{'fraction_non_alphanumeric': 0.042036526885011735, 'fraction_numerical': 0.00882563003775125, 'mean_word_length': 4.157195474875033, 'pattern_counts': {'":': 0, '<': 2, '<?xml version=': 0, '>': 0, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 7, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
One-way quantum key distribution: Simple upper bound on the secret key rate

We present a simple method to obtain an upper bound on the achievable secret key rate in quantum key distribution (QKD) protocols that use only unidirectional classical communication during the public-discussion phase. This method is based on a necessary precondition for one-way secret key distillation; the legitimate users need to prove that there exists no quantum state having a symmetric extension that is compatible with the available measurements results. The main advantage of the obtained upper bound is that it can be formulated as a semidefinite program, which can be efficiently solved. We illustrate our results by analysing two well-known qubit-based QKD protocols: the four-state protocol and the six-state protocol. Recent results by Renner et al., Phys. Rev. A 72, 012332 (2005), also show that the given precondition is only necessary but not sufficient for unidirectional secret key distillation.


I. INTRODUCTION
Quantum key distribution (QKD) [2,3] allows two parties (Alice and Bob) to generate a secret key despite the computational and technological power of an eavesdropper (Eve) who interferes with the signals. This secret key is the essential ingredient of the one-time-pad or Vernam cipher [4], which can provide information-theoretic secure communications.
Practical QKD protocols distinguish two phases in order to generate a secret key: a quantum phase and a classical phase. In the quantum phase a physical apparatus generates classical data for Alice and Bob distributed according to a joint probability distribution p(a i , b j ) ≡ p ij . In the classical phase, Alice and Bob try to distill a secret key from p ij by means of a public discussion over an authenticated classical channel.
Two types of QKD schemes are used to create the correlated data p ij . In entanglement based (EB) schemes, a source, which is assumed to be under Eve's control, produces a bipartite quantum state ρ AB that is distributed to Alice and Bob. Eve could even have a third system entangled with those given to the legitimate users. Alice and Bob measure each incoming signal by means of two positive operator valued measures (POVM) [5] {A i } and {B j }, respectively, and they obtain p ij = T r(A i ⊗ B j ρ AB ).
In an ideal prepare and measure (PM) schemes, Alice prepares a pure state |ϕ i with probability p i and sends it to Bob. On the receiving side, Bob measures each received signal with a POVM {B j }. The signal preparation process in PM schemes can be also thought of as follows [6]: First, Alice produces the bipartite state |ψ source AB = i √ p i |α i A |ϕ i B and, afterwards, she measures the first subsystem in the orthogonal basis |α i A corresponding to the measurements A i = |α i A α i |. This action generates the (non-orthogonal) signal states |ϕ i with probabilities p i . In PM schemes the reduced density matrix of Alice, ρ A = T r B (|ψ source AB ψ source |), is fixed and cannot be modified by Eve. To include this information in the measurement process one can add to the observables {A i ⊗ B j }, measured by Alice and Bob, other observables {C k ⊗ 1 1} such that they form a tomographic complete set of Alice's Hilbert space [7,8]. In the most general PM scheme Alice is free to prepare arbitrary states ρ i instead of only pure states |ϕ i . One can apply the same framework as for the ideal PM scheme, as reviewed in App. A.
From now on, we will consider that p ij and {A i ⊗ B j } refer always to the complete set of measurements, i.e., they include also the observables {C k ⊗ 1 1} for PM schemes.
The public discussion performed by Alice and Bob during the classical phase of QKD can involve either one-way or two-way classical communication. Two-way classical communication is more robust than one-way in terms of the amount of errors that the QKD protocol can tolerate in order to distill a secret key [9]. However, the first security proof of QKD by Mayers [10], and the most commonly known proof by Shor and Presskill [11] are based on one-way communications, and many other security proofs of QKD belong also to this last paradigm [12,13]. Moreover, any two-way communication protocol includes a final non-trivial step that is necessarily only one-way, so that the study of one-way communication is also useful for the study of two-way communication.
In this paper we concentrate on one-way classical communication protocols during the public discussion phase. Typically, these schemes consist of three steps: local preprocessing of the data, information reconciliation to correct the data, and privacy amplification to decouple the data from Eve [14]. Depending on the allowed direction of communication, two different cases must be considered. Direct communication refers to communication from Alice to Bob, reverse reconciliation allows com-munication from Bob to Alice only. (See, for instance, [15,16].) We will consider only the case of direct communication. Expressions for the opposite scenario, i.e., reverse reconciliation, can be directly obtained simply by renaming Alice and Bob. Note that for typical experiments, the joint probability distribution p ij is not symmetric, so that the qualitative statements for both cases will differ.
We address the question of how much secret key can be obtained from the knowledge of p ij and {A i ⊗ B j }. This is one of the most important figures of merit in order to compare the performance of different QKD schemes. We consider the so-called trusted device scenario, where Eve cannot modify the actual detection devices employed by Alice and Bob. (See Refs. [8,17].) We assume that the legitimate users have complete knowledge about their detection devices, which are fixed by the actual experiment.
In the last years, several lower and upper bounds on the secret key rate for particular one-way QKD schemes have been proposed. The lower bounds come from protocols that have been proven to be secure [1, 11-13, 18, 19]. The upper bounds are generally derived by considering some particular eavesdropping attack and by determining when this attack can defeat QKD [1,[19][20][21][22]. Unfortunately, to evaluate these known bounds for general QKD protocols is not always a trivial task. Typically, it demands to solve difficult optimization problems, which can be done only for some particular QKD protocols [1].
In this paper we present a simple method to obtain an upper bound on the secret key rate for general one-way QKD protocols. The obtained upper bound will not be tight for all QKD schemes, but it has the advantage that it is straightforward to evaluate in general since it can be formulated as a semidefinite program [23,24]. Such instances of convex optimization problems can be efficiently solved, for example by means of interior-point methods [23,24]. Our analysis is based on a necessary precondition for one-way QKD: The legitimate users need to prove that there exists no quantum state having a symmetric extension that is compatible with the available measurement results [25]. This kind of states (with symmetric extensions) have been recently analyzed in Refs. [26][27][28].
The paper is organized as follows. In Sec. II we review some known upper bounds on the secret key rate using one-way post-processing techniques. Sec. III includes the main result of the paper. Here we introduce a straightforward method to obtain an upper bound on the secret key rate for one-way QKD. This result is then illustrated in Sec. IV for two well-known qubit-based QKD protocols: the four-state [3] and the six-state [29] QKD schemes. We select these two particular QKD schemes because they allow us to compare our results with already known upper bounds in the literature [1,[19][20][21][22]. Then in Sec. V we present our conclusions. The paper includes also two Appendices. In App. A we consider very briefly the case of QKD based on mixed signal states instead of pure states. Finally, App. B contains the semidefinite program needed to actually solve the upper bound derived in Sec. III.

II. KNOWN UPPER BOUNDS
Different upper bounds on the secret key rate for oneway QKD have been proposed in the last years. These results either apply to a specific QKD protocol [20][21][22], or they are derived for different starting scenarios of the QKD scheme [1,18,19], e.g., one where Alice and Bob are still free to design suitable measurements.
Once Alice and Bob have performed their measurements during the quantum phase of the protocol, they are left with two classical random variables A and B, respectively, satisfying an observed joint probability distribution p(a i , b j ) ≡ p ij . On the other hand, Eve can keep her quantum state untouched and delay her measurement until the public-discussion phase, realized by Alice and Bob, has finished.
In order to provide an upper bound on the secret key rate it is sufficient to consider a particular eavesdropping strategy. For instance, we can restrict ourselves to collective attacks [1,19]. This situation can be modelled by assuming that Alice, Bob, and Eve share an unlimited number of the so-called ccq states ρ ccq which are given by [18] where ρ i,j E denotes Eve's conditional quantum state, and the states {|i A } and {|j B } form orthonormal basis sets for Alice and Bob, respectively. As shown in Refs. [1,19], in this scenario the rate K → , at which Alice and Bob can generate a secret key by using only direct communication, is bounded from above by where the supremum is taken over all possible density operators σ U and σ T depending on the random variable A of Alice. The von Neumann entropy of a quantum state ρ reads as S(ρ) = −T r(ρ log ρ), while the conditional von Neumann entropy S is defined in terms of von Neumann entropies itself, i.e., S(U |ET ) = S(U ET ) − S(ET ). The upper bound given by Eq. (2) refers to the quantum state given by Eq. (1) after a local post-processing step. It is given by [1,19] where ρ i E = j p(b j |a i )ρ i,j E . This upper bound involves only a single letter optimization problem. However, the optimization runs over density operators σ U and σ T which makes Eq. (2) hard to evaluate.
Another upper bound that applies to the QKD scenario that we consider here is the Csiszár and Körner's secret key rate for the one-way classical key-agreement scenario [30]. Suppose that Alice, Bob, and Eve have access to many independent realizations of three random variables A, B, and E, respectively, that are distributed according to the joint probability distribution p(a i , b j , e k ). Csiszár and Körner showed that the one-way secret key rate is given by [30] The single letter optimization ranges over two classical channels characterized by the transition probabilities Q(u l |a i ) and R(t m |u l ), and where the conditional Shannon entropy is defined as H(U |ET ) = − p(u l , e k , t m ) log p(u l |e k , t m ). The first channel produces the secret key U , while the second channel creates the broadcasted information T . Note that Eq. (4) provides also an upper bound on K → . Eve can always measure her subsystem of the ccq state given by Eq. (1) by means of a POVM {E k }. As a result, Alice, Bob, and Eve share the tripartite probability dis- Unfortunately, the optimization problem that one has to solve in order to obtain S → (A; B|E) is also non-trivial, and its solution is only known for particular examples. (See Ref. [31].) Finally, an easy computable upper bound on K → is given by the classical mutual information I(A; B) between Alice and Bob [32]. This quantity is defined in terms of the Shannon entropy H(A) = − p(a i ) log p(a i ) and the Shannon joint entropy The mutual information represents an upper bound on the secret key rate for arbitrary public communication protocols, hence in particular for one-way communication protocols [32], i.e., To evaluate I(A; B) for the case of QKD, we only need to use as p(a i , b j ) the correlated data p ij .

III. UPPER BOUND ON K→
Our starting point is again the observed joint probability distribution p ij obtained by Alice and Bob after their measurements. This probability distribution defines an equivalence class S of quantum states that are compatible with it, By definition, every state ρ AB ∈ S can represent the state shared by Alice and Bob before their measurements [47]. Now the idea is simple: just impose some particular eavesdropping strategy for Eve, and then use one of the already known upper bounds. (See also Ref. [33].) The upper bound resulting represents an upper bound for any possible eavesdropping strategy. The method can be described with the following three steps.
(1) Select a particular eavesdropping strategy for Eve. This strategy is given by the choice of a tripartite quantum state ρ ABE and a POVM {E k } to measure Eve's signals. The only restriction here is that the chosen strategy cannot alter the observed data, i.e., T r E (ρ ABE ) ∈ S.
(2) Calculate the joint probability distribution (3) Use an upper bound for K → given the probability distribution p ijk . Here we can use, for instance, Eq. (4) or just the mutual information between Alice and Bob which is straightforward to calculate.
This method can be improved by performing an optimization over all possible measurements on Eve's system and over all possible tripartite states that Eve can access [48]. This gives rise to a set of possible extensions P of the observed bipartite probability distribution p ij for the random variables A and B to a tripartite probability distribution p ijk for the random variables A, B, and E. Now the upper bound is given by with S → representing the chosen quantity in step (3). In Sec. III A we present a necessary precondition for one-way QKD. In particular, Alice and Bob need to prove that there exists no quantum state having a symmetric extension that is compatible with the available measurements results [25]. Motivated by this necessary precondition, we introduce a special class of eavesdropping strategies for Eve in Sec. III B. These strategies are based on a decomposition of quantum states similar to the best separability approximation [34,35], but now for states with symmetric extensions. The general idea followed here is similar to that presented in Ref. [33] for two-way upper bounds on QKD.

A. States With Symmetric Extensions & One-Way QKD
A quantum state ρ AB is said to have a symmetric extension to two copies of system B if and only if there exists a tripartite state ρ ABB ′ with H B = H B ′ which fulfills the following two properties [26]: where the operator P satisfies P |ijk ABB ′ = |ikj ABB ′ . This definition can be easily extended to cover also the case of symmetric extensions of ρ AB to two copies of system A, and also of extensions of ρ AB to more than two copies of system A or of system B.
States with symmetric extension play an important role in quantum information theory, as noted recently.
They can deliver a complete family of separability criteria for the bipartite [26,27] and for the multipartite case [28], and they provide a constructive way to create local hidden variable theories for quantum states [36]. Moreover, they are related to the capacity of quantum channels [37]. Most important, a connection to one-way QKD has also been noticed: Observation 1 [25]: If the observed data p ij originate from a quantum state ρ AB which has a symmetric extension to two copies of system B, then the secret key rate for unidirectional communication K → from Alice to Bob vanishes.
Proof: Suppose that the observed data p ij originate from a state ρ AB which has a symmetric extension to two copies of system B. Suppose as well that the third subsystem of the extended tripartite state ρ ABB ′ is in Eve's hands, i.e., ρ ABE = ρ ABB ′ . This results in equal marginal states for Alice-Bob and Alice-Eve, i.e., ρ AB = ρ AE . From Alice's perspective the secret key distillation task is then completely symmetric under interchanging Bob and Eve. Since we restrict ourselves to unidirectional classical communication from Alice to Bob only, we find that it is impossible for Bob to break this symmetry. That is, if Alice tries to generate a secret key with Bob her actions would automatically create exactly the same secret key with Eve. To complete the proof we need to verify that Eve can access the symmetric extension ρ ABB ′ of ρ AB in both kinds of QKD schemes, EB schemes and PM schemes. It was demonstrated in Ref. [7] that Eve can always create a purification of the original state ρ AB , which means that Eve can have access to the symmetric extension.
Remark 1: A quantum state ρ AB has a symmetric extension to two copies of system B if and only if there exists a tripartite state ρ ABE with equal marginal states for Alice-Bob and Alice-Eve, i.e., ρ AB = ρ AE .
Proof: If a quantum state ρ AB has a symmetric extension this automatically implies equal marginal states for Alice-Bob and Alice-Eve. For the other direction, suppose that there exists a tripartite stateρ ABE with equal marginals, but which is not symmetric under interchange of subsystems B and E. Then the state Pρ ABE P is also a possible tripartite state with equal marginals. This allows to construct the symmetric extension of the state ρ AB as ρ ABE = 1/2(ρ ABE + Pρ ABE P ).
There exists entangled states which do have symmetric extensions [26,27]. Hence, accordingly to Observation 1, although these states are entangled and therefore potentially useful for two-way QKD [7], they are nevertheless useless for one-way QKD in the corresponding direction.
We define the best extendibility approximation of a given state ρ AB as the decomposition of ρ AB into a state with symmetric extension, that we denote as σ ext , and a state without symmetric extension ρ ne , while maximizing the weight of the extendible part σ ext [49], i.e., This definition follows the same spirit as the best separa-bility approximation introduced in Refs. [34,35]. Since the set of all extendible quantum states forms a closed and convex set [27], the maximum in Eq. (11) always exists. We denote the maximum weight of extendibility of ρ AB as λ max (ρ AB ), where 0 ≤ λ max (ρ AB ) ≤ 1 is satisfied.
Given an equivalence class S of quantum states, we define the maximum weight of extendibility within the equivalence class, denoted as λ S max , as This parameter is related to the necessary precondition for one-way secret key distillation by the following observation.
Observation 2 : Assume that Alice and Bob can perform local measurements with POVM elements A i and B j , respectively, to obtain the joint probability distribution of the outcomes p ij on the distributed quantum state ρ AB . Then the following two statements are equivalent: (1) The correlations p ij can originate from an extendible state. (2) The maximum weight of extendibility λ S max within the equivalence class of quantum states S compatible with the observed data p ij satisfies λ S max = 1. Proof. If p ij can originate from an extendible state, then there exists a σ ext such as σ ext ∈ S. Moreover, we have that any extendible state satisfies λ max (σ sep ) = 1. The other direction is trivial.
Let us define S max as the equivalence class of quantum states composed of those states ρ AB ∈ S that have maximum weight of extendibility. It is given by

B. Eavesdropping Model
An eavesdropping strategy for our purpose is completely characterized by selecting the overall tripartite quantum state ρ ABE and the measurement operators {E k }. Again, the only restriction here is that T r E (ρ ABE ) ∈ S. We consider that Eve chooses a purification ρ ABE = |Φ ABE Φ| of a state ρ AB taken from the equivalence class S max .
The quantum states σ ext and ρ ne of the best extendibility approximation of ρ AB can be written in terms of their spectral decomposition as [50] with φ i |φ j = ψ i |ψ j = 0 for all i = j. A possible purification of the state ρ AB is given by where the states {|t k = ext, f i , |t k = ne, f j } form an orthogonal bases on Eve's subsystem.
It is important to note that in both kinds of QKD schemes, EB schemes and PM schemes, Eve can always have access to the state |Φ ABE given by Eq. (16). This has been shown in Ref. [7]. In an EB scheme this is clear since Eve is the one who prepares the state ρ AB and who distributes it to Alice and Bob. In the case of PM schemes we need to show additionally that Eve can obtain the state |Φ ABE by interaction with Bob's system only. In the Schmidt decomposition the state prepared by Alice, |ψ source AB , can be written as |ψ source = i c i |u i A |v i B . Then the Schmidt decomposition of |Φ ABE , with respect to system A and the composite system BE, is of the form |Φ ABE = i c i |u i A |ẽ i BE since c i and |u i A are fixed by the known reduced density matrix ρ A to the corresponding values of |ψ source AB . Then one can find a suitable unitary operator U BE such that |ẽ i BE = U BE |v i B |0 E where |0 E is an initial state of an auxiliary system.
For simplicity, we consider a special class of measurement strategies for Eve. This class of measurements can be thought of as a two step procedure: (1) First, Eve distinguishes contributions coming from the part with symmetric extension and from the part without symmetric extension of ρ AB .
The corresponding measurements are projections of Eve's subsystem onto the orthogonal subspaces Π ext = i |t k = ext, f i t k = ext, f i | and Π ne = j |t k = ne, f j t k = ne, f j |.
(2) Afterwards, Eve performs a refined measurement strategy on each subspace separately. As we will see, only the non-extendible part ρ ne might allow Alice and Bob to distill a secret key by direct communication; from the extendible part no secret key can be obtained.
We shall label Eve's measurement outcomes e k with two variables, e k = (t k , f k ). The first variable t k ∈ {ext, ne} denotes the outcome of the projection measurement, while f k corresponds to the outcome arising from the second step of the measurement strategy. With probability p(t k = ne) = 1 − λ S max Eve finds that Alice and Bob share the non-extendible part of ρ AB . After this first measurement step, the conditional quantum state shared by Alice, Bob, and Eve, denoted as ρ ne ABE = |Φ ne Φ ne |, corresponds to a purification of ρ ne , i.e., Next we provide an upper bound for K → that arises from this special eavesdropping strategy. Moreover, as we will see, the obtained upper bound is straightforward to calculate.

C. Resulting Upper Bound
For the special eavesdropping strategy considered in Sec. III B, we will show that we can restrict ourselves to the non-extendible part ρ ne of a given ρ AB only. As a consequence, the resulting upper bound will only depend on this non-extendible part. This motivates the definition of a new equivalence class of quantum states S ne max , defined as where ρ ne (ρ AB ) represents the non-extendible part in a valid best extendibility approximation of ρ AB ∈ S max given by Eq. (11). To simplify the notation, from now on we will write ρ ne instead of ρ ne (ρ AB ). The possibility to concentrate on the non-extendible parts only is given by the following theorem. Theorem 1 : Suppose Alice's and Bob's systems are subjected to measurements described by the POVMs {A i } and {B j } respectively, and their outcomes follow the probability distribution p ij . They try to distill a secret key by unidirectional classical communication from Alice to Bob only. The secret key rate, denoted as K → , is bounded from above by where S → (A; B|E) denotes the classical one-way secret key rate given by Eq. (4) for a tripartite probability distributionp ijk ∈ P * . The set P * considers all possible POVMs {E k } which Eve can perform on a purification |Φ ne ABE of the non-extendible part ρ ne ∈ S ne max only, Proof : In order to derive Eq. (19) we have considered only a particular class of eavesdropping strategies for Eve as described in Sec. III B. This class defines a subset P ′ of the set of all possible extensions P of the observed data p ij to a general tripartite probability distribution p ijk , which are considered in the upper bound given by Eq. (8). We have, therefore, that As introduced in Sec. III B, we label the outcome of Eve's measurement strategy by two variables e k = (f k , t k ), where the value of t k ∈ {ext, ne} labels the outcome of her projection measurement. For the tripartite probability distribution p(a i , b j , e k = (f k , t k )) we denote the secret key rate by S → (A; B|F T ).
For the one-way secret key rate S → (A; B|F T ) we get In the first line we just use the definition of the classical secret key rate given by Eq. (4). The first inequality comes from the fact that conditioning can only decrease the entropy, i.e., H(U |V B) ≥ H(U |V BT ). For the last inequality, we give Alice also access to the random variable T , additionally to her variable A, over which she can perform the post-processing. Altogether Eq. (21) tells that if Eve announces publicly the value of the variable T , so whether Alice and Bob share the extendible or non-extendible part, that this action can only enhance Alice and Bob's ability to create a secret key. Next, we have that First we rewrite the conditional entropies in terms of an expectation value over the parameter t k . The map U ← AT acts independent on each term of the sum over t k . Therefore the supremum can be put into the sum taking the specific value of t k . Since sup U←At k is equal to sup U←A for t k fixed, we find on the right hand side the one-way secret key rate for the conditional three party correlation p(a i , b j , f l |t k ) denoted as S t k → (A; B|F ). Combining Eqs. (21,22) we have, therefore, that From Observation 1 we learn that Alice and Bob cannot draw a secret key out of the extendible part σ ext , i.e., S → (A; B|E; t k = ext) = 0. Therefore, only the non-extendible part ρ ne can contribute to a positive secret key rate. The conditional probability distribution p(a i , b j , f k |t k = ne) ≡p ijk defines exactly the considered extensions P * . This concludes the proof. The upper bound given by Eq. (19) requires to solve the infimum over all possible extensions P * . Instead of this optimization, one can just pick a particular state S ne max and calculate the infimum over all possible measurements {E k } employed by Eve.
Corollary 1 : Given a state ρ ne ∈ S ne max , the secret key rate K → is bounded from above by with S E k → (A; B|E) being the classical one-way secret key rate of the tripartite probability distributionp ijk = T r(A i ⊗ B j ⊗ E k (|Φ ne Φ ne |)), and where |Φ ne denotes a purification of ρ ne .
Proof : The right hand side of Eq. (24) is an upper bound of the right hand side of Eq. (19), because in Eq. (24) we take only a particular state ρ ne ∈ S ne max , whereas in Eq. (19) we perform the infimum over all possible states ρ ne ∈ S ne max .
The upper bounds provided by Theorem 1 and Corollary 1 still demand solving a difficult optimization problem. Next, we present a simple upper bound on K → that is straightforward to calculate. Then, in Sec. IV, we illustrate the performance of this upper bound for two well-known QKD protocols: the four-state [3] and the six-state [29] QKD schemes. We compare our results to other well-known upper bounds on K → for these two QKD schemes [1,[19][20][21][22].
Corollary 2 : The secret key rate K → is upper bounded by where I ne (A; B) denotes the classical mutual information calculated on the probability distributionp ij = T r(A i ⊗ B j ρ ne ) with ρ ne ∈ S ne max . Proof : According to Eq. (6), the one-way secret key rate S → (A; B|E) is bounded from above by the mutual information I (A; B). Note that the mutual information I(A; B) is an upper bound on the secret key rate for arbitrary communication protocols [32].
The main difficulty when evaluating the upper bound given by Eq. (25) for a particular realization of QKD relies on obtaining the parameter λ S max and the nonextendible state ρ ne . In App. B we show how this problem can be cast as a convex optimization problem known as semidefinite program [51]. Such instances of convex optimization problems can be efficiently solved, for example by means of interior-point methods [23,24].

IV. EVALUATION
In this section we evaluate the upper bound on K → given by Eq. (25) for two well-known qubit-based QKD protocols: the four-state [3] and the six-state [29] QKD schemes. We select these two particular QKD schemes because they allow us to compare our results with already known upper bounds on K → [1,[19][20][21][22]. Let us emphasize, however, that our method can also be used straightforwardly to obtain an upper bound for higher dimensional, more complicated QKD protocols, for which no upper bounds have been calculated yet. By means of semidefinite programming one can easily obtain the maximum weight of extendibility λ S max and the corresponding non-extendible part ρ ne which suffice for the computation of the upper bound. (See App. B.) In the case of the four-state EB protocol, Alice and Bob perform projection measurements onto two mutually unbiased bases, say the ones given by the eigenvectors of the two Pauli operators σ x and σ z . In the corresponding PM scheme, Alice can use as well the same set of measurements but now on a maximally entangled state. Note that here we are not using the general approach introduced previously, |ψ source AB = i √ p i |α i A |ϕ i B , to model PM schemes, since for these two protocols it is sufficient to consider that the effectively distributed quantum states consist only of two qubits. For the case of the  25) for the four-state (solid) and the six-state (dotted) QKD protocols in comparison to known lower bounds on the secret key rate given in Ref. [1]. The equivalence class of states S is fixed by the observed data pij , which are generated via measurements onto the state ρAB(e) = (1 − 2e)|ψ + AB ψ + | + e/21 1AB. The quantum bit error rate is given by QBER = e.
Here we assume an asymmetric basis choice to suppress the sifting effect [38].
six-state EB protocol, Alice and Bob perform projection measurements onto the eigenvectors of the three Pauli operators σ x , σ y , and σ z on the bipartite qubit states distributed by Eve. In the corresponding PM scheme Alice prepares the eigenvectors of those operators by performing the same measurements on a maximally entangled two-qubit state.
We model the transmission channel as a depolarizing channel with error probability e. This defines one possible eavesdropping interaction. In particular, the observed probability distribution p ij is obtained in both protocols by measuring the quantum state ρ AB (e) = (1− 2e)|ψ + AB ψ + |+ e/21 1 AB , where the state |ψ + AB represents a maximally entangled two-qubit state as |ψ + AB = 1/ √ 2(|00 AB + |11 AB ), and 1 1 AB denotes the identity operator. The state ρ AB (e) provides a probability distribution p ij that is invariant under interchanging Alice and Bob. This means that for this particular example there is no difference whether we consider direct communication (extension of ρ AB (e) to two copies of system B) or reverse reconciliation (extension of ρ AB (e) to two copies of system A). The quantum bit error rate (QBER), i.e., the fraction of signals where Alice and Bob's measurements results differ, is given by QBER = e.
The resulting upper bounds on K → are illustrated in Fig. 1. These results do not include the sifting factor of 1/2 for the four-state protocol (1/3 for the six-state protocol), since this effect can be avoided by an asymmetric basis choice for Alice and Bob [38].
Let us consider in more detail the cut-off points for K → , i.e., the values of QBER for which the secret key rate drops down to zero in Fig. 1. We find that in the four-state protocol (six-state protocol) one-way secret key distillation might only be possible for a QBER < 14.6 (QBER < 1/6). These results reproduce the wellknown upper bounds on both protocols from Refs. [20][21][22]. More recently, a new upper bound for the six-state protocol was obtained in Refs. [1,19], QBER 16.3. This result indicates that the upper bound given by Eq. (25) is not tight, since it fails to reproduce this last value. More importantly, both statements together entail that Observation 1 is necessary but not sufficient for one-way secret key distillation: there exist bipartite states which are non-extendible, nevertheless no secret key can be obtained from them via one-way post-processing. It shows that the characterization of useful quantum states for one-way QKD is still an open problem. Finally, let us mention that the threshold point for the four-state protocol computed in Ref. [1,19] lead to the same cut-off point as for the optimal approximate cloner attack and thus also coincides with the value of our result.

V. CONCLUSION
In this paper we address the fundamental question of how much secret key can be obtained from the classical data that become available once the first phase of QKD is completed. In particular, we restrict ourselves to one-way public communication protocols between the legitimate users. This question has been extensively studied in the literature and analytic expressions for upper and lower bounds on the one-way secret key rate are already known. Unfortunately, to evaluate these expressions for particular QKD protocols is, in general, a non-trivial task. It demands to solve difficult optimization problems for which no general solution is known so far.
Here we provide a simple method to obtain an upper bound on the one-way secret key rate for QKD. It is based on a necessary precondition for one-way secret key distillation: The legitimate users need to prove that there exists no quantum state having a symmetric extension that is compatible with the available measurements results. The main advantage of the method is that it is straightforward to calculate, since it can be formulated as a semidefinite program. Such instances of convex optimization problems can be solved very efficiently. More importantly, the method applies both to prepare and measure schemes and to entanglement based schemes, and it can reproduce most of the already known cut-off points for particular QKD protocols. Recent results show that the given precondition is only necessary but not sufficient, so there exists non-extendible quantum state which nevertheless are useless for one-way key distillation.
In this Appendix we describe very briefly the case of QKD based on mixed quantum states instead of pure states. In particular, we analyze PM schemes, since in EB schemes it is clear that Eve can always distribute mixed states to Alice and Bob, and this situation is already contained in the results included in the previous sections. More specifically, we translate the necessary precondition for secret key generation by unidirectional communication to the PM mixed state scenario.
In the most general PM scheme, Alice prepares mixed signal states ρ i B following a given probability distribution p i and sends them to Bob. Equivalently, we can think of the preparation process as follows. Suppose that the spectral decomposition of the signal state ρ i B is given by This can be interpreted as producing with probability λ i j the pure state |ϕ i j . Alternatively, ρ i B can as well originate from a pure state in a higher dimensional Hilbert space. That is, from a possible purification |φ i A ′ B of the state ρ i B in the composite Hilbert space H A ′ ⊗ H B which reads as Now we can use the same formalism as the one for PM schemes based on pure signal states. We can assume that first Alice prepares the tripartite quantum state Afterwards, in order to produce the actual signal state in system B, Alice performs a measurement onto the standard basis of system A only, and completely ignores system A ′ . Her measurement operators are given by The produced signal states are sent to Bob who measures them by means of the POVM {B j }.
Since Eve can only interact with system B, the reduced density matrix of ρ AA ′ = T r B (|ψ source AA ′ B ψ source |) is fixed by the actual preparation scheme. This information can be included in the measurement process by adding to the observables measured by Alice and Bob other observables {C k,AA ′ ⊗ 1 1 B } such that they provide complete information on the bipartite Hilbert space of Alice H AA ′ = H A ⊗ H A ′ . (See also [52].) The relevant equivalence class of quantum states S AA ′ B contains all tripartite quantum states ρ AA ′ B consistent with the available information during the measurement process. Obviously, Eve can always access every purification |Ψ AA ′ BE of a state in S AA ′ B . Note that the situation is completely equivalent to the case of pure signal states [7]. Now we are ready to rephrase the necessary precondition for one-way secret key distillation for the case of QKD based on mixed states. For direct communication we need to search for symmetric extensions to two copies of system B. That is, if we denote withĀ the bipartite system on Alice's sideĀ ≡ AA ′ , we have to search for quantum states in the equivalence class S AA ′ B = SĀ B which are extendible to ρĀ BB ′ . In the case of reverse reconciliation, Eve needs to possess only a copy of system A. Note that the final key is created only from measurements onto this system. Therefore, in order to determine the cut-off points for the key distillation process, one has to examine the question whether a four-partite quantum state ρ AA ′ BE with T r E (ρ AA ′ BE ) ∈ S AA ′ B exists such that T r A ′ (ρ AA ′ BE ) is exactly the desired symmetric extension to two copies of system A.

APPENDIX B: SEMIDEFINITE PROGRAMS
AND SEARCHING FOR λ S max AND ρne In this Appendix we provide a method to obtain the parameter λ S max and the corresponding non-extendible state ρ ne . In particular, we show how one can cast this problem as a convex optimization problem known as semidefinite programming. Such instances of convex optimization problems appear frequently in quantum information theory and they can be solved very efficiently. There are freely-available input tools like, for instance, YALMIP [39], and standard semidefinite programming solvers, see SeDuMi [40] and SDPT3-3.02 [41].
A typical semidefinite problem, also known as primal problem, has the following form where the vector x = (x 1 , ..., x t ) T represents the objective variable, the vector c is fixed by the particular optimization problem, and the matrices F 0 and F i are Hermitian matrices. The goal is to minimize the linear objective function c T x subject to a linear matrix inequality constraint F (x) ≥ 0 [23,24]. (See also Ref. [53].) Any bounded Hermitian operator ρ A = ρ † A acting on a n-dimensional Hilbert space S can be written in terms of an operator basis, which we shall denote by {S k }, satisfying the following three conditions: T r(S j ) = nδ j1 , S j = S † j , and T r(S j S j ′ ) = nδ jj ′ . A possible choice is given by the SU (n) generators. Using this representa-constraintsF (x) ≥ 0,F (x) ≥ 0, can be combined into a single new linear matrix inequality constraint as: ≡F (x) ⊕F (x) ≥ 0.