{'fraction_non_alphanumeric': 0.04738460961383372, 'fraction_numerical': 0.01113111648755603, 'mean_word_length': 4.301466567238379, 'pattern_counts': {'":': 0, '<': 3, '<?xml version=': 0, '>': 5, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 24, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
Limitations on device independent key secure against non signaling adversary via the squashed non-locality

We initiate a systematic study to provide upper bounds on device-independent key, secure against a non-signaling adversary (NSDI). We employ the idea of"squashing"on the secrecy monotones and show that squashed secrecy monotones are the upper bounds on the NSDI key. Our technique for obtaining upper bounds is based on the non-signaling analog of quantum purification: the complete extension. As an important instance of an upper bound, we construct a measure of nonlocality called"squashed nonlocality". Using this bound, we identify numerically a certain domain of two binary inputs and two binary outputs non-local devices for which the squashed nonlocality is zero. Therefore one can not distill secure-key from these non-local devices via a considered (standard) class of operations. Showing a connection of our approach to [New J. Phys., 8:126, 2006] we provide, to our knowledge, the tightest known upper bound in the (3,2,2,2) scenario. Moreover, we formulate a security condition, equivalent to known ones, for the considered class of protocols. To achieve this, we introduce a non-signaling norm that constitutes an analogy to the trace norm used in the security condition of the quantum key distribution.


Introduction:
Secure key distribution is a process of generation of secret key bits between two distant parties, in presence of an eavesdropper [1][2][3]. There are four major cryptographic security paradigms developed in the last several decades that provide a background for our investigation. These are: (i) secret key agreement scenario (SKA) [1][2][3][4], (ii) device-dependent security against a quantum adversary (QDD) [4][5][6][7], (iii) deviceindependent security against a quantum adversary (QDI) [5,[8][9][10][11][12][13] and (iv) device-independent security against a non-signaling adversary (NSDI) [14][15][16][17], see [3] for a review. We have enumerated them in order of increasing power of the eavesdropper. In what follows, we are going to use concepts of SKA paradigm to place upper bounds on the secret key rate in the NSDI scenario in a manner that is known from the QDD paradigm. Let us then begin with a short reminder of the main ideas behind the aforementioned cryptographic setups.
In the SKA scenario, the parties share marginals of a classical probability distribution P (ABE), respectively. The honest parties (often called Alice and Bob) can process their data by the so-called Local Operations and Public Communication (LOPC). At the same time, the eavesdropper Eve can listen to public communication and can apply any stochastic map on her data [1,2]. This paradigm is of special interest in context of security of the wireless communication.
The QDD scenario, originating conceptually from the SKA, was introduced at the early stage of quantum cryptography [4,5]. In this paradigm, the three parties share (in the worst case) a subsystem of a joined pure quantum state |Ψ ABE . Alice and Bob can process this state by Local quantum Operations and Classical Communication (LOCC). At the same time, Eve obtains any system which is discarded by Alice and Bob and can perform any quantum operation on her subsystem [18][19][20]. This scenario has a drawback that Alice and Bob have to trust the inner working of their device: the dimensionality of the state and operations of measurement performed by the device. This problem has been resolved in a much more sophisticated approach of QDI, quantum device-independent scenario. In this paradigm, the honest parties share an untrusted device, described by a joint conditional probability distribution P (AB|XY ) originating from a measurement on a quantum state ρ AB : P (AB|XY ) = Tr(M A|X ⊗ M B|Y ρ AB ). Security in this scenario is based solely on statistics of the inputs X, Y , and outputs A, B of the device. Eavesdropper is assumed to be restricted by the laws of quantum mechanics. She is therefore bound to hold a purifying system of a ρ AB i.e., the system E of such a pure state |ψ ABE , that Tr E |ψ ψ| ABE = ρ AB .
Non-signaling adversary scenario: In this manuscript, we focus on another branch of key distribution that has emerged in the last two decades, which is the nonsignaling device-independent (NSDI) scenario [10,[14][15][16][17][21][22][23]. This scenario has even more relaxed assumptions than QDI. Here, the eavesdropper is restricted only by the non-signaling condition, i.e., she can not influence statistics of the honest parties in a faster than light manner. Similarly the honest parties can share a possibly supra-quantum correlation only constrained by the non-signaling condition. The advantage of NSDI approach over SKA, QDD, and QDI scenarios is the fact that it assures security even if a new theory replacing quantum mechanics became established, as long as it is non-signaling. The object shared by Alice, Bob, and Eve is a tripartite non-signaling device, P (ABE|XY Z), with Z and E being the input and output respectively of Eve's part of the device. On this device, the parties perform some measurements (X, Y ) and post-process their output data (A, B) by some LOPC operations, to produce the secure key. This device is assumed to be (in a worst-case) created by the eavesdropper who can listen to the public communication, and perform certain operations on her subsystem.
The first NSDI protocol, whose security was proven, was given by Barrett, Hardy, and Kent [14]. The protocol results in a single key bit in the noiseless scenario. Later, lower bounds on the key rate have been derived in [10,16,22], via several key distillation protocols, under the assumption that eavesdropper attacks each of the subsystems separately. In the presence of a collective eavesdropping attack, it was shown in Refs. [15,17,23], that one can obtain a non-zero key rate under the fully non-signaling constraint. By fully non-signaling, we mean that none of the subsystems of a device can signal to each other. More precisely, a device with 2N + 1 inputs and 2N + 1 outputs (N for each of the honest parties and one for the eavesdropper) is understood to have 2N + 1 subsystems none subset k of which can signal to the remaining 2N + 1 − k. 1 This assumptions is vital, because if the device can perform signaling between its subsystems (of one party) [24], then no hash function is known to achieve privacy amplification against the nonsignaling eavesdropper. Moreover, if the device has a memory [25,26], or can signal forward (from one run 2 of the protocol to the next one) [27], then a wide class of hash functions can be attacked by a non-signaling Eve.
The assumption of full non-signaling can be achieved by performing measurements in parallel on all of the 2N subsystems. We refer to this approach as to parallel measurement model.
The non-signaling paradigm that allows defining the NSDI scenario became an active field of research since the seminal papers of Rastall [28], Khalfin, and Tsirelson [29] as well as Popescu and Rohrlich [30] (for a recent review on Bell non-locality see [8]). Our findings will contribute not only to the aforementioned cryptographic scenarios (NSDI and SKA) but also to the domain of Bell non-locality. This is because some of the functions that serve as upper bounds on the key rate that we establish in the NSDI scenario, are novel measures of non-locality.
Motivation: In the NSDI scenario described above, mainly the lower bounds on the key rate has been considered [10,[14][15][16][17][21][22][23], while general upper bounds remain unknown (an upper bound for specific protocol was considered [10]). In contrast, if one considers the QDD scenario, both lower bounds [18,31], and upper bounds [31][32][33] on the secure key rate are well known. Some of them are based on the entanglement measure called "squashed entanglement" [33]. A welcome feature of this measure is that it is an additive function, i.e., one avoids regularization like it is the case for the relative entropy of entanglement [19,20,35]. We aim at both constructing upper bounds in the NSDI scenario and introducing novel measures of non-locality. Although the analog of relative entropy -the "strength of non-locality proof" [36] (also called relative entropy of non-locality [37]) has been constructed, no analog of squashed entanglement was known in the realm of non-locality (for the parallel, and different approach see [38]). In our approach to the problem, we are guided by an analogy between entanglement and non-locality.
Main results: In this manuscript, we construct upper bounds on the NSDI key rate, distillable via (i) direct measurement, changing device into a distribution followed by (ii) Local Operations and Public Communication (denoted together as MDLOPC operations). Aiming at upper bounds, we study the scenario in which the shared device consists of N independent and identically distributed (iid) copies of a non-signaling device P (AB|XY ). We define a wide class of secrecy quantifiers taken from the so-called SKA (secure key agreement) model [2]. One such quantifier, we call the squashed nonlocality, as we define it in analogy to squashed entanglement [33], however, in the realm of non-signaling devices. We then show that the squashed non-locality serves as an upper bound on the key distilled by MDLOPC operations. It is important to note that almost all of the secure key distillation protocols in QDI and NSDI, proposed so far, belong to the MDLOPC class of operations (see however recent proposal [34]). Therefore, our bounds, on the amount of key, bound from above the key rate achieved by a wide class of practical protocols.
Using the bound, we then obtain numerically a region of non-local two binary input and two binary output, (2, 2, 2, 2) devices, from which no key can be distilled via MDLOPC operations. These are the "isotropic" mixtures of the devices, namely the Popescu-Rohrlich (PR) box and the box complementarity to it, the anti-PR box when the admixture of the PR box is less than 80%. Notably, this result implies that in parallel measurement model, when the same measurement on each device is performed, non-locality does not imply secrecy. We compare the upper bound via non-signaling squashed nonlocality for isotropic devices with the lower bound on the key rate taken from [17] (see figure 3).
The squashed non-locality, as we prove, possesses many properties of those desired for a measure of non-locality such as convexity and additivity. The generality of our approach stems from the fact that we also provide a method of generating tighter (though possibly harder to compute) upper bounds. Indeed, in defining the squashed non-locality, we used the secrecy monotone called intrinsic information. One can, however, use some other monotone, e.g., the so-called reduced intrinsic mutual information, which also leads to an upper bound. Due to an analogy between entanglement and non-locality, the upper bounds we provide here are also measures of non-locality, and as such, can be studied independently.
We finally compare the proposed security criteria with the previously known ones [10,17], and prove their equivalence. In the case of quantum mechanics, the power of eavesdropper is fully described by system of the honest parties through the so-called purification. However, it is known that there is no analog of the quantum purification in the realm of devices [41,42]. To overcome this problem, we have used a recently introduced notion of complete extension [43], to describe the eavesdropper's power. The complete extension, E(P )(ABE|XY Z), of the shared device P (AB|XY ), is the worst-case extension that Eve can share with the honest parties. It is the worst case in the sense that it gives the eavesdropper an ultimate power as compared to quantum purification does in QDD and QDI scenarios. Indeed, the complete extension gives access to all possible ensembles of the device of the honest parties, when randomizing input and post-processing channel is applied on the extended part. It implies, as we show in detail, that this structural approach is equivalent to the one proposed in [17].
We have further introduced a novel criterion of security, based on an operational distance measure between non-signaling devices -the non-signlaing norm (NS norm) analogous to the trace norm in quantum mechanics (related to the one given in [44]). We have also proved equivalence between our criteria and the two proposed so far in [10] and [17], respectively. As a byproduct, we have shown that the latter two definitions are equivalent. By proving equivalence of our definition based on ||.|| N S norm to the definition of [17], we have shown that the former is composable, in a sense given in [17] 3 . A visualization of some of the main results that contribute to developing a structural analogy between SKA, QDD, and NSDI are presented in Figure 1.
Security definition in the IID scenario: In every DI secure key distillation protocol, the honest parties perform several numbers of test runs to estimate the non-local correlation present in the system and a (larger) number of key generation runs to generate the raw key. The raw key is further processed to yield the final key only if the device has passed the test run, i.e., the data are compatible with a sufficiently non-local device. Aiming at upper bounds, we study only the performance of the key generation runs. We, therefore, assume that, on the N iid (identical, independently distributed) 4 copies of the shared device P (AB|XY ) ⊗N , the honest parties perform full direct measurement [M F x,y ] ⊗N , by setting X = x (Alice) and Y = y (Bob) at their choice, followed by any composition of classical post-processing of the distribution P (AB|xy), and public communication (denoted as Q). These operations result in a pair of random variables (S A , S B ) that represents the key. That is, on the outputs of the measured device, the honest parties perform an LOPC protocol. An operation performed on a device, that is a composition of the direct measurements and an LOPC operations we call Measurement on Device Local Operation and Public Communication operation (MDLOPC).
In NSDI scenario Eve collects all the public communication Q, and then post-process her data represented byP (E|Z, Q). She can also perform a wider class of operations than the honest parties, including the general measurement M G z = z p(z|z )M F z . This is equivalent to a probabilistic choice of the inputs for direct measurements. She can do so by the general measurement M G z , by wiring the output of her local auxiliary device (a dice), that generates a random conditional probability distribution p(z|z ), to the input of her part of the device, i.e., Z ofP (E|Z, Q). However, the ultimate power of eavesdropping in this scenario is fixed by definition of the class of operations that a hypothetical agent called distinguisher could perform. It is assumed that distinghuisher has access to both the output of the protocol (i.e., the keys of the honest parties) and the Eve's deviceP (E|Z, Q). By his operations, distinguisher should be almost not able to tell apart this so-called "real" device P real (S A , S B , Q, E|Z) from an "ideal" one i.e., containing perfectly uniform and correlated keys, product with Eve's system.
We can specify now what the key distillation protocol is. A protocol of key distillation is a sequence of MD-LOPC operations Λ = {Λ N }, performed by the honest parties on N iid copies of the shared devices. Each of this Λ N , consists of a measurement stage {M N }, followed by post-processing {P N }, on N iid copies of P (AB|XY ). Moreover, for each consecutive, complete extension of N copies of shared devices E(P ⊗N )(ABE|XY Z), the protocol outputs a probability distribution in part of Alice and Bob and a device in part of Eve, which is arbitrarily close to an ideal distribution, satisfies Here P out = Λ N E P ⊗N . Moreover A = A 1 A 2 . . . A N , B, X and Y are similarly defined. The tensor product should be understood as a "max" tensor product in R N space [47]. To measure the closeness between two devices P and P , we use the newly defined distance measure, the NS norm which reads where G, is a set of certain operations that map a device to probability distributions and ||.|| 1 is a variational distance between two distributions. More precisely, operations from G are convex combinations of operations that can be composed of the following basic ones (i) fetching an auxiliary device that has single input and single output (a dice) (ii) connecting the output of a device/dice to the input of a dice/device respectively, called wirings (iii) pre-processing the inputs of device(s) (iv) post-processing inputs and outputs of the devices. We call them generating operations 5 , and refer to this norm as to non-signaling norm. The set of generating operations G is a subset of all linear operations L mapping device to distribution, that were considered in [44]. Operational characterization of the set L is interesting, yet, to our knowledge, unresolved task. However, as we show (see Proposition 1), the set G ⊆ L has enough power in discriminating between devices, to be used in security definition in place of L. Indeed, N S norm via Eq.
(2) leads to security definition, which is equivalent to the other two already present in literature ( [10] and [48,49]). For more detailed discussion, see Sec. III of the Appendix.
After the MDLOPC key distribution protocol, the output of the honest parties reduces to a classicalclassical-probability distribution, whereas the part shared by Eve still remains a device, of the form where s A and s B are the instances of the key shared between Alice and Bob. We will denote random variables S A , S B for the secret keys in possession of Alice and Bob, whereas Q stands for all possible classical communications between Alice and Bob; E, Z for Eve's output and input (and the lower case letters are for their values). This distribution, which is, in part a probability distribution, and in part a conditional probability distribution, i.e., device. Hence we will refer to it as to "classical-classicaldevice" (cc-d) distribution throughout the paper. The , is an ideal cc-d distribution which contains uniform and perfectly correlated outcomes shared between the honest parties. Eve is completely uncorrelated in case of this distribution, and it is assumed that Eve's system is the same as she possesses at the end of the real protocol Λ N .
For the cc-d distribution shared at the end of the MD-LOPC protocol, the NS norm given in Eq. (2) takes a more simplified form, stated in the following Proposition: Proposition 1. For the cc-d states P and R shared at the end of the MDLOPC protocol Λ N , the NS norm can be rephrased with a simplified expression: where max z , stands for the maximization over all possible direct measurements performed by the eavesdropper. 5 Name for these operations stems from the fact that they are proven in [43] to generate from the complete extension any possible other non-signaling extension of a conditional probability distribution.
Proof. For the proof, see Sec. III of the Appendix. In the above equality, one can see that the adopted definition of security is equivalent to the one used in [10,50] in the case of the NSDI scenario (the latter is defined as in RHS of the (3). This justifies our security definition given in Eq. (1), in particular, the choice of the set of operations G, that define the NS norm ||.|| N S . However, in literature another definition of security is adopted, given in [17,48,49]. This one is based on assuring high correlations between the parties and low correlations with the eavesdropper. In this approach, Eve can generate ensembles of the device of the honest parties i.e., representation of a device as probabilistic mixtures of devices. In later part of this manuscript we show that the latter definition is also equivalent to the newly proposed one based on the NS norm. By doing so, as a byproduct, we have also proven that our, and the two definitions given in [10,50] and [17,48,49] respectively, are equivalent. The definition of the secret key rate, based on the notion of the (i) complete extension and (ii) the key distillation protocol, satisfying the proximity in the NS norm security criterion according to the Eq. (3), is given below. Definition 1. Given a bipartite device P ≡ P (AB|XY ) the secret key rate of the protocol of key distillation Λ N , on N iid copies of the device, denoted by R ( Λ| P ) is a number lim sup N →∞ log d N N , where log d N is the length of a secret key shared between Alice and Bob, with The device independent key rate of the iid scenario is given by where the supremum is taken over all MDLOPC protocols {Λ}.
Later in this manuscript, we argue that the above definition is equivalent in terms of security to the one adopted earlier [12,17], which allows us to compare some of the existing lower bounds with the upper bounds that we provide. Rephrasing the key rate of the SKA model: In the SKA model of key distillation, the honest parties and the eavesdropper share a joint probability distribution P (ABE). The task of the honest parties is to perform LOPC operation to distill a secret key, in such a manner that the eavesdropper's knowledge about the key remains negligibly small. In the following lines, we propose an alternative definition of the key rate in the aforementioned scenario and prove that it is equivalent to the definition of the secret key rate introduced in the literature [1,2,33,51].
Theorem 1 (Informal). The secret key rate S(A : B||E) of SKA cryptographic model [1,2,33,51] is equivalent to the following asymptotic expression: with security condition (6) where P = ∪ ∞ N =1 {P N } is a cryptographic protocol consisting of LOPC operations, acting on N iid copies of the classical probability distribution P (ABE) , and P ideal N is the distribution containing ideal secret key, with adequate dimensions.
Proof. For the proof, see Sec. V of the Appendix. The aim of this rephrasing is to show and utilize a connection between the definition of secret key rate in SKA and NSDI scenarios, as it was done in the case of quantum cryptography [33].
The link we have made in the above Theorem, is technical, however important in our method for obtaining the upper bound on the key rate in NSDI scenario. We rephrase the security definition of SKA proposed by U. Maurer [2], with the one based on the trace norm ||.|| 1 . What is crucial in the choice of the latter criterion is the fact that it is equivalent to the NS norm ||.|| N S for tripartite probability distributions 6 . We recall here that the security definition in SKA is based on the control of the correlations (in terms of the mutual information) of the random variable of the honest parties with a random variable representing Eve's knowledge. These correlations should tend to zero for a large number of copies, N . Thus, in other words, in the above Theorem, we have modified the security criterion of the SKA to an equivalent form, which is more useful for our purpose. We have done so by demanding that the output distribution of the protocol should be close to an ideal one. The ideal is the distribution representing perfectly correlated uniform random variables, of the honest parties close to being product with the variable of Eve, in trace norm distance ||.|| 1 . As it will appear later, this technical change turns to be useful when we pass to the case of devices because the NS norm of a device is in fact a trace norm of a distribution coming from this device after measurement. Squashing procedure: Let us suppose that M(A : B||E) is a real-valued and non-negative function, with domain in the set of tripartite probability distributions P (ABE), which is an upper bound on secret key rate S(A : B||E) in SKA cryptographic paradigm [2], i.e., ∀P (ABE), M(A : B||E) ≥ S(A : B||E). We will refer to M(A : B||E) as to secrecy quantifier. Additionally, if M(A : B||E) is monotonic with respect to LOPC and zero for product distributions, we call it a secrecy monotone. Squashing a secrecy monotone will not yield an MDLOPC monotonic quantifier in general. The quantifiers of secret correlations in the NSDI model can be constructed by mapping the tripartite non-signaling device R(ABE|XY Z) to a joint probability distribution, as given in the definition.  Here, by max x,y , we mean the maximization over all possible direct measurements, M F x,y ≡ M F x ⊗ M F y by the honest parties, whereas the min z implies that the eavesdropper will try to minimize the function over all possible choices of measurements, direct and general. Optimization over direct measurements involves a fixed input choice, whereas for general measurement, one needs to perform optimization over all possible conditional probability distributions p(z|z ). In our MDLOPC key distillation protocol, the eavesdropper can choose her measurement adaptively, based on the public communication variable Q. Hence the causal order of the optimization on the secrecy quantifier is that Alice and Bob first choose their optimal measurements, and then Eve performs her part. This gives her the maximal operational power to reduce the correlations between the honest parties 7 .
The motivation to use the term "squashed" in the above measures, comes from the fact that the definition of squashed entanglement, of an arbitrary quantum state ρ AB , contains an optimization over all possible extensions ρ ABE , where tr E (ρ ABE ) = ρ AB . This arbitrary extension ρ ABE can be obtained from the purification |ψ ABE of the quantum state [40]. In the analogy of these, here we use the complete extension E(P ), the nonsignaling equivalent of quantum purification, which is the key ingredient to perform an optimization over all possible non-signaling extensions [43] of a given device P . The secrecy quantifiers, we have used for squashing, are the mutual information I(A : B), the conditional mutual information I(A : B|E), the intrinsic information 7 One can also consider the reverse order of optimization, but that opens up a different, uncommon paradigm of key distillation. Any M (A : B||E) functions which is positive semidefinite and vanishes for devices which is the product of two local devices, is called a non-signaling squashed secrecy quantifier, and the set of all such functions is the entire region inside the black ellipse. The quantifiers, that are generated from the monotones of the SK paradigm are called non-signaling squashed secrecy monotones, and are represented by the green region inside the green ellipse, as a a subset of the secrecy quantifiers. I(A : B|E), I(A : B ↓ E) and I(A : B ↓↓ E) are the monotones belonging to this category. If a function is additionally monotonic under MDLOPC operations for devices, vanishes for local ones, then we call it the non-signaling squashed secrecy measure, and the set represented by the red region in the figure. Any secrecy quantifier will be called squashed secrecy quantifier if the extension of the device P (AB|XY ) has been taken to be the CE E(P )(ABE|XY Z). The set of such functions are denoted by the dashed blue region. The intersection of the dashed blue region with the green region includes all squashed secrecy monotones, whereas its intersection with the red contains all squashed secrecy measures. The squashed non-locality Nsq is a particular function from that region, which is depicted as the black dot. Generic upper bound and the squashed non-locality: Below, we use the aforementioned idea of squashing for upper-bounding the secret key in the NSDI scenario with MDLOPC operations.
Theorem 2. The secret key rate, in the non-signaling device-independent iid scenario achieved with MDLOPC operations, K (iid) DI , from a device P , is upper bounded by any non-signaling squashed secrecy quantifier evaluated for the complete extension of P : where P ≡ P (AB|XY ) is a single copy of a bipartite non-signaling device shared by the honest parties, and E(P ) ≡ E(P )(ABE|XY Z) is its complete extension to the eavesdropper's system.
Proof. For the proof, see Sec. VI of the Appendix. Theorem 2, together with Definition 2, establishes a connection between the secret key rate in the SKA and NSDI scenario. The novelty of our approach is that not only it connects at least two major security paradigms, but it also opens up a new area of research -to study more tighter upper bounds on the key rate in the NSDI scenario (for parallel, different approach see [38]). In this paper, we focus on the secrecy monotone called intrinsic information I(A : B ↓ E). From this secrecy monotone via squashing we construct the so called squashed non-locality, as an upper bound on the NSDI key. We then prove several important properties of squashed nonlocality, which promotes it as a measure of non-locality. Secrecy monotone called the reduced intrinsic information I(A : B ↓↓ E), provide a tighter bound on the key rate in the SKA scenario, as I(A : B ↓↓ E) ≤ I(A : B ↓ E) for tripartite probability distribution P (ABE) [54]. Hence we open a possibility to study even tighter upper bound on the K  where E (P ) := E (P ) (ABE|XY Z) is the complete extension of the device P [43].
From the definition of a complete extension of a device (see Ref. [43]) we know that in order to construct it, one needs to identify all possible so-called minimal ensembles of the device. For example, in the polytope of two binary input and two binary output devices (2, 2, 2, 2), a device lying on the isotropic line between Popescu-Rohrlich and Tsirelson's one 8 has up to 354 minimal ensembles (achieved for the Tsirelson's device). However, a priori, there are 880946 of ensembles that can be potentially minimal [43]. Hence, obtaining all possible minimal ensembles, and therefore finding out the complete structure of the CE may be an arduous task. However, we observe 8 By Tsirelson's device we mean a one attaining maximal value of violation of the CHSH inequality [55] among quantum (2, 2, 2, 2) devices [56].
that to obtain a non-trivial upper bound on the N sq , not the whole complete extension has to be even known. We collect below certain properties of the above measure. Some of them are used in what follows, and some of them are of independent interest in the context of Bell non-locality. Proposition 2. Besides being non-faithful, the squashed non-locality satisfies the following properties: 1. Positive. It is a non-negative real function of bipartite non-signaling devices, and equal to zero for local devices. 9 .

2.
Monotonic with respect to MDLOPC class of operations.
3. Convex with respect to the mixture of devices.

5.
Additive for product devices.
Proof. For the proof, see Sec. VII of the Appendix. Calculating N sq for an arbitrary bipartite device P is a non-trivial task, but we can use the convexity of this measure to simplify the procedure of finding an upper bound of it. Positivity, monotonicity, and additivity of squashed non-locality lead to the following Corollary.
Corollary 2. The squashed non-locality is a measure of non-local correlation of the bipartite device P .
We describe now, how to use the convexity of the squashed non-locality. Consider any set of functions F = {F i (P )}, that are convex w.r.t. the mixture of devices, each of which upper bounds the squashed nonlocality F i (P ) ≥ N sq (P ), ∀i. Then the lower convex hull (LCH) of F denoted as F (P )(≡ LCH(F)) upper bounds N sq (P ), i.e., N sq (P ) ≤ F (P ), as a consequence of property 3. To exemplify the above convexification process, let ). This fact is used in order to construct figure 3: the orange curve is, in fact, a convex hull of several upper bounds that are incomparable with each other.
Quantitative results: In figure 3, we construct numerically an upper bound on the N sq , with the help of above specified convexification procedure. We also draw several other squashed quantifiers for the set of (2, 2, 2, 2) devices, lying in the isotropic line, i.e., P iso = (1 − ε)P R + εP R. Where P R is the famous Popescu-Rohrlich box [30], and P R is the anti-PR box 10 . The 9 By local we mean devices which possess a local hidden variable model [8]. 10 Anti-PR box is a binary input output device, satisfy P R(ab|xy) = 1 2 δ a⊕b,x.y , ∀a, b, x, y ∈ {0, 1} [57]  non-faithfulness of our measure, N sq is visible from the numerical results. The orange curve is the upper bound on N sq , and we have found that the bound reaches 0 for ε = 0.2 (it remains equal to 0 for ε ∈ [0.2, 0.25] due to the convexity of the measure). This is since, in MD-LOPC protocol, Eve can perform adaptive general measurements and post-process her output through a classical post-processing channel to reduce the correlations between Alice and Bob. In the range ε ∈ [0.2, 0.25], corresponding to each input (x, y) of the honest parties, we have found a measurement and a post-processing channel on Eve, which partitioned the device into an ensemble of product distributions. This proves that there exists nonlocality which can not be turned into security via MD-LOPC protocols. Interestingly, these devices are quantum realizable ones. One can conjecture that even the general operation, including the so-called "wirings" 11 can not help in distilling key out of these isotropic devices. Indeed, using wirings that is necessary for the key to be non-zero, which implies that we enter to some extent the general scenario of key distillation for which there is a wide class of attacks by employing the forward signaling attacks found in [25,26]. 11 Operations of feeding input of one device with the output of the other.
In the Appendix (see Sec. X), we plot upper bounds on N sq for several other sets of (2, 2, 2, 2) devices. We observe that there exists some region of non-local correlation (figure 6(a) and 6(b)), which can be simulated by a quantum device and for which the lower bound obtained by [17] is positive, and N sq is also non-trivial and close to the lower bound.
Equivalence of the complete-extension based security definition with the ensembles-based one: We show that in the NSDI scenario, in analogy to quantum cryptography [58,59], there exist two different, however equivalent definitions of security. One connected to the notion of the so-called distinguisher and the other one based on the proximity in norm [60,61]. In the case of NSDI, Renner, Hänggi, and Wolf [17] present the approach via the notion of distinguisher. Recall here, that to develop the latter approach, we consider the non-signaling norm, which is a total variational distance for two devices mapped into probability distribution with the so-called non-signaling operations, over which we take a supremum (see [17,44] in this context). We then focus on tripartite cc-d distributions (classical distribution is isomorphic to a device with unary input) as these are encountered at the end of an NSDI cryptographic protocol. The two classical parts are in the hands of the honest parties, while eavesdropper holds some device. We then show that the NS norm takes for such cc-d distribution a closed-form expression. In particular, we prove that the supremum over Eve's operations reduces to a maximization over direct measurements (for the proof, see Sec. III of the Appendix).
We present below the Theorem, which states that our definition of NS norm security criterion is equivalent to the criteria used by Renner, Hänggi, and Wolf [17]. We do it in analogy to the results of Refs. [58,59] related to quantum device-dependent security, but for nonsignaling devices: Theorem 3 (Equivalence of the NSDI security criteria). For an MDLOPC protocol Λ, the proximity in the NS norm security criterion is equivalent to the criterion based on secrecy and correctness of the protocol. That is for any ε sec + ε cor ≡ ε ≥ ε sec , ε cor ≥ 0 the following relation holds: where p abort is the probability for the protocol to abort and the constant O(ε) does not depend on any parameter of the protocol.
Proof. For the proof, see Sec. IV of the Appendix. Following arguments in Ref. [58], as a consequence of the above Theorem, we can claim that our definition of security is restricted composable [60][61][62] provided the device is not reused. In that sense, our definition diverges from that of [17] formally in two ways. First, we use the notion of the complete extension. This encapsulates the access of the eavesdropper to all ensembles of the device shared by the honest parties -the fact used in [17]. Furthermore, in our approach, the memory of Eve is finite and minimal without compromising her eavesdropping power. Second, as we have mentioned, we modify the security criterion, without losing the effect of composability. We use the proximity in NS norm to the ideal classical-classical-device distribution. We show that it is equivalent to the statement that (as it was used in [17]) the distinguisher can not tell apart the real cc-d distribution from the ideal one.
Discussion and open problems: In this manuscript, we have contributed in three ways to the topics of cryptographic security and Bell non-locality. Each of these contributions opens up an area for further investigation, which we comment below.
Firstly, we have initiated a systematic study on the upper bounds on the secret key rate on the NSDI scenario and defined a computable function, the squashed non-locality as one of the bounds. We have also demonstrated a direct link between the Secrete Key Agreement scenario and that of NSDI by systematic construction of the bounds in the latter case from the secrecy monotones of the former. Interestingly this method leads among others to a known measure of non-locality, which is the non-locality fraction. However, our approach goes much beyond that by offering construction of novel non-locality measures, which confirms the generality of our paradigm. Looking for tighter upper bounds stemming from (or even going beyond) the relationship between SKA and NSDI scenarios is a new direction to study.
The numerical estimate of the upper bound suggests that only a limited amount of key can be obtained from quantum devices with two binary inputs and two binary outputs via direct measurement followed by local operations and public communication. For the family of devices studied here, it is below 40%. Given characterization from [63] of the boundary of the quantum set, one can find limitations on the key rate obtained via quantum mechanics against a non-signaling adversary for the set of (2, 2, 2, 2) devices. It appears plausible that employing similar idea to the contextual set of observables may also lead to a novel measure of contextuality which upper bounds their private randomness content [64].
One of the most important problems which arise here is a dual one -whether the isotropic devices in (2, 2, 2, 2) scenario with less than 80% weight of Popescu-Rohrlich box are key undistillable in general. We have shown that one can not distill them by MDLOPC operations, i.e., by direct measurements on device and LOPC operations. However, one might consider that grouping several of such devices together and distilling one of them via the so-called "wirings", could lead to a positive key if followed by MDLOPC operations. Although one can not exclude this case, it is rather improbable, because an action of wiring, within a group of wired devices, opens a possibility of the forward-signaling attack, as discovered in [25] and developed in [26] (the two-way signaling case was excluded already in [24]). This is the reason why the non-signaling between individual devices seems necessary precondition of security in NSDI. In any case, extending presented results to a more general class of operations e.g., including wirings, is an important open problem. As a step in this direction, one can consider how the key rate changes if the honest parties have access to randomness private from Eve. Such randomness could be in principle used for performing general measurements.
As the second of the main contributions, we have provided a method of constructing novel measures of nonlocality and proved several important properties for one of them -the squashed non-locality. Among these properties are the monotonicity, convexity, and additivity. One property which is not considered here, the asymptotic continuity of the squashed non-locality, will be presented in the forthcoming contribution [65].
Comparing it with the other measure -the relative entropy of non-locality [66][67][68] may lead to interesting results and possibly the proof that the latter is also an upper bound on the distillable device-independent key. Exploring further the analogy between squashed entanglement and squashed non-locality may lead to novel analogous results in the realm of quantum devices. We also notice that the squashing procedure can be naturally extended to an arbitrary number of parties. This can be achieved by following Ref. [69], where the multipartite version of the intrinsic information in SKA has been shown to upper bound the conference key in the latter scenario.
As the third contribution, we have realized a novel idea of incorporating the eavesdropper in the scenario by applying the newly introduced concept of the complete extension [43]. Eve controls the additional interfaces of the extended part. This provides the NSDI protocol a structural definition like the quantum purification did for QDD and QDI. Although the security condition derived from this approach is equivalent to the former, it shows a direct structural analogy between NSDI and QDD paradigms. In consequence, the complete extension models an adversary with minimal memory required for ultimate eavesdropping power. The amount of memory needed for a given attack in a non-signaling scenario to best our knowledge has not been studied so far and deserves attention in the future. To formalize security, we considered the NS norm analogous to the trace norm in quantum mechanics. We have proven that this approach is equivalent to the two former ones [10,17]. We obtained that our definition of security is composably secure if the same device is not reused in composing the protocols (restricted composable). The properties of this NS norm computed for classical-classical-devices may become useful also in the context of Generalized Probabilistic Theory [41,42,70]. In this context, it is an important open problem if the class of operations G, over which supremum is taken in the definition of the NS device norm, is equal to the set of all linear operations L considered in [44]. Finding an answer to this problem may lead to the full operational characterization of the set of maps that can be performed on devices.

Note added
On the completion of the main results of this article contained in Sections III-VI, IX and X in the Appendix, we have noticed the paper E. Kaur, M. Wilde and A. Winter [38] also related to upper bounds on device independent key. The proofs of monotonicity, subadditivity and additivity over tensor product devices (see Sections VII C and VII D of the Appendix), were inspired by the analogous result for the squashed intrinsic non-locality presented there.
S ABE : Total state of the system after the MDLOPC protocol.    : η optimal LOPC protocol on N iid copies of the distribution.

E(P)
: Overcomplete extension of the device P .
x,y P η N : Measurement dependent η optimal LOPC protocol on N iid copies of the distribution.
Ω GMDLOPC : LOPC operations involve general measurements on the devices. N C : Non-locality cost of a non-signaling device.

C(P)
: Non-locality fraction of a non-signaling device P .

Appendix
Notation: In the Appendix we adapt two different notations for conditional probability distributions (devices). We do this to avoid small fonts in multi-level mathematical expressions that appear in forthcoming parts of this work and hence to make them more readable.

I. DEFINITIONS OF ENTROPIC FUNCTIONS
In this section, we recall definitions of basic quantities associated with random variables. Suppose A, B and E are discrete random variables, with outcomes a ∈ A, b ∈ B and e ∈ E. Let P (ABE) be the joint probability distribution of random variables A, B, E. Similarly, let P (A = a, B = b, E = e) ≡ p(abe) be the probability for obtaining the outcome A = a, B = b and E = e.
• The Shannon entropy of a random variable (variables) is defined as where, p(ab) = e p(abe) and p(a) = b p(ab) are the marginal probabilities of the joint probability distribution P (ABE).
• The conditional Shannon entropy of any random variable A with respect to the random variable B, quantifying the lack of knowledge about the outcome of A when one already knows the value of B, is given by • The mutual information I(A : B), measuring the correlations between A and B, is defined as • The conditional mutual information I(A : B|E), quantifying the correlation remaining between variables A and B conditioned upon the knowledge about value of third variable E, is given by • The intrinsic mutual information [52,71] where I(A : B|E ) is the conditional mutual information of the probability distribution P (ABE ) = e Θ E |E (E |E = e)P (AB, E = e), while the infimum is taken over all possible conditional channels Θ E |E .
• The reduced intrinsic information [53,72] of random variables A, B and E, denoted by I(A : B ↓↓ E) is defined as where the infimum is taken over all possible conditional channels Θ U |ABE .

II. THE WORLD OF NON-SIGNALING DEVICES AND THE NSDI CRYPTOGRAPHIC SCENARIO
In the NSDI cryptographic scenario, we consider that the honest parties, Alice and Bob, share a cryptographic device of unknown internal structure, identified with a non-signaling conditional probability distribution P (AB|XY ) (we use also P AB|XY notation). We refer to P (AB|XY ), as to a non-signaling device throughout our paper. Here A, B, X, and Y are random variables and a ∈ A, b ∈ B, x ∈ X, and y ∈ Y are respectively their values. The indices x and y are considered to be choices of inputs of the honest parties, whereas the respective outcomes are denoted by a and b. The non-signaling condition for P AB|XY (ab|xy), that roughly speaking forbids faster than light communication between the two parties, is defined as We incorporate the no-signaling eavesdropper (Eve) in the system by giving her the access to the additional interfaces of the complete extension (CE) [43], of the shared tripartite non-signaling device (see next Subsection II A for reference on CE). We denote the complete extension of a bipartite device P (AB|XY ) as E(P )(ABE|XY Z), where the additional input z ∈ Z and the corresponding output e ∈ E, are controlled by Eve. Extending a bipartite device with CE ensures that the non-signaling constraints also hold between Eve and Alice's and Bob's joint subsystem. Additionally, Eve can also apply local randomness in both her input and output to generate general measurements and to post-processing the output, which gives her the ultimate operational eavesdropping power, as then by construction of CE, she can access all possible ensembles of the extended device [43].

A. The notion of the complete extension
For an arbitrary device P (A|X), one can always find its extension P (AE|XZ) in the space of a larger dimension, such that the non-signaling constraints are satisfied (see equations (20), (21)). Some extensions of bipartite nonsignaling boxes have been studied in the past [10,[15][16][17]. The complete extension defined in [43], is an extension of the lowest possible dimension, that possesses all basic properties of quantum purification except extremality.
Let us consider a polytope (state space) of non-signaling devices, with a fixed number of parties and fixed cardinalities of inputs and outputs. An arbitrary device P , in that polytope, can always be expanded as a convex combination of the extremal (pure) devices {P i E }, as P = i p i P i E . The ensemble {p i , P i E } will be called a pure members ensemble (PME). The decomposition {p i } is not unique in general. [43].
Definition 4 (Minimal ensemble). A pure members ensemble, {p i , P i E } i∈I will be called a minimal ensemble of P , if all the members are pure and if any proper subset of {P i E } i∈I for any new choices of the corresponding probabilities {p i } i∈I is not an ensemble of the device P.
We can now invoke the definition of a complete extension. Qualitatively, it is such an extension of a device, which enables to produce all minimal ensembles of it, with the choice of input in the extending part resolving which minimal ensemble will be generated. The complete extension is, by its definition a non-signaling extension, which makes it a perfect tool for the NSDI cryptography (see [17] in this context).
Definition 5 (Complete extension [43]). Given a device P A (A|X), we say that a device E(P ) AX (AE|XZ) is its complete extension to system X if for any z ∈ Z and e ∈ E there holds such that the ensemble {p(e|z), P e,z A (A|X)} is a minimal ensemble of the device P A (A|X), and corresponding to each minimal ensemble of P A (A|X), there is exactly one z ∈ Z which generates it 12 .
Here we slightly abuse the notation, so by P A (A|X), we mean the device P (A|X) with random variables A and X. The subscript A denotes that the device is in possession of party A. Similarly, the subscript X , for the complete extension E(P ) AX (AE|XZ), stands for the extending party X , who controls the additional interfaces Z and E.
The complete extension satisfies the following properties alike the quantum purification, what makes CE its counterpart [43].
1. ACCESS: A complete extension of a device P , together with access to arbitrary randomness, gives access to any ensemble of a device P .
2. GENERATION: The extending system of the complete extension gives access to any possible (even mixed) ensemble of the purified device.

B. Possible eavesdropping actions
In this section, we define the building blocks of the set of allowed operations that the non-signaling eavesdropper can perform. In every device-independent key distribution protocol, the honest parties hold a device, the internal structure of which is completely unknown to them. Their task is to share at the end of the protocol a cryptographically secure key, which is perfectly correlated between the honest parties and completely secret with respect to the eavesdropper [59], by use of several copies of the device P (AB|XY ). As we are interested in finding the upper bound on the key rate, we consider the attacks by the eavesdropper as an independent and identically distributed (iid) attack as a choice of particular eavesdropping strategy. In this attack, the eavesdropper prepares N iid devices P (AB|XY ) ⊗N ≡ P ⊗N (AB|XY ) for Alice and Bob and holds the extending part of the CE E(P ⊗N )(ABE|XY Z), where A = A 1 A 2 · · · A N , and similarly for B, X, and Y . At this point we are ready to describe the possible actions of Eve on input and output of the extending system The inputs correspond to the choices of different minimal ensembles. In a cryptographic sense, some inputs are in favour of Eve, and some are not.

General measurement, {M
Upon each choice of general measurement on the CE of the shared device, Eve can generate any pure members ensemble of the device. Here {p(z |z)} represents the dice, an external randomness.
3. Classical post-processing channel Θ E |E on the output of the extending subsystem that can also be conditioned upon values of inputs and outputs of the dice. These operations when considered together with a general measurement gives access to all ensembles (possibly mixed) of the part of the device shared by the honest parties.
4. Eve can also monitor the communication, i.e., collect the classical information exchanged between the honest parties.
The most general strategy of the eavesdropper is to utilize both the general measurement and the post-processing channel. Any other strategy is a specific case of the general one described above. For example, the full direct measurement can be considered as a combination of deterministic dice and an identity post-processing channel.

C. Cryptographic protocol
In this section, we describe the building blocks of the set of operations that the honest parties can perform to generate a cryptographically secure key. In the case of non-signaling device-independent protocol, the honest parties can perform the following operations on their shared devices: 1. Full direct measurements on the input, i.e., setting certain values x, y of their inputs X, Y , followed by any composition of operations 2 and 3 below: 2. Classical post-processing of the distribution 3. Public communication.
We call this class of operations as Measurement on Devices followed by Local Operations and Public Communications (MDLOPC) [23]. Here we do not allow the honest parties to perform wirings between their subsystems because the forward signaling between the subsystems has been proved to be an insecure procedure for many important examples of post-processing [25,26]. Limitation from a general measurement to a direct one is because, in the former case, Eve does not have access to correlation with the whole system of Alice and Bob.
In our cryptographic protocol, we prove the security when the Eve's attacking strategy is to prepare N iid copies of a non-signaling device P (AB|XY ) and hands them over to the honest parties. Eve controls the CE of the full system, i.e., P ⊗N (AB|XY ). It is important to note that CE of a tensor product of devices is not a tensor product of CE's of these devices. This is the most general eavesdropping strategy (in the iid case) since it gives Eve access to all possible statistical ensembles of the shared device. Incorporating CE in this NSDI scenario encompasses a structural way to access to all ensembles of the extended device, which is the key point in all NSDI security protocol [10,[14][15][16][17][21][22][23].

III. PROPERTIES OF THE NS NORM
The NS norm introduced in Eq. (2) that has its main application in Proposition 1 strongly relies on the notion of the so-called distinguishing system [17,24,48]. The distinguishing system, also dubbed as the distinguisher, is an external black box type device having the same interfaces as the original device (with one extra output) however, its inputs are interchanged into outputs and vice versa. The structure of the distinguishing system allows it then to be connected to the interfaces of the original device. For each pair of systems to be distinguished, the distinguisher is devised in such a way that it attains maximal guessing advantage to distinguish between two examined devices. The extra output is used to communicate the guess. For a far more detailed description of the distinguishing system, we refer the reader to [48].
In this section, we show that in the heuristic approach, the NS norm is a maximal guessing advantage for a distinguisher to distinguish between two devices and plays a role of a distance D between two conditional probability distributions [48,58]. Devices with unary inputs are isomorphic to probability distributions. For them, the NS norm, is by definition, proportional to the total variational distance.
For the sake of cohesion we introduce the NS norm formally: Definition 6 (Of the NS norm). Let P and P be any two non-signaling devices. The following distance measure between P and P is called the NS norm.
where ||.|| 1 is a variational distance between two distributions. Furthermore G, is a set of generating operations that consists of: (i) adding an auxiliary device that has single input and single output (a dice), (ii) connecting the output of a device/dice to the input of a dice/device respectively, called wirings, (iii) pre-processing the inputs of device(s), (iv) post-processing inputs and outputs of the devices.
The results of this section, although seem to be highly technical, have a direct implication in distinguishability of the states of devices at the end of the protocol. For an initial tripartite device P (ABE|XY Z), when the honest parties finish the MDLOPC protocol on it, i.e., perform measurements in their respective parts and post-process their data by local operations and public communication, the device is transformed into a classical-classical-device probability distribution (cc-d state). In fact, it is enough to consider classical-device states (c-d states) P B,A1|X1 , and the result still holds for any c-d states, i.e., consisting of many classical subsystems (see Fig. 4). This is because one can always claim that classical variable B is the Cartesian product of many classical variables.
We identify the operations g ∈ G that the distinguisher can perform to discriminate between the devices. These can always be decomposed into several basic operations belonging to disjoint sub-classes of different operational meaning, i.e., g = P • M G • W considered together with external randomness D. This decomposition guarantees adequate causal order of operations.
i) The distinguisher can make use of external randomness, which in general may depend on the output of the classical part of the system B. We incorporate this randomness by combining systems to be distinguished with an external system, D A2|X2,B called a dice. represents the converse one, i.e., wiring from an external device to the cc-d distribution, W ← . The diagram is motivated by [73].
ii) A composition of wirings and prior to input classical communication (WIPCC), we denote this operation with W. In general, wirings can be adaptive to the outcome of classical variable B, and can be constructed in different manners.
a) W → : deterministic wirings from c-d system to dice. b) W ← : deterministic wirings from a dice into the input of the c-d system.
c) A mixture of the above.
iii) Direct or general measurements a) Full direct measurement M F x : A full direct measurement acting on a device P (A|X) ≡ P A|X , is equivalent to choosing an input x ∈ X, resulting with a conditional probability distribution, x , and its action is described as with a conditional probability distribution p(x|x ) satisfying x p(x|x ) = 1 ∀x . Here different x indicate different choices of a general measurement.
iv) Classical data post-processing we denote with P.
In the proof of the following Proposition, we consider supremum over external systems D A2|X2B . Hence without loss of generality, we can consider only wirings employing deterministic functions. The notation for wirings is adapted from [73], as depicted in Fig. 4 above. The domains and codomains of functions f b and g b , which determine wirings, are always adapted to the sizes of inputs and outputs. We consider deterministic wiring, so the sets of {f b } and {g b } are always finite. For the sake of simplicity, in the proof, we omit a unary input in the places where it does not lead to any ambiguity. Proposition 1. For the c-d states (alike those shared at the end of the MDLOPC-protocol Λ N ), i.e., the many parties non-signaling device for which only a single party has not unary input, the NS norm takes the form where b ∈ B is a multi-variable corresponding to outputs of c part of the c-d distribution.
From now on, for the sake of the ease of notation we make the following identification: , where x should be understood from the context. Note that wherever fiducial measurements are considered the sup operator can be used here interchangeably with max operator, as they act in the set with a finite number of elements.
Proof. To attain the supremum over all operations given in Eq. (2), we have to consider all possible actions of the distinguisher. For the proof, it is sufficient to consider the single most general operation instead of a mixture. This is because a norm defined with supremum of some distance is a convex function and attains maximum at the boundaries of the set over which the supremum is evaluated.
whereg ∈G are pure operations, i.e., they are not a mixture of others. Following the arguments of the previous paragraphs the NS norm can be phrased as where the suprema are taken over operations being adaptive with respect to the output B. When acting on the systems with a fixed value of classical output B, with a little abuse of notation, this can be rephrased using the same symbols for non-adaptive operations.
The first step to simplify the expression above is to notice that ||· − ·|| 1 is contractive under classical post-processing on probability distributions. Since the trivial post-processing is always accessible, we obtain As it was stated informally above, the general wiring, W, can be constructed adaptively upon the knowledge of the values of the output B, as a probabilistic combination of two types of wirings conv{W → , W ← } (see Fig. 4). In the following lines, we show that the strategy of mixing is not optimal. However, in general, the cardinalities of inputs and outputs in different (types) of wiring can be different. In order to overcome this obstacle, we consider a common supremum over a convex set of wirings composed with measurements. From an operational point of view, this procedure means that the knowledge about the preparation was discarded after the optimal measurement for each type of wiring had already been chosen.
In the two following paragraphs, we investigate probability distributions, obtained after the wirings W → and W ← .
W → ) The first thing to do now is to identify a probability distribution we obtain after wiring. The state of the system after distinguisher obtains a classical output B = b, which is prior to input in the considered scenario, is given by P A1|X1,B=b ⊗ D A2|X2B=b , see Fig. 4(a). The distinguisher can apply wirings from P to D, controlled by f b , g b , which can depend on outcome b. The probability distribution after the wiring W → (for a fixed value of outcome B) is given by Hence the probability distribution for the device after a wiring is given by W ← ). The first thing to do is again to identify a probability distribution after wiring. However, we are now in a comfortable situation, as it is enough to interchange inputs of P A1|X1,B and D A2|X2,B systems, see Fig. 4(b).
At this point we are ready to calculate both terms in Eq. (36) separately. a) In the first term ∀ b∈B ∀ D we have: = sup ≤ sup = sup = sup = max = sup The important point is to notice that a 1 a1,a2: g b (a1,a2,x 1 )=a 1 h(a 1 , a 2 ) = a1,a2 h(a 1 , a 2 ). b) Now in the second term ∀ b∈B ∀ D we have: = sup = sup = max x1 a1 = sup From a), b) and Eq. (36) we conclude that: As the r.h.s of the expression above realizes a particular strategy of the distinguisher within considered NS norm, the above inequality can be always saturated, what yields: Corollary 1. For the cc-d states shared at the end of the MDLOPC protocol Λ, the NS norm can be rephrased with a simplified expression: where max z , stands for the maximization over all possible direct measurements performed by the eavesdropper.
Proof. The proof follows directly from substituting B ≡ (S A , S B , Q), A 1 ≡ E and X 1 ≡ Z in the result of Proposition III. In this way we obtain cc-d states that are shared at the end of the MDLOPC protocol Λ, and hence we arrive at the claim: where the max z is the maximization over direct measurements in the part of Eve.
Remark 1. The norm on the space of no-signaling conditional probability distributions based on trace distance introduced by M. Christandl and B. Toner [44] is based on a supremum over all possible linear operations. According to our best knowledge, these operations have not been characterized yet in the literature. In this section, we do not target to describe this class of operations. Instead, via the set G, we constructed a particular action of the distinguishing system on c-d states, which is sufficient for cryptographic purpose as it yields equivalent security criterion to [23].

IV. EQUIVALENCE BETWEEN SECURITY CRITERIA FOR NSDI PROTOCOLS
The iid NSDI key rate in Definition 1 is implicitly dependent on proximity in the NS norm security criterion in Eq. (1). In the quantum case, it was shown that the proximity in the norm (of a state to the ideal one) is equivalent to the correctness and secrecy of a protocol [58,59]. These two notions are employed in a protocol independent definition of security [61]. In this section, we show that security criterion based on NS norm is equivalent to the one based on secrecy and correctness of MDLOPC protocol.
In what follows, we employ the notions of real, ideal, and intermediate systems.
A real system is a device shared by the parties at the end of a protocol. An ideal device is the one which possesses the same distribution on Eve's side as a real device, however, possesses perfect (uniform) correlations between Alice and Bob, that are completely uncorrelated with Eve. An intermediate device is another kind of device in which Alice and Bob always share fully correlated keys. However, the distribution of the keys is not uniform (Eve's part stays unchanged). The usual part of any protocol employing non-local correlations is an acceptance phase in which honest parties decide (upon some test) whether to abort or to proceed with the protocol.
Composability concept in security is an area of research concerned with composing cryptographic primitives into more complex ones while keeping high security level. In the universal composability approach, a cryptographic primitive is said to be universally composable if any functionality using this primitive is as secure as an ideal one [61,62]. The composable security is considered as the strongest notion of security [61,62]. However, in the device independent scenario, so far, it was not rigorously proven that this scheme is ultimately secure. Furthermore, the results of [45] strongly suggest that it is not the case, so the problem arises when one wants to reuse the device. In particular, if the device used for composition has some memory, then it can leak the key of the previous use. This implies that, in general, the protocol is composably secure as long as the same device is not reused in the protocol. We refer to this notion of security to be restricted composable.
Theorem 3 is essential to compare the secret key of our scenario to these of other cryptographic schemes or even certain protocols, in particular to the results of Hänggi, Renner and Wolf [17], with the upper bounds that will be presented in this paper. We start with a few definitions.
Definition 7 (State of the device at the end of protocol). The state of the device after the MDLOPC protocol is a conditional probability distribution (c-d state) denoted by P real S A ,S A ,Q,E|Z : The random variables S A , S B , E are respectively outputs of Alice, Bob, and Eve conditioned upon input Z of Eve. S A , S B are the key strings hold by Alice and Bob after the protocol, respectively. Q is the random denoting public communication. During the protocol, Q is shared by the three parties, although Alice and Bob use it only to distill the final key and discard it after the protocol is finished. For this reason, we treat Q to be the random variable of Eve that she can use for the choice of her input. Despite the fact that in the notation adopted by as variables of outputs are conditioned upon variables of inputs, Eve's choice of input Z can still depend on the value of Q. The superscripts abort and pass indicate whether protocol passed the acceptance phase.
Since the honest parties are uncorrelated with Eve, the ideal system can be decomposed according to tensor rule formula for independent systems in the following way: Definition 9 (State of the intermediate system). An intermediate system is the one that bears fully correlated key strings between the honest parties, but the distribution they possess is not uniform; hence correlations are not perfect in a cryptographic sense. Eavesdropper is not completely uncorrelated with the honest parties.
Since the states of the intermediate and the ideal systems are constructed with respect to the state of the real system, the p abort is the same in all cases (later, we consider the protocol after the acceptation phase, for which p abort = 0). The same is true for all states conditioned on aborting, i.e., they are trivially the same. For the sake of cohesion, we provide definitions of secrecy, correctness, and security of a cryptographic protocol in case of non-signaling devices.
Definition 10 (ε-secrecy of a protocol). An MDLOPC key distribution protocol is ε-secret if it outputs a device for which conditional probability distribution shared between Alice (Bob) and Eve at the end of the protocol (and the protocol does not abort) satisfies Definition 11 (ε-correctness). An MDLOPC key distribution protocol is ε-correct if the probability (and the protocol does not abort) for Alice and Bob not to share the same output keys satisfies Definition 12 (ε-security of a protocol). Let P real|pass S A ,S B ,Q,E|Z be the state of the system shared between Alice, Bob, and Eve after the protocol (and the protocol does not abort). Then the protocol is ε-secure if where p abort is the probability of aborting (which is the same for the real and ideal protocols).
To prove the equivalence between security criterion based on NS norm and the one based on security and correctness, we provide technical Lemmas, showing that proximity in NS norm implies secrecy and correctness, and vice versa. Observation 1. The following equality holds. Proof.
(I) -we use the fact that P where (I) and (II) are due to non-signaling condition on Eves's input z. Finally we obtain: Lemma 2 (Secrecy and correctness imply security). If a protocol is ε sec -secret and ε cor -correct then the protocol is ε-secure, where ε = ε sec + ε cor .
(1 − p abort ) P where we used the triangle inequality for the NS norm. From Proposition 1 we have: Using now Lemma 1 and Eq. (100) we have: Hence, Using the above inequality if a protocol is ε sec -secret and ε cor -correct it is also at least (ε sec + ε cor )-secure.
(1 − p abort ) P We proved that if the protocol is ε sec -secret and ε cor -correct then its output is ε sec + ε cor close to ideal device in NS norm, and by definition is ε sec + ε cor secure. To prove equivalence of security criteria, we now show the proof in the opposite direction, i.e., we show that if an output device of the protocol is ε close in NS norm to the ideal one, then the protocol is at least ε-secret and ε-correct.

Lemma 3 (Security implies secrecy and correctness).
If a protocol is ε-secure, then it is at least ε-secret and ε-correct.
(1 − p abort ) P To proceed with this task we employ Definition 8 of the ideal system and Proposition 1.
where we used the triangle inequality used in (I) and (III), and the non-signaling condition in the Eve's subsystems used in (II). Hence: The above inequality verifies that ε-security implies ε-correctness.
In the next step we prove: (1 − p abort ) P where in (I) the second component is treated like in the previous step, reverse triangle inequality has been used in (II), triangle inequality in (III) and in (IV) we use the results given in Eqs. (97) and (105). We have: One should now go through two separate cases: Finally: If protocol is ε-secure we see from (111) and (122) that: Once we proved the above Lemmas, we can state the Theorem regarding the equivalence between the secrecy and correctness and proximity in NS norm criteria of security for a protocol we have considered.
Theorem 3 (Equivalence of security criteria). For an MDLOPC protocol Λ, the proximity in the NS norm security criterion is equivalent to the criterion based on security and correctness. That is for any ε sec + ε cor ≡ ε ≥ ε sec , ε cor ≥ 0 the following equivalence relation holds: where p abort is the probability for the protocol to abort and the constant in O(ε) does not depend on any parameter of the protocol.

Remark 2.
In the rest of this article, we assume that the protocol is after the acceptance phase. However, for the full generality in this section, we took a step back and also considered the possibility of aborting. From now, we set the probability of aborting to zero.

V. REPHRASING THE KEY RATE IN THE SECRET KEY AGREEMENT SCENARIO
The secret key agreement (SKA) scenario is a cryptographic scheme in which the honest parties and the eavesdropper share many copies of a classical joint probability distribution P (ABE) [1,2]. The honest parties task is to agree on the secret key, by employing local operations and public communication (LOPC), in such a manner that the eavesdropper's knowledge about the key is negligible. In the following lines, we propose an alternative definition of the secret key rate S(A : B||E) in the aforementioned scenario and prove that the definition we propose is equivalent to those present in the literature [2,51,53]. This technical result intends to show and utilize a connection between the definition of secret key rate in SKA and NSDI scenarios, as it was done in the case of quantum cryptography [33].
Before we begin with the proof of Theorem 1, let us recall two definitions of secret key rate in SKA scenario [2,51].
Definition 13 (The weak secret key rate [2,51]). The (weak) secret key rate of A and B with respect to E, denoted S(A : B||Z), is the maximal R ≥ 0 such that for every ε > 0 and for all N ≥ N 0 (ε) there exists a protocol, using public communication over an insecure but an authenticated channel, such that Alice and Bob , who receive A The above definitions of secret key rate were proven to be equivalent [51], i.e., S(A : B||Z) = S(A : B||Z), for every distribution P (ABE) shared between the parties before the protocol. We propose an alternative definition of the secret key rate based on proximity in the trace distance (total variational distance).
Definition 15 (The secret key rate). Let P (ABE) be the joint distribution of three discrete random variables A, B, and E. The secret key rate S(A : B||E) is given by for Before we show the proof of Theorem 1, we present the basic tools that will be used. For two joint probability distributions P ≡ P (XY ) and Q ≡ Q(XY ), that are close by according to the trace distance, their Shannon entropies, and the mutual information functions satisfy the asymptotic continuity relations [74,75], which is is the binary Shannon entropy, g ( ) := − log + (1 + ) log (1 + ), and d = min{dim X (P ) , dim Y (P )}. Functions h 2 and g are equal at = 0 and for > 0 h 2 ( ) < g( ). It is also useful to observe that ||P (X) − Q(X)|| 1 ≤ ||P (XY ) − Q(XY )|| 1 for P (X) and Q(X) being marginal probability distributions of P (XY ) and Q(XY ) respectively.
Another relation that we need is the so-called Pinsker's inequality. It states that if P and Q are two probability distributions, then where D KL (P ||Q) is the Kullback-Leibler divergence. One of the properties of this function is its relation to mutual information, i.e., for a joint probability distribution P (XY ) and P (X), P (Y ) being its marginal distributions we have: The last mathematical property we describe before the proof is the Fano's inequality stating that: where h(x) is the binary entropy andX = f (Y ) is an approximate version of X.
In the proof, we also use the notions of real and ideal systems. The real system P real N is a tripartite probability distribution shared by the honest parties after N -th round of an LOPC protocol P. The ideal system P ideal N is the one in which the honest parties are perfectly correlated (with uniform distribution), and Eve's marginal distribution is the same as for the real system, however completely uncorrelated with the honest parties.
where P (ABE) is tripartite probability distribution shared by all parties at the beginning of SKA protocol, i.e., input state of the protocol, |S| = dim S P real We denote protocol that satisfy security condition in Eq. (149) with P. From asymptotic continuity of the mutual information and the fact that I(S A : CE N ) P ideal N = 0 by the construction of P ideal N , we read Because in any reasonable LOPC protocol dimension of the output is smaller than the dimension of the input, and we observe that 13 Hence, Hence if a protocol satisfies the trace norm security condition P N P ⊗N (ABE) − P ideal as r.h.s. of Eq. (160) approaches 0 when N goes to infinity. Another condition in Definition 13 we call correctness of a protocol, requiring that S A = S B with probability at least 1 − ε (equivalently Prob[S A = S B ] ≤ ε) is satisfied 14 by virtue of Theorem 3, with |Z| = 1 and p abort = 0. This is because the NS norm computed for classical probability distributions is equal to the trace distance. Therefore from the condition in Eq. (149) and Theorem 3 we have Let us show now the upper bound. We first observe that for all protocols the following is true.
where the inequality is due to the definition of ideal system in which S A is uniformly distributed and of the same dimension as in real system. From asymptotic continuity of the Shannon entropy we have: where the second inequality is a consequence of the similar arguments as in Eq. (159) and the fact that ∀ x>0 h 2 (s) < g(x).
Let us define now N 0 (ε) := max {N 1 (ε), N 2 (ε), N 3 (ε)}. All conditions in Definition 13, are now satisfied as for all ε > 0 and for all N ≥ N 0 (ε), with R = lim sup N →∞ log dim S A (P real N ) N . The weak secret key rate is by Definition 13 maximal R, for which second inequality in Eq. (146) is satisfied, hence to achieve S(A : B||E) one has to take a supremum over rates of all protocols.
where P are the protocols that satisfy conditions in Definition 13. As we have shown that condition (149) in Definition 15 implies conditions in Definition 13, it is clear that {P} ⊆ P , and hence: Let us now show that the secret key rate S(A : B||E) is lower bounded with the strong secret key rate S(A : B||E). In this part, we refer again to results in Section IV. It is enough to show that conditions in Definition 14 imply secrecy and correctness of a protocol, as by virtue of Theorem 3 and the same arguments regarding the connection between the NS norm and the trace distance, these conditions imply proximity in the trace distance.
We start with the condition of secrecy (see Definition 10). Let P real N (S A S B SCE N ) be an extension of P real N (S A S B CE N ), such it satisfies conditions in equations (147).
where 1 |S A | denotes uniform distribution, and we identify |S A | with |S|. The first term in the Eq. above can be upper bounded via Pinsker's inequality, and the first inequality in (147): where h(x) is the binary entropy and in (II) we used non-negativity of the conditional entropy, (III) follows from Fano's inequality for P (e) = Prob[S = S A ], and the last step (IV ) is a consequence of Prob [S A = S B = S] ≥ 1 − and an assumption that ε ≤ 1 2 . This assumption is well justified in cryptography. From inequalities (170) and (171), we have: In order to upper bound the second term we make the following observations: Therefore we have: where (I) follows from triangle inequality, (II) is due to Observation c), and in the last step we used a). From equations (169), (170) and (176) we conclude that ε sec The correctness of a protocol is explicitly stated in Definition 14, i.e., Prob[S A = S B = S] > 1 − ε (see Definition 11 for reference). Hence we have ε cor N := ε. From Theorem 3 we obtain: or equivalently From the second inequality (147) and Eq. (163) we have that: for L(N ) = log dim S A (P real N ) N and hence by performing a limit N → ∞, and condition of R being maximal number so that the above is satisfied we have R = lim sup N →∞ log dim S A (P real N ) N . The strong secret key rate is defined as where P are protocols that satisfy conditions in Definition 14. Because conditions in Definition 14 imply condition (149), we have P ⊆ {P}, and therefore: By combining equations (168) and (181) we have: However, in the Reference [51] it was shown that ∀ P with S(A : B||E) P (ABE) = sup P lim sup N →∞ log dim S A (PN (P ⊗N (ABE))) N , and therefore all three definitions are equivalent.

VI. UPPER BOUND ON DEVICE INDEPENDENT KEY
In this section, we prove our main result. Namely, we show that the secrecy quantifiers, that provide upper bounds on the key rate in the SKA model [2,51], can serve us to construct upper bounds in device-independent key agreement scenario via operation of squashing. The secret key agreement scenario (SKA) is a well established area of cryptography, where upper bounds on the key rate are well known and given by entropic functions. The connection between upper bounds in SKA and NSDI cryptographic paradigms that we show in this section may simplify further studies on the latter. Theorem 2. The secret key rate, in the non-signaling device-independent iid scenario achieved with MDLOPC operations, K (iid) DI , from a device P is upper bounded by any non-signaling squashed secrecy quantifier evaluated for the complete extension of P : where P ≡ P (AB|XY ) is a single copy of a bipartite non-signaling device shared by the honest parties, and E(P ) ≡ E(P )(ABE|XY Z) is its complete extension to the eavesdropper's system.
Proof of Theorem 2. We start the proof by modifying the equality in Eq. (148), in Definition 15 in the following way: where P x,y,z is a LOPC protocol secure with respect to probability distribution that arises after x, y, z choice of inputs (see Section V of Appendix for reference), and M F x,y , M G z are fiducial and general measurements of Alice, Bob and Eve respectively, described before in Section II B of Appendix.
Let us notice that for each choice of x and y there exists z =z x,y such that: Now, when the optimization domains are explicitly stated, we can make use of max-min inequality to obtain: ≥ max x,y sup P x,y,zx,y min z lim sup We notice that the minimization of Eve's choice of input (min z ) is void in the r.h.s. of the Eq. (188) above. This is because the value of r.h.s. depends only on the value of dim SA (·) that is determined by choice of x, y, and hence by the protocol. Therefore we can write the following sequence of equalities where we swap from classical probability distributions to cc-d states.
In the third equality above, we again used the fact that the dimension of Alice's subsystem (when the protocol is already fixed) is independent of Eve's action and her marginal distribution. This is the reason why we can substitute E P ⊗N in the place of E ⊗N (P ). Moreover, in the last equality we use a notation that explicitly shows the composition between a measurement and a LOPC protocol. With a little abuse of notation 1 in Eve's part is abandoned.
We notice now that each composition of measurement x, y and protocol P x,y,zx,y is a candidate for MDLOPC protocol Λ := {Λ N } = P x,y,zx,y N • (M F x,y ) ⊗N . However we require that the distribution after the protocol is secure in NS-norm i.e.: what implies security not only with respect to Eve choosingz x,y , but against eavesdropper that has access to all inputs of E P ⊗N , hence possibly more powerful attacks. This is also a reason why we stay general even if there is any other good choice ofz x,y in Eq. (186). Having this in mind, we can write the inequalities below: ≥ max x,y sup P x,y,zx,y lim sup N →∞ log dim SA P x,y,zx,y N where the second inequality is due to the fact that now optimization is over a smaller set (not larger), i.e., only these combinations of measurements and LOPC operations that satisfy security condition in Eq. (195). Moreover, in the equality we identified MDLOPC (iid) secret key rate from Definition 1.
For the second part of the proof, we need to recall some properties of a family of secrecy quantifiers {M (A : B||E)} of SKA model [72]. Each function that upper bounds secret key rate in the SKA paradigm can be squashed according to the following procedure. For any function among them: By extending the above inequality to any tripartite non-signaling device P (ABE|XY Z) and general measurement for input Z, one can write

VII. PROOF OF THE PROPERTIES OF NON-SIGNALING SQUASHED NON-LOCALITY
In this section, we give the proofs of the properties of the non-signaling squashed non-locality. Before we start with the proof, let us recall the definition of intrinsic information I (A : B ↓ E), given in Sec. X. We will rewrite the definition in two new ways. One of them is in full analogy to the forms of the squashed entanglement [39,40]. Indeed, one can write the latter measure in terms of the minimization over all possible extensions: E sq (ρ AB ) := inf σ ABE :Tr E σ ABE =ρ AB I(A : B|E) σ ABE . The second form of the squashed non-locality involves ensembles induced by measurements on the extending system and resembles the definition of the so-called classical squashed entanglement [40].
The intrinsic information involves an optimization over all possible conditional probability distributions Θ E |E . Moreover, in the squashing procedure, an optimization over the measurements on the CE of a bipartite device P (AB|XY ), has been involved. The non-signaling squashed intrinsic information is = max where M F x,y is the direct measurement on the inputs X and Y , and M G z is a general measurement on Z. According to Theorem 4 of [43], , is an arbitrary ensemble (possibly mixed) of the device P (AB|XY ), where 1 is the identity operator on the system of the honest parties. Hence, for a fixed input randomizer (dice p(z|z )) and a fixed channel, one can generate an arbitrary extensionP (ABE |XY ) with unary input. All possible choices of input randomizer and post-processing channel lead to all possible extensions, hence min z inf Θ z E |E = infP (ABE |XY ) . And hence, it follows that Definition 3 of the squashed non-locality is equivalent to From Eq. (212), it is clear that the squashed non-locality reduces to the convex roof extension of the mutual information function. This is analogous to the definition of entanglement for mixed quantum states [76], the only difference is that here we are not restricting the device to be decomposable in terms of only pure (extremal) devices (see in this context [77]).
A. Positivity of the measure Proposition 3. The squashed non-locality is a positive semidefinite function of bipartite non-signaling devices P (AB|XY ), and the equality holds if the device P admits a local hidden variable model [8].
Proof. The intrinsic conditional mutual information satisfy I(A : B ↓ E) ≥ 0 for all distributions P (ABE), hence the positive semi-definiteness directly follows from its definition: Now we have to show that it is zero for all local devices. Let us assume P L (AB|XY ) is a local device, i.e. there exists a hidden variable model λ, such that P L (AB|XY ) = λ P (A|X, λ) ⊗ P (B|Y, λ)ρ(λ). This leads to an ensemble {ρ(λ), P (A|X, λ) ⊗ P (B|Y, λ)} whose members are tensor products of local devices, hence from Eq. (212), we can directly write N sq (P L (AB|XY )) = max where in (I), we use the inequality (222), with x =x and y =ȳ. In (II), we use the fact that direct measurementsx andȳ, may not maximize terms at r.h.s. of the inequality (222). In this section, we will show that any secrecy monotone (functional, nonincreasing under LOPC operations), after squashing procedure yields a functional which is monotonic under MDLOPC operations. Proof. Let us consider arbitrary MDLOPC operation Λ M DLOP C . By definition it is a composition of the form Λ M DLOP C = Λ LOP C • M F x0,y0 . Let us also choose arbitrary device P (ABE|XY Z) and let us fix arbitrarily z = z 0 . As a consequence we can write a sequence of (in)equalities which we comment below, where for the sake of clarity of the proof we will use a short notation: In the first equality, we use the definition of M. In Eq. (228) we use the fact that the device P after measurement M F x0,y0 has unary inputs in part of the honest parties (it becomes a distribution in that part), hence there is no parameter x, y to maximise over. The inequality (229) follows from the property of minimum (over z). The inequality (230) is due to the monotonicity of M under Λ LOP C . The inequality (231) is because x 0 , y 0 may be suboptimal in max x,y over M(P (ABE|X = x, Y = y, Z = z 0 )). The equality (232) comes from the fact that the choice of z 0 was arbitrary, so it is true for the z 0 that attains min z in (232). The last equality comes from definition of M ≡ M(A : B|E), which ends the proof.
From Proposition 5, it directly follows that the squashed non-locality, is monotonic under Λ M DLOP C , as it is defined based on the secrecy quantifier, intrinsic mutual information I(A : B ↓ E). And it is monotonic under LOPC operation [33,53].
Without using the above Proposition, we can also independently prove that N sq is monotonic under MDLOPC operation, or in principle, under a larger class of operations, the GMDLOPC. We have mentioned in the main text, that the MDLOPC class of operations involve (i) direct measurement, changing devices into distributions followed by (ii) Local Operations and Public Communication. If we relax the measurement procedure and include all possible general measurements, then we will have the GMDLOPC class of operations, as shown in the schematic diagram in Fig. 5. Clearly MDLOPC ⊂ GMDLOPC, and one particular operation of GMDLOPC class will be denoted as Ω GMDLOPC . Hence the monotonicity: Proposition 6. 15 The non-signaling squashed non-locality of any non-signaling bipartite device P satisfies Proof. To prove the monotonicity under GMDLOPC, we will use the equivalent definition of N sq given in Eq. (212). Under the GMDLOPC operation Ω GMDLOPC ∈ GMDLOPC, the honest parties can choose general measurements in the input of the shared device P (AB|XY ). The general measurements can be chosen by using a public shared local randomeness generator D L XY |X Y (xy|x y ) (as depicted in Fig. 5), with x ∈ X , y ∈ Y the input and x ∈ X, y ∈ Y are the output. As the output of D L will be feeded to the input of P (AB|XY ), hence, we will assume without any loss of generality that both cardinality are same. Moreover, as D L is local randomness generator, hence where λ 1 ∈ Λ 1 is the local hidden variable and λ1 µ(λ 1 ) = 1. Similarly, the outputs are also passed through a local post-processing channel P C L A B |ABXY (a b |abxy), which also depends on the inputs of the initial device, as shown in Fig. 5. Additionally, the locality condition give rise to with λ 2 ∈ Λ 2 and λ2 ν(λ 2 ) = 1. Hence, under Ω GMDLOPC , the given device P (AB|XY ) transforms into Now the N sq of P as in Eq. (212) is where E (P ) (A B E|X Y Z), is the CE of P (A B |X Y ), and S all (P ) denotes all possible ensembles of P . Consider the following tripartite device, resulting upon performing the Ω GMDLOPC on the the CE of P (AB|XY ), Here 1 E means the identity operator in Eve's subsystem. Consider the ensemble p(e|z)µ(λ 1 )ν(λ 2 ), P ezλ1λ2 (a b |x y ) , where P ezλ1λ2 (a b |x y ) = xy D 1 (x|x λ 1 )D 2 (y|y λ 1 ) ab P ez (ab|xy)P C 1 (a |axλ 2 )P C 2 (b |byλ 2 ).
Now we will show that the above ensemble will be an ensemble of P (A B |X Y ), if {p(e|z), P ez AB|XY } is an ensemble of P (AB|XY ).
Suppose {p(e|z), P ez AB|XY }, is an ensemble of P , then by using Eq. (239) and the fact that e p(e|z)P ez (ab|xy) = P (ab|xy). Moreover, {p(e|z), P ez AB|XY } is an arbitrary ensemble, and Eve can easily access it once she has the CE E(P )(ABE|XY Z): Because p(e|z)µ(λ 1 )ν(λ 2 ), P ezλ1λ2 (a b |x y ) is an ensemble of P , where in (I) we use the data processing inequality and also use the fact that the distribution P ezλ1λ2 AXBY |X Y (axby|x y ) = D 1 (x|x λ 1 )D 2 (y|y λ 1 )P ez AB|XY (ab|xy) a b P C 1 (a |axλ 2 )P C 2 (b |byλ 2 ) is independent of λ 2 . The chain rule of mutual information has been used in (II) whereas in (III), we use the fact that given x , y and λ 1 , the random variables X and Y are independent, hence I(X : B|Y ) = I(A : Y |X) = 0, which follows from the non-signaling condition. In (IV) we simply write P ezλ1 (AB|X = x, Y = y, X = x , Y = y ) = P ez (AB|X = x, Y = y).
The r.h.s. of (254) is valid for an arbitrary ensemble {p(e|z), P ez } ∈ S all (P ), so it is still valid when taking infimum over all ensembles. Hence, As MDLOPC ⊂ GMDLOPC, so we have Corollary 3. The non-signaling squashed non-locality of any non-signaling bipartite device P satisfies The above monotonicity property also holds for the non-signaling squashed conditional mutual information I(A : B|E) E(P )(ABE|XY Z) .

D. Superadditivity and additivity
Proposition 7. 16 If two bipartite non-signaling devices P (A 1 B 1 |X 1 Y 1 ) and Q(A 2 B 2 |X 2 Y 2 ) are the marginals of a four partite non-signaling deviceP ( , then the non-signaling squashed non-locality N sq is superadditive, and additive for tensor product of devices P ( a2b2P (a 1 , a 2 , b 1 , b 2 |x 1 , x 2 , y 1 , y 2 ) = P (a 1 , b 1 |x 1 , y 1 ) ∀a 1 , b 1 , x 1 , x 2 , y 1 , y 2 , (260) a1b1P (a 1 , a 2 , b 1 , b 2 |x 1 , x 2 , y 1 , y 2 ) = Q(a 2 , b 2 |x 2 , y 2 ), ∀a 2 , b 2 , x 1 , x 2 , y 1 , y 2 . (261) is also satisfy non-signaling conditions among all of its parties, as defined in Eqs. (20) and (21). Consider an arbitrary non-signaling extension ofP ( , with unary input |Z| in the extended part. The input is unary, so the non-signaling condition is automatic and we can omit the Z. The conditional mutual information of the distribution after performing an arbitrary pair of direct measurements, i.e., M F x1,y1 ⊗ M F x2,y2 on the inputs X 1 , Y 1 and X 2 , Y 2 reads ∀x 1 , x 2 , y 1 , y 2 where we use the chain rule of mutual information in (I) and in (II), we use positivity condition of mutual information.
after the direct measurements on the inputs. Recall that Noticing thatP ( The above inequality holds for all extensions ofP ( , hence also for an optimal extension on the LHS, so Suppose thatx 1 ,ȳ 1 are the optimal direct measurement choice for N sq (P ) andx 2 ,ȳ 2 are for N sq (Q), inf P (A1B1E|X1Y1) Finally, In (I), we use an specific choice of direct measurement, M F x1,ȳ1 ⊗ M F x2,ȳ2 , which may not be optimal for devicē . We use Eq. (268) for the direct measurements M F x1,ȳ1 ⊗ M F x2,ȳ2 in (II) and finally in (III), Eqs. (269) and (270) has been used. Additivity for tensor product of devices: Let us assume that the joint non-signaling four party device (two random variables for input and output in the honest parties' part) is the tensor product [47] of two bipartite devices, Consider the (non-signaling) extensions with unary inputs of both the devices, P ( , which are the optimal extensions for calculating N sq for both the devices, as given in Eq. (210), for all x and y. Hence, their tensor productP ( , which may not be optimal one, resulting in ∀x 1 , x 2 , y 1 , y 2 inf P (A1B1A2B2E|X1X2Y1Y2) Considering the optimal direct measurements M F x1,ȳ1 ⊗ M F x2,ȳ2 in the LHS of the above relation, gives = inf P (A1B1A2B2E|X1X2Y1Y2) Using relation (274), we finish the proof with equality: where d A = max x (suppM F x (P (A|X))) and d B = max y (suppM F y (P (B|Y )) are dimensions of the outputs, and C(P ) is the non-locality fraction of P [78,79].
Proposition 9. The secret key rate K (iid) Proof. Suppose Alice and Bob share a non-signaling device P ≡ P (AB|XY ), and Eve has access to its complete extension [43]. The device P can be decomposed into a non-local vertex and a local device, where P V NL is the non-local vertex and P L is any local device. Let us denote the non-locality fraction C(P ) := min All decompsitions as in Eq. (290) α.
Eve can always get access to this ensemble, C(P ),P V NL , 1 − C(P ),P L , in part of the honest parties. We assume that Eve works in favor of Alice and Bob, and informs them about her output when she obtains the above ensemble. The key rateK, in this scenario, must be greater than in NSDI-iid scenario, since in the latter case Eve does not work on account of Alice and Bob, With a probability C(P ) the honest parties share the non-local correlations, useful for secret key agreement and with probability 1−C(P ), they share a local device with zero key rates. Since the key satisfying Maurer's security definition is upper bounded by mutual information function, and both of them are non-increasing under the LOPC operations, we obtainK Furthermore, where d Monotones, based on mutual information functions, are used to upper bound the secret key rate on the SKA scenario. However, the only one amongst them, which is easily computable, is the mutual information itself. All of them can be "squashed" and used to generate the upper bounds for K (iid) DI . Fact 1. The secrecy quantifiers and monotones [33] (and the mutual information function) are the upper bounds on S (A : B||E): We can use all of the functions displayed in Fact 1 to construct the non-signaling squashed secrecy quantifiers and monotones for the devices. See Section I for the proper definition of the above functions.
The proof of the above Corollary is straightforward from Theorem 2. It is important to note that, the complete extension of a device, P (AB|XY ), has been denoted as E(P )(ABE|XY Z), where the extended systems are in full control of Eve.
The intrinsic information I (A : B ↓ E) and the reduced intrinsic information I (A : B ↓↓ E) are functions without closed-form expression, and hence they cannot be computed straightforwardly. We present a technique for finding a nontrivial bound using the properties of one of them. First, we notice that for any fixed bipartite device and its complete extension, the following is true.
Unfortunately, the squashed non-locality lacks a closed-form expression for an arbitrary non-signaling device. It involves optimization over general measurement and post-processing channels in the eavesdropper side. This makes it hard to compute for a generic non-signaling device. Moreover, we obtained the squashed non-locality to be a convex function over the mixture of devices, see Sec. VII B, whereas the intrinsic information is not a convex function. This might be due to the fact that it was constructed in the same way as the non-signaling squashed entanglement, and the latter is a convex function of quantum states [40]. In this Section, we will show how convexity of squashed non-locality can be used not only to calculate nontrivial upper bounds on K (iid) DI , but also how it can be used to define new non-signaling squashed secrecy quantifiers.
Observation 3, brings the idea of how to use the convexity property of squashed non-locality. Since the squashed non-locality is an upper bound on K   Theorem 4, can be easily generalized by imposing different constraints than Equations (308) and (309) for example by using other upper bounds on the squashed non-locality and also an arbitrary number of them.
Proof. We prove by contradiction. If there would be a function which at any point is greater than the lower convex hull of I (A : B) and I (A : B |E ), either it would not be convex or it would be greater (at least at a single point) then at least one from the above non-signaling squashed non-locality quantifiers. Therefore, it is not in the set {F i }.
The upper bound on K (iid) DI introduced in the above Corollary can be computed much more easily than the nonsignaling squashed non-locality. We will refer to the procedure of calculating upper bounds via this technique as convexification. Observation 2 and Proposition 9 provide a collection of functions which are upper bounds for N sq . Hence, there exists a convex (in the same sense) function, which is an upper bound on the squashed non-locality, but at the same time, it is a lower bound on any function in this group, which is very clear from the proof of Theorem 4.

X. NUMERICAL UPPER BOUNDS ON SQUASHED NON-LOCALITY
In this Section, we will provide the upper bound on the N sq , for some exemplary two binary input and two binary output devices. We have obtained that there exist some devices that are not MDLOPC key distillable, although they are non-local. Describing the procedure of convexification, we focused on obtaining upper bounds by employing a lower convex hull of the upper bounds on N sq . The reason behind such an approach is to simplify our calculations. In this Section, we present a specific example of upper bounds on N sq , which we have obtained via this technique for some bipartite binary input output non-local devices. Let us recall here that N sq is defined as The core strategy is based on the observation that the definition of non-signaling squashed non-locality involves two minimizations: one in the measurement process and another one in applying suitable post-processing channel, in part of the eavesdropper. We notice that one can obtain upper bounds also in the case in which used measurement and channels are not optimal, which follows from the property of infimum. Knowing this, we can run a three-step strategy to obtain an upper bound on K (iid) DI for the desired set of devices.
1. Choose an (arbitrary, possibly continuous) set of devices, for which an upper bound is to be calculated.

2.
Calculate the values of upper bounds on non-signaling squashed non-locality employing different devices, different measurement choices, and different post-processing channels. These can be obtained either via educated guess, some heuristic method or with computer aid, including a random search over the space.
3. Construct lower convex hull of all previously generated plots, and the result is the convex hull of the chosen set of points.
We will now employ the above technique to bound the K (iid) DI . As we have argued, the notion of security employed by us is equivalent to that used by Hänggi, Renner and Wolf [17]. The protocol proposed by them yields a positive key rate for devices exhibiting quantum correlations, we compare our upper bounds with the lower bound presented by them [17,48], in Fig. 6. The non-signaling device we consider, as in Ref. [17], is given by P HRW (ab|xy) = It remains a valid non-signaling probability distribution in the parameter range 0 ≤ δ ≤ 1 and − 1 4 ≤ ≤ 3 4 . It exhibits non-local correlation for a very small range of parameters, quantified by the parameter ε, probability of not wining the CHSH game [55], which is ε = Pr(a ⊕ b = x · y) = 1 4 The device is non-local when the error ε ∈ [0, 1 4 ), and there are multiple choices of δ and to attain this. Without loss of generality, we choose 0 ≤ δ ≤ 1 and − 1 4 ≤ ≤ 1 12 − δ 3 . The non-locality fraction of these devices in the above range of parameters is C(P ) = 1 4 − δ − 3 . The polytope of P HRW , bipartite binary input-output devices, consists of 24 extremal devices [80], among which 16 are local or deterministic devices, and the remaining 8 are non-local. The local devices are given by L αβγσ (ab|xy) = 1 if a = αx ⊕ β, b = γy ⊕ σ 0 otherwise.
where α, β, γ, σ ∈ {0, 1}. And the non-local devices are B rst (ab|xy) = 1/2 if a ⊕ b = xy ⊕ rx ⊕ sy ⊕ t 0 otherwise, where r, s, t ∈ {0, 1}. In Fig. 6, we plot several non-signaling squashed secrecy quantifiers and monotones M (A : B||E) for different choices of the parameters δ and , with respect to the ε, which forms the upper bound on K (iid) DI . Different plots correspond to different choices of the parameters and δ, as given in Table I. The last row of Table I, give rise to the isotropic device, i.e., P iso = (1 − ε)P R + εP R, described in the main text.
In all the four figures, the red dashed line represents the squashed mutual information I(A : B) P between Alice and Bob. The optimal choices of the measurements by Alice and Bob in the squashing process varies with δ and . For Figs. 6(a) and 6(b), the optimum direct measurement choice is (x = 0, y = 0) for δ < ε, and any one of the other three input choices for δ ≥ ε. The measurement choice (x = 0, y = 0) is optimal in the entire range of ε for Fig. 6(c), and all measurements choices give the same mutual information for the choice of δ and in Fig. 6(d).
The non-locality cost N C (P HRW ) is plotted with the dashed-dot blue line in all the figures. Fig. 6(d) clearly shows that our measure, non-signaling squashed non-locality N sq is not a faithful measure of non-locality. The orange curve is the upper bound on N sq , and we have found that the bound reaches to 0 for ε = 0.2 (it remains equal 0 for ε ∈ (0.2, 0.25] due to the convexity of the measure). It strongly suggests that there exists nonlocality which can not be turned into security. Indeed, for these devices, no protocol of distribution is known. Using wirings that is necessary for the key to be non-zero, imply that we enter to some extent the general scenario of K DI for which there is a wide class of attacks [26]. Since our scenario is restricted, we can not postulate nonequivalence between non-locality and secrecy in NSDI paradigm. DI , for the bipartite binary input output device PHRW given in Eq. (313) (also in Ref. [17]). The parameters chosen for drawing these figures are provided in Table I Table of the different values of the parameters δ and , for the sub-figures as given in Fig. 6. δ and are the parameters of bipartite non-signaling device PHRW given in Eq. (313).

A. Method to obtain the upper bound on Nsq
The non-signaling squashed non-locality defined in Eq. (312), is the optimal conditional mutual information I(A : B|E ) E(PHRW) , between Alice and Bob, when Eve holds the complete extension of the device P HRW . It involves a maximization over the measurement (input) choices of Alice and Bob. In our cryptographic protocol, we assume that Eve will perform an adaptive choice of measurements after learning Alice and Bob's measurements, followed by a post-processing channel. We also observed that an arbitrary adaptive measurement by Eve, direct or general, with any post-processing channel, provides an upper bound on N sq , which remains convex over ε, in the entire range of ε.
We calculate the CE [43] of P HRW numerically in the entire range of δ and , where the device is non-local. The most tighter upper bound we have obtained numerically, involve a direct measurement by Eve. This direct measurement is no doubt is a function of Alice and Bob's input choice, which is intended to reduce the correlation shared by them. This measurement on Eve's system creates the following minimal ensembles in part of Alice and Bob,