# Boosting device-independent cryptography with tripartite nonlocality

Federico Grasselli<EMAIL_ADDRESS>Gláucia Murta  Hermann
Kampermann  Dagmar Bruß  Institut für Theoretische Physik III, Heinrich-Heine-
Universität Düsseldorf, Universitätsstraße 1, D-40225 Düsseldorf, Germany

###### Abstract

Device-independent (DI) protocols, such as DI conference key agreement (DICKA)
and DI randomness expansion (DIRE), certify private randomness by observing
nonlocal correlations when two or more parties test a Bell inequality. While
most DI protocols are restricted to bipartite Bell tests, harnessing
multipartite nonlocal correlations may lead to better performance. Here, we
consider tripartite DICKA and DIRE protocols based on testing multipartite
Bell inequalities, specifically: the Mermin-Ardehali-Belinskii-Klyshko (MABK)
inequality, and the Holz and the Parity-CHSH inequalities introduced in the
context of DICKA protocols. We evaluate the asymptotic performance of the
DICKA (DIRE) protocols in terms of their conference key rate (net randomness
generation rate), by deriving lower bounds on the conditional von Neumann
entropy of one party’s outcome and two parties’ outcomes. For the Holz
inequality, we prove a tight analytical lower bound on the one-outcome entropy
and conjecture a tight lower bound on the two-outcome entropy. We additionally
re-derive the analytical one-outcome entropy bound for the MABK inequality
with a much simpler method and obtain a numerical lower bound on the two-
outcome entropy for the Parity-CHSH inequality. Our simulations show that
DICKA and DIRE protocols employing tripartite Bell inequalities can
significantly outperform their bipartite counterparts. Moreover, we establish
that genuine multipartite entanglement is not a precondition for multipartite
DIRE while its necessity for DICKA remains an open question.

##  1 Background

The security of practical quantum cryptographic protocols [1, 2] holds as far
as the theoretical model of the quantum devices used in the protocol
accurately describes their experimental implementation. Indeed, any small
deviation from the ideal functionality of a quantum device can be exploited by
an eavesdropper to breach the security of the protocol, as demonstrated by
several quantum hacking attacks [3, 4, 2].

This leaves the user(s) with only two possibilities to ensure that their
quantum cryptographic protocol is actually secure. They can either thoroughly
characterize the devices being used, verifying that every assumption on the
device is met in practice. However, this procedure might be challenging and
beyond the capabilities of an end user. The other possibility is represented
by device-independent (DI) cryptography, whose security is guaranteed
independently of the inner workings of the employed devices [5, 6, 7].

The typical setting of a DI protocol is the Bell scenario [8]. Here, two (or
more) parties hold uncharacterized devices, treated as “black boxes”. Each
party can interact with their device by selecting an input, which prompts the
device to return an output. In a quantum realization of the DI protocol, the
device corresponds to a quantum system and the party interacts with it by
choosing a measurement setting (input) and collecting the measurement outcome
(output). By repeating this procedure a sufficient number of times and by
revealing a fraction of their input-output pairs, the parties can characterize
the probability distribution of the outputs, given the inputs.

To each Bell scenario can be associated a correlation inequality, called Bell
inequality [9]. If the distribution of the outputs observed by the parties
violates a Bell inequality, the outputs are said to be nonlocally correlated.
This occurs, e.g., if the parties perform appropriate measurements on their
share of an entangled state in a loophole-free111Note that, since we assume
quantum mechanics to hold, the Bell experiment does not need to close the
locality loophole, as far as the parties’ devices are isolated. Bell
experiment [10, 11].

Nonlocal correlations cannot be explained in terms of local deterministic
strategies; for example, an eavesdropper could not have pre-programmed the
devices to return a predetermined sequence of outcomes. Hence, the
eavesdropper cannot have full information about the parties’ outcomes,
regardless of the physical implementation of the devices [12]. Therefore, the
nonlocality of the outcomes, certified in a device-independent manner by the
violation of a Bell inequality, ensures that the outcomes are random and
secret to some extent. This constitutes the security principle of DI
protocols. In particular, by observing nonlocality in the outcomes, DI quantum
key distribution (DIQKD) [12, 13, 14, 15, 16] and its multiparty
generalization, DI conference key agreement (DICKA) [17, 18, 19, 20, 21],
enable a set of parties to share a common secret key, while DI randomness
expansion (DIRE) [22, 23, 24, 25, 26, 27, 28] expands the initial share of
private randomness of one or more parties.

In order to benchmark DI protocols based on different Bell scenarios and Bell
inequalities, one needs to quantify the minimum amount of secret randomness in
the parties’ outcomes, for a given Bell violation. The figure of merit is the
conditional von Neumann entropy of the parties’ outcomes, given the
eavesdropper’s quantum side information, up to corrections due to finite-size
effects. Indeed, the conditional von Neumann entropy of a set of outcomes
determines the rate of secret bits generated by DIRE, DIQKD and DICKA
protocols.

Although any lower bound on this quantity is also a valid measure of secret
randomness, tighter bounds imply higher secret bit generation rates and hence
more efficient and robust DI protocols. This is particularly important since
today’s quantum technology is mature enough to enable the experimental
implementation of DI protocols, as testified by recent DIRE [29, 30] and DIQKD
experiments [31, 32, 33].

The derivation of tight bounds on the conditional von Neumann entropies
relevant for the security of DI protocols has been a major theoretical
challenge in the field of DI cryptography. In the bipartite DI scenario, tight
analytical bounds on one-outcome entropies [13] were derived for the CHSH
inequality [34] and its variants [35, 36, 37]. Recently, two-outcome entropy
bounds were investigated in [38] for the CHSH inequality. In parallel,
reliable numerical lower bounds on the conditional von Neumann entropy can be
obtained with the techniques developed in [39, 40, 41].

##  2 Summary of results

In this work we consider a tripartite DI scenario where three unknown quantum
systems are individually measured by Alice, Bob and Charlie, respectively.
Every party can perform one of two measurements, labelled by inputs $0$ and
$1$, each of which yields a binary outcome, either $0$ or $1$. The two
measurements are: $A_{0}$ and $A_{1}$ for Alice, $B_{0}$ and $B_{1}$ for Bob
and $C_{0}$ and $C_{1}$ for Charlie. In this scenario, the parties can either
test a tripartite Bell inequality or a bipartite Bell inequality, in which
case one of the parties remains idle.

For brevity of notation, we define: $B_{\pm}:=(B_{0}\pm B_{1})/2$ and
$C_{\pm}:=(C_{0}\pm C_{1})/2$, while $\overset{L}{\leq}$ ($\overset{Q}{\leq}$)
indicates the local (quantum) bound. Moreover, $\left<A_{x}B_{y}C_{z}\right>$
represents the correlation function:

$\displaystyle\sum_{a,b,c}(-1)^{a+b+c}\Pr[A_{x}=a,B_{y}=b,C_{z}=c],$ (1)

and similarly for the two-party correlators. The Bell inequalities considered
in this work are the following:

  * •

The tripartite _Holz inequality_ [19],

$\begin{split}\beta_{\mathrm{H}}=&\left<A_{1}B_{+}C_{+}\right>-\left<A_{0}B_{-}\right>\\\
&-\left<A_{0}C_{-}\right>-\left<B_{-}C_{-}\right>\overset{L}{\leq}1\overset{Q}{\leq}3/2.\end{split}$
(2)

  * •

The tripartite _Parity-CHSH inequality_ [20],

$\beta_{\mathrm{pC}}=\left<A_{1}B_{-}C_{0}\right>+\left<A_{0}B_{+}\right>\overset{L}{\leq}1\overset{Q}{\leq}\sqrt{2}.$
(3)

  * •

The tripartite _Mermin-Ardehali-Belinskii-Klyshko (MABK) inequality_ [42, 43,
44],

$\displaystyle\begin{split}\beta_{\mathrm{M}}=&\braket{A_{0}B_{0}C_{1}}+\braket{A_{0}B_{1}C_{0}}\\\
&+\braket{A_{1}B_{0}C_{0}}-\braket{A_{1}B_{1}C_{1}}\overset{L}{\leq}2\overset{Q}{\leq}4.\end{split}$
(4)

  * •

The bipartite family of _asymmetric Clauser-Horne-Shimony-Holt (CHSH)
inequalities_ [45, 35], parametrized by $\alpha\in\mathbbm{R}$,

$\displaystyle\begin{split}\beta_{\alpha\mathrm{C}}&=2\alpha\braket{A_{0}B_{+}}+2\braket{A_{1}B_{-}}\\\
&\overset{L}{\leq}\left\\{\begin{array}[]{ll}2\left|\alpha\right|&\mbox{if
}\left|\alpha\right|>1\\\ 2&\mbox{if }\left|\alpha\right|\leq
1\end{array}\right.\\\ &\overset{Q}{\leq}2\sqrt{1+\alpha^{2}}.\end{split}$ (5)

The goal of our work is to benchmark the performance of DICKA and DIRE
protocols based on the above Bell inequalities and determine which Bell
inequality is optimal for each cryptographic task.

The crucial ingredient for our comparison is the derivation of tight
analytical and numerical lower bounds on one-outcome conditional entropies,
$H(A_{0}|E)$, and two-outcome conditional entropies, $H(A_{0}B_{0}|E)$, as a
function of the violation of the considered Bell inequality. Indeed, the
entropy $H(A_{0}|E)$ determines the conference key rate of DICKA protocols,
while the two-outcome entropy $H(A_{0}B_{0}|E)$ determines the net randomness
generation rate of our DIRE protocols.

In order to have a fair comparison, we provide the parties with an equivalent
entanglement resource in each Bell scenario, which is chosen to be a noisy
version of the entangled state which maximally violates each of the Bell
inequalities. The parties then perform the measurements that would lead, in
the absence of noise, to maximal Bell violation. In particular, when the
parties test the Holz, Parity-CHSH and MABK inequality, they share a locally-
depolarized GHZ state:

$\rho^{(3)}=\mathcal{D}^{\otimes 3}(|\hskip
0.7pt\mathrm{GHZ}\rangle\langle\mathrm{GHZ}\hskip 0.7pt|),$ (6)

where the map $\mathcal{D}$ acts on every qubit as follows:

$\displaystyle\mathcal{D}(\sigma)=p\sigma+\frac{1-p}{2}\mathbbm{1},$ (7)

and where $\ket{\mathrm{GHZ}}=(\ket{000}+\ket{111})\sqrt{2}$ is the GHZ state.
Conversely, when the parties test the (bipartite) asymmetric CHSH
inequalities, they share the bipartite version of the GHZ state, namely the
Bell state $\ket{\Phi^{+}}=(\ket{00}+\ket{11})/\sqrt{2}$, also subjected to
local depolarization:

$\rho^{(2)}=\mathcal{D}^{\otimes 2}(|\hskip
0.7pt\Phi^{+}\rangle\langle\Phi^{+}\hskip 0.7pt|).$ (8)

The noise parameter, $p$, is linked to the probability that each qubit is
depolarized, given by $1-p$. We also study the case in which the ideal GHZ and
Bell states are globally depolarized:

$\displaystyle\rho^{(3)}=p|\hskip
0.7pt\mathrm{GHZ}\rangle\langle\mathrm{GHZ}\hskip
0.7pt|+(1-p)\frac{\mathbbm{1}}{8},$ (9)

for three parties testing a tripartite Bell inequality and

$\displaystyle\rho^{(2)}=p|\hskip
0.7pt\mathrm{\Phi^{+}}\rangle\langle\mathrm{\Phi^{+}}\hskip
0.7pt|+(1-p)\frac{\mathbbm{1}}{4},$ (10)

for two parties testing a bipartite Bell inequality. In this case, $1-p$ is
the probability that the three-qubit (two-qubit) state is depolarized. Further
details on the optimal measurement settings of each inequality are given in
Appendix A.

We compare the performance of DICKA protocols based on the inequalities (2),
(3) and (5), by computing their asymptotic conference key rates for the two
noise models outlined above. Similarly, we compare DIRE protocols based on
each of the four Bell inequalities (for the bipartite Bell inequality we set
$\alpha=1$, which recovers the CHSH inequality) in terms of their asymptotic
net randomness generation rate, when the randomness is extracted from the
outcomes of two parties.

For both DICKA and DIRE protocols, we observe that tripartite Bell
inequalities can provide a performance advantage over the family of bipartite
Bell inequalities in (5), which are currently regarded as being optimal for DI
tasks such as DIQKD [35, 37].

The performance comparisons are enabled by bounds on the conditional von
Neumann entropy. The derivation of conditional entropy bounds in the
multipartite scenario was first addressed in [46] and then more thoroughly in
[47], where one-outcome and two-outcome entropy bounds were derived for the
MABK inequality, a full-correlator Bell inequality [42, 43, 44].

In this work, we take a significant step further and provide tight analytical
entropy bounds as a function of the violation of the Holz inequality. More
precisely, we derive a tight analytical bound for the one-outcome entropy
$H(A_{0}|E)$ (see Theorem 1) and provide an analytical conjecture of the tight
bound for the two-outcome entropy $H(A_{0}B_{0}|E)$ (Conjecture 1), which is
robustly confirmed by numerical data. To the best of our knowledge, our bound
on $H(A_{0}|E)$ is the first tight analytical bound derived for a non-full-
correlator Bell inequality, like the Holz inequality. And our conjectured
bound on $H(A_{0}B_{0}|E)$ is the first multi-outcome analytical bound for a
non-full-correlator Bell inequality.

The derivation of the analytical bound on $H(A_{0}|E)$ for the tripartite Holz
inequality builds on an entropic uncertainty relation, similarly to the
approach used in [35, 36] for the CHSH inequality. However, the increased
number of parties and the asymmetry with respect to permutations of parties
makes our derivation highly non-trivial. We report the full proof of the bound
and of its tightness in Appendix B. By following the same approach, in
Appendix C we rederive the analytical bound on $H(A_{0}|E)$ for the MABK
inequality with a proof that is considerably simpler than the derivation in
[47]. Besides, in Appendix E we prove that the analytical lower bound on
$H(A_{0}|E)$ for the Parity-CHSH inequality, originally derived in [20], is
actually tight.

We additionally compute numerical bounds on the two-outcome entropy
$H(A_{0}B_{0}|E)$ for the Parity-CHSH and CHSH inequalities, which are used to
compute the corresponding DIRE rates. A detailed calculation of the bounds is
provided in Appendix D. The numerical bound for the Parity-CHSH inequality is
a new result, while the one for the CHSH inequality has been independently
derived in [38].

The remainder of the paper is structured as follows. In Sec. 3 we present our
analytical and numerical one-outcome and two-outcome entropy bounds. In Sec. 4
we apply our bounds to DICKA protocols and compare their performance to deduce
the optimal Bell inequality among the Bell inequalities that we consider. In
Sec. 5 we apply the entropy bounds to DIRE protocols and perform an analogous
comparison. We discuss our results and conclude in Sec. 6, where we also
provide an overview of all the entropy bounds considered in this work in Table
3. The analytical and numerical calculations of the entropy bounds are
presented in Appendices B to E, while in Appendix A we summarize all the Bell
inequalities and entropy bounds considered in this work.

##  3 One-outcome and two-outcome entropy bounds

In this section, we present our analytical bounds on the conditional von
Neumann entropy when the parties test the Holz inequality. Additionally, we
compare the analytical and numerical bounds derived in this work with other
bounds, when the parties test the inequalities (2)-(5). The bounds are then
used to compute DICKA and DIRE rates, respectively, in Sec. 4 and 5.

###  3.1 Single party’s outcome

We obtain a tight analytical lower bound on the conditional entropy of Alice’s
outcome $A_{0}$, when Alice, Bob and Charlie test the Holz inequality (2).

######  Theorem 1.

Let Alice, Bob and Charlie test the Holz inequality [19] and let
$\beta_{\mathrm{H}}$ be the expected Bell value. Then, the von Neumann entropy
of Alice’s outcome $A_{0}$ conditioned on Eve’s information $E$ satisfies

$H(A_{0}|E)\geq
1-h\left[\frac{1}{4}\left(\beta_{\mathrm{H}}+1+\sqrt{\beta_{\mathrm{H}}^{2}+2\beta_{\mathrm{H}}-3}\right)\right],$
(11)

where $h(x)=-x\log_{2}x+(1-x)\log_{2}(1-x)$ is the binary entropy. Moreover,
the bound is tight. That is, for every Bell value $\beta_{\mathrm{H}}$ there
exists a quantum strategy (state and measurements) which attains that Bell
value and whose conditional entropy is given by the r.h.s. of (11).

Here we provide a sketch of the proof of Theorem 1, a detailed proof is
presented in Appendix B.

###### Proof sketch.

First, we employ Jordan’s Lemma [48, 47] to simplify the problem at hand,
without loss of generality. In particular, we show that we can focus on
deriving a convex lower bound on $H(A_{0}|E)$ when Alice, Bob and Charlie
share a three-qubit state and perform rank-one binary projective measurements
on their respective qubits.

We identify the plane induced by the qubit observables of each party to be the
$(x,z)$ plane of the Bloch sphere. Then, we choose the local reference frames
such that the Bell value (2) is simplified and Alice’s measurement $A_{0}$
corresponds to the Pauli measurement $\sigma_{z}$: $A_{0}=Z$. With these
choices, we show that the three-qubit state $\rho_{ABC}$ shared by the parties
can be assumed to be block-diagonal in the GHZ basis, without loss of
generality. We are thus left to derive a lower bound on $H(Z|E)$.

The next step is to employ the uncertainty relation for von Neumann entropies
[49] in combination with other properties of the conditional von Neumann
entropy to obtain the lower bound:

$\displaystyle H(Z|E)\geq
1-h\left(\frac{1+\left|\braket{XXX}\right|}{2}\right),$ (12)

where $\braket{XXX}$ is the expectation value of a $\sigma_{x}$ measurement
performed by all parties. Note that a similar step to the one above is
employed in [35] to derive an entropy bound when two parties test the
asymmetric CHSH inequality.

The last decisive step of our proof lies in the ability to link the
expectation value $\braket{XXX}$ to the Bell value $\beta_{H}$. We show that
they can be related by the following non-linear inequality:

$\left|\braket{XXX}\right|\geq\frac{\beta_{\mathrm{H}}}{2}-\frac{1}{2}+\frac{1}{2}\sqrt{\beta_{\mathrm{H}}^{2}+2\beta_{\mathrm{H}}-3}.$
(13)

By combining (13) with (12) and with the fact that $h(1/2+x)$ is monotonically
decreasing for $x>0$, we obtain the result in (11). ∎

The Holz inequality was introduced in [19] as a multipartite generalization of
the CHSH inequality (i.e., all the parties have two inputs and two outputs)
and its construction was tailored for DICKA protocols. In Sec. 4, we employ
the tight entropy bound we derived in Theorem 1 to show that the Holz
inequality indeed leads to DICKA protocols with the currently best-known
performance.

Besides, the technique used to derive the entropy bound of Theorem 1 can
constitute a simpler alternative to the approach used in [47], as demonstrated
by our re-derivation of the single-outcome entropy bound for the MABK
inequality from [47]. We provide the details of the derivation in Appendix C.

Local depolarization

Global depolarization

Figure 1: Analytical lower bounds on the conditional entropy $H(A_{0}|E)$ of
Alice’s outcome $A_{0}$ for various Bell inequalities, when three (two)
parties are given a GHZ (Bell) state that has been locally and globally
depolarized with probability $1-p$. The bound for the Holz inequality is
derived in Theorem 1, while the bounds for the Parity-CHSH, the asymmetric
CHSH, and the MABK inequality are taken from [20], [35], and [47] (and re-
derived in Appendix C), respectively. All bounds are reported in Appendix A.

In Fig. 1 we compare the lower bound on $H(A_{0}|E)$ derived in Theorem 1 for
the Holz inequality with analogous bounds for the Parity-CHSH and asymmetric
CHSH inequality from Refs. [20, 35], and the bound for the MABK inequality
from [47] re-derived in Appendix C. Note that all the bounds are tight (we
prove the tightness of the Parity-CHSH bound in Appendix E), except for the
case of the MABK inequality, and that we maximize the bound for the asymmetric
CHSH inequality (5) over the parameter $\alpha$. We plot the entropy bounds as
a function of the depolarization parameter $p$, where $1-p$ is the probability
of local or global depolarization (see Sec. 2). From the plot with local
depolarization we observe that, for a fixed value of $p$, the largest entropy
is certified by the bipartite asymmetric CHSH inequality, while the Holz
inequality provides the largest bound among the tripartite inequalities. This
is expected, since for local noise the Bell violation is proportional to $\sim
p^{N}$, where $N$ is the number of parties testing the inequality. Hence, the
violation decreases for increasing number of parties and fixed noise and so
does the entropy bound. This fact does not necessarily hold with other noise
models, e.g. global depolarization, where the Holz inequality leads to the
largest entropy at high noise levels (low $p$).

Interestingly, the entropy bounds for the Holz and the Parity-CHSH inequality
in Fig. 1 are non-zero below the genuine multipartite entanglement (GME)
threshold of the MABK inequality. This suggests that GME might not be
necessary to certify the privacy of a single party’s outcome when testing
multipartite Bell inequalities. Indeed, this is the case for asymmetric Bell
inequalities like the Holz and the Parity-CHSH inequality studied here, while
a previous study [47] on the permutationally-invariant MABK inequality showed
that GME is necessary to extract private randomness from a party’s outcome.

It is straightforward to find a non-GME state that leads to non-zero entropy
in the case of the Parity-CHSH inequality, where Charlie’s role is trivial.
Indeed, depending on the outcome of Charlie’s only measurement $C_{0}$, Alice
and Bob are effectively testing two distinct CHSH inequalities, one for
outcome $C_{0}=0$ and another for outcome $C_{0}=1$. Therefore, one could
easily obtain the maximal violation of such inequality by distributing the
biseparable state: $\ket{\Phi^{+}}\otimes\ket{0}$ and selecting the optimal
CHSH measurements for Alice and Bob and setting Charlie’s measurement to be
$Z$. Because the Parity-CHSH inequality can be seen as a special case of the
Holz inequality where Charlie’s measurements coincide ($C_{0}=C_{1}$), we can
obtain non-zero entropy with non-GME states also for the Holz inequality by
choosing the same setup as above, up to some change of sign.

###  3.2 Two parties’ outcomes

In this section we compare lower bounds on the joint conditional entropy
$H(A_{0}B_{0}|E)$ of Alice’s outcome $A_{0}$ and Bob’s outcome $B_{0}$ when
the parties test the inequalities (2)-(5) (we set $\alpha=1$ in the asymmetric
CHSH inequality, which reduces it to the standard CHSH inequality), in view of
their application for DIRE.

Local depolarization

Global depolarization

Figure 2: Lower bounds on the conditional entropy $H(A_{0}B_{0}|E)$ of Alice’s
and Bob’s outcomes for various Bell inequalities, when three (two) parties are
given a GHZ (Bell) state that has been locally and globally depolarized with
probability $1-p$. The bound for the MABK inequality is analytical and was
obtained in [47], the bound for the Holz inequality is a conjectured tight
analytical expression given by (17), while the bounds for the Parity-CHSH and
CHSH inequality are numerical (see Appendix D).

The entropy bound when three parties test the MABK inequality (4) is
analytical and was derived in [47]; we report it in Appendix A. Conversely,
the entropy bounds for the Parity-CHSH, CHSH and Holz inequality are novel
numerical bounds obtained by directly minimizing the entropy over all states
and measurements yielding a given Bell violation. In order to achieve this, we
significantly simplify the optimization problem for each inequality (details
in Appendix D) before carrying out the numerical computation.

In particular, the numerical bound on $H(A_{0}B_{0}|E)$ for the Holz
inequality relies on the intermediate results used to derive Theorem 1, which
allow us to simplify the optimization problem by reducing the number of
variables. As a result, we optimize over just one measurement direction, i.e.
one angle, and over block-diagonal states. This simplification also allowed us
to conjecture the form of the corresponding analytical bound (17).

######  Conjecture 1.

Let Alice, Bob and Charlie test the Holz inequality [19] and let
$\beta_{\mathrm{H}}$ be the expected Bell value. Then, the joint von Neumann
entropy of Alice’s outcome $A_{0}$ and Bob’s outcome $B_{0}$, conditioned on
Eve’s information $E$, satisfies

$\displaystyle H(A_{0}B_{0}|E)\geq$
$\displaystyle\left\\{\begin{array}[]{ll}\eta(\beta_{\mathrm{H}})&\beta_{\mathrm{H}}\in[1,\sqrt{2}]\\\\[8.61108pt]
\displaystyle\frac{\theta(\beta^{*}_{\mathrm{H}},x(\beta^{*}_{\mathrm{H}}))-1}{\beta^{*}_{\mathrm{H}}-\sqrt{2}}(\beta_{\mathrm{H}}-\sqrt{2})+1&\beta_{\mathrm{H}}\in(\sqrt{2},\beta^{*}_{\mathrm{H}}]\\\\[12.91663pt]
\theta(\beta_{\mathrm{H}},x(\beta_{\mathrm{H}}))&\beta_{\mathrm{H}}\in(\beta^{*}_{\mathrm{H}},3/2]\end{array}\right.,$
(17)

where the functions $\eta$, $\theta$ and $x$, and the parameter
$\beta^{*}_{\mathrm{H}}$, are reported in Appendix A. Moreover, the bound is
tight.

The bound on $H(A_{0}B_{0}|E)$ when three parties test the Parity-CHSH
inequality is also obtained by direct numerical optimization, similarly to the
bound for the Holz inequality. As a matter of fact, note that the Parity-CHSH
inequality (3) is a particular case (upon relabeling the observables) of the
Holz inequality (2) when Charlie’s two measurements coincide, i.e.
$C_{0}=C_{1}$, or equivalently $C_{-}=0$.

For the numerical computation of the entropy bound when two parties test the
CHSH inequality, we apply the results of [13, 47] to the CHSH scenario and
parametrize the state shared by Alice and Bob as a Bell-diagonal state. We
remark that the same bound has been independently computed in [38] with
numerical techniques. The details on the optimization problem solved for each
numerical bound are given in Appendix D.

It is important to remark that the numerical curves obtained by directly
minimizing the entropy cannot be treated as reliable lower bounds, as the
numerical optimization is non-convex and may return local minima.
Nevertheless, we believe that our optimizations are very close to the
corresponding tight lower bounds.

In Fig. 2 we plot the bounds on $H(A_{0}B_{0}|E)$ as a function of the
depolarization parameter $p$, in the cases of local and global depolarization.
We observe that three parties testing the MABK inequality can certify a
considerably higher amount of randomness for Alice’s and Bob’s outcomes,
compared to testing the other inequalities, both for locally and globally
depolarized states.

In Fig. 3 we plot the analytical conjecture (17) and the corresponding
numerical bound on $H(A_{0}B_{0}|E)$ for the Holz inequality. We observe that
the bound presents a distinct behavior for $\beta_{\mathrm{H}}\leq\sqrt{2}$
and $\beta_{\mathrm{H}}>\sqrt{2}$, represented by two distinct functions
$\eta(\beta_{\mathrm{H}})$ and
$\theta(\beta_{\mathrm{H}},x(\beta_{\mathrm{H}}))$ in (17). Interestingly, the
boundary of the two regions ($\beta_{\mathrm{H}}=\sqrt{2}$) coincides with the
GME threshold [19] above which the Holz inequality certifies genuine
multipartite entanglement shared by the three parties. For smaller violations,
the inequality cannot certify genuine multipartite entanglement and the
entropy is bounded by: $H(A_{0}B_{0}|E)\leq\eta(\sqrt{2})=1$, while for larger
violations the entropy increases rapidly and eventually surpasses the other
entropy bounds, except for MABK (see Fig. 2).

Figure 3: Lower bound on $H(A_{0}B_{0}|E)$ as a function of the violation of
the tripartite Holz inequality. The plot points are obtained by numerically
minimizing the entropy for a fixed Bell value $\beta_{\rm H}$ (see Appendix D
for details), while the blue solid line is our conjectured analytical bound
(17). Note that the numerical curve is concave in the interval enclosed by the
red dashed lines while our analytical bound is convex in the whole domain, as
required for a DI entropy bound.

We remark that the discrepancy between our analytical conjecture and the
numerical curve in Fig. 3 is because the latter is not always a convex
function of the violation. Indeed, within the interval
$(\sqrt{2},\beta^{*}_{\mathrm{H}}]$, the numerical curve and its conjectured
analytical expression, $\theta(\beta_{\mathrm{H}},x(\beta_{\mathrm{H}}))$,
become concave. However, a DI lower bound on a conditional entropy must be a
convex function of the violation. If this is not the case, Eve could
distribute a convex combination of states yielding an entropy lower than that
certified by the bound, thus spoiling its validity. For this, our conjectured
bound (17) is constructed as the convex hull of the numerical curve, which
guarantees that the bound is convex in the whole interval $(\sqrt{2},3/2]$. In
particular, we replace the concave part of the curve by taking the tangent to
the function $\theta(\beta_{\mathrm{H}},x(\beta_{\mathrm{H}}))$ at
$\beta_{\mathrm{H}}=\beta^{*}_{\mathrm{H}}$, such that the point of
coordinates $(\sqrt{2},1)$ belongs to the tangent line. This explains the
definition of $\beta^{*}_{\mathrm{H}}$ given in Appendix A.

##  4 Device-independent conference key agreement

The goal of device-independent conference key agreement (DICKA) is to
establish a secret conference key among $N>2$ parties in a DI fashion. For
this, it is necessary to certify the secrecy of Alice’s outcome used to
generate the key, which we choose to be $A_{0}$. This is done by testing a
Bell inequality and computing a lower bound on $H(A_{0}|E)$, which indicates
what fraction of Alice’s outcome bit is secret with respect to the
eavesdropper Eve. At the same time, Alice and the other parties want to obtain
correlated outcomes to form the shared conference key. While such outcomes can
be obtained from an additional measurement setting for the other parties,
Alice’s key-generating setting must be the same that is proved to be secret,
i.e., $A_{0}$ [50, 16]. Due to potential noise affecting the parties’ key-
generating outcomes, Alice publicly broadcasts some error correction
information for the other parties to correct their key bits and match Alice’s.
Asymptotically, the error-correction information needed by party $i$ to
correct their key –affected by a bit error rate $Q_{i}$– is given by a
fraction $h(Q_{i})$ of the whole key. Since the error-correction information
is public, it is not secure, and must be subtracted from the fraction of
secret key bits. Thus, the asymptotic conference key rate of a DICKA protocol,
that is, the asymptotic rate of secret conference key bits produced per
distributed state, is given by [46, 51]:

$\displaystyle r_{\rm DICKA}=H(A_{0}|E)-\max_{2\leq i\leq N}h(Q_{i}),$ (18)

where we maximize the error-correction information over the error rates
$Q_{i}$ so that even the party with the noisiest raw key can recover Alice’s
key.

Using the entropy bound on $H(A_{0}|E)$ derived in Theorem 1 for the Holz
inequality, together with the other bounds considered in Subsec. 3.1 (the
bound for the asymmetric CHSH inequality is numerically optimized over
$\alpha$), we can compute the asymptotic secret key rate of DICKA protocols
based on the Holz, the Parity-CHSH and the asymmetric CHSH inequality, where
the latter is implemented as a concatenation of bipartite DIQKD protocols. In
contrast, it is conjectured [50, 47] that the MABK inequality cannot be used
in a DICKA protocol since Alice’s optimal measurements yielding large
violations are different from the key-generating measurement she uses to
establish a shared conference key with the other parties.

In Fig. 4, we plot the asymptotic conference key rate (18) of the DICKA
protocols as a function of the parameter $p$, in logarithmic scale. The DICKA
rates are obtained by using the optimal strategies reported in Appendix A,
which require Alice’s outcome $A_{0}$ to be the result of a Pauli $Z$
measurement. This setting allows the parties to obtain perfectly correlated
key bits –in the ideal scenario of no depolarization– if the others also
choose $Z$ as their additional key-generating measurement.

Local depolarization

Global depolarization

Figure 4: Asymptotic conference key rates, Eq. (18), of tripartite DICKA
protocols based on the Holz inequality, Parity-CHSH inequality and a
concatenation of bipartite DIQKD based on the asymmetric CHSH inequality, as a
function of the parameter $p$ (the probability of local or global
depolarization is $1-p$). The DICKA protocol based on the asymmetric CHSH
inequality is composed of two consecutive DIQKD protocols that Alice performs
with Bob and then with Charlie. Hence its key rate earns a factor of $1/2$.
The bit error rate between every pair of parties, for both the GHZ and Bell
state, is $Q=(1-p^{2})/2$ ($Q=(1-p)/2$) when the state is locally (globally)
depolarized.

From Fig. 4 we observe that the optimal tripartite inequality for DICKA is the
Holz inequality, which was expressly designed for this scope in [19]. The plot
also shows a clear advantage in establishing a conference key with a DICKA
protocol based on multipartite entanglement rather than Bell pairs. This
advantage nearly covers the whole range of $p$ in the case of global
depolarization, while it vanishes for low values of $p$ and local
depolarization. This is due to the starker effect of local depolarization on
multipartite entangled states, which reduces their ability to violate a Bell
inequality for a given value of local noise. The threshold values for $p$
above which a non-zero conference key can be extracted, in the case of local
and global depolarization, are reported in Table 1.

Bell ineq. | local noise | global noise
---|---|---
Holz | $0.934$ | $0.855$
Parity-CHSH | $0.936$ | $0.858$
asym. CHSH | $0.923$ | $0.852$
Table 1: Threshold values for $p$ (with $1-p$ being the probability of local
or global depolarization, see Sec 2) such that a non-zero conference key can
be extracted, in the asymptotic limit, by DICKA protocols based on different
Bell inequalities.

We remark that, in our comparison, a DICKA protocol based on a bipartite Bell
inequality, such as the asymmetric CHSH inequality (5), is obtained as a
concatenation of bipartite DIQKD protocols where Alice performs a DIQKD
protocol first with Bob and then with Charlie222Alice then uses the two keys
established with Bob and Charlie to distribute the conference key with one-
time-pad.. For this, the total number of states distributed per conference key
bit doubles, causing a factor $1/2$ in the conference key rate (18). In the
case of $N$ parties establishing a conference key with concatenated DIQKD
protocols, the conference key rate is reduced by a factor of $1/(N-1)$.

Another important drawback of implementing DICKA by a concatenation of DIQKD
protocols is that the security of the established conference key is spoiled
unless Alice uses a new device for every iteration of the DIQKD protocol [52,
53], making it more resource demanding. We argue on this issue in Sec. 6,
where we also discuss about alternative definitions of conference key rates
where the advantage provided by multipartite entanglement can still be
retained.

##  5 Device-independent randomness expansion

A DIRE protocol aims to expand the initial share of private randomness of one
or more parties in a DI way, by testing a Bell inequality. The amount of
randomness in the outcomes of one or more parties is certified by computing a
lower bound on a suitable conditional entropy, in terms of the observed Bell
violation. Here we can envision a setup where the parties are located in the
same lab333For device-independent randomness certification, it is essential,
however, to ensure that the potentially malicious devices do not communicate.
and wish to explore the randomness of their joint outcomes. The goal is
achieved when the amount of randomness produced by the protocol is greater
than the input randomness used for testing the Bell inequality.

In this section we investigate the applicability to DIRE of the bounds on
$H(A_{0}B_{0}|E)$ presented in Sec. 3. Such bounds, as we will see, are
particularly suited for spot-checking DIRE protocols [38], where Alice and Bob
generate randomness with inputs $A_{0}$ and $B_{0}$ in most of the rounds and
only sporadically test the Bell inequality with random inputs.

In Fig. 2 of Sec. 3 we observed that the two-outcome entropy bound for the
MABK inequality is significantly larger than the other bounds. However, this
does not necessarily imply that a DIRE protocol based on testing the MABK
inequality can generate more net randomness than DIRE protocols based on the
other inequalities. This is due to the fact that the MABK inequality requires
a larger amount of input randomness (two random inputs for Alice, Bob and
Charlie compared to the Parity-CHSH and the CHSH inequality where Charlie has
a fixed input or remains idle). A definitive answer could come from a thorough
finite-key analysis of the DIRE protocols via the entropy accumulation theorem
[54]. Here instead, we aim at gaining intuition on the input/output randomness
tradeoff by computing lower bounds on the asymptotic net randomness generation
rate of DIRE protocols based on the four inequalities (2)-(5), which accounts
for the input randomness required by each Bell test.

The net randomness generation rate of a DIRE protocol is the fraction of fresh
random bits produced per distributed state, i.e., per round. In a spot-
checking DIRE protocol a public source of randomness, shared by all parties,
declares whether each round is a testing round ($T=1$ with probability
$\gamma$) or a randomness-generation round ($T=0$ with probability
$1-\gamma$). In a randomness-generation round, Alice and Bob select input $0$
and collect the outcomes $A_{0}$ and $B_{0}$, which generate $H(A_{0}B_{0}|E)$
bits of secret randomness (if the protocol involves additional parties, they
also select a predefined input). In a testing round, the parties locally
choose random inputs for their devices (represented by a joint random variable
$I$) and test the selected Bell inequality. Since this step does not require
public communication if the parties operate in the same lab, they consider
their outcomes as part of the generated secret randomness. The conditional
entropy that quantifies the amount of secret randomness generated in a test
round is $H(AB|E)$. This entropy is larger than $H(A_{0}B_{0}|E)$, since in
this case the inputs that generated the outputs ($AB$) are random and unknown
to Eve. Thus, the output randomness generation rate of the spot-checking DIRE
protocol is given by:

$\displaystyle H(AB|TE)$ $\displaystyle=(1-\gamma)H(A_{0}B_{0}|E)+\gamma
H(AB|E)$ $\displaystyle\geq H(A_{0}B_{0}|E),$ (19)

where we used the strong sub-additivity of the von Neumann entropy in the
inequality.

The input randomness consumed in a generic round of a spot-checking DIRE
protocol is given by:

$\displaystyle H(T,I)$ $\displaystyle=H(I|T)+H(T)$ $\displaystyle=\gamma
H(I|T=1)+(1-\gamma)H(I|T=0)+h(\gamma)$ $\displaystyle=r\gamma+h(\gamma),$ (20)

where $r$ is the total number of random bits required as inputs by the
selected Bell inequality. Then, the asymptotic net randomness generation rate
of a spot-checking DIRE protocol is obtained by subtracting the input
randomness (20) from the output randomness (19), as follows:

$\displaystyle r_{\rm spDIRE}$ $\displaystyle=H(AB|TE)-H(T,I)$
$\displaystyle\geq H(A_{0}B_{0}|E)-r\gamma-h(\gamma).$ (21)

Thus, the net randomness generation rate of a DIRE protocol based on testing
the CHSH or Parity-CHSH inequality satisfies:

$\displaystyle r_{\rm spDIRE}\geq H(A_{0}B_{0}|E)-2\gamma-h(\gamma),$ (22)

while that of a DIRE protocol based on the MABK or the Holz inequality
satisfies:

$\displaystyle r_{\rm spDIRE}\geq H(A_{0}B_{0}|E)-3\gamma-h(\gamma),$ (23)

since three random bits are required in each testing round. We can now use the
two-outcome entropy bounds presented in Sec. 3 in combination with (22) and
(23) to compare the performance of the corresponding DIRE protocols.

We remark that, asymptotically, the optimal value for $\gamma$ tends to zero,
i.e. it is sufficient to test the Bell inequality on a negligible fraction of
rounds in order to learn the exact Bell violation. In this case, the net
randomness generation rate in (21) is given by $H(A_{0}B_{0}|E)$ with an
equality sign. However, in order to investigate the effect of test rounds on
spot-checking DIRE protocols where more input randomness is required (MABK and
Holz inequalities), we set $\gamma$ to $\gamma=0.033\%$, which is the value
used in the DIRE experiment of [29].

Local depolarization

Global depolarization

Figure 5: Asymptotic net randomness generation rates for DIRE protocols that
extract secret randomness from the outcomes of two parties, as a function of
$p$, where $1-p$ is the probability of local or global depolarization. The
solid lines correspond to spot-checking DIRE protocols where a test round is
performed on a fraction $\gamma$ of the total set of rounds, while the dashed
line represents a DIRE protocol where the CHSH inequality is tested in every
round and the random inputs are recycled [38]. A spot-checking DIRE protocol
based on the MABK inequality still generates the largest amount of net
randomness. The value of $\gamma$ is set to the experimental value of [29].

In order to benchmark the DIRE rates (22) and (23), we consider a new type of
DIRE protocol without spot-checking and based on the CHSH inequality [38]. In
this DIRE protocol there is no distinction between rounds and in each round
Alice (Bob) randomly selects her (his) input $X$ ($Y$) and uses the outputs
$A$ and $B$ to test the CHSH inequality. If the outputs are not publicly
revealed (e.g. Alice and Bob are in the same lab), they can form part of the
randomness generated by the protocol. Moreover, the protocol recycles the
input randomness $X$ and $Y$ –which is also secret and unknown to Eve– and
appends it to the output randomness before extracting the secret random
string. In this case, the asymptotic net randomness generation rate of the
protocol is given by:

$\displaystyle r_{\rm DIRE}$ $\displaystyle=H(ABXY|E)-H(XY)$
$\displaystyle=H(AB|XYE),$ (24)

where, physically, the conditional entropy $H(AB|XYE)$ expresses the
uncertainty that Eve has about Alice’s and Bob’s outcomes, when Alice and Bob
use random inputs $X$ and $Y$ and the inputs become known to Eve after the
measurement. The authors in [38] conjecture a tight analytical lower bound on
$H(AB|XYE)$ as a function of the CHSH value $\beta_{C}$ (reported in Appendix
A), which we employ to plot the DIRE rate (24).

In Fig. 5 we plot the asymptotic net randomness generation rates of spot-
checking DIRE protocols based on the CHSH and Parity-CHSH inequalities (22)
and on the MABK and Holz inequalities (23), as well as the net randomness
generation rate of the DIRE protocol without spot-checking based on the CHSH
inequality (24). The threshold values for $p$ above which we have a positive
randomness generation rate, assuming $\gamma=0$, can be calculated
analytically since each of the analyzed two-outcome entropy bounds yields non-
zero randomness as soon as the corresponding classical bound is violated. The
numerical values we obtain are reported in Table 2.

Bell ineq. | local noise | global noise
---|---|---
MABK | $0.794$ | $0.500$
Parity-CHSH | $0.870$ | $0.707$
Holz |  $0.84$9 | $0.667$
CHSH | $0.841$ | $0.707$
CHSH (no spot-ch.) | $0.841$ | $0.707$
Table 2: Threshold values for $p$ (with $1-p$ being the probability of local
or global depolarization, see Sec 2) such that, asymptotically, DIRE protocols
based on the analyzed Bell inequalities yield a positive net-randomness
generation rate.

From Fig. 5 we observe that the optimal Bell inequality for DIRE is the MABK
inequality, both in terms of randomness generation rate and noise tolerance.
However, DIRE protocols based on the Holz inequality can also outperform
protocols based on the CHSH inequality in the low-noise regime (high values of
$p$), even when compared to CHSH-based DIRE protocols which recycle the input
randomness. Moreover, for the chosen realistic value of $\gamma$, the effect
of test rounds on the DIRE rates is negligible as they approximately coincide
with the entropy curves in Fig. 2.

Nevertheless, for a fixed Bell inequality, a DIRE protocol without spot-
checking and with recycled input randomness may yield more net randomness than
the corresponding protocol with spot-checking. This holds for any DIRE
protocol based on a Bell inequality which is symmetric with respect to
permutations of the parties’ observables, like the CHSH inequality. Indeed,
the asymptotic net randomness generation rate of, say, a bipartite spot-
checking protocol is given by a lower bound $F(\beta)$ on $H(A_{0}B_{0}|E)$
(recall that $\gamma\to 0$ in the asymptotic regime), while the rate of the
protocol without spot-checking and with recycled input randomness is given by
a lower bound on $H(AB|XYE)$. Due to the permutation symmetry of the
inequality, the lower bound on $H(A_{0}B_{0}|E)$ is actually valid for any
combination of inputs of Alice and Bob: $F(\beta)\leq H(A_{k}B_{l}|E)\equiv
H(AB|X=k,Y=l,E)$ for all $k,l\in\\{0,1\\}$, hence it is also a lower bound on
$H(AB|XYE)=\sum_{k,l}p_{kl}H(AB|X=k,Y=l,E)$. However, it is likely that a
direct calculation of $H(AB|XYE)$ would lead to a tighter lower bound and
hence to a higher rate for the DIRE protocol without spot-checking. This is
confirmed in the CHSH case by Fig. 5, where the dashed magenta line (DIRE
protocol without spot-checking) lies significantly above the solid magenta
line (DIRE protocol with spot-checking).

##  6 Discussion and conclusion

In this work we consider a two-input/two-output tripartite device-independent
(DI) scenario with different tripartite Bell inequalities, namely: the Holz
inequality [19], the MABK inequality [42, 43, 44], and the Parity-CHSH
inequality [20], as well as the family of (bipartite) asymmetric CHSH
inequalities [45, 35]. We investigate the asymptotic performance of DI
conference key agreement (DICKA) and DI randomness expansion (DIRE) protocols
when the different Bell inequalities are tested to certify private randomness
in the parties’ outcomes. To this aim, we present analytical and numerical
lower bounds on the conditional von Neumann entropy of a single party’s
outcome and of two parties’ outcomes, as a function of the Bell inequality
violation. We provide a concise overview of the bounds in Table 3.

Specifically, for the Holz inequality [19] we derive a tight analytical bound
on the one-outcome entropy, $H(A_{0}|E)$, and conjecture a tight analytical
bound on the two-outcome entropy, $H(A_{0}B_{0}|E)$, that is strongly
supported by numerical results. These are the first tight analytical bounds on
the conditional von Neumann entropy for a non-full-correlator Bell inequality
–apart from the one-outcome entropy bound derived in [20] for the Parity-CHSH
inequality, whose tightness is only proved in this work in Appendix E. For the
Parity-CHSH and CHSH inequality we instead compute numerical bounds on the
two-outcome entropy $H(A_{0}B_{0}|E)$.

By using the derived bounds together with bounds obtained in previous
literature [35, 20, 47], we compute the asymptotic conference key rate (net
randomness generation rate) of DICKA (DIRE) protocols based on the above-
mentioned Bell inequalities. We remark, however, that the analytical bounds
presented in this work can be readily applied to finite-key analyses of DICKA
and DIRE protocols through the entropy accumulation theorem [54, 16].

Bell inequality | $\mathbf{H(A_{0}|E)}$ | $\mathbf{H(A_{0}B_{0}|E)}$
---|---|---
| lower bound | tight | lower bound | tight
Holz | Theorem 1 | YES | Conjecture 1 | YES
| [This work] | [This work] | [This work] | [This work]
Parity-CHSH | (A.14) | YES | numerical | YES∗
| [20] | [This work] | [This work] | [This work]
MABK | Appendix C | NO | (A.18) | NO
| [This work] & [46, 47] | [47] | [47] | [47]
asymmetric CHSH (CHSH for $\alpha=1$) | (A.26) | YES | numerical ($\alpha=1$) | YES∗
| [35] | [35] | [This work] & [38] | [This work] & [38]
Table 3: Summary of the one-outcome and two-outcome entropy bounds used to
investigate DIRE and DICKA protocols based on different Bell inequalities. The
expressions of all the analytical bounds are reported in Appendix A. We
additionally employ the tight analytical bound (A.29) on $H(AB|XYE)$,
conjectured in [38], to study a CHSH-based DIRE protocol without spot-checking
and with recycled input randomness. ∗Note that the numerical lower bounds
obtained in this work are not reliable as they are the result of a non-convex
minimization of the entropy over the set of states compatible with the Bell
violation. Hence, their tightness is understood as the existence of an
implementation which attains the plotted curve.

Importantly, our results show that DI protocols based on multipartite Bell
inequalities can outperform implementations based on bipartite Bell
inequalities under different noise models (local and global depolarizing
noise) and for a broad range of noise levels.

For the task of DICKA, the Holz inequality turns out to be the one that yields
the largest key rate and, in general, DICKA is better performed with
multipartite Bell inequalities. In Sec. 4 we remark that a DICKA protocol
based on a bipartite Bell inequality must be obtained as a concatenation of
DIQKD protocols subsequently run, e.g., between Alice and each of the other
parties. Hence, its conference key rate, defined as the fraction of secret
conference key bits per distributed state, is overly penalized compared to the
key rate of a DICKA protocol based on a multipartite Bell inequality. In this
regard, one could argue that a more practical definition of conference key
rate is given by the fraction of secret conference key bits generated per unit
of time. In this case, the relationship between the key rates in Fig. 4 might
change significantly due to, e.g., a faster distribution of Bell pairs
compared to multipartite entangled states. However, future quantum networks
might generate highly non-trivial resource states in order to suit the
different needs of its nodes [55], or could present peculiar topologies (e.g.
bottle-necks [56]) such that the distillation of a multipartite entangled
state and of a Bell pair require the same amount of resources and time. In
these cases, the advantage of performing DICKA with multipartite entangled
states rather than a concatenation of DIQKD protocols would be retained even
with more practical definitions of conference key rate.

Another important drawback of implementing DICKA by a concatenation of DIQKD
protocols is that the security of the established conference key is spoiled
unless Alice uses a new device for every iteration of the DIQKD protocol.
Indeed, reusing the same quantum device in independent runs of a DIQKD
protocol could lead to security loopholes [53, 52]. Thus, in such a case,
Alice would need to possess $N-1$ quantum measurement devices in order to
establish a conference key with $N-1$ other parties. For the tripartite DICKA
protocol based on the asymmetric CHSH inequality, she would need two distinct
quantum devices. Conversely, Alice can establish a conference key with an
arbitrary number of parties with only one device, by a single run of a DICKA
protocol based on multipartite Bell inequalities, such as the Holz inequality.

Concerning DIRE, we observe that a spot-checking DIRE protocol based on the
MABK inequality is the one that yields the largest amount of net randomness in
the outcomes of two parties, even when compared with a recent CHSH-based DIRE
protocol without spot-checking, where the input randomness is recycled [38].
The advantage of the MABK inequality over the other inequalities could lie in
its permutational symmetry, which does not privilege one party at the expense
of the other parties (as in the Holz and the Parity-CHSH inequality). However,
the CHSH inequality is also permutationally-invariant but its bound on
$H(A_{0}B_{0}|E)$ lies well below the bound for the MABK inequality. This
could be explained by the fact that, for any full-correlator Bell inequality
such as the MABK and the CHSH inequality, one can assume all the marginal
distributions of the outcomes to be symmetric, without loss of generality
[47]. Therefore, for the tripartite MABK inequality we have that the
unconditional entropy of Alice’s and Bob’s outcomes is maximal:
$H(A_{0}B_{0})=2$. While in general this is not true for the bipartite CHSH
inequality: $H(A_{0}B_{0})<2$, where the conditions on the marginals
($\braket{A_{0}}=\braket{B_{0}}=0$) cannot fix the joint distribution of
$A_{0}B_{0}$.

Our work suggests many possible lines of future research. To start with, we
emphasize that the techniques employed in the derivation of the one-outcome
entropy bounds for the Holz and the MABK inequality (Theorem 1 and Appendix C)
are applicable to general Bell inequalities with two inputs and two outputs
per party. For instance, one could generalize Theorem 1 to the multipartite
scenario where the $N$-party Holz inequality is tested [19], although the way
to achieve this might be highly non-trivial. This result, nevertheless, could
lead to the best DICKA rate achievable by $N$ parties, since the Holz
inequality was introduced in [19] exactly for the purpose of DICKA. On a
similar note, one could derive a one-outcome entropy bound that accounts for
noisy pre-processing and bias of Alice’s raw output, similarly to what has
been done in the bipartite case for the CHSH inequality [35, 36].

In the case of DIRE, it is important to remark that the net randomness
generated by testing tripartite Bell inequalities can be significantly
increased compared to the results presented in Sec. 5, making multipartite
nonlocality even more beneficial for DI cryptography. One obvious way to
increase the DI randomness is to combine the outputs of all three parties in
the randomness-generation rounds, instead of only using Alice’s and Bob’s
outputs. However, this requires the derivation of bounds on three-outcome
entropies of the form $H(A_{i}B_{j}C_{k}|E)$, for which no analytical nor
numerical result is yet available. Another way to generate more randomness
from multipartite nonlocality is to extend the idea of DIRE protocols without
spot-checking and with recycled input randomness to the multiparty scenario.
Indeed, such protocols can outperform the corresponding spot-checking protocol
that tests the same Bell inequality, especially when the latter is
permutationally invariant. Therefore, an important avenue to improve the
randomness generated by the MABK-based DIRE protocol, and any multipartite
DIRE protocol based on permutationally-invariant Bell inequalities, is the
derivation of entropy bounds on quantities like $H(AB|XYZE)$ and
$H(ABC|XYZE)$.

Besides deriving new entropy bounds and improving the performance of DI
protocols, our work leaves an interesting question open. In Sec. 3 we show
that genuine multipartite entanglement (GME) is not always necessary to
certify non-zero entropy in a single party’s outcome when testing a
multipartite Bell inequality, especially when the latter presents asymmetries.
This means that GME is not a precondition for DIRE protocols with multipartite
Bell inequalities. Conversely, DICKA schemes, apart from certifying private
randomness, also require the parties to obtain correlated outcomes that can
form a shared conference key. It remains an open question whether non-GME
states can be used to perform DICKA, while their usefulness has been
established in the case of device-dependent CKA [57].

## Acknowledgements

We acknowledge support by the Deutsche Forschungsgemeinschaft (DFG, German
Research Foundation) under Germany’s Excellence Strategy - Cluster of
Excellence Matter and Light for Quantum Computing (ML4Q) EXC 2004/1
-390534769. D.B. and H.K. acknowledge support by the QuantERA project QuICHE,
via the German Ministry for Education and Research (BMBF Grant No.
16KIS1119K). F.G. and D.B. acknowledge support by a DFG Individual Research
Grant.

## References

  * Pirandola et al. [2020] S. Pirandola, U. L. Andersen, L. Banchi, M. Berta, D. Bunandar, R. Colbeck, D. Englund, T. Gehring, C. Lupo, C. Ottaviani, J. L. Pereira, M. Razavi, J. Shamsul Shaari, M. Tomamichel, V. C. Usenko, G. Vallone, P. Villoresi, and P. Wallden.  Advances in quantum cryptography.  _Adv. Opt. Photon._ , 12(4):1012–1236, Dec 2020\.  doi: 10.1364/AOP.361502.  URL http://opg.optica.org/aop/abstract.cfm?URI=aop-12-4-1012.
  * Xu et al. [2020] Feihu Xu, Xiongfeng Ma, Qiang Zhang, Hoi-Kwong Lo, and Jian-Wei Pan.  Secure quantum key distribution with realistic devices.  _Rev. Mod. Phys._ , 92:025002, May 2020.  doi: 10.1103/RevModPhys.92.025002.  URL https://link.aps.org/doi/10.1103/RevModPhys.92.025002.
  * Lydersen et al. [2010] Lars Lydersen, Carlos Wiechers, Christoffer Wittmann, Dominique Elser, Johannes Skaar, and Vadim Makarov.  Hacking commercial quantum cryptography systems by tailored bright illumination.  _Nature Photonics_ , 4(10):686–689, Oct 2010\.  ISSN 1749-4893.  doi: 10.1038/nphoton.2010.214.  URL https://doi.org/10.1038/nphoton.2010.214.
  * Gerhardt et al. [2011] Ilja Gerhardt, Qin Liu, Antía Lamas-Linares, Johannes Skaar, Christian Kurtsiefer, and Vadim Makarov.  Full-field implementation of a perfect eavesdropper on a quantum cryptography system.  _Nature Communications_ , 2(1):349, Jun 2011.  ISSN 2041-1723.  doi: 10.1038/ncomms1348.  URL https://doi.org/10.1038/ncomms1348.
  * Yao and Mayers [1998] A. Yao and D. Mayers.  Quantum cryptography with imperfect apparatus.  In _2013 IEEE 54th Annual Symposium on Foundations of Computer Science_ , page 503, Los Alamitos, CA, USA, nov 1998. IEEE Computer Society.  doi: 10.1109/SFCS.1998.743501.  URL https://doi.ieeecomputersociety.org/10.1109/SFCS.1998.743501.
  * Acín et al. [2006] Antonio Acín, Nicolas Gisin, and Lluis Masanes.  From bell’s theorem to secure quantum key distribution.  _Phys. Rev. Lett._ , 97:120405, Sep 2006.  doi: 10.1103/PhysRevLett.97.120405.  URL https://link.aps.org/doi/10.1103/PhysRevLett.97.120405.
  * Barrett et al. [2006] Jonathan Barrett, Adrian Kent, and Stefano Pironio.  Maximally nonlocal and monogamous quantum correlations.  _Phys. Rev. Lett._ , 97:170409, Oct 2006.  doi: 10.1103/PhysRevLett.97.170409.  URL https://link.aps.org/doi/10.1103/PhysRevLett.97.170409.
  * Bell [2004] J. S. Bell.  _Speakable and Unspeakable in Quantum Mechanics_.  Cambridge University Press, 2004.
  * Brunner et al. [2014] Nicolas Brunner, Daniel Cavalcanti, Stefano Pironio, Valerio Scarani, and Stephanie Wehner.  Bell nonlocality.  _Rev. Mod. Phys._ , 86:419–478, Apr 2014.  doi: 10.1103/RevModPhys.86.419.  URL https://link.aps.org/doi/10.1103/RevModPhys.86.419.
  * Hensen et al. [2015] B. Hensen, H. Bernien, A. E. Dréau, A. Reiserer, N. Kalb, M. S. Blok, J. Ruitenberg, R. F. L. Vermeulen, R. N. Schouten, C. Abellán, W. Amaya, V. Pruneri, M. W. Mitchell, M. Markham, D. J. Twitchen, D. Elkouss, S. Wehner, T. H. Taminiau, and R. Hanson.  Loophole-free bell inequality violation using electron spins separated by 1.3 kilometres.  _Nature_ , 526(7575):682–686, Oct 2015.  ISSN 1476-4687.  doi: 10.1038/nature15759.  URL https://doi.org/10.1038/nature15759.
  * Giustina et al. [2015] Marissa Giustina, Marijn A. M. Versteegh, Sören Wengerowsky, Johannes Handsteiner, Armin Hochrainer, Kevin Phelan, Fabian Steinlechner, Johannes Kofler, Jan-Åke Larsson, Carlos Abellán, Waldimar Amaya, Valerio Pruneri, Morgan W. Mitchell, Jörn Beyer, Thomas Gerrits, Adriana E. Lita, Lynden K. Shalm, Sae Woo Nam, Thomas Scheidl, Rupert Ursin, Bernhard Wittmann, and Anton Zeilinger.  Significant-loophole-free test of bell’s theorem with entangled photons.  _Phys. Rev. Lett._ , 115:250401, Dec 2015.  doi: 10.1103/PhysRevLett.115.250401.  URL https://link.aps.org/doi/10.1103/PhysRevLett.115.250401.
  * Acín et al. [2007] Antonio Acín, Nicolas Brunner, Nicolas Gisin, Serge Massar, Stefano Pironio, and Valerio Scarani.  Device-independent security of quantum cryptography against collective attacks.  _Phys. Rev. Lett._ , 98:230501, Jun 2007.  doi: 10.1103/PhysRevLett.98.230501.  URL https://link.aps.org/doi/10.1103/PhysRevLett.98.230501.
  * Pironio et al. [2009] Stefano Pironio, Antonio Acín, Nicolas Brunner, Nicolas Gisin, Serge Massar, and Valerio Scarani.  Device-independent quantum key distribution secure against collective attacks.  _New Journal of Physics_ , 11(4):045021, apr 2009\.  doi: 10.1088/1367-2630/11/4/045021.  URL https://doi.org/10.1088%2F1367-2630%2F11%2F4%2F045021.
  * Masanes et al. [2011] Lluís Masanes, Stefano Pironio, and Antonio Acín.  Secure device-independent quantum key distribution with causally independent measurement devices.  _Nature Communications_ , 2(1):238, 2011.  ISSN 2041-1723.  doi: 10.1038/ncomms1244.  URL https://doi.org/10.1038/ncomms1244.
  * Vazirani and Vidick [2014] Umesh Vazirani and Thomas Vidick.  Fully device-independent quantum key distribution.  _Phys. Rev. Lett._ , 113:140501, Sep 2014.  doi: 10.1103/PhysRevLett.113.140501.  URL https://link.aps.org/doi/10.1103/PhysRevLett.113.140501.
  * Arnon-Friedman et al. [2018] Rotem Arnon-Friedman, Frédéric Dupuis, Omar Fawzi, Renato Renner, and Thomas Vidick.  Practical device-independent quantum cryptography via entropy accumulation.  _Nature Communications_ , 9(1):459, 2018.  ISSN 2041-1723.  doi: 10.1038/s41467-017-02307-4.  URL https://doi.org/10.1038/s41467-017-02307-4.
  * Scarani and Gisin [2001a] Valerio Scarani and Nicolas Gisin.  Quantum communication between n partners and bell’s inequalities.  _Phys. Rev. Lett._ , 87:117901, Aug 2001a.  doi: 10.1103/PhysRevLett.87.117901.  URL https://link.aps.org/doi/10.1103/PhysRevLett.87.117901.
  * Scarani and Gisin [2001b] Valerio Scarani and Nicolas Gisin.  Quantum key distribution between n partners: Optimal eavesdropping and bell’s inequalities.  _Phys. Rev. A_ , 65:012311, Dec 2001b.  doi: 10.1103/PhysRevA.65.012311.  URL https://link.aps.org/doi/10.1103/PhysRevA.65.012311.
  * Holz et al. [2020] Timo Holz, Hermann Kampermann, and Dagmar Bruß.  Genuine multipartite bell inequality for device-independent conference key agreement.  _Phys. Rev. Research_ , 2:023251, May 2020.  doi: 10.1103/PhysRevResearch.2.023251.  URL https://link.aps.org/doi/10.1103/PhysRevResearch.2.023251.
  * Ribeiro et al. [2019] Jérémy Ribeiro, Gláucia Murta, and Stephanie Wehner.  Reply to “comment on fully device-independent conference key agreement”.  _Phys. Rev. A_ , 100:026302, Aug 2019.  doi: 10.1103/PhysRevA.100.026302.  URL https://link.aps.org/doi/10.1103/PhysRevA.100.026302.
  * Murta et al. [2020] Gláucia Murta, Federico Grasselli, Hermann Kampermann, and Dagmar Bruß.  Quantum conference key agreement: A review.  _Advanced Quantum Technologies_ , 3(11):2000025, 2020.  doi: https://doi.org/10.1002/qute.202000025.  URL https://onlinelibrary.wiley.com/doi/abs/10.1002/qute.202000025.
  * Colbeck [2007] Roger Colbeck.  Quantum and relativistic protocols for secure multi-party computation, 2007.  PhD thesis, University of Cambridge. Also available at: arXiv:quant-ph/0911.3814.
  * Pironio et al. [2010] S. Pironio, A. Acín, S. Massar, A. Boyer de la Giroday, D. N. Matsukevich, P. Maunz, S. Olmschenk, D. Hayes, L. Luo, T. A. Manning, et al.  Random numbers certified by bell’s theorem.  _Nature_ , 464(7291):1021–1024, 2010.  ISSN 1476-4687.  doi: 10.1038/nature09008.  URL https://doi.org/10.1038/nature09008.
  * Colbeck and Kent [2011] Roger Colbeck and Adrian Kent.  Private randomness expansion with untrusted devices.  _Journal of Physics A: Mathematical and Theoretical_ , 44(9):095305, feb 2011.  doi: 10.1088/1751-8113/44/9/095305.  URL https://doi.org/10.1088%2F1751-8113%2F44%2F9%2F095305.
  * Miller and Shi [2016] Carl A. Miller and Yaoyun Shi.  Robust protocols for securely expanding randomness and distributing keys using untrusted quantum devices.  _J. ACM_ , 63(4), October 2016.  ISSN 0004-5411.  doi: 10.1145/2885493.  URL https://doi.org/10.1145/2885493.
  * Pironio and Massar [2013] Stefano Pironio and Serge Massar.  Security of practical private randomness generation.  _Phys. Rev. A_ , 87:012336, Jan 2013.  doi: 10.1103/PhysRevA.87.012336.  URL https://link.aps.org/doi/10.1103/PhysRevA.87.012336.
  * Fehr et al. [2013] Serge Fehr, Ran Gelles, and Christian Schaffner.  Security and composability of randomness expansion from bell inequalities.  _Phys. Rev. A_ , 87:012335, Jan 2013.  doi: 10.1103/PhysRevA.87.012335.  URL https://link.aps.org/doi/10.1103/PhysRevA.87.012335.
  * Woodhead et al. [2018] Erik Woodhead, Boris Bourdoncle, and Antonio Acín.  Randomness versus nonlocality in the Mermin-Bell experiment with three parties.  _Quantum_ , 2:82, August 2018.  ISSN 2521-327X.  doi: 10.22331/q-2018-08-17-82.  URL https://doi.org/10.22331/q-2018-08-17-82.
  * Liu et al. [2021] Wen-Zhao Liu, Ming-Han Li, Sammy Ragy, Si-Ran Zhao, Bing Bai, Yang Liu, Peter J. Brown, Jun Zhang, Roger Colbeck, Jingyun Fan, Qiang Zhang, and Jian-Wei Pan.  Device-independent randomness expansion against quantum side information.  _Nature Physics_ , 17(4):448–451, Apr 2021.  ISSN 1745-2481.  doi: 10.1038/s41567-020-01147-2.  URL https://doi.org/10.1038/s41567-020-01147-2.
  * Shalm et al. [2021] Lynden K. Shalm, Yanbao Zhang, Joshua C. Bienfang, Collin Schlager, Martin J. Stevens, Michael D. Mazurek, Carlos Abellán, Waldimar Amaya, Morgan W. Mitchell, Mohammad A. Alhejji, Honghao Fu, Joel Ornstein, Richard P. Mirin, Sae Woo Nam, and Emanuel Knill.  Device-independent randomness expansion with entangled photons.  _Nature Physics_ , 17(4):452–456, Apr 2021.  ISSN 1745-2481.  doi: 10.1038/s41567-020-01153-4.  URL https://doi.org/10.1038/s41567-020-01153-4.
  * Zhang et al. [2021] Wei Zhang, Tim van Leent, Kai Redeker, Robert Garthoff, Rene Schwonnek, Florian Fertig, Sebastian Eppelt, Valerio Scarani, Charles C. W. Lim, and Harald Weinfurter.  Experimental device-independent quantum key distribution between distant users, 2021.  URL https://arxiv.org/abs/2110.00575.  arXiv:2110.00575.
  * Nadlinger et al. [2021] D. P. Nadlinger, P. Drmota, B. C. Nichol, G. Araneda, D. Main, R. Srinivas, D. M. Lucas, C. J. Ballance, K. Ivanov, E. Y-Z. Tan, P. Sekatski, R. L. Urbanke, R. Renner, N. Sangouard, and J-D. Bancal.  Device-independent quantum key distribution, 2021.  URL https://arxiv.org/abs/2109.14600.  arXiv:2109.14600.
  * Liu et al. [2022] Wen-Zhao Liu, Yu-Zhe Zhang, Yi-Zheng Zhen, Ming-Han Li, Yang Liu, Jingyun Fan, Feihu Xu, Qiang Zhang, and Jian-Wei Pan.  Toward a photonic demonstration of device-independent quantum key distribution.  _Phys. Rev. Lett._ , 129:050502, Jul 2022.  doi: 10.1103/PhysRevLett.129.050502.  URL https://link.aps.org/doi/10.1103/PhysRevLett.129.050502.
  * Clauser et al. [1969] John F. Clauser, Michael A. Horne, Abner Shimony, and Richard A. Holt.  Proposed experiment to test local hidden-variable theories.  _Phys. Rev. Lett._ , 23:880–884, Oct 1969.  doi: 10.1103/PhysRevLett.23.880.  URL https://link.aps.org/doi/10.1103/PhysRevLett.23.880.
  * Woodhead et al. [2021] Erik Woodhead, Antonio Acín, and Stefano Pironio.  Device-independent quantum key distribution with asymmetric CHSH inequalities.  _Quantum_ , 5:443, April 2021.  ISSN 2521-327X.  doi: 10.22331/q-2021-04-26-443.  URL https://doi.org/10.22331/q-2021-04-26-443.
  * Masini et al. [2021] Michele Masini, Stefano Pironio, and Erik Woodhead.  Simple and practical diqkd security analysis via BB84-type uncertainty relations and pauli correlation constraints, 2021.  URL https://arxiv.org/abs/2107.08894.  arXiv:quant-ph/2107.08894.
  * Sekatski et al. [2021] Pavel Sekatski, Jean-Daniel Bancal, Xavier Valcarce, Ernest Y.-Z. Tan, Renato Renner, and Nicolas Sangouard.  Device-independent quantum key distribution from generalized CHSH inequalities.  _Quantum_ , 5:444, April 2021.  ISSN 2521-327X.  doi: 10.22331/q-2021-04-26-444.  URL https://doi.org/10.22331/q-2021-04-26-444.
  * Bhavsar et al. [2021] Rutvij Bhavsar, Sammy Ragy, and Roger Colbeck.  Improved device-independent randomness expansion rates from tight bounds on the two sided randomness using chsh tests, 2021.  URL https://arxiv.org/abs/2103.07504.  arXiv:quant-ph/2103.07504.
  * Brown et al. [2021] Peter Brown, Hamza Fawzi, and Omar Fawzi.  Computing conditional entropies for quantum correlations.  _Nature Communications_ , 12(1):575, Jan 2021\.  ISSN 2041-1723.  doi: 10.1038/s41467-020-20018-1.  URL https://doi.org/10.1038/s41467-020-20018-1.
  * Tan et al. [2021] Ernest Y.-Z. Tan, René Schwonnek, Koon Tong Goh, Ignatius William Primaatmaja, and Charles C.-W. Lim.  Computing secure key rates for quantum cryptography with untrusted devices.  _npj Quantum Information_ , 7(1):158, Oct 2021\.  ISSN 2056-6387.  doi: 10.1038/s41534-021-00494-z.  URL https://doi.org/10.1038/s41534-021-00494-z.
  * Tan et al. [2020] Ernest Y. Z. Tan, Pavel Sekatski, Jean-Daniel Bancal, René Schwonnek, Renato Renner, Nicolas Sangouard, and Charles C. W. Lim.  Improved diqkd protocols with finite-size analysis, 2020.  URL https://arxiv.org/abs/2012.08714.  arXiv:2012.08714.
  * Mermin [1990] N. David Mermin.  Extreme quantum entanglement in a superposition of macroscopically distinct states.  _Phys. Rev. Lett._ , 65:1838–1840, Oct 1990.  doi: 10.1103/PhysRevLett.65.1838.  URL https://link.aps.org/doi/10.1103/PhysRevLett.65.1838.
  * Ardehali [1992] M. Ardehali.  Bell inequalities with a magnitude of violation that grows exponentially with the number of particles.  _Phys. Rev. A_ , 46:5375–5378, Nov 1992.  doi: 10.1103/PhysRevA.46.5375.  URL https://link.aps.org/doi/10.1103/PhysRevA.46.5375.
  * Belinskiĭ and Klyshko [1993] A. V. Belinskiĭ and D. N. Klyshko.  Interference of light and bell’s theorem.  _Phys. Rev. A_ , 36:653–693, 1993.  doi: 10.1070/PU1993v036n08ABEH002299.  URL https://doi.org/10.1070/PU1993v036n08ABEH002299.
  * Acín et al. [2012] Antonio Acín, Serge Massar, and Stefano Pironio.  Randomness versus nonlocality and entanglement.  _Phys. Rev. Lett._ , 108:100402, Mar 2012.  doi: 10.1103/PhysRevLett.108.100402.  URL https://link.aps.org/doi/10.1103/PhysRevLett.108.100402.
  * Ribeiro et al. [2018] Jérémy Ribeiro, Gláucia Murta, and Stephanie Wehner.  Fully device-independent conference key agreement.  _Phys. Rev. A_ , 97:022307, Feb 2018.  doi: 10.1103/PhysRevA.97.022307.  URL https://link.aps.org/doi/10.1103/PhysRevA.97.022307.
  * Grasselli et al. [2021] Federico Grasselli, Gláucia Murta, Hermann Kampermann, and Dagmar Bruß.  Entropy bounds for multiparty device-independent cryptography.  _PRX Quantum_ , 2:010308, Jan 2021.  doi: 10.1103/PRXQuantum.2.010308.  URL https://link.aps.org/doi/10.1103/PRXQuantum.2.010308.
  * Masanes [2006] Lluís Masanes.  Asymptotic violation of bell inequalities and distillability.  _Phys. Rev. Lett._ , 97:050503, Aug 2006.  doi: 10.1103/PhysRevLett.97.050503.  URL https://link.aps.org/doi/10.1103/PhysRevLett.97.050503.
  * Berta et al. [2010] Mario Berta, Matthias Christandl, Roger Colbeck, Joseph M. Renes, and Renato Renner.  The uncertainty principle in the presence of quantum memory.  _Nature Physics_ , 6(9):659–662, Sep 2010.  ISSN 1745-2481.  doi: 10.1038/nphys1734.  URL https://doi.org/10.1038/nphys1734.
  * Holz et al. [2019] Timo Holz, Daniel Miller, Hermann Kampermann, and Dagmar Bruß.  Comment on “fully device-independent conference key agreement”.  _Phys. Rev. A_ , 100:026301, Aug 2019.  doi: 10.1103/PhysRevA.100.026301.  URL https://link.aps.org/doi/10.1103/PhysRevA.100.026301.
  * Grasselli [2021] Federico Grasselli.  _Quantum Cryptography_.  Springer International Publishing, 2021.  ISBN 978-3-030-64359-1.  doi: 10.1007/978-3-030-64360-7.
  * Murta et al. [2019] G Murta, S B van Dam, J Ribeiro, R Hanson, and S Wehner.  Towards a realization of device-independent quantum key distribution.  _Quantum Science and Technology_ , 4(3):035011, jul 2019.  doi: 10.1088/2058-9565/ab2819.  URL https://doi.org/10.1088/2058-9565/ab2819.
  * Barrett et al. [2013] Jonathan Barrett, Roger Colbeck, and Adrian Kent.  Memory attacks on device-independent quantum cryptography.  _Phys. Rev. Lett._ , 110:010503, Jan 2013.  doi: 10.1103/PhysRevLett.110.010503.  URL https://link.aps.org/doi/10.1103/PhysRevLett.110.010503.
  * Dupuis and Fawzi [2019] F. Dupuis and O. Fawzi.  Entropy accumulation with improved second-order term.  _IEEE Transactions on Information Theory_ , 65(11):7596–7612, Nov 2019.  ISSN 1557-9654.  doi: 10.1109/TIT.2019.2929564.
  * Pickston et al. [2022] Alexander Pickston, Joseph Ho, Andrés Ulibarrena, Federico Grasselli, Massimiliano Proietti, Christopher L. Morrison, Peter Barrow, Francesco Graffitti, and Alessandro Fedrizzi.  Experimental network advantage for quantum conference key agreement, 2022\.  URL https://arxiv.org/abs/2207.01643.  arXiv:2207.01643.
  * Epping et al. [2017] Michael Epping, Hermann Kampermann, Chiara Macchiavello, and Dagmar Bruß.  Multi-partite entanglement can speed up quantum key distribution in networks.  _New Journal of Physics_ , 19(9):093012, sep 2017\.  doi: 10.1088/1367-2630/aa8487.  URL https://doi.org/10.1088%2F1367-2630%2Faa8487.
  * Carrara et al. [2021] Giacomo Carrara, Hermann Kampermann, Dagmar Bruß, and Gláucia Murta.  Genuine multipartite entanglement is not a precondition for secure conference key agreement, Mar 2021.  URL https://link.aps.org/doi/10.1103/PhysRevResearch.3.013264.
  * Nielsen and Chuang [2010] Michael A. Nielsen and Isaac L. Chuang.  _Quantum Computation and Quantum Information: 10th Anniversary Edition_.  Cambridge University Press, 2010.  doi: 10.1017/CBO9780511976667.
  * Tendick et al. [2021] Lucas Tendick, Hermann Kampermann, and Dagmar Bruß.  Quantifying necessary quantum resources for nonlocality, 2021.  arXiv:quant-ph/2102.08722.
  * Inc. [2016] Wolfram Research, Inc.  Mathematica, Version 10.3, 2016.

##  Appendix A Summary of optimal strategies and entropy bounds

In this appendix we report the quantum strategies that lead to maximal
violation of the Bell inequalities considered in the manuscript, as well as a
summary of the one-outcome and two-outcome entropy bounds used to benchmark
DICKA and DIRE protocols.

##### Holz inequality [19]

For three parties, the inequality reads:

$\beta_{\mathrm{H}}:=\left<A_{1}B_{+}C_{+}\right>-\left<A_{0}B_{-}\right>-\left<A_{0}C_{-}\right>-\left<B_{-}C_{-}\right>\leq
1,$ (A.1)

and has quantum bound $\beta^{Q}_{\mathrm{H}}=3/2$. The quantum bound is
attained when the parties share a GHZ state and choose the following optimal
measurements:

$\displaystyle A_{0}=\sigma_{z}\quad$ $\displaystyle;\quad A_{1}=\sigma_{x}$
$\displaystyle B_{+}=C_{+}=\frac{\sqrt{3}}{2}\sigma_{x}\quad$
$\displaystyle;\quad B_{-}=C_{-}=-\frac{1}{2}\sigma_{z}.$ (A.2)

The tight lower bound on the conditional entropy of Alice’s outcome $A_{0}$,
certified by a violation of the Holz inequality, reads (Theorem 1):

$H(A_{0}|E)\geq
1-h\left[\frac{1}{4}\left(\beta_{\mathrm{H}}+1+\sqrt{\beta_{\mathrm{H}}^{2}+2\beta_{\mathrm{H}}-3}\right)\right].$
(A.3)

The tight lower bound on the conditional entropy of Alice’s and Bob’s outcomes
$A_{0}$ and $B_{0}$ is conjectured to be (Conjecture 1):

$\displaystyle H(A_{0}B_{0}|E)\geq$
$\displaystyle\left\\{\begin{array}[]{ll}\eta(\beta_{\mathrm{H}})&\beta_{\mathrm{H}}\in[1,\sqrt{2}]\\\\[8.61108pt]
\displaystyle\frac{\theta(\beta^{*}_{\mathrm{H}},x(\beta^{*}_{\mathrm{H}}))-1}{\beta^{*}_{\mathrm{H}}-\sqrt{2}}(\beta_{\mathrm{H}}-\sqrt{2})+1&\beta_{\mathrm{H}}\in(\sqrt{2},\beta^{*}_{\mathrm{H}}]\\\\[12.91663pt]
\theta(\beta_{\mathrm{H}},x(\beta_{\mathrm{H}}))&\beta_{\mathrm{H}}\in(\beta^{*}_{\mathrm{H}},3/2]\end{array}\right.$
(A.7)

where the functions $\eta$ and $\theta$ are defined as:

$\displaystyle\eta(\beta_{\mathrm{H}})=2-H\left(\left\\{\frac{1}{4}\left(1+\sqrt{\beta^{2}_{\mathrm{H}}-1}\right),\frac{1}{4}\left(1+\sqrt{\beta^{2}_{\mathrm{H}}-1}\right),\frac{1}{4}\left(1-\sqrt{\beta^{2}_{\mathrm{H}}-1}\right),\frac{1}{4}\left(1-\sqrt{\beta^{2}_{\mathrm{H}}-1}\right)\right\\}\right)$
(A.8)

and

$\displaystyle\theta(\beta_{\mathrm{H}},x)$
$\displaystyle=H\left(\left\\{\frac{\beta_{\mathrm{H}}(2-\beta_{\mathrm{H}})-x^{2}}{8(\beta_{\mathrm{H}}-1)},\frac{\beta_{\mathrm{H}}(2-\beta_{\mathrm{H}})-x^{2}}{8(\beta_{\mathrm{H}}-1)},\frac{(\beta_{\mathrm{H}}-1)(\beta_{\mathrm{H}}+3)+x^{2}-1}{8(\beta_{\mathrm{H}}-1)},\frac{(\beta_{\mathrm{H}}-1)(\beta_{\mathrm{H}}+3)+x^{2}-1}{8(\beta_{\mathrm{H}}-1)}\right\\}\right)$
$\displaystyle-h\left(\frac{2(1-x)-(\beta_{\mathrm{H}}-x)^{2}}{4x(\beta_{\mathrm{H}}-1)}\right).$
(A.9)

The function $x(\beta_{\mathrm{H}})$ returns the real solution of the
following transcendental equation in $x$:

$\displaystyle\left(\beta_{\mathrm{H}}^{2}-x^{2}-2\right)\log\left(-\beta_{\mathrm{H}}^{2}-2\beta_{\mathrm{H}}x-x^{2}+2x+2\right)+\left(x^{2}+2\right)\log\left(\beta_{\mathrm{H}}^{2}-2\beta_{\mathrm{H}}x+x^{2}+2x-2\right)$
$\displaystyle+2x^{3}\log\left(\beta_{\mathrm{H}}^{2}+2\beta_{\mathrm{H}}+x^{2}-4\right)-\beta_{\mathrm{H}}^{2}\log\left(\beta_{\mathrm{H}}^{2}-2\beta_{\mathrm{H}}x+x^{2}+2x-2\right)-2x^{3}\log\left(-\beta_{\mathrm{H}}^{2}+2\beta_{\mathrm{H}}-x^{2}\right)=0,$
(A.10)

which is obtained by setting $\partial\theta(\beta_{\mathrm{H}},x)/\partial
x=0$. Finally, the violation $\beta^{*}_{\mathrm{H}}$ is approximately given
by $\beta^{*}_{\mathrm{H}}\approx 1.49$ and is implicitly defined by the
following equation:

$\displaystyle\frac{d\theta(\beta^{*}_{\mathrm{H}},x(\beta^{*}_{\mathrm{H}}))}{d\beta^{*}_{\mathrm{H}}}(\beta^{*}_{\mathrm{H}}-\sqrt{2})=\theta(\beta^{*}_{\mathrm{H}},x(\beta^{*}_{\mathrm{H}}))-1.$
(A.11)

##### Parity-CHSH inequality [20]

The inequality reads, after renormalization, as follows:

$\beta_{\mathrm{pC}}=\left<A_{1}B_{-}C\right>+\left<A_{0}B_{+}\right>\leq 1$
(A.12)

where $B_{\pm};=(B_{0}\pm B_{1})/2$ and $\beta^{Q}_{\mathrm{pC}}=\sqrt{2}$ is
the quantum bound, which is attained when the parties share a GHZ state and
choose the following optimal measurements:

$\displaystyle A_{0}=\sigma_{z}\quad$ $\displaystyle;\quad
A_{1}=\sigma_{x}\quad;\quad C=\sigma_{x}$ $\displaystyle
B_{+}=\frac{1}{\sqrt{2}}\sigma_{z}\quad$ $\displaystyle;\quad
B_{-}=\frac{1}{\sqrt{2}}\sigma_{x}.$ (A.13)

A lower bound on the entropy of Alice’s outcome $A_{0}$ certified by the
Parity-CHSH inequality is given by:

$H(A_{0}|E)\geq
1-h\left(\frac{1}{2}+\frac{1}{2}\sqrt{\left(\beta_{\mathrm{pC}}\right)^{2}-1}\right).$
(A.14)

The above bound is derived in [20], however it was not proved to be tight. We
show its tightness in Appendix E.

A numerical lower bound on the two-outcome entropy $H(A_{0}B_{0}|E)$ is
obtained in this work. For details, see Appendix D.

##### MABK inequality [42, 43, 44]

In the case of three parties the inequality reads:

$\displaystyle\beta_{\mathrm{M}}=\braket{A_{0}B_{0}C_{1}}+\braket{A_{0}B_{1}C_{0}}+\braket{A_{1}B_{0}C_{0}}-\braket{A_{1}B_{1}C_{1}}\leq
2.$ (A.15)

The quantum bound $\beta_{\mathrm{M}}^{Q}=4$ is achieved by the following
optimal measurements on the GHZ state:

$\displaystyle A_{0}=B_{0}=\sigma_{y}\quad$ $\displaystyle;\quad
A_{1}=B_{1}=\sigma_{x}$ $\displaystyle C_{0}=-\sigma_{y}\quad$
$\displaystyle;\quad C_{1}=-\sigma_{x}.$ (A.16)

A lower bound on the entropy of Alice’s outcome is given by [46, 47]:

$H(A_{0}|E)\geq
1-h\left(\frac{1}{2}+\frac{1}{2}\sqrt{\frac{\beta_{\mathrm{M}}^{2}}{8}-1}\right).$
(A.17)

We provide an alternative proof of this bound in Appendix C.

For the two-party entropy $H(A_{0}B_{0}|E)$, a lower bound is given by [47]:

$\displaystyle H(A_{0}B_{0}|E)\geq
2-H\left(\left\\{1-3f(\beta_{\mathrm{M}}),f(\beta_{\mathrm{M}}),f(\beta_{\mathrm{M}}),f(\beta_{\mathrm{M}})\right\\}\right),$
(A.18)

where $H(\\{p_{1},p_{2},\dots\\})$ is the Shannon entropy of the probability
distribution $\\{p_{1},p_{2},\dots\\}$ and the function $f$ is defined as:

$f(\beta_{\mathrm{M}})=\frac{1}{4}-\frac{\sqrt{3}}{24}\sqrt{\beta_{\mathrm{M}}^{2}-4}.$
(A.19)

We remark that, according to the numerical calculations in [47], the bounds in
(A.17) and (A.18) are not tight but are close to the corresponding tight lower
bound.

##### Asymmetric CHSH inequalities [45, 35]

The family of inequalities is parametrized by $\alpha\in\mathbbm{R}$ and
reads:

$\displaystyle\beta_{\alpha\mathrm{C}}=\alpha\braket{A_{0}B_{0}}+\alpha\braket{A_{0}B_{1}}+\braket{A_{1}B_{0}}-\braket{A_{1}B_{1}}\leq\left\\{\begin{array}[]{ll}2\left|\alpha\right|&\mbox{if
}\left|\alpha\right|>1\\\ 2&\mbox{if }\left|\alpha\right|\leq
1\end{array}\right.$ (A.22)

The CHSH inequality is maximally violated and reaches its quantum bound
$\beta^{Q}_{\alpha\mathrm{C}}=2\sqrt{1+\alpha^{2}}$ when Alice and Bob share
$\ket{\Phi^{+}}$ and perform the optimal measurements [35]:

$\displaystyle A_{0}=\sigma_{z}\quad$ $\displaystyle;\quad A_{1}=\sigma_{x}$
$\displaystyle
B_{0}=\frac{\alpha}{\sqrt{1+\alpha^{2}}}\sigma_{z}+\frac{1}{\sqrt{1+\alpha^{2}}}\sigma_{x}\quad$
$\displaystyle;\quad
B_{1}=\frac{\alpha}{\sqrt{1+\alpha^{2}}}\sigma_{z}-\frac{1}{\sqrt{1+\alpha^{2}}}\sigma_{x}.$
(A.23)

A tight lower bound on the entropy of Alice’s outcome was derived in [35], and
reads:

$\displaystyle
H(A_{0}|E)\geq\left\\{\begin{array}[]{ll}g^{\prime}(\beta^{*}_{\alpha\mathrm{C}})(\beta_{\alpha\mathrm{C}}-2)&\mbox{if
}\left|\alpha\right|<1\mbox{ and
}2\leq\beta_{\alpha\mathrm{C}}<\beta^{*}_{\alpha\mathrm{C}}\\\\[4.30554pt]
g(\beta_{\alpha\mathrm{C}})&\mbox{if }\left|\alpha\right|\geq 1\mbox{ or
}\beta_{\alpha\mathrm{C}}\geq\beta^{*}_{\alpha\mathrm{C}}\end{array}\right.,$
(A.26)

where the function $g(x)$ is defined as:
$g(x):=1-h(1/2+(1/2)\sqrt{x^{2}/4-\alpha^{2}})$, $g^{\prime}(x)$ is its first
derivative and $\beta^{*}_{\alpha\mathrm{C}}$ is the solution of the following
equation: $g^{\prime}(x)(x-2)=g(x)$.

For the two-party entropy $H(A_{0}B_{0}|E)$, a numerical bound for the case of
$\alpha=1$ (which reduces to the standard CHSH inequality) is obtained in this
work (see Appendix D) and agrees with the numerical bound independently
derived in [38]. Moreover, for the CHSH inequality a tight analytical lower
bound on $H(AB|XYE)$ (where $X$ and $Y$ are Alice’s and Bob’s inputs) as a
function of the CHSH value $\beta_{C}$ is conjectured in [38] and reported
here:

$\displaystyle
H(AB|XYE)\geq\left\\{\begin{array}[]{ll}g_{1}^{\prime}(\beta^{*}_{\mathrm{C}})(\beta_{\mathrm{C}}-2)&\mbox{if
}2\leq\beta_{\mathrm{C}}\leq\beta^{*}_{\mathrm{C}}\\\\[4.30554pt]
g_{1}(\beta_{\mathrm{C}})&\mbox{if
}\beta^{*}_{\mathrm{C}}<\beta_{\mathrm{C}}\leq 2\sqrt{2}\end{array}\right.,$
(A.29)

where $g_{1}(x)$ is defined as $g_{1}(x)=1+h(1/2+x/8)-2\,h(1/2+\sqrt{2}x/8)$,
$g_{1}^{\prime}(x)$ is its first derivative and $\beta^{*}_{C}$ is the
solution of $g_{1}^{\prime}(x)(x-2)=g_{1}(x)$ and is approximately given by
$\beta^{*}_{C}\approx 2.75$.

##  Appendix B Proof of one-outcome entropy bound for the Holz inequality

In this appendix we prove Theorem 1, i.e., we prove the following lower bound
on the von Neumann entropy of Alice’s outcome $A_{0}$, conditioned on the
eavesdropper’s total side information $E_{\rm tot}$, when three parties test
the Holz inequality:

$H(A_{0}|E_{\mathrm{tot}})\geq
1-h\left[\frac{1}{4}\left(\beta_{\mathrm{H}}+1+\sqrt{\beta_{\mathrm{H}}^{2}+2\beta_{\mathrm{H}}-3}\right)\right],$
(B.1)

where $h(x)=-x\log_{2}x+(1-x)\log_{2}(1-x)$ is the binary entropy.
Additionally, we prove that the bound above is tight.

Directly performing an analytical minimization of the conditional entropy over
every quantum state (of any dimension) and measurement would be prohibitive.
Therefore, the first step to prove (B.1) is to simplify the problem at hand.

###  B.1 Simplification of the problem

Here we simplify the generic quantum state shared by the parties and the form
of the Holz inequality, without losing generality.

Holz’s Bell inequality [19], for $N=3$ parties, is given by:

$\beta_{\mathrm{H}}:=\left<A_{1}B_{+}C_{+}\right>-\left<A_{0}B_{-}\right>-\left<A_{0}C_{-}\right>-\left<B_{-}C_{-}\right>\leq
1,$ (B.2)

where $A_{i}$, $B_{i}$ and $C_{i}$ (for $i=0,1$) are Alice’s, Bob’s and
Charlie’s binary observables, respectively, and where we define the
unnormalized observables: $B_{\pm}=(B_{0}\pm B_{1})/2$ and $C_{\pm}=(C_{0}\pm
C_{1})/2$.

To start with, we observe that each party holds two observables with binary
outcomes. By following the proof of Theorem 1 in [47], it is not restrictive
to assume that (in every protocol round) Alice, Bob and Charlie share a
mixture of three-qubit states and perform rank-one binary projective
measurements on their respective qubits. In particular, due to the DI setting,
we allow Eve to be in control of the state preparation and to determine the
projective measurements performed by the parties on each state of the mixture.
We formalize this by saying that, in each round, Eve distributes the following
three-qubit mixture:

$\rho_{ABC\Xi E^{\prime}}=\sum_{\alpha}p_{\alpha}\rho_{\alpha}\otimes|\hskip
0.7pt\alpha\rangle\langle\alpha\hskip 0.7pt|_{\xi_{A}}\otimes|\hskip
0.7pt\alpha\rangle\langle\alpha\hskip 0.7pt|_{\xi_{B}}\otimes|\hskip
0.7pt\alpha\rangle\langle\alpha\hskip 0.7pt|_{\xi_{C}}\otimes|\hskip
0.7pt\alpha\rangle\langle\alpha\hskip 0.7pt|_{E^{\prime}}$ (B.3)

together with a set of ancillae $\Xi=\\{\xi_{A},\xi_{B},\xi_{C}\\}$ that
instruct the parties’ devices on the projective measurements to implement on
each state $\rho_{\alpha}$ of the mixture. Recall that Eve knows which state
in the mixture gets distributed; this is represented by the classical register
$\ket{\alpha}_{E^{\prime}}$.

The conditional entropy of Alice’s outcome $A_{0}$ given Eve’s total
information $E_{\mathrm{tot}}=EE^{\prime}$ can then be expressed as
follows444Note that the same result can also be derived from a generic pure
state distributed by Eve [35]. In this case, the classical mixture in (B.3) is
the result of the block-diagonal measurement of each party (due to Jordan’s
lemma [48]). Thanks to the concavity of the conditional von Neumann entropy
one recovers (B.4).:

$\displaystyle H(A_{0}|E_{\mathrm{tot}})$
$\displaystyle=\sum_{\alpha}p_{\alpha}H(A_{0}|EE^{\prime}=\alpha)$
$\displaystyle=\sum_{\alpha}p_{\alpha}H(A_{0}|E)_{\rho_{\alpha}},$ (B.4)

and we aim at deriving a lower bound on $H(A_{0}|E_{\mathrm{tot}})$ as a
function of the Bell value $\beta_{\mathrm{H}}$ yielded by (B.3). The latter
can be expressed in terms of the Bell values $\beta^{\alpha}_{\mathrm{H}}$
yielded by each state $\rho_{\alpha}$ of the mixture:

$\beta_{\mathrm{H}}=\sum_{\alpha}p_{\alpha}\beta^{\alpha}_{\mathrm{H}}.$ (B.5)

Equations (B.4) and (B.5) allow us to focus on a specific state
$\rho_{\alpha}$ and derive a convex lower bound $F$ on its conditional entropy
$H(A_{0}|E)_{\rho_{\alpha}}$ in terms of the Bell value
$\beta^{\alpha}_{\mathrm{H}}$:

$H(A_{0}|E)_{\rho_{\alpha}}\geq F(\beta^{\alpha}_{\mathrm{H}}).$ (B.6)

Indeed, by combining the above expression with (B.4) and (B.5) and by
exploiting the convexity of $F$, we obtain the desired lower bound:

$H(A_{0}|E_{\mathrm{tot}})\geq F(\beta_{\mathrm{H}}).$ (B.7)

For the above argument, we now focus on a specific three-qubit state
$\rho_{\alpha}$ and derive the convex lower bound (B.6). For ease of notation,
in the following we omit the symbol $\alpha$.

####  B.1.1 Reduction of the inequality

######  Lemma 1.

The Bell value of the Holz inequality (2) can be reduced without loss of
generality to the following form, for some angles $a_{1}$, $b_{-}$, and
$c_{-}$,

$\beta_{\mathrm{H}}=\left(\cos a_{1}\braket{ZXX}+\sin
a_{1}\braket{XXX}\right)\cos b_{-}\cos c_{-}+\sin
b_{-}\braket{ZZ\mathbbm{1}}+\sin c_{-}\braket{Z\mathbbm{1}Z}-\sin b_{-}\sin
c_{-}\braket{\mathbbm{1}ZZ},$ (B.8)

where $\mathbbm{1}$ is the identity operator.

###### Proof.

We identify the plane induced by the two qubit observables of each party to be
the $(x,z)$ plane of the Bloch sphere. Then the parties’ observables can be
parametrized as follows:

$\displaystyle A_{i}$ $\displaystyle=Z\cos a_{i}+X\sin a_{i}$ (B.9)
$\displaystyle B_{i}$ $\displaystyle=Z\cos b_{i}+X\sin b_{i}$ (B.10)
$\displaystyle C_{i}$ $\displaystyle=Z\cos c_{i}+X\sin c_{i}$ (B.11)

where $a_{i},b_{i},c_{i}\in[0,2\pi]$ and where $X,Y$ and $Z$ are the Pauli
operators. By defining the parameters $b_{\pm}=(b_{0}\pm b_{1})/2$ and
$c_{\pm}=(c_{0}\pm c_{1})/2$, we can recast the observables $B_{\pm}$ and
$C_{\pm}$ as follows:

$\displaystyle B_{+}$ $\displaystyle=\cos b_{-}(Z\cos b_{+}+X\sin b_{+})$
(B.12) $\displaystyle B_{-}$ $\displaystyle=-\sin b_{-}(Z\sin b_{+}-X\cos
b_{+})$ (B.13) $\displaystyle C_{+}$ $\displaystyle=\cos c_{-}(Z\cos
c_{+}+X\sin c_{+})$ (B.14) $\displaystyle C_{-}$ $\displaystyle=-\sin
c_{-}(Z\sin c_{+}-X\cos c_{+}).$ (B.15)

By employing the rotational degree of freedom of the local reference frame of
each party (rotations around the $y$ axis), we can partially fix the
observables (without loss of generality) by rotating Alice’s, Bob’s and
Charlie’s reference frames such that:

$\displaystyle a_{0}$ $\displaystyle=0$ (B.16) $\displaystyle b_{+}=c_{+}$
$\displaystyle=\frac{\pi}{2}.$ (B.17)

In particular, we have fixed Alice’s key generation measurement $A_{0}$ to be
$Z$. With the above non-restrictive conditions, we reduce the Bell value of
the Holz inequality to the form given in (B.8). ∎

####  B.1.2 Reduction of the quantum state

After having reduced the generic quantum state shared by Alice, Bob and
Charlie in each round to a mixture of three-qubit states (B.3), here we prove
that each state of the mixture, without loss of generality, is diagonal in the
GHZ basis except for some real off-diagonal coefficients. The GHZ basis is an
orthonormal basis for the Hilbert space of three qubits and is given by
$\\{\ket{\psi_{i,j,k}}\\}^{1}_{i,j,k=0}$, with:

$\ket{\psi_{i,j,k}}=\frac{1}{\sqrt{2}}\left(\ket{0,j,k}+(-1)^{i}\ket{1,\bar{j},\bar{k}}\right),$
(B.18)

where the bar over a bit indicates its negation.

######  Lemma 2.

Without loss of generality, the three-qubit state shared by Alice, Bob and
Charlie can be parametrized as follows:

$\displaystyle\rho=$ $\displaystyle\sum_{i,j,k=0}^{1}\lambda_{ijk}|\hskip
0.7pt\psi_{i,j,k}\rangle\langle\psi_{i,j,k}\hskip
0.7pt|+\sum_{j,k=0}^{1}r_{jk}\left(|\hskip
0.7pt\psi_{0,j,k}\rangle\langle\psi_{1,\bar{j},\bar{k}}\hskip
0.7pt|+\mathrm{h.c.}\right),$ (B.19)

where $\lambda_{ijk}$ are the diagonal terms and $r_{jk}$ are real off-
diagonal coefficients.

In view of later calculations, we provide the eigenvalues and eigenvectors of
the state in (B.19). The eigenvalues $\\{\rho_{ijk}\\}$ of $\rho$ are given
by:

$\displaystyle\rho_{ijk}=\frac{1}{2}\left(\lambda_{0jk}+\lambda_{1\bar{j}\bar{k}}+(-1)^{i}\sqrt{(\lambda_{0jk}-\lambda_{1\bar{j}\bar{k}})^{2}+4r_{jk}^{2}}\right),$
(B.20)

and the corresponding eigenvectors $\\{\ket{\rho_{ijk}}\\}$ read as follows:

$\displaystyle\ket{\rho_{0jk}}$
$\displaystyle=\cos(t_{jk})\ket{\psi_{0,j,k}}+\sin(t_{jk})\ket{\psi_{1,\bar{j},\bar{k}}}$
$\displaystyle\ket{\rho_{1jk}}$
$\displaystyle=-\sin(t_{jk})\ket{\psi_{0,j,k}}+\cos(t_{jk})\ket{\psi_{1,\bar{j},\bar{k}}},$
(B.21)

where $t_{jk}$ is defined as:

$t_{jk}=\arctan\frac{2r_{jk}}{\lambda_{0jk}-\lambda_{1\bar{j}\bar{k}}+\sqrt{(\lambda_{0jk}-\lambda_{1\bar{j}\bar{k}})^{2}+4r_{jk}^{2}}}.$
(B.22)

We remark that the two sets of parameters $\\{\lambda_{ijk},r_{jk}\\}$ and
$\\{\rho_{ijk},t_{jk}\\}$ can be used interchangeably to completely describe
the state $\rho$. The inverse relations of (B.20) and (B.22) read as follows:

$\displaystyle r_{jk}$ $\displaystyle=\sin(2t_{jk})(\rho_{0jk}-\rho_{1jk})$
(B.23) $\displaystyle\lambda_{0jk}$
$\displaystyle=\cos^{2}(t_{jk})\rho_{0jk}+\sin^{2}(t_{jk})\rho_{1jk}$ (B.24)
$\displaystyle\lambda_{1\bar{j}\bar{k}}$
$\displaystyle=\cos^{2}(t_{jk})\rho_{1jk}+\sin^{2}(t_{jk})\rho_{0jk}.$ (B.25)

###### Proof.

We start by noticing that the elements of the GHZ basis are eigenstates of the
operators whose expectation value appear in the Holz inequality (B.8), except
for $ZXX$. More specifically, the action of every operator in (B.8) on the GHZ
basis reads:

$\displaystyle XXX\ket{\psi_{i,j,k}}$
$\displaystyle=(-1)^{i}\ket{\psi_{i,j,k}}$ (B.26) $\displaystyle
ZZ\mathbbm{1}\ket{\psi_{i,j,k}}$ $\displaystyle=(-1)^{j}\ket{\psi_{i,j,k}}$
(B.27) $\displaystyle Z\mathbbm{1}Z\ket{\psi_{i,j,k}}$
$\displaystyle=(-1)^{k}\ket{\psi_{i,j,k}}$ (B.28)
$\displaystyle\mathbbm{1}ZZ\ket{\psi_{i,j,k}}$
$\displaystyle=(-1)^{j+k}\ket{\psi_{i,j,k}}$ (B.29) $\displaystyle
ZXX\ket{\psi_{i,j,k}}$ $\displaystyle=\ket{\psi_{\bar{i},\bar{j},\bar{k}}}.$
(B.30)

Let us now consider the most generic three-qubit state and express it in the
GHZ basis:

$\displaystyle\rho=\sum_{\begin{subarray}{c}i,j,k=0\\\
i^{\prime},j^{\prime},k^{\prime}=0\end{subarray}}^{1}\rho_{(ijk),(i^{\prime}j^{\prime}k^{\prime})}|\hskip
0.7pt\psi_{i,j,k}\rangle\langle\psi_{i^{\prime},j^{\prime},k^{\prime}}\hskip
0.7pt|.$ (B.32)

For the observation above, the only terms in (B.32) that matter in the
calculation of the Bell value $\beta_{\mathrm{H}}$ are the diagonal elements
$\rho_{(ijk),(ijk)}$ and the coherences
$\rho_{(ijk),(\bar{i}\bar{j}\bar{k})}$. Any other term would provide no
contribution to the Bell value $\beta_{\mathrm{H}}$.

Let us denote by $\rho^{\prime}$ the state with the same matrix elements
$\rho_{(ijk),(ijk)}$ and $\rho_{(ijk),(\bar{i}\bar{j}\bar{k})}$ of $\rho$ in
the GHZ basis and null elements otherwise. Recall that in the DI scenario Eve
is in total control of the quantum channel and can distribute any arbitrary
three-qubit state to Alice, Bob and Charlie.

Reduction to block-diagonal state
Here we show that we can assume, without loss of generality, that Eve
distributes the state $\rho^{\prime}$ in place of the generic state $\rho$.
This is so because, by construction, the Bell value observed by the parties
would not change if they are given $\rho^{\prime}$ instead of $\rho$.
Moreover, Eve’s uncertainty about Alice’s outcome when she measures $Z$ would
not increase. More formally we show that:

$H(Z|E)_{\rho}\geq H(Z|E)_{\rho^{\prime}}.$ (B.33)

In order to show (B.33), we first derive the quantum map $\mathcal{D}$ that
brings any generic state $\rho$ to $\rho^{\prime}$, i.e., that sets to zero
every coherence of $\rho$ in the GHZ basis except for
$\rho_{(ijk),(\bar{i}\bar{j}\bar{k})}$, while leaving the diagonal elements
untouched. The map $\mathcal{D}$ can be better understood as a composition of
two consecutive maps. The first map acts as follows on the generic state
$\rho$:

$\displaystyle\rho\mapsto\frac{1}{2}\rho+\frac{1}{2}\mathbbm{1}ZZ\rho\mathbbm{1}ZZ,$
(B.34)

so that any off-diagonal term in (B.32) with $j+k\neq j^{\prime}+k^{\prime}$
is set to zero, while the other terms are not affected. The second map is
given by:

$\displaystyle\rho\mapsto\frac{1}{2}\rho+\frac{1}{2}YYX\rho YYX,$ (B.35)

so that every coherence with $i+j\neq i^{\prime}+j^{\prime}$ is set to
zero555Note that $YYX\ket{\psi_{i,j,k}}=-(-1)^{i+j}\ket{\psi_{i,j,k}}$.. The
combined effect of (B.34) and (B.35) is exactly the desired map $\mathcal{D}$.
We can express the action of $\mathcal{D}$ in a more compact form as follows:

$\displaystyle\mathcal{D}(\rho)$
$\displaystyle=\frac{1}{4}\left(\rho+\mathbbm{1}ZZ\rho\mathbbm{1}ZZ+YYX\rho
YYX+YXY\rho YXY\right)$ (B.36)
$\displaystyle=\sum_{i,j,k=0}^{1}\rho_{(ijk),(ijk)}|\hskip
0.7pt\psi_{i,j,k}\rangle\langle\psi_{i,j,k}\hskip
0.7pt|+\rho_{(ijk),(\bar{i}\bar{j}\bar{k})}|\hskip
0.7pt\psi_{i,j,k}\rangle\langle\psi_{\bar{i},\bar{j},\bar{k}}\hskip 0.7pt|,$
(B.37)

and we have that $\rho^{\prime}=\mathcal{D}(\rho)$. We can now prove (B.33).

To start with, we interpret the state $\mathcal{D}(\rho)$ in (B.36) as Eve
preparing one of the four states
($\rho,\,\mathbbm{1}ZZ\rho\mathbbm{1}ZZ,\,YYX\rho YYX$ and $YXY\rho YXY$) in
the mixture according to the value $t$ of a random variable $T$ known to her.
We generically indicate each of the four states as $\rho^{t}$, for different
values of $t$. Since we provide Eve with maximum power, we assume that she
holds the purification $\ket{\phi_{ABCE}^{t}}$ of each $\rho^{t}$. Therefore,
the global quantum state Eve produces reads:

$\rho_{ABCET}=\frac{1}{4}\sum_{t}|\hskip
0.7pt\phi_{ABCE}^{t}\rangle\langle\phi_{ABCE}^{t}\hskip 0.7pt|\otimes|\hskip
0.7ptt\rangle\langle t\hskip 0.7pt|_{T},$ (B.38)

where the classical register $T$ storing the value $t$ is held by Eve.
Finally, Eve also holds the purifying system $T^{\prime}$ of (B.38), such that
the global state reads:

$\displaystyle\rho_{ABCETT^{\prime}}=\frac{1}{2}\sum_{t}\ket{\phi_{ABCE}^{t}}\otimes\ket{t}_{T}\otimes\ket{t}_{T^{\prime}},$
(B.39)

where the total information available to Eve is
$E_{\mathrm{tot}}=ETT^{\prime}$. Then, by the strong subadditivity property,
we can upper bound the conditional entropy computed on
$\rho^{\prime}=\mathcal{D}(\rho)$ as follows:

$H(Z|E_{\mathrm{tot}})_{\mathcal{D}(\rho)}\leq H(Z|ET)_{\mathcal{D}(\rho)},$
(B.40)

where the entropy on the rhs is computed on the state:

$\displaystyle\rho_{ZET}$
$\displaystyle=\frac{1}{4}\sum_{t}\operatorname{Tr}_{BC}\left[(\mathcal{E}_{Z}\otimes\mathbbm{1}_{BCE})|\hskip
0.7pt\phi_{ABCE}^{t}\rangle\langle\phi_{ABCE}^{t}\hskip
0.7pt|\right]\otimes|\hskip 0.7ptt\rangle\langle t\hskip 0.7pt|_{T}$
$\displaystyle=:\frac{1}{4}\sum_{t}\rho_{ZE}^{t}\otimes|\hskip
0.7ptt\rangle\langle t\hskip 0.7pt|_{T},$ (B.41)

where $\mathcal{E}_{Z}$ is the quantum map describing Alice’s $Z$ measurement
and where we implicitly defined the state $\rho_{ZE}^{t}$.

Since Alice’s $Z$ measurement is a projection on the computational basis
states of subsystem $A$, we can recast $\rho_{ZE}^{t}$ as follows:

$\displaystyle\rho_{ZE}^{t}=\sum_{z=0,1}|\hskip 0.7ptz\rangle\langle z\hskip
0.7pt|_{Z}\otimes\operatorname{Tr}_{BC}[\braket{z}{\phi_{ABCE}^{t}}\braket{\phi_{ABCE}^{t}}{z}].$
(B.42)

Let us now fix for concreteness the value of $t$ such that
$\ket{\phi_{ABCE}^{t}}$ is the purification of the state $YYX\rho YYX$.
Nevertheless, our conclusions hold for any other state of the mixture (B.36).
Then we have that:

$\ket{\phi_{ABCE}^{t}}=\sum_{\lambda}\sqrt{\lambda}\,YYX\ket{\lambda}_{ABC}\otimes\ket{e_{\lambda}}_{E}$
(B.43)

when the spectral decomposition of $\rho$ reads
$\rho=\sum_{\lambda}\lambda|\hskip 0.7pt\lambda\rangle\langle\lambda\hskip
0.7pt|$ and with $\\{\ket{e_{\lambda}}\\}$ an orthonormal basis for $E$. By
substituting (B.43) into (B.42) we obtain:

$\rho_{ZE}^{t}=\sum_{z=0,1}|\hskip 0.7ptz\rangle\langle z\hskip
0.7pt|_{Z}\otimes\sum_{\lambda,\sigma}\sqrt{\lambda\sigma}\operatorname{Tr}_{BC}[\bra{z}YYX|\hskip
0.7pt\lambda\rangle\langle\sigma\hskip 0.7pt|YYX\ket{z}]\otimes|\hskip
0.7pte_{\lambda}\rangle\langle e_{\sigma}\hskip 0.7pt|_{E}.$ (B.44)

By using the cyclic property of the trace on $BC$ and the fact that
$Y\ket{z}=\mathbbm{i}(-1)^{z}\ket{\bar{z}}$ (we indicate the imaginary unit
with $\mathbbm{i}$), we can simplify the previous expression as follows:

$\displaystyle\rho_{ZE}^{t}$ $\displaystyle=\sum_{z=0,1}|\hskip
0.7ptz\rangle\langle z\hskip
0.7pt|_{Z}\otimes\sum_{\lambda,\sigma}\sqrt{\lambda\sigma}\operatorname{Tr}_{BC}[\braket{\bar{z}}{\lambda}\braket{\sigma}{\bar{z}}]\otimes|\hskip
0.7pte_{\lambda}\rangle\langle e_{\sigma}\hskip 0.7pt|_{E}$
$\displaystyle=\sum_{z=0,1}|\hskip 0.7pt\bar{z}\rangle\langle\bar{z}\hskip
0.7pt|_{Z}\otimes\sum_{\lambda,\sigma}\sqrt{\lambda\sigma}\operatorname{Tr}_{BC}[\braket{z}{\lambda}\braket{\sigma}{z}]\otimes|\hskip
0.7pte_{\lambda}\rangle\langle e_{\sigma}\hskip 0.7pt|_{E}$ (B.45)

Being $\rho_{ZET}$ classical on subsystem $T$ (B.41), we can compute its
conditional entropy as follows:

$H(Z|ET)_{\mathcal{D}(\rho)}=\frac{1}{4}\sum_{t}H(Z|E)_{\rho^{t}},$ (B.46)

i.e., as the average over $t$ of the entropies of (B.45). However, from (B.45)
we deduce that the states $\rho_{ZE}^{t}$ are all the same up to a relabeling
of the classical register $Z$. Therefore, they lead to the same conditional
entropy $H(Z|E)_{\rho^{t}}=H(Z|E)_{\rho}$ which is just the conditional
entropy of the original state $\rho$. By employing this observation in (B.46)
we can write:

$H(Z|ET)_{\mathcal{D}(\rho)}=H(Z|E)_{\rho}.$ (B.47)

Finally, by combining the last expression with (B.40), we obtain (B.33). We
thus proved that it is not restrictive to assume that the parties are given a
block-diagonal state of the form (B.37). In order to continue with the proof,
we relabel the non-null matrix elements of the distributed state in terms of
real numbers:

$\displaystyle\rho^{\prime}=\sum_{i,j,k=0}^{1}\lambda_{ijk}|\hskip
0.7pt\psi_{i,j,k}\rangle\langle\psi_{i,j,k}\hskip
0.7pt|+\sum_{j,k=0}^{1}(r_{jk}+\mathbbm{i}s_{jk})|\hskip
0.7pt\psi_{0,j,k}\rangle\langle\psi_{1,\bar{j},\bar{k}}\hskip
0.7pt|+\mathrm{h.c.}$ (B.48)

where $\lambda_{ijk},r_{jk}$ and $s_{jk}$ are real numbers and $\mathrm{h.c.}$
indicates the Hermitian conjugate of the preceding addend.

Reduction to purely-real coherences
Here we show that, without loss of generality, we can assume that $s_{jk}=0$
for every $j$ and $k$ in (B.48). That is, the state shared by the parties only
displays real off-diagonal elements.

We start by computing the Bell value (B.8) on the state $\rho^{\prime}$. One
obtains:

$\displaystyle(\beta_{\mathrm{H}})_{\rho^{\prime}}=$
$\displaystyle\sum_{i,j,k=0}^{1}\lambda_{ijk}\left[(-1)^{i}\sin a_{1}\cos
b_{-}\cos c_{-}+(-1)^{j}\sin b_{-}+(-1)^{k}\sin c_{-}-(-1)^{j+k}\sin b_{-}\sin
c_{-}\right]$ $\displaystyle+2r_{jk}\cos a_{1}\cos b_{-}\cos c_{-}.$ (B.49)

We observe that $(\beta_{\mathrm{H}})_{\rho^{\prime}}$ is independent of the
imaginary component of the coherences of $\rho^{\prime}$, therefore it would
read the same when computed for the complex conjugate of $\rho^{\prime}$ with
respect to the GHZ basis, namely

$(\rho^{\prime})^{*}=\sum_{i,j,k=0}^{1}\lambda_{ijk}|\hskip
0.7pt\psi_{i,j,k}\rangle\langle\psi_{i,j,k}\hskip
0.7pt|+\sum_{j,k=0}^{1}(r_{jk}-\mathbbm{i}s_{jk})|\hskip
0.7pt\psi_{0,j,k}\rangle\langle\psi_{1,\bar{j},\bar{k}}\hskip
0.7pt|+\mathrm{h.c.}$ (B.50)

Moreover, note that the states $\rho^{\prime}_{ZE}$ and
$(\rho^{\prime}_{ZE})^{*}$ –obtained from (B.48) and (B.50) after
purification, Alice’s $Z$ measurement and partial trace over $BC$– are still
the complex conjugate of each other with respect to the orthonormal basis of
$E$ used for the purification. Given that $\rho^{\prime}_{ZE}$ is Hermitian,
this implies that $(\rho^{\prime}_{ZE})^{*}$ is also the transposed of
$\rho^{\prime}_{ZE}$ with respect to the same basis. Since a matrix and its
transpose have the same eigenvalues, their von Neumann entropies must
coincide:

$H(Z|E)_{\rho^{\prime}}=H(Z|E)_{(\rho^{\prime})^{*}}.$ (B.51)

We conclude that $\rho^{\prime}$ and $(\rho^{\prime})^{*}$ lead to the same
Bell value $(\beta_{\mathrm{H}})_{\rho^{\prime}}$ and provide Eve with the
same amount of information about Alice’s $Z$ outcome. This means that Eve has
no preference in preparing $\rho^{\prime}$ rather than $(\rho^{\prime})^{*}$.
As a matter of fact, we can assume without loss of generality that Eve
prepares a balanced mixture of the two states:

$\bar{\rho}:=\frac{\rho^{\prime}+(\rho^{\prime})^{*}}{2}.$ (B.52)

Indeed, the Bell value $(\beta_{\mathrm{H}})_{\bar{\rho}}$ would be unchanged
($(\beta_{\mathrm{H}})_{\bar{\rho}}=(\beta_{\mathrm{H}})_{\rho^{\prime}}$) and
Eve’s uncertainty would not increase:

$H(Z|E)_{\rho^{\prime}}\geq H(Z|E_{\mathrm{tot}})_{\bar{\rho}}.$ (B.53)

In order to verify the above inequality, we interpret $\bar{\rho}$ as Eve
preparing the purifications $\ket{\varphi_{ABCE}}$ and
$\ket{\varphi^{*}_{ABCE}}$ of $\rho^{\prime}$ and $(\rho^{\prime})^{*}$,
respectively, according to the value of a classical random variable $T$ known
to her:

$\frac{1}{2}|\hskip 0.7pt\varphi_{ABCE}\rangle\langle\varphi_{ABCE}\hskip
0.7pt|\otimes|\hskip 0.7pt0\rangle\langle 0\hskip
0.7pt|_{T}+\frac{1}{2}|\hskip
0.7pt\varphi^{*}_{ABCE}\rangle\langle\varphi^{*}_{ABCE}\hskip
0.7pt|\otimes|\hskip 0.7pt1\rangle\langle 1\hskip 0.7pt|_{T}.$ (B.54)

Moreover, we provide Eve with the purifying system $T^{\prime}$ of the above
quantum state. Thus, similarly to (B.39), the global quantum state prepared by
Eve reads:

$\displaystyle\frac{1}{\sqrt{2}}\ket{\varphi_{ABCE}}\otimes\ket{0}_{T}\otimes\ket{0}_{T^{\prime}}+\frac{1}{\sqrt{2}}\ket{\varphi^{*}_{ABCE}}\otimes\ket{1}_{T}\otimes\ket{1}_{T^{\prime}}$
(B.55)

and she holds systems $E_{\mathrm{tot}}=ETT^{\prime}$. By the strong
subadditivity property and the fact that the states are classical on $T$, we
can upper bound the rhs of (B.53) by:

$\displaystyle H(Z|E_{\mathrm{tot}})_{\bar{\rho}}\leq H(Z|ET)_{\bar{\rho}}$
$\displaystyle=\frac{1}{2}H(Z|E)_{\rho^{\prime}}+\frac{1}{2}H(Z|E)_{(\rho^{\prime})^{*}}$
$\displaystyle=H(Z|E)_{\rho^{\prime}},$ (B.56)

where we used (B.51) in the last equality. This proves (B.53). Hence, without
loss of generality the three-qubit state shared by Alice, Bob and Charlie is
given by (B.52), which is exactly the state given in (B.19). ∎

###  B.2 Derivation of the bound

Having simplified the inequality (Lemma 1) and the form of a generic three-
qubit state (Lemma 2) shared by Alice, Bob and Charlie, we are now ready to
prove Theorem 1.

The bound derivation is based on a recent technique presented in [35]. The
main idea is to lower bound the conditional entropy in terms of a certain
expectation value appearing in the Holz inequality, via the uncertainty
relation for von Neumann entropies [49]. The proof is then completed by
relating the chosen expectation value to the whole Bell value of the Holz
inequality.

###### Proof of Theorem 1.

In Subsec. B.1 we show that it is not restrictive to assume that the state
shared by Alice, Bob and Charlie is a mixture of three-qubit states. We now
focus on a single element of the mixture, $\rho_{ABC}$, and on its extension
$\rho_{ABCE}$ that accounts for Eve’s quantum side information.

Since we fixed $A_{0}=Z$ as Alice’s key generation measurement, we are
interested in finding a lower bound on the conditional von Neumann entropy of
Alice’s key generation outcome given Eve’s quantum side information, $H(Z|E)$.
The uncertainty relation in the presence of quantum memories [49] states that:

$H(Z|E)\geq 1-H(X|BC),$ (B.57)

where $H(X|BC)$ is the entropy of Alice’s outcome if she measures $X$ on her
qubit, given the quantum side information of Bob and Charlie. By the fact that
quantum operations can only increase the conditional entropy when applied to
the conditioning system (see e.g. Theorem 11.15 in [58]), we have that:

$\displaystyle H(X|BC)\leq H(X|X_{B}X_{C})\leq H(X|X_{BC}),$ (B.58)

where $X_{B}$ ($X_{C}$) represents Bob’s (Charlie’s) outcome upon measuring in
the $X$ basis and $X_{BC}$ is a classical random variable defined as the
multiplication of $X_{B}$ and $X_{C}$, $X_{BC}=X_{B}X_{C}$. Then, thanks to
Fano’s inequality, the Shannon entropy on the rhs of (B.58) can be bounded by
the binary entropy of the probability that $X$ differs from $X_{BC}$, namely:

$H(X|X_{BC})\leq h(Q_{X}),$ (B.59)

with $Q_{X}=\Pr[XX_{B}X_{C}=-1]=(1-\braket{XXX})/2$ (where $XXX$ is intended
as the product of the $X$ outcomes of Alice, Bob and Charlie). By combining
(B.58) and (B.59), we obtain the following upper bound on $H(X|BC)$:

$\displaystyle H(X|BC)$ $\displaystyle\leq
h\left(\frac{1-\braket{XXX}}{2}\right)$
$\displaystyle=h\left(\frac{1-\left|\braket{XXX}\right|}{2}\right)$
$\displaystyle=h\left(\frac{1+\left|\braket{XXX}\right|}{2}\right),$ (B.60)

where we used the fact that $h(1/2-p/2)$ is symmetric in $p$ in the first
equality and that $h(p)=h(1-p)$ in the second equality.

By combining (B.57) and (B.60) we derive the following lower bound on
$H(Z|E)$:

$H(Z|E)\geq 1-h\left(\frac{1+\left|\braket{XXX}\right|}{2}\right).$ (B.61)

The rest of the proof focuses on proving the following inequality between the
expectation value $\braket{XXX}$ and the Bell value $\beta_{\mathrm{H}}$ of
the Holz inequality:

$\left|\braket{XXX}\right|\geq\frac{\beta_{\mathrm{H}}}{2}-\frac{1}{2}+\frac{1}{2}\sqrt{\beta_{\mathrm{H}}^{2}+2\beta_{\mathrm{H}}-3}.$
(B.62)

Indeed, by employing (B.62) in (B.61) we obtain the desired lower bound on the
conditional entropy (B.1).

We implicitly assume throughout the proof that $\beta_{\mathrm{H}}>1$,
otherwise without Bell violation the conditional entropy is trivially bounded
by zero. Moreover we assume that every inequality is to be proven for every
value of its parameters, unless otherwise stated.

To start with, we recast the inequality to be proven (B.62) as follows:

$2\left|\braket{XXX}\right|+1-\beta_{\mathrm{H}}\geq\sqrt{\beta_{\mathrm{H}}^{2}+2\beta_{\mathrm{H}}-3},$
(B.63)

which is true if and only if the following system of inequalities is true:

$\displaystyle(2\left|\braket{XXX}\right|+1-\beta_{\mathrm{H}})^{2}\geq\beta_{\mathrm{H}}^{2}+2\beta_{\mathrm{H}}-3$
(B.64a) $\displaystyle 2\left|\braket{XXX}\right|+1-\beta_{\mathrm{H}}\geq 0$
(B.64b)

First we focus on proving (B.64b). A sufficient condition for proving (B.64b)
is given by:

$\left|\braket{XXX}\right|+\braket{XXX}\sin a_{1}\cos b_{-}\cos
c_{-}+1-\beta_{\mathrm{H}}\geq 0,$ (B.65)

which reads as follows after employing (B.8):

$\displaystyle 1+\left|\braket{XXX}\right|\geq\cos a_{1}\cos b_{-}\cos
c_{-}\braket{ZXX}+\sin b_{-}\braket{ZZ\mathbbm{1}}+\sin
c_{-}\braket{Z\mathbbm{1}Z}-\sin b_{-}\sin c_{-}\braket{\mathbbm{1}ZZ}.$
(B.66)

The inequality in (B.66) is implied by another inequality, namely:

$\displaystyle 1\geq\left|\cos b_{-}\cos c_{-}\braket{ZXX}\right|+\sin
b_{-}\braket{ZZ\mathbbm{1}}+\sin c_{-}\braket{Z\mathbbm{1}Z}-\sin b_{-}\sin
c_{-}\braket{\mathbbm{1}ZZ}.$ (B.67)

Thus, it is sufficient that we prove the following inequality:

$\displaystyle C:=\cos b_{-}\cos c_{-}\braket{ZXX}+\sin
b_{-}\braket{ZZ\mathbbm{1}}+\sin c_{-}\braket{Z\mathbbm{1}Z}-\sin b_{-}\sin
c_{-}\braket{\mathbbm{1}ZZ}\leq 1$ (B.68)

for every value of $b_{-}$ and $c_{-}$ in order to show that (B.67), and hence
(B.66), holds. Indeed, the first term in (B.68) can always be made equal to
$\left|\cos b_{-}\cos c_{-}\braket{ZXX}\right|$ by replacing $b_{-}$ with
$\pi-b_{-}$ if the term is negative. Note that this replacement does not
affect the other terms.

To show that (B.68) holds, we start by exploiting the inverse relations
(B.23), (B.24) and (B.25), we compute the expectation values in (B.68) in
terms of the parameters $\\{\rho_{ijk},t_{jk}\\}$ describing the shared state
$\rho$. We obtain:

$\displaystyle\braket{ZXX}$
$\displaystyle=\sum_{j,k=0}^{1}(\rho_{0jk}-\rho_{1jk})\sin(2t_{jk})$ (B.69)
$\displaystyle\braket{ZZ\mathbbm{1}}$
$\displaystyle=\sum_{j,k=0}^{1}(-1)^{j}(\rho_{0jk}-\rho_{1jk})\cos(2t_{jk})$
(B.70) $\displaystyle\braket{Z\mathbbm{1}Z}$
$\displaystyle=\sum_{j,k=0}^{1}(-1)^{k}(\rho_{0jk}-\rho_{1jk})\cos(2t_{jk})$
(B.71) $\displaystyle\braket{\mathbbm{1}ZZ}$
$\displaystyle=\sum_{j,k=0}^{1}(-1)^{j+k}(\rho_{0jk}+\rho_{1jk}).$ (B.72)

By inserting the expectation values in the lhs of (B.68) we get:

$\displaystyle C=$
$\displaystyle\sum_{j,k=0}^{1}(\rho_{0jk}-\rho_{1jk})\left[\sin(2t_{jk})\cos
b_{-}\cos c_{-}+(-1)^{j}\cos(2t_{jk})\sin b_{-}+(-1)^{k}\cos(2t_{jk})\sin
c_{-}\right]$
$\displaystyle-\sum_{j,k=0}^{1}(-1)^{j+k}(\rho_{0jk}+\rho_{1jk})\sin b_{-}\sin
c_{-}.$ (B.73)

We upper bound $C$ by maximizing it over $t_{jk}$. In doing so we use the fact
that $\rho_{0jk}\geq\rho_{1jk}$ and that
$A\cos\theta+B\sin\theta\leq\sqrt{A^{2}+B^{2}}$. We thus obtain:

$\displaystyle C$
$\displaystyle\leq\sum_{j,k=0}^{1}(\rho_{0jk}-\rho_{1jk})\sqrt{\cos^{2}b_{-}\cos^{2}c_{-}+\sin^{2}b_{-}+\sin^{2}c_{-}+2(-1)^{j+k}\sin
b_{-}\sin c_{-}}$
$\displaystyle\quad-\sum_{j,k=0}^{1}(-1)^{j+k}(\rho_{0jk}+\rho_{1jk})\sin
b_{-}\sin c_{-}$
$\displaystyle=\sum_{j,k=0}^{1}(\rho_{0jk}-\rho_{1jk})\sqrt{\cos^{2}c_{-}+\sin^{2}b_{-}(1-\cos^{2}c_{-})+\sin^{2}c_{-}+2(-1)^{j+k}\sin
b_{-}\sin c_{-}}$
$\displaystyle\quad-\sum_{j,k=0}^{1}(-1)^{j+k}(\rho_{0jk}+\rho_{1jk})\sin
b_{-}\sin c_{-}$
$\displaystyle=\sum_{j,k=0}^{1}(\rho_{0jk}-\rho_{1jk})\sqrt{1+\sin^{2}b_{-}\sin^{2}c_{-}+2(-1)^{j+k}\sin
b_{-}\sin c_{-}}-\sum_{j,k=0}^{1}(-1)^{j+k}(\rho_{0jk}+\rho_{1jk})\sin
b_{-}\sin c_{-}$
$\displaystyle=\sum_{j,k=0}^{1}(\rho_{0jk}-\rho_{1jk})\left[1+(-1)^{j+k}\sin
b_{-}\sin c_{-}\right]-\sum_{j,k=0}^{1}(-1)^{j+k}(\rho_{0jk}+\rho_{1jk})\sin
b_{-}\sin c_{-}$
$\displaystyle=\sum_{j,k=0}^{1}(\rho_{0jk}-\rho_{1jk})+\sum_{j,k=0}^{1}(-1)^{j+k}\sin
b_{-}\sin c_{-}(\rho_{0jk}-\rho_{1jk}-\rho_{0jk}-\rho_{1jk})$
$\displaystyle\leq\sum_{j,k=0}^{1}(\rho_{0jk}-\rho_{1jk})+2\left|\sum_{j,k=0}^{1}(-1)^{j+k}\rho_{1jk}\right|$
$\displaystyle\leq\sum_{j,k=0}^{1}(\rho_{0jk}-\rho_{1jk})+2\sum_{j,k=0}^{1}\rho_{1jk}$
$\displaystyle=\sum_{i,j,k=0}^{1}\rho_{ijk}=1,$ (B.74)

where we maximized over $b_{-}$ and $c_{-}$ in the second inequality, used the
fact that $\rho_{ijk}\geq 0$ in the third inequality and that the eigenvalues
$\rho_{ijk}$ of $\rho$ sum to one in the last equality. We proved (B.68) and
thus proved (B.64b).

We now focus on proving (B.64a). By computing the square in the lhs of
(B.64a), we can recast the inequality as follows:

$\displaystyle\left(1+\left|\braket{XXX}\right|\right)\beta_{\mathrm{H}}\leq
1+\left|\braket{XXX}\right|+\braket{XXX}^{2}.$ (B.75)

We now insert (B.8) into the above expression and obtain:

$\displaystyle\left(1+\left|\braket{XXX}\right|\right)$
$\displaystyle\left(\cos a_{1}\cos b_{-}\cos c_{-}\braket{ZXX}+\sin a_{1}\cos
b_{-}\cos c_{-}\braket{XXX}+\sin b_{-}\braket{ZZ\mathbbm{1}}+\sin
c_{-}\braket{Z\mathbbm{1}Z}-\sin b_{-}\sin c_{-}\braket{\mathbbm{1}ZZ}\right)$
$\displaystyle\leq 1+\left|\braket{XXX}\right|+\braket{XXX}^{2}$ (B.76)

Now consider that the above inequality must be proven true for every value of
$a_{1}$. In particular it must hold true for $a_{1}$ and $2\pi-a_{1}$, which
is equivalent to having an arbitrary sign for the second term in the second
bracket. Then, we can equivalently express the fact that (B.76) must hold for
every $a_{1}$ as the requirement that the following inequality holds for every
$a_{1}$:

$\displaystyle\left(1+\left|\braket{XXX}\right|\right)$
$\displaystyle\left(\cos a_{1}\cos b_{-}\cos c_{-}\braket{ZXX}+\sin a_{1}\cos
b_{-}\cos c_{-}\left|\braket{XXX}\right|+\sin b_{-}\braket{ZZ\mathbbm{1}}+\sin
c_{-}\braket{Z\mathbbm{1}Z}-\sin b_{-}\sin c_{-}\braket{\mathbbm{1}ZZ}\right)$
$\displaystyle\leq 1+\left|\braket{XXX}\right|+\braket{XXX}^{2},$ (B.77)

where we replaced $\braket{XXX}$ with $\left|\braket{XXX}\right|$ in the
second term of the second bracket. By rearranging the terms in (B.77) we
obtain:

$\displaystyle\left|\braket{XXX}\right|^{2}(1-\sin a_{1}\cos b_{-}\cos
c_{-})+\left|\braket{XXX}\right|$ $\displaystyle(1-\sin a_{1}\cos b_{-}\cos
c_{-}-\cos a_{1}\cos b_{-}\cos c_{-}\braket{ZXX}-\sin
b_{-}\braket{ZZ\mathbbm{1}}-\sin c_{-}\braket{Z\mathbbm{1}Z}+\sin b_{-}\sin
c_{-}\braket{\mathbbm{1}ZZ})$ $\displaystyle+1-\cos a_{1}\cos b_{-}\cos
c_{-}\braket{ZXX}-\sin b_{-}\braket{ZZ\mathbbm{1}}-\sin
c_{-}\braket{Z\mathbbm{1}Z}+\sin b_{-}\sin c_{-}\braket{\mathbbm{1}ZZ}\geq 0.$
(B.78)

A sufficient condition for (B.78) to be true is when the second degree
equation, obtained by replacing $\left|\braket{XXX}\right|$ with a generic
variable $x$ and taking the equals sign in (B.78), has no solution or only one
solution in $\mathbbm{R}$. Indeed, in that case the parabola defined by the
lhs of (B.78) never intersects the $x$ axis and always sits above zero (except
at most in one point), thus proving the inequality666We can conclude this
since the parabola described by the lhs of (B.78) is concave upward, which we
deduce from the positivity of the coefficient of $\braket{XXX}^{2}$. In the
special case where $\sin a_{1}\cos b_{-}\cos c_{-}=1$, the inequality (B.78)
is trivially satisfied.. Therefore, a sufficient condition for (B.78) to be
true is having the discriminant of the second degree equation smaller or equal
to zero:

$\displaystyle(1-\sin a_{1}\cos b_{-}\cos c_{-}-\cos a_{1}\cos b_{-}\cos
c_{-}\braket{ZXX}-\sin b_{-}\braket{ZZ\mathbbm{1}}-\sin
c_{-}\braket{Z\mathbbm{1}Z}+\sin b_{-}\sin c_{-}\braket{\mathbbm{1}ZZ})^{2}$
$\displaystyle-4(1-\sin a_{1}\cos b_{-}\cos c_{-})(1-\cos a_{1}\cos b_{-}\cos
c_{-}\braket{ZXX}-\sin b_{-}\braket{ZZ\mathbbm{1}}-\sin
c_{-}\braket{Z\mathbbm{1}Z}+\sin b_{-}\sin c_{-}\braket{\mathbbm{1}ZZ})\leq
0,$ (B.79)

which can be rewritten as

$\displaystyle(1-\sin a_{1}\cos b_{-}\cos c_{-}+\cos a_{1}\cos b_{-}\cos
c_{-}\braket{ZXX}+\sin b_{-}\braket{ZZ\mathbbm{1}}+\sin
c_{-}\braket{Z\mathbbm{1}Z}-\sin b_{-}\sin c_{-}\braket{\mathbbm{1}ZZ})^{2}$
$\displaystyle\leq 4(1-\sin a_{1}\cos b_{-}\cos c_{-}),$ (B.80)

and hence as

$\displaystyle\left|1-\sin a_{1}\cos b_{-}\cos c_{-}+\cos a_{1}\cos b_{-}\cos
c_{-}\braket{ZXX}+\sin b_{-}\braket{ZZ\mathbbm{1}}+\sin
c_{-}\braket{Z\mathbbm{1}Z}-\sin b_{-}\sin c_{-}\braket{\mathbbm{1}ZZ}\right|$
$\displaystyle\leq 2\sqrt{1-\sin a_{1}\cos b_{-}\cos c_{-}}.$ (B.81)

We now remove the absolute value by splitting the previous inequality into an
equivalent system of inequalities:

$\displaystyle 1-\sin a_{1}\cos b_{-}\cos c_{-}+\cos a_{1}\cos b_{-}\cos
c_{-}\braket{ZXX}+\sin b_{-}\braket{ZZ\mathbbm{1}}+\sin
c_{-}\braket{Z\mathbbm{1}Z}-\sin b_{-}\sin c_{-}\braket{\mathbbm{1}ZZ}$
$\displaystyle\leq 2\sqrt{1-\sin a_{1}\cos b_{-}\cos c_{-}}$ (B.82a)
$\displaystyle-(1-\sin a_{1}\cos b_{-}\cos c_{-}+\cos a_{1}\cos b_{-}\cos
c_{-}\braket{ZXX}+\sin b_{-}\braket{ZZ\mathbbm{1}}+\sin
c_{-}\braket{Z\mathbbm{1}Z}-\sin b_{-}\sin c_{-}\braket{\mathbbm{1}ZZ})$
$\displaystyle\leq 2\sqrt{1-\sin a_{1}\cos b_{-}\cos c_{-}}$ (B.82b)

which can be rearranged as follows:

$\displaystyle\cos a_{1}\cos b_{-}\cos c_{-}\braket{ZXX}+\sin
b_{-}\braket{ZZ\mathbbm{1}}+\sin c_{-}\braket{Z\mathbbm{1}Z}-\sin b_{-}\sin
c_{-}\braket{\mathbbm{1}ZZ}$ $\displaystyle\leq\sqrt{1-\sin a_{1}\cos
b_{-}\cos c_{-}}(2-\sqrt{1-\sin a_{1}\cos b_{-}\cos c_{-}})$ (B.83a)
$\displaystyle-\cos a_{1}\cos b_{-}\cos c_{-}\braket{ZXX}-\sin
b_{-}\braket{ZZ\mathbbm{1}}-\sin c_{-}\braket{Z\mathbbm{1}Z}+\sin b_{-}\sin
c_{-}\braket{\mathbbm{1}ZZ}$ $\displaystyle\leq\sqrt{1-\sin a_{1}\cos
b_{-}\cos c_{-}}(2+\sqrt{1-\sin a_{1}\cos b_{-}\cos c_{-}}).$ (B.83b)

We emphasize that once we prove (B.83a) and (B.83b) we are done, since this is
a sufficient condition for the validity of (B.64a).

We first observe that (B.83a), together with a simple inequality to be proved,
implies (B.83b). In order to see this, let us label the lhs and rhs of (B.83a)
as $l$ and $r$, respectively, so that (B.83a) can be written as $l\leq r$. Now
notice that since (B.83b) must be proved for every angle $a_{1}$, $b_{-}$ and
$c_{-}$, we can obtain an equivalent inequality by replacing
$a_{1}\rightarrow\pi-a_{1}$, $b_{-}\rightarrow-b_{-}$ and $c_{-}\rightarrow-
c_{-}$ and requiring that the new inequality is satisfied for every $a_{1}$,
$b_{-}$ and $c_{-}$. The resulting inequality reads:

$\displaystyle\cos a_{1}\cos b_{-}\cos c_{-}\braket{ZXX}+\sin
b_{-}\braket{ZZ\mathbbm{1}}+\sin c_{-}\braket{Z\mathbbm{1}Z}+\sin b_{-}\sin
c_{-}\braket{\mathbbm{1}ZZ}$ $\displaystyle\leq\sqrt{1-\sin a_{1}\cos
b_{-}\cos c_{-}}(2+\sqrt{1-\sin a_{1}\cos b_{-}\cos c_{-}}),$ (B.84)

and can be recast in terms of $l$ and $r$ as follows:

$\displaystyle l+2\sin b_{-}\sin c_{-}\braket{\mathbbm{1}ZZ}\leq r+2(1-\sin
a_{1}\cos b_{-}\cos c_{-}).$ (B.85)

Now assuming that (B.83a) holds, (B.84) –and hence (B.83b)– follows upon
proving that the following inequality is true:

$\sin b_{-}\sin c_{-}\braket{\mathbbm{1}ZZ}\leq 1-\sin a_{1}\cos b_{-}\cos
c_{-}.$ (B.86)

The proof of (B.86) is easily obtained from the following sufficient condition
for its validity:

$\left|\sin b_{-}\sin c_{-}\right|+\left|\cos b_{-}\cos c_{-}\right|\leq 1,$
(B.87)

which is trivially true for $b_{-},c_{-}\in[0,\pi/2]$ since

$1\geq\cos(b_{-}-c_{-})=\sin b_{-}\sin c_{-}+\cos b_{-}\cos c_{-}=\left|\sin
b_{-}\sin c_{-}\right|+\left|\cos b_{-}\cos c_{-}\right|.$ (B.88)

Note that for angles outside the interval $[0,\pi/2]$ similar arguments can be
made.

We are thus left to prove that (B.83a) holds. In order to do so, we again
express the expectation values in (B.83a) in terms of the parameters
describing the shared state $\rho$:

$\displaystyle\sum_{j,k=0}^{1}(\rho_{0jk}-\rho_{1jk})\left[\cos a_{1}\cos
b_{-}\cos c_{-}\sin(2t_{jk})+(-1)^{j}\sin b_{-}\cos(2t_{jk})+(-1)^{k}\sin
c_{-}\cos(2t_{jk})\right]$
$\displaystyle-\sum_{j,k=0}^{1}(-1)^{j+k}(\rho_{0jk}+\rho_{1jk})\sin b_{-}\sin
c_{-}\leq\sqrt{1-\sin a_{1}\cos b_{-}\cos c_{-}}(2-\sqrt{1-\sin a_{1}\cos
b_{-}\cos c_{-}})$ (B.89)

We find a sufficient condition for (B.89) by maximizing the lhs over $t_{jk}$.
In doing so, we use the fact that $\rho_{0jk}\geq\rho_{1jk}$ and that
$A\cos\theta+B\sin\theta\leq\sqrt{A^{2}+B^{2}}$. We obtain:

$\displaystyle\sum_{j,k=0}^{1}(\rho_{0jk}-\rho_{1jk})\sqrt{\cos^{2}a_{1}\cos^{2}b_{-}\cos^{2}c_{-}+\sin^{2}b_{-}+\sin^{2}c_{-}+2(-1)^{j+k}\sin
b_{-}\sin c_{-}}$
$\displaystyle-\sum_{j,k=0}^{1}(-1)^{j+k}(\rho_{0jk}+\rho_{1jk})\sin b_{-}\sin
c_{-}\leq\sqrt{1-\sin a_{1}\cos b_{-}\cos c_{-}}(2-\sqrt{1-\sin a_{1}\cos
b_{-}\cos c_{-}}).$ (B.90)

In turn, a sufficient condition for (B.90) is given by:

$\displaystyle\sum_{j,k=0}^{1}\tau_{jk}\left[\sqrt{\cos^{2}a_{1}\cos^{2}b_{-}\cos^{2}c_{-}+\sin^{2}b_{-}+\sin^{2}c_{-}+2(-1)^{j+k}\sin
b_{-}\sin c_{-}}-(-1)^{j+k}\sin b_{-}\sin c_{-}\right]$
$\displaystyle\leq\sqrt{1-\sin a_{1}\cos b_{-}\cos c_{-}}(2-\sqrt{1-\sin
a_{1}\cos b_{-}\cos c_{-}}),$ (B.91)

where we defined $\tau_{jk}:=\rho_{0jk}+\rho_{1jk}$. We recast (B.91) in the
following chain of equivalent inequalities:

$\displaystyle\quad\sum_{j,k=0}^{1}\tau_{jk}\left[\sqrt{(1-\sin^{2}b_{-})\cos^{2}c_{-}+\sin^{2}b_{-}+\sin^{2}c_{-}+2(-1)^{j+k}\sin
b_{-}\sin c_{-}-\sin^{2}a_{1}\cos^{2}b_{-}\cos^{2}c_{-}}\right.$
$\displaystyle\quad\left.-(-1)^{j+k}\sin b_{-}\sin
c_{-}\right]\leq\sqrt{1-\sin a_{1}\cos b_{-}\cos c_{-}}(2-\sqrt{1-\sin
a_{1}\cos b_{-}\cos c_{-}})$
$\displaystyle\Leftrightarrow\,\,\sum_{j,k=0}^{1}\tau_{jk}\left[\sqrt{1+\sin^{2}b_{-}\sin^{2}c_{-}+2(-1)^{j+k}\sin
b_{-}\sin c_{-}-\sin^{2}a_{1}\cos^{2}b_{-}\cos^{2}c_{-}}-(-1)^{j+k}\sin
b_{-}\sin c_{-}\right]$ $\displaystyle\quad\leq\sqrt{1-\sin a_{1}\cos
b_{-}\cos c_{-}}(2-\sqrt{1-\sin a_{1}\cos b_{-}\cos c_{-}})$
$\displaystyle\Leftrightarrow\,\,\sum_{j,k=0}^{1}\tau_{jk}\left[\sqrt{(1+(-1)^{j+k}\sin
b_{-}\sin c_{-})^{2}-\sin^{2}a_{1}\cos^{2}b_{-}\cos^{2}c_{-}}-(-1)^{j+k}\sin
b_{-}\sin c_{-}\right]$ $\displaystyle\quad\leq\sqrt{1-\sin a_{1}\cos
b_{-}\cos c_{-}}(2-\sqrt{1-\sin a_{1}\cos b_{-}\cos c_{-}})$
$\displaystyle\Leftrightarrow\,\,(\tau_{00}+\tau_{11})A+(\tau_{01}+\tau_{10})B\leq\sqrt{1-\sin
a_{1}\cos b_{-}\cos c_{-}}(2-\sqrt{1-\sin a_{1}\cos b_{-}\cos c_{-}})$ (B.92)

where in the last inequality we defined:

$\displaystyle A:=\sqrt{(1+\sin b_{-}\sin
c_{-})^{2}-\sin^{2}a_{1}\cos^{2}b_{-}\cos^{2}c_{-}}-\sin b_{-}\sin c_{-}$
(B.93) $\displaystyle B:=\sqrt{(1-\sin b_{-}\sin
c_{-})^{2}-\sin^{2}a_{1}\cos^{2}b_{-}\cos^{2}c_{-}}+\sin b_{-}\sin c_{-}.$
(B.94)

Now, a sufficient condition for (B.92) is obtained by replacing $A$ and $B$ by
$\max\\{A,B\\}$. However, since $A$ and $B$ can be mapped to each other under
$b_{-}\leftrightarrow-b_{-}$ and since (B.92) must hold for every $b_{-}$, we
can always assume that $A\geq B$. Thus we replace $B$ with $A$ in (B.92) and
use the fact that $\sum_{j,k}\tau_{jk}=1$ to obtain the following sufficient
condition for (B.83a):

$\displaystyle\sqrt{(1+\sin b_{-}\sin
c_{-})^{2}-\sin^{2}a_{1}\cos^{2}b_{-}\cos^{2}c_{-}}-\sin b_{-}\sin
c_{-}\leq\sqrt{1-\sin a_{1}\cos b_{-}\cos c_{-}}(2-\sqrt{1-\sin a_{1}\cos
b_{-}\cos c_{-}}),$ (B.95)

which is equivalent to:

$\displaystyle\sqrt{(1+\sin b_{-}\sin c_{-})^{2}-(\sin a_{1}\cos b_{-}\cos
c_{-})^{2}}\leq\sin b_{-}\sin c_{-}+2\sqrt{1-\sin a_{1}\cos b_{-}\cos
c_{-}}-(1-\sin a_{1}\cos b_{-}\cos c_{-}).$ (B.96)

By taking the square of both sides in the last inequality, we obtain the
equivalent system of inequalities:

$\displaystyle(1+\sin b_{-}\sin c_{-})^{2}-(\sin a_{1}\cos b_{-}\cos
c_{-})^{2}$ $\displaystyle\leq\left[\sin b_{-}\sin c_{-}+2\sqrt{1-\sin
a_{1}\cos b_{-}\cos c_{-}}-(1-\sin a_{1}\cos b_{-}\cos c_{-})\right]^{2}$
(B.97a) $\displaystyle\sin b_{-}\sin c_{-}+2\sqrt{1-\sin a_{1}\cos b_{-}\cos
c_{-}}-(1-\sin a_{1}\cos b_{-}\cos c_{-})\geq 0.$ (B.97b)

We first focus on proving (B.97b). If $\sin a_{1}\cos b_{-}\cos c_{-}=1$, then
the inequality (B.97b) is trivially true. If $\sin a_{1}\cos b_{-}\cos
c_{-}\neq 1$, we can recast (B.97b) as follows:

$2\geq\sqrt{1-\sin a_{1}\cos b_{-}\cos c_{-}}-\frac{\sin b_{-}\sin
c_{-}}{\sqrt{1-\sin a_{1}\cos b_{-}\cos c_{-}}},$ (B.98)

and deduce the following sufficient condition:

$\frac{\left|\sin b_{-}\sin c_{-}\right|}{\sqrt{1-\sin a_{1}\cos b_{-}\cos
c_{-}}}\leq 1\quad\Leftrightarrow\quad\left|\sin b_{-}\sin
c_{-}\right|\leq\sqrt{1-\sin a_{1}\cos b_{-}\cos c_{-}}.$ (B.99)

The validity of the last inequality can be easily proved from (B.87) and from
the fact that $1-\sin a_{1}\cos b_{-}\cos c_{-}\leq\sqrt{1-\sin a_{1}\cos
b_{-}\cos c_{-}}$. This completes the proof of (B.97b).

We now focus on proving (B.97a). For ease of notation, we define the variables
$s$ and $c$ as follows:

$\displaystyle s:=\sin b_{-}\sin c_{-}$ (B.100) $\displaystyle c:=\sin
a_{1}\cos b_{-}\cos c_{-}.$ (B.101)

Then (B.97a) can be recast as follows:

$\displaystyle(1+s)^{2}-c^{2}\leq\left[s+2\sqrt{1-c}-(1-c)\right]^{2}$
$\displaystyle\Leftrightarrow\,\,1+s^{2}+2s-c^{2}\leq
4(1-c)+(s+c-1)^{2}+4\sqrt{1-c}(s+c-1)$
$\displaystyle\Leftrightarrow\,\,2s-c^{2}\leq
4(1-c)-2s+c^{2}-2c(1-s)+4\sqrt{1-c}(s+c-1)$
$\displaystyle\Leftrightarrow\,\,2c^{2}+4-4c-4s-2c(1-s)+4\sqrt{1-c}(s+c-1)\geq
0$ $\displaystyle\Leftrightarrow\,\,1+(1-c)^{2}-2s-c+cs+2\sqrt{1-c}(s+c-1)\geq
0$
$\displaystyle\Leftrightarrow\,\,(1-c)^{2}+(1-c)-s(1-c)+2s\sqrt{1-c}-2\sqrt{1-c}(1-c)-s\geq
0$
$\displaystyle\Leftrightarrow\,\,(1-c)^{2}-2\sqrt{1-c}(1-c)+(1-c)(1-s)+2s\sqrt{1-c}-s\geq
0.$ (B.102)

We now view (B.102) as a fourth degree inequality in the variable
$x:=\sqrt{1-c}$, i.e. we rewrite it as follows:

$f(x):=x^{4}-2x^{3}+(1-s)x^{2}+2sx-s\geq 0.$ (B.103)

Then a sufficient condition for the validity of (B.102) is that $f(x)\geq 0$
for every $x\in[0,\sqrt{2}]$, which is the domain induced by the definition of
$x$. Nevertheless, if there are intervals in the domain where $f(x)<0$,
inequality (B.102) can still hold true as far as such intervals are not
compatible with the underlying definitions of $s$ and $c$ given in (B.100) and
(B.101). We will see that this is indeed the case.

In order to study the plot of $f(x)$, we first find its zeroes777We used
Mathematica’s “Reduce” function to easily find the zeroes of $f(x)$. for
different parametric regions of $s$:

  * •

If $-1\leq s<0$, then $f(x)$ has only one zero in $x_{0}=1$. Since
$f(1/2)=1/16-s/4>0$ and $f(x)$ is a $C^{\infty}$ function, we conclude that
$f(x)\geq 0$ for $x\in[0,1]$. Similarly, $f(5/4)=241/256-s/16>0$ which implies
that $f(x)\geq 0$ for $x\in[1,\sqrt{2}]$. Thus we conclude that $f(x)\geq 0$
in all its domain.

  * •

If $s=0$ then $f(x)=x^{2}(1-x^{2})\geq 0$ for every $x$.

  * •

If $s=1$ then it follows from (B.101) that $c=0$ and thus $x=1$. We have that
$f(1)|_{s=1}=0$.

  * •

If $0<s<1$, then $f(x)$ has three zeroes in $x_{0}=-\sqrt{s}$,
$x^{\prime}_{0}=\sqrt{s}$ and $x^{\prime\prime}_{0}=1$. Since
$f(\sqrt{s}/2)=-3s(1-\sqrt{s})/4-3s^{2}/16<0$, we conclude that $f(x)\leq 0$
for $x\in[0,\sqrt{s}]$.