see that thanks to (3) by putting states σ from (2) satisfying (24) we always get an irreducible pbit.Private pbits obtained by twisting of absolutely separable state together with a singlet form the set T AS, see Figure 3.Of course we can find a state ω / ∈ ASEP and non-local twisting operations for which conditions in (23) are fulfilled.We illustrate this by the following example: which is not absolutely separable, since the condition (24) does not hold.This means that there exists a unitary transformation U for which U ωU † is entangled, so ω Γ = U ρU † Γ 0, where Γ denotes the operation of the partial transposition with respect to one of the subsystems [38,39].On the other hand, there exist non-local unitary operations V , such that condition ω Γ = V ωV † Γ ≥ 0 holds -this means that the state V ωV † is separable.Here we provide the family of such operations where c = cos(θ) and s = sin(θ) for θ ∈ [0, 2π].It is easy to see that ω Γ = V ωV † Γ ≥ 0, which means that V ωV † ∈ SEP.The unitary transformation V is indeed non-local, since after an action on the separable state we get V ωV † Γ 0. Private states γ(ω) constructed by the use of the state ω form equation (25) and twisting operations from (26) are outside of the set T AS (twisted absolutely separable states), but still within the set of strictly irreducible pbits SIR, see Figure 3.

IV. PROPERTIES OF THE KEY-UNDISTILLABLE STATES
In this section for the first time we investigate properties of the conditional states of the irreducible private states without presenting their explicit form.For the keyattacked state of an irreducible private state we are able to show even more, namely their key-undistillability.We then show a lower bound on the trace distance between the key-undistillable and private states.Observation 2. The key-attacked state γ of an irreducible private state γ is key-undistillable.The same holds for γ⊗n for n ≥ 2.
Having an operation of mapping a bipartite state on systems AB to a classical-classical-quantum (ccq) state on systems ABE from [27] (or see Section A 4 of Appendix A ) we are ready now for an attempt to consider a general question, interesting on its own: how far are the key-undistillable states from the private states?We base on the proof of a lower bound on distillable key given in [40] (see [27] for more elaborative explanation): Theorem 4. [27,40] For any bipartite state ρ AB there is: where ρ psq is the privacy squeezed state of the state ρ.
We will now generalize the above theorem to obtain the necessary condition of key-undistillability, which in fact can be viewed as non-one-way-key-distillability.In what follows by Z we will denote the set of key-undistillable states, where the dimension is assumed to be understood from the context.Theorem 5.For any key-undistillable state ρ ∈ Z, and for any local unitary transformations U 1 and U 2 which act on ρ so that

as well as any unitary transformation of the form
A B there is: where the ccq state is w.r.t. to the computational basis {|ij }.
The above theorem will allow us to prove a lower bound on distance between key-undistillable states and private states, improving the result of [27] where a dual fact is proved, namely that the states closer to private bits by δ < 0.001 are key distillable.Theorem 6.For any state which has K D (ρ) = 0, and any private state γ with the d ⊗ d dimensional key-part: with where η(x) = −x log x.
Having above theorem, let us mention an easy corollary.
Corollary 3.For any private state γ d , there is: The state Λ(ρ) and γ d in the above are assumed to be properly embedded so that their dimensions are compatible.
For such a choice of embedding as described in above proof any operation applied initially to states ρ d1 , γ d has to be extended by the identity operator 1 acting on additional subsystems.Further we always understand such extensions as a part of the shield in the case of private states.
With a bit of self criticism let us note that the bound in Theorem 6 is actually small, reaching asymptotically lim d→∞ z(d) = 1/6 = 0.1(6) as 1/ log d instead of 1/d, although perhaps our considerations can be improved by more careful approach.The bound however is non-trivial even for the smallest d = 2, with the value 0.041.It is worth to mention here that proof of theorem 6 can be recalculated also for embedded private state γ ≡ γ d ⊗ |0 0| ⊗2 d1 as it is described in the proof of corollary 3 and below it.Namely, the only thing we have to do is treat additional subsystems |0 0| ⊗2 d1 as a part of the shield.Then partial trace in expression D3 is well defined as well as untwisting operation U .
After completing this paper authors where pointed to paper [41], where estimation tighter than in (D2) is presented.Unfortunately, in the limit case both approaches lead to the same value of the lower bound.

V. APPROXIMATE IRREDUCIBLE PRIVATE STATES
We note that there is a natural way to define approximate irreducible private states as follows (compare with [26], where approximate strictly reducible private states were defined): A natural property that we would expect from the approximate irreducible private states is that they have the distillable key close to log d.We prove a weaker condition, namely only for states that approximate those irreducible private states which are from the set R ir,M with M being asymptotically continuous and bound on the distillable key.The bound then applies for E r , E ∞ r , I sq as they are all asymptotically continuous, and upper bound K D .To be precise, in what follows by asymptotic continuity of M we mean the fact that for any two states satisfying ||ρ − ρ || = ≤ 1 there is: where h is the binary Shannon entropy, and the constant in O(•) notation is independent of the dimension d.
Observation 3.For an -approximate irreducible private state ρ with ≤ 0.367879 there is: where η(x) = −x log x.If it also satisfies ||ρ − γ|| 1 ≤ such that γ ∈ R ir,M where M is asymptotically continuous and M ≥ K D , then there is: In particular it is true for M ∈ {E r , E ∞ r , I sq }.
Let us note here, that if we are not interested in optimal constants in the formulation of the asymptotic continuity, then the above observation can be stated in much compressed way.Namely that for ||ρ − γ d || ≤ ≤ 1  2 there is: if only γ d ∈ R ir,M with M ≥ K D and M asymptotic continuous.
Finally, it is interesting to note, that there are private states γ d , for which it is not known if they are -approximate irreducible private states, but they possess the major property of the latter, namely |K D (γ d ) − log d| ≤ .We leave as an open question if the states with that property are indeed the -irreducible private states, and invoke now the construction of a private state which has this property.To begin with, we consider a family of states on where with m ≥ 2. Now in the proof of Corollary 23 of [19] it is shown (together with construction), that there exists γ such that We will argue now that this γ is the O(exp(−m))almost irreducible private state.For the upper bound on K D (γ) we note that by Lemma 24 of [19] there is , where E f is the entanglement of formation measure.On the other hand the state is private, hence K D (γ) ≥ 1 by the definition.

VI. DISCUSSION
We have considered distillation of the key from private states with non-trivial shield part.We have provided the first protocol, which distills the key not only from the key part of the private state but also exploits its shield.The protocol is rather intuitive: in the first step we decouple the key part and the shield by "sorting" the states on the shield conditionally on the value of the key on key part.In the second one we distill the key from the states on shield, and to the total output state of the original key part and resulting the state we apply the Devetak-Winter protocol.It is plausible, that the protocol is optimal, however we have proven only a better bound on its rate which reads: It would be interesting to amen this question.We also leave the problem open whether our protocol has rate close to (12), when run on an approximate irreducible private state.At first it seems possible, as C DW is asymptotically continuous, yet our protocol uses as subprotocol an optimal one for distillation of state σ 0 ⊗ • • • ⊗ σ d−1 , which need not yield optimal value on a close by state to the latter.The presented protocol allowed us to characterize the irreducible private states -those for which distillable key equals a logarithm of the dimension of the key part.These states in matrix form have key-undistillable states on diagonal.Formally, for a private is irreducible if and only if with K D U i σU † i = 0, that is, its conditional states are key-undistillable.In turn the private states with 2 ⊗ 2 dimensional key part and shield are only strictly irreducible.To further characterize them, we observe, that the latter form strictly larger set than the set based on absolutely separable states as proposed in [27].
A major problem left over, which stays behind our considerations is whether there exist entangled keyundistillable states.We show, that if they do not exist, then the class of irreducible private states collapses to the class of strictly irreducible ones, having K D = E r .If not, then we may have other subsets, with K D = M where M is some entanglement measure which is an upper bound on K D , like E ∞ r and I sq .We show that these sets have useful property of being closed under tensor product.
Finally our result may lead to the generalization of one of the results of [26].It is shown there that the oneway key repeater rate of any strictly irreducible states γ (in two copies) R → D (γ ⊗ γ) is upper bounded by the one-way distillable entanglement E → D (γ ⊗ γ) (see definitions in Appendix A 3).The result of Ferrara and Christandl [26] in a part bases on the fact [7], that the distance between separable and private states approaches 1 exponentially fast in number of qubits that the states occupy.Since it works for separable states, only strictly irreducible private states were considered there [26] The above definition works for any input tripartite state ρ ABE .However, in the case where the total state is pure, we observe that the latter is determined by the state ρ AB = Tr E ρ ABE up to unitary transformations on Eve's side.Since from the very definition C D does not change under such transformations, the latter freedom is not an issue, so that we can say the state ρ AB completely determines the total state.Thus, we get definition of distillable classical secure key from bipartite state ρ AB Definition 11.For given bipartite state ρ AB the distillable classical secure key is given by where ψ ABE is the purification of ρ AB .

Definition of key one-way swapping rate and one-way distillable entanglement
In this section, for the sake of completeness, we recall the definition of the one-way key swapping rate introduced in [26] and one-way distillable entanglement used by us in discussion.
Definition 12.For all bipartite states ρ and ρ, we define the one-way key swapping rate achieved with one-way key swapping protocols as: where by γ n r , γ nr we denote the strictly irreducible private state with dimension of the key part n r and nr respectively, by γ nR the private state with dimension of the key part equal to nR .Moreover, by Λ C→A:B , Γ C→A and Γ C →B we denote one-way swapping protocols acting on respective subsystems.
Definition 13.For all bipartite states ρ we define one-way distillable entanglement where maps Λ A→B are restricted to one-way LOCC and Φ AB is maximally entangled state between A and B.
In the above expressions we use the notation ρ ≈ σ for ||ρ − σ|| 1 ≤ to compress the definitions.

Classical-classical-quantum states and privacy squeezing
Definition 14.For a bipartite state ρ ABA B its ccq state with respect to system AB and basis B = {|e i ⊗ |f j } is the state where , while |ψ ρ is a purification of the state ρ AB to system E.In case when the system A B is absent, we say that (ρ) ccq is a ccq state of ρ with respect to basis B.
Let us note here, that such defined ccq state is not unique, however any two ccq states of ρ can differ only by an isometry on system E, hence the secure content of them is the same, as such operation is at hand of Eve, and is reversible.In particular we may fix for the rest of our considerations that we use the standard purification: An important fact for what follows is that the twisting with control basis A B ) does not change the ccq state with respect to system AB and basis B of a given state ρ ABA B ( [7], see also Theorem 3.3 of [27]).Formally we have: We note now that the rate of the one-way Devetak-Winter protocol on some ccq state ρ which we invoke in Theorem 1 reads: where I(X : Y ) ρ is the (quantum) mutual information of a state of X, Y subsystem of the state ρ ccq .For the more formal definition of C DW (the classical distillable key) we refer to Section A 2 of this appendix.Finally, let us recall the notion of privacy squeezed state [7].It involves the operation of privacy squeezing.Privacy squeezing of ρ according to basis {|e i ⊗|f j } is composition of (i) operation of the form with certain special U (ei,fj ) defined by the state ρ and subsequently (ii) tracing out the subsystem A B .The result of this operation is called the privacy squeezed state of ρ.
Appendix B: Proofs from Section II First, we are going to prove here the main theorem of the manuscript, namely that we have a protocol that can distill key not only from the key part but also from the shield of a private state in case where Let us recall that it key rate is given the following theorem: Theorem 1.For a private state γ d , there is Recall that the input to the protocol , where γ is a private state with d ⊗ d dimensional key part.The private state γ d has also finite dimensional shield, which without loss of generality we may assume to be of dimension d ⊗ d .Parameters m and k will be chosen later.We first recall the protocol: 1.For each of k blocks of m states Alice and Bob repeat items 2-6 as follows: 2. Alice and Bob measure their subsystems of the key part A and B.
5. If necessary Alice and Bob trace out some of the states σ 0 , . . ., σ d leaving only 6.As a subprotocol, Alice and Bob perform on systems A B any optimal key distillation protocol of the state σ, acting on (σ , with output close in the trace norm to the state γ A B A B .The state on systems AB from the item 3 and state on systems A B A B form one of the k input states for the final step 7 of the protocol. 7. On k output states of the k repetitions of items 2-6 (or items 2 − 3 if unsuccessful in item 3 respectively) Alice and Bob perform the Devetak-Winter protocol [29].
As it was argued in the main text, in what follows, we can w.l.g.assume ) > 0, as otherwise the bound from theorem is trivially satisfied without need for the above protocol.
We will now examine how the output state of the protocol looks like.Let us fix some δ (m) > 0. As we already noticed, we start from a pbit γ ⊗m ABA B E .In what follows we will write |ψ instead of |ψ ψ| to simplify the notation.After projection on the key part and control-sorting of the key part and shield, the state is: Here |ψ 0 is purification of σ 0 = U 0 σ A B U † 0 , and similar for |ψ k for k ∈ {0, . . ., d−1}.The multi-index i = (i 1 , . . ., i m ), where i j ∈ {0, . . ., d − 1}, the set G is the set of types satisfying |t s − 1 d | ≤ δ(m) for all s ∈ {0, . . ., d − 1}, and the set of all strings i of the type t is denoted as Q t .To simply the notation, we will write Eq. (B2) as where p(t) = |Qt| d m and ρ t = i∈Qt 1 |Qt| |ii ii| AB .Moreover we have The state |e AA ⊗ |e BB ⊗ |e E is an error state produced when there are too little of σ 0 . . .σ d−1 .From properties of types, there is p B ≤ p(m) [30] with i.e. decays exponentially fast with m.Moreover the cardinality of the set T of all types reads the following value and a bound: where h is the Shannon binary entropy.
According to item 5 of the protocol Alice and Bob trace (if needed) some of states σ i , leaving For simplicity we will denote t min (m) as t(m).Without loss of generality we may assume that Eve knows the very type of string i of system AB which we denote as |t t| Ẽ .Indeed, she may actually conclude t from the kind and number of states traced out in item 5. Altogether the input state in item 6 of the protocol is of the form : where |ψ k ≡ |ψ k ψ k |.
On the system A B Alice and Bob have then A B subsystem of the state (|ψ m) .Now from the very definition of distillable key, for any good t (that is t ∈ G), from this they distill by some operation Λ t(m) a state Without loss of generality we may assume that it is accompanied by creation of state |e E .To analyse the key rate of the considered protocol it will be convenient to use the notion of classical distillable key [29] C D (for the definition, see Appendix).It is shown that if there exists protocol which distills from ρ a state close to private state by via LOCC operation, then there also exists a protocol with local operations and public communication, which works on purification of the input state ρ and distills state that is close to an ideal ccq state by 2 √ (see theorem 4.11 of [27]), with the same rate of key (K m) .Hence, there exists LOPC operation Λt(m) which distills state αA B E (d t(m) ) of the ccq form E , such that: where As we will see, to lower bound the key rate of the considered protocol, it is enough to analize the state which would be the output of Λt(m) : where |t t| is the state which describes Eve's knowledge about type t of her total state on E = E Ẽ.Our figure of merit will be state which is close by in the trace norm distance, and simpler to analyse.This is the above state with α ideal in place of α(d t(m) ): To see that the above state is close to ρ m observe that for all t, t ∈ G such that t = t there is We can also assume w.l.g. that symbol e of the error states |e AA ⊗ |e BB ⊗ |e E does not belong to the set Σ = {0, . . ., d − 1} ×m .Thanks to these two facts, via properties of the trace norm and Eq.(B10) we obtain: where t(m) ≡ 2 t(m) .
We will now reduce the problem of calculating the rate of the considered protocol to study of the Devetak-Winter formula of certain state as follows, which shows that it is enough to analyse the state (B12) In first inequality we use definition of K D which, as operational entanglement measure is regularized by definition.
We then use the aforementioned equivalence between C D and K D where C D is calculated on the purification of input state |ψ γ d to system of Eve.We then use the fact that C D is non-increasing under operations of Alice and Bob.By R DW we denote the rate of the (one-way) Devetak-Winter protocol run for k copies of the state.In the last step we follow [9], observing that it need not be optimal, yet is good enough for our purpose, hence the last inequality follows.
From [29] we have that: hence, in the limit of large k there is: for all m.It is then enough to find lower bound on the RHS of the above inequality.We will find it using asymptotic continuity of entropy (and conditional entropy), based on the fact that ρ m is close to ρ m for which it is rather easy to calculate the entropies.Lemma 1 states that Finally K D ( σ) ≤ d log d where d is the dimension of the shield part of γ d , hence the pre-last term in the above tends to 0 with m for our choice of δ(m).Now, since h(1) = 0, the term h( m m+d−1 ) vanishes asymptotically as well.Finally δ (m) was arbitrarily small, hence the thesis.
Lemma 1.For the state ρ m from Eq. (B12), there is: (B21) However, we will compute the above quantity for ρ m and will use the asymptotic continuity of C DW .We will first lower bound I(AA : BB ).From the definition of quantum mutual entropy, it is equal to where S(AA |BB ) is the quantum conditional entropy.We will also use the Fannes inequality for the asymptotic continuity of the von Neumann entropy [45], i.e. for ||ρ 1 − ρ 2 || 1 ≤ we have where η(x) = −x log x, and the Alicki-Fannes inequality for continuity of the conditional entropy [46]: where here X, Y denotes two subsystems of ρ 1 and ρ 2 .Direct calculations of entropies for the state ρ m give for each part (B26) The entropy of BB is the same as S(AA ).It remains to calculate the joint entropy S(AA BB ), which is equal to S(AA ), since the systems AA and BB are maximally correlated.We are going to lower bound I(AA : BB ) ρm as follows: Now in the RHS we apply the asymptotic continuity of the entropies obtaining : where ρ E = Tr A B α ideal and H(•) is the Shannon entropy.Finally, Summing up, we have By the asymptotic continuity of entropy and conditional entropy, we have: Now entropy of the "distribution of types" is less than the log of the support of this distribution which is the number of types.Hence by (B6) we have: Due to (B26) there is: The first term of the RHS of last equality is sublinear in m as we argued above, while the second vanishes for our choice of δ . Hence the assertion follows.
Proof of Theorem 2. The first part of the proof is based on Theorems 3 and 4 from [7].For the sake of completeness we present here the crucial steps which are necessary to prove our result.From Theorem 3 of the above-mentioned paper for the state γ ⊗n ABA B we have where k = (i 1 , . . ., i n ) is a multi-index with i l ∈ {0, 1, . . ., d − 1} for every l ∈ {1, . . ., n}, and ρ k = σ i1 ⊗ • • • ⊗ σ in .This equation divided by n from the both sides can be easily rewritten as , where the left-hand-side for n → ∞ approaches E ∞ r γ ⊗n ABA B .First of all, let us recall that E r (ρ k ) = E r (ρ k ) which has the same numbers of occurrence of symbols from the set {0, . . ., d − 1}, i.e. when k = k .Additionally, considering only those ρ k for which k is δ−strongly typical (δ > 0) we have where a(k) denotes frequency of a symbol a in a sequence k.The set of such k we denote as where > 0. Now, our goal is to improve the bound on E r (ρ where σ i are conditional states on A B .Defining m ≡ min {m 0 , m 1 , . . ., m d−1 } we can make the following observation using the fact on strong typicality (B44) By the triangle inequality we have Using the definition of the parameter m and triangle inequality we are able to rewrite the first term on the RHS of (B45) as where The first term on the RHS of (B48) by the condition given by (B44) and the definition of the regularized relative entropy we get Proof of Theorem 5. Let us set U 1 ⊗ U 2 arbitrarily.We have a chain of (in)equalities, which we explain below.
The first inequality comes from the fact that composition of U 1 ⊗ U 2 and the Devetak-Winter protocol applied to subsystem of the state U 1 ⊗ U † 2 ρU 1 ⊗ U † 2 is a particular key-distillation protocol, which on a key-undistillable state cannot achieve a positive rate (in fact C DW as one can see in Eq. (A13) can be negative).The ccq state considered there is with respect to subsystem AB and computational basis, so as in the next equality.This equality is due to the aforementioned fact that unitary transformation U † does not change the ccq state (w.r.t. to subsystem AB and control-basis of U ) of the state U 1 ⊗ U † 2 ρU 1 ⊗ U † 2 (see Theorem 3.3 [27]).Now the partial trace of the subsystem A B cannot increase the key, so that the final inequality holds, and the assertion follows.
Proof of Corollary 3. The statement of corollary follows from the fact that the set of key-undistillable states is closed under LOCC operations.We also use the fact that η(x) ≤ h(x) with h being the binary Shannon entropy function and that binary Shannon entropy is less than 1.Idea of the embedding is based on least common multiple for dimensions.Suppose that Λ(ρ) = ρ d1 with dim ρ d1 = d Proof of Theorem 6.We will use the fact, that C DW is asymptotic continuous.Clearly for the singlet state it reads log d and for the state emerging from the key-undistillable state via control-unitary and the partial trace, must be zero through Theorem 5.This in turn implies the bound on the distance between states.Let us note here, that it is actually rather uncommon usage of the asymptotic continuity, aiming at the proof that states must be far as continuous faction differs on them enough, rather than finding evaluation of functions close on some close states.We first invoke the asymptotic continuity of the entropy and the conditional entropy function [51,52].As long as the states satisfy ||ρ Let us note here, that we assumed that the control basis of twisting U is the computational basis, since the proof for other product basis {|e i ⊗ |f i } is analogous.
We first note that due to the monotonicity of operation under measurements, for an arbitrary state ρ and the private state γ there is: where ρ = (ρ ) ccq and we consider particular subsystems of ρ.Following [27] we now observe, that I(A : E) ρ ccq ≤ S(A : B) ρ .Since ρ is close to the singlet state which is pure it satisfies: In this section we will argue, that the same lower bound as given in Theorem 1 holds in the case of multipartite private states.
We show this by studying the rate of the analogous protocol as described in Section II, with B → B 1 , . . ., B l for some finite number l of the parties, so that the total private state has l + 1 subsystems (lth+1 denoted as A for the Alices' subsystem).We note that the protocol is realizable, since multipartite private state has maximally correlated subsystems in secure basis, so that each of the parties can perform control-sorting of the conditional states σ i which is the main step of the protocol.
We will show now the cases when the proof for bipartite case needs to be modified.The state in (B2) is the same with the only change that 1. ρ t = i 1 |Qt| |ii ii| AB1...B l , where i is the multiindex with l values i each for one of several Bob's system 2. the error state has more error flags: These two changes are the only modifications of the state ρ in of Eq. (B7) to the multipartite case.Further, although the state E is different than in bipartite case, due to larger number of communication, we never used actual form of its state, hence it is still denoted as ρ E .In particular in Eq. (B10) the only difference is that the state α ideal is of the form: Without loss of generality we may assume that the above minimization is realized for i = 1.It is now crucial to observe, that ∀ i∈{1,...,l} ρ m|AA BiB i E (l) = ρ m|AA B1B 1 E (l) (F6) where ρ m|AA BiB i E (l) is the state ρ m (l) after tracing out all systems B j = B i .We then use the fact that due to (F4), the state ρ m|AA B1B 1 E (l) is close in trace norm to ρ m|AA B1B 1 E (l) , so that we can compute RDW (ρ m (l) ) and use asymptotic continuity of the mutual information to conclude about RDW (ρ m (l)).It is then crucial to observe that ρ m|AA B1B 1 E (l) has the same form as ρ m .Thus, we conclude that the main claim of the Lemma 1 stays the same in multipartite case.What changes is the function f ( m , d t(m) , d, m), with a substitution d → d l , as there are l parties.However we still have 1 m f ( m , d t(m) , d, m) → 0 for the same δ(m) as in the bipartite case.It is just more demanding for m and δ(m) to make l log d zero, which is yet possible as long as l is constant.We have then proved, that the proof for the multipartite case is mutatis mutandis equivalent to the bipartite one.

d d− 1 i=0
|ii ii| is maximally correlated state, and U = d−1 i,j=0 w ij |ii jj| is the embedding of unitary transformation W = d−1 i,j=0 w ij |i j| = H ⊗ logd with H being Hadamard transformation.

FIG. 3 :
FIG.3: Within the set of all strictly irreducible private states of dimension 4 ⊗ 4 we distinguish the set T AS of twisted absolutely separable private states.States from T AS are obtained by twisting a singlet together with an absolutely separable state on the shield part.We see that outside of T AS but still within the set of strictly irreducible private states SIR we can find the "flower state" γ f lower as well as class of the private states γ(ω) constructed in Example 1.

2 ⊗k and τ 2 =− 1 k< 2
(ρ s ) ⊗k , while ρ s and ρ a are the d-dimensional symmetric and antisymmetric Werner state, respectively.The state ρp, d,k,m is PPT iff p ≤ 1 .We satisfy this condition by setting p = 1 3 , d = m 2 and k = m, as then d dfor m ≥ 2. Then we define

3 .
If number t s (m) of any symbol s ∈ {0, ..., d − 1} in the key |i 0 ⊗ • • • ⊗ |i m with i j ∈ {0, ..., d − 1} is below the threshold δ(m), i.e. | m d −t s (m)| > δ(m), they trace out the original state, produce the error state |e AA ⊗|e BB .They then proceed with step 2 on the next block if such is left, or go directly to step 7 otherwise.If however | m d − t s (m)| ≤ δ(m) for all s, they proceed with the steps 4 − 6 of the protocol.4. Alice and Bob perform each control-permutation operation: depending on the value of the key |i 0 ⊗ • • • ⊗ |i m with i j ∈ {0, . . ., d − 1} they permute states on the systems A B from its original form

) with lim m→∞, n →0 1 m
f ( t(m) , d, d t(m) , m) = 0. Thus in limit of large m = sd (s → ∞) we obtain the desired lower bound.To see this observe that we can set δ(m) = 2 log m √ d √ m which assures p B → 0. Further, t(m) m ≥ 1 d − δ(m), thus we have:

S
(A : B) ρ ≤|| |Ψ + Ψ + | − ρ || 1 log d 2 + η (|| |Ψ + Ψ + | − ρ || 1 ) .(D5)1.Proof of Theorem 1 for multipartite private states α ideal = 1 d t(m) d t(m) −1 k=0 |kk kk| AB1...B l ⊗ ρ E (F3)with k = k . . .k for l systems.In this step we have used analogous fact to K D = C D in multipartite case give in[6].Now the analogues of states ρ m and ρ m (denote them ρ m (l) and ρ m (l) ), differ from ρ m and ρ m respectively only by the two aforementioned changes 1 and 2 as well as difference in definition of α ideal and αideal .It is then clear that||ρ m (l) − ρ m (l) || 1 ≤ t(m) .(F4)Further,we have by analogous considerations and the inequality F2 the lower bound:K D (γ d ) ≥1m min i∈{1,...,l} I(AA : B i B i ) ρm(l) − I(AA : E ) ρm(l) ≡ 1 m RDW (ρ m (l)).(F5) and σ A B is an arbitrary bipartitie quantum state on C d A ⊗ C d B .Imposing now separability of σ A B we obtain an example of irreducibly private state.It is not hard to see that in this case we can extract the secret key only from the singlet P + AB .Of course both classes introduced above are of much more richer structure and below we present their rigorous definitions.Let us start from the definition of the private state (pdit) [7]: Definition 1 (of private state).A state ρ ABA B on a Hilbert space The set of irreducible private states with local dimension of key part d and total dimension of the shield part d , will be denoted as IR d,d .on the diagonal, i.e.U i σU i ∈ SEP.We denote such states as γ or γ d .
The state ρ is called -approximate irreducible private state if it satisfies ||ρ − γd,d || 1 ≤ for some irreducible private state γd,d .
. It is an open question if our new bound on distance between key undistillable states and private ones may lead to analogous bound on repeated key of any irreducible private state.Answering this question would show that irreducible private states are useless for transferring key for long distances unless they have high distillable entanglement.Acknowledgments KH thanks Matthias Christandl and Roberto Ferrara for discussions and Mark Wilde for useful comments.KH and MS would like to thank also Marek Winczewski for fruitful discussion on the connection between strictly irreducible private states and the key repeaters.Authors acknowledge grant Sonata Bis 5 (grant num-ber: 2015/18/E/ST2/00327) from the National Science Centre.KH and P Ć acknowledge also the EU grant ERC AdG QOLAPS.
B42)Define now f = g 1 + g 2 and observe, that for m = sd with s → ∞ such defined f t(m) , d, d t(m) , m divided by m approaches 0 with t(m) approaching 0. Indeed apart from bounded terms in f such as h t(m) which are clearly sublinear in m, we have terms O t(m) log d m d t(m) .Such term breaks into two t(m) m log d and t(m) log d t(m) .The first term is sublinear in m if only t(m) → 0. This is assured by m = sd so that t(m) ≈ m d → ∞.The second term is equal to