A non-distillability criterion for secret correlations

A non-distillabilit y crit erion for secret correlations Llu ´ ıs Masanes 1 , Andreas Winter 2 , 3 1 ICFO-Institu t de Ciencies F ot oniques, 08860 C astel ldefels (Bar c elona), Sp ain 2 Dep artment of Mathematics, University o f Bristol, Bristol BS8 1TW, U.K. 3 Centr e for Quantum T e chnolo gies, National Uni versity of Singap or e, 2 Scienc e Drive 3, Singap or e 117542 Within entangl ement theory there are criteria whic h certify that some quantum states cannot be distilled into pu re entanglemen t. An example is the positive partial transposition criterion. Here w e present, for the first time, th e analogous th ing for secret correlations. W e introduce a com- putable criterion whic h certifies that a probability distribution b etw een t w o honest p arties and an ea ves dropp er cannot b e (asymptotically) distilled into a secret k ey . The existence of non-distillable correlations with p ositiv e secrecy cost, also known as bound information, is an op en qu estion. This criterion may b e t he key for finding b ound information. H o w eve r, if it turns out th at this criterion does not detect b ou n d information, then, a very interesting consequence fo llo ws: any distribution with p ositive secrecy cost can increase the secrecy content of another distribution. In other w ords, all correlations with p ositive secrecy cost constitute a useful resource. I. INTRO DUCTION Information theoretic cryptolog y started with Shan- non [2 0], and it established that secret communication relied entirely on se c ret key; but no t until Wyner’s fa- mous wiretap paper [23] w a s it reco gnized that noise in the eavesdropper ’s c hannel can b e used to establish se- crecy in a communication. The secrecy ca pacity of what is no w called t he general wiretap channel was determined in [7]. After that, again, it to ok some while b efor e the distillation o f k ey from given corre la tion P AB E betw een t wo co op erating play ers , Alice (A) and B o b (B), a nd an eav esdr opp er Eve (E) was cons idered [2 , 16], in a mo del where the three pa r ties share a larg e num b er of co pies of the given distribution P AB E , and Alice and Bob ca n freely exchange messa ges over an authenticated but pub- lic channel (i.e., monitor ed by Eve). Indeed, Maur er [16] show ed that this scenar io is muc h richer than the one of the w ir etap channel. His pap er po sed the proble m of deter mining the optimal secre t key rate of any giv en distribution P AB E , in the discrete mem- oryless setting of av ailabilit y of asympto tica lly many in- depe ndent samples of the distribution, and in pa rticular the problem o f deciding whether a distribution can b e distilled into a secret key o r not. There has by now b een a long history of fr uitful ex- change o f ideas b etw een cryptography a nd entanglement theory (see e.g. [3]), mostly relating proto cols for secret key a nd entanglement distillatio n. In the quantum case, the reverse pro cess was considerred in [3]: create a quan- tum state fro m pure entanglement with ma ximum effi- ciency . Subsequently it was shown that there exist states that require a p ositive rate of entanglemen t to b e cr e- ated, but yield no pure entanglemen t a t a ll under any distillation pro cedure. These states are c a lled b ound en- tanglement [9, 21]. The key to show the existence of bo und entanglemen t is the p ositive partial transp ositio n criterion [18], which ce r tifies that a given state is not distillable. This motiv ated Gisin a nd W olf [8] to sp eculate on the existence of b ound information , i.e. distributions t hat yield no secr et key under distillation but nevertheless somehow co nt ain sec recy . They presented some candi- dates fo r b o und information derived from bound en ta n- gled q ua nt um s tates. Subsequently , the notion of secret key cost of a given distribution P AB E was formalised (un- der the na me information of formation ) [19]. Roughly sp eaking, this is the minimum amount of secret bits that are necessary in order to generate P AB E from public communication. Latter, a single-letter formula for this quantit y was found [2 2]. Renner and W olf [19] hav e shown that there can b e ar- bitrarily large gaps betw een the s ecret key co st and the key distillation rate, thus providing evidence for the ex- istence of b o und informa tion (see also [2 2]). In [1, 13] it was shown that multip art ite (i.e., more than tw o honest play ers ) b ound informa tion indeed exists. But no thing is known ab out the existence of b ound informa tion in the bipa rtite case . The reaso n is that no criter ion for non-distillability of secret co rrelations is known. In this pap er we prese nt the fir st o ne, which is ba sed on the idea presented in [14, 15]. II. NOT A TION Key distilla tion a nd key cos t are most conv eniently ex - pressed via the probability distribution from which Alice, Bob and E ve obs e r ve samples. A g eneric multipartite probability distr ibutio n among the parties AB . . . is de- noted by a non-nega tiv e vector P AB ... belo nging to the R -linear s pa ce H A ⊗ H B ⊗ · · · which comes with a dis- tinguished (tenso r pro duct) ba sis. This distinguished, “computational” , basis of the lo cal space H A has o ne element for each outcome from the alphab et of A . F or instance, the computational bas is of a bit B consists of the tw o vectors (1 , 0 ) and (0 , 1 ). Note tha t for g eneric alphab ets we use H to denote the vector space, but for bits (tw o dimensions) we r eserve B . F ur thermore, to 2 ident ify whic h party has access to the sample fro m a fac- tor in the tenso r pr o duct, w e attach generic indices A , B and E ; if the spa ce of one party co nsists of several alpha- bets , w e denote them A , A ′ , A ′′ , etc. The co efficients of P AB ... in the co mputational (pro duct) basis a re denoted by P AB ... ( a, b, . . . ), and each cor resp onds to the pro ba- bilit y o f the even t with outcomes ( a, b . . . ). Hence all the co efficients of P AB ... m ust b e non-negative. Unless explicitly men tioned, we allow probabilit y distributions P AB ... to b e not nor malized. A general (stochastic) o per ation M , which may be fil- tering (i.e., not prese r ving pr obability), is repr e sented by a linear map with no n-negative coefficie nts M : H 1 → H 2 . B ecause we do not care ab out normalization, there is no additiona l constraint on the co e fficie nts of M , apar t from non-negativity . In the case of lo cal op erations, we sp ecify whic h party p erforms ea ch opera tion b y attach- ing a n appropria te index, e.g. M A N B . W e omit the tensor pro duct sign, and the identit y matr ix for the re- maining parties . II I. PRELIMINAR Y RESUL T S The secret bit fraction w as introduced in [12], as the secrecy a nalog of the qua nt um singlet fraction, in tro- duced in [11]. Definition 1 (s ecret bit fraction). Supp ose P AB E is a tripa rtite nor malized probability distribution, where the outcomes corresp onding to parties A and B take v al- ues on { 0 , 1 } . The secr et bit fraction of P AB E , denoted λ [ P AB E ], is the maximum v alue of µ for which a decom- po sition P AB E = µ S AB P ′ E + (1 − µ ) P ′′ AB E (1) exists, where P ′ E and P ′′ AB E are arbitra ry normalize d dis- tributions, a nd S is a secr et bit shared by tw o parties: S ( a, b ) = 1 2 δ a,b . Lemma 2. The secr et bit fraction of P AB E can b e written as λ [ P AB E ] = 2 P e min { P AB E (0 , 0 , e ) , P AB E (1 , 1 , e ) } P a,b,e P AB E ( a, b, e ) . (2) This is prov en in [12]. W e hav e included the normal- ization factor in the denominator of (2) in or der not to worry ab out the nor malization of P AB E ; in this wa y , the quantit y λ [ P AB E ] makes sens e ir resp ective of no r- malization of P AB E . Note that λ [ P AB E ] = 1 means that P AB E = S AB P ′ E , s o that P AB E represents a se cr et bit betw een Alice a nd Bob. Definition 3. The maximal extra ctable secret bit fraction of a given distribution P AB E ∈ H A ⊗ H B ⊗ H E is Λ[ P AB E ] = sup M A , N B λ [ M A N B P AB E ] , (3) where the optimization is made over maps M A : H A → B a nd N B : H B → B . Note that the function λ [ P AB E ] is o nly defined for dis - tributions P AB E where the alpha bets of A, B are { 0 , 1 } , hence, in the definition of Λ, it is imp or tant that the range of the maps M A , M B is B . O n the other hand, the function Λ is defined on proba bility distributions P AB E for r andom v ariables taking v a lues on arbitrar y alphab ets. The ma ximal extra ctable secr e t bit fra ction expresses the quality of the secret bit that can b e e x - tracted from a s ingle copy of a g iven distribution. If Λ[ P AB E ] = 1 then a per fect secret bit can be extracted from a single copy of P AB E . If P AB E is the pro duct of tw o uniformly random bits (o ne for ea ch of the hon- est par ties ) and a ny uncorr elated information for Eve, then Λ[ P AB E ] = 1 / 2. Because the output of the ma ps M A , M B can alwa y s be an indep endent uniform random bit, irresp ectively of the input, the range of Λ is [1 / 2 , 1]. It is shown in [12] that the quantit y Λ is a secr ecy mono- tone, a nd hence, constitutes a measure of the amount of secrecy contained in a given P AB E . Additionally , ther e is a r elation betw een this s ingle-copy secrecy measure and a symptotic distillability . It is shown in [12] that if Λ[ P AB E ] > 1 / 2 then P AB E is distilla ble . In what fo llows we rephra se the definition of distillabilit y in ter ms of Λ. Definition 4 (Distillabi l it y). W e say that the distribution P AB E ∈ H A ⊗ H B ⊗ H E is (secret-key-)distillable if for each λ 0 ∈ [1 / 2 , 1) there ex- ists a n in teger n such that Λ[ P ⊗ n AB E ] > λ 0 . That is , fro m a sufficiently large num b er of c o pies of P AB E , Alice and Bob ca n, b y loca l opera tions a nd pub- lic communication (which, without loss of genera lity , c an be assumed to be a filtering of the form wr itten in (3)), obtain a rbitrarily go o d a pproximations to a secr et bit. If there exists n such that Λ[ P ⊗ n AB E ] > 1 / 2, one can ap- ply adv antage distillation [1 6] to the result and obtain a secr et key (see [12]). Note furthermore that in this case even p ositive ra tes of secret key can be obtained, as n → ∞ . (The reader familia r with en ta nglement theor y will realiz e the similarity of these conce pts to singlet frac- tion a nd sing let distillability .) The difficult y in dealing with distillability is that its definition involv es an arbi- trarily la rge num b er of copies of P AB E . The following to ols deal with this problem. Lemma 5. Let H 1 , H 2 and H 3 be given vector spaces. Any “ global” linear map M : H 1 ⊗ H 2 → H 3 with no n-negative co efficients c a n b e decomp osed int o a lo cal linear map with non- neg ative co efficients, M ′ : H 1 → H 3 ⊗ H 2 (whic h dep ends on M ), a nd a simple global linear map with non-neg ative c o efficients, U : ( H 3 ⊗ H 2 ) ⊗ H 2 → H 3 (whic h is independent of M , that is, universal, and given by U y 3 x 3 x 2 y 2 = δ y 3 x 3 δ x 2 y 2 ), such that M = U M ′ . Pr o of . If we ado pt the conv ent ion that low er indices cor - resp ond to the input a nd upp e r indices to the o utput, we 3 can write M ′ in terms of M as M ′ x 3 x 2 x 1 = M x 3 x 1 x 2 . The equality M y 3 x 1 y 2 = X x 2 x 3 y ′ 2 U y 3 x 3 x 2 y ′ 2  M ′ x 3 x 2 x 1 δ y ′ 2 y 2  , (4) holds by definition. ✷ Lemma 6. If the distribution P AB E ∈ H A ⊗ H B ⊗ H E is distillable, then for each λ 0 ∈ [1 / 2 , 1) there ex ists a distribution Q AB E ′ ∈ ( B A ⊗ H A ) ⊗ ( B B ⊗ H B ) ⊗ H E ′ such that Λ[ Q AB E ′ ] ≤ λ 0 , (5) λ [ U A U B Q AB E ′ ⊗ P AB E ] > λ 0 , (6) where U is defined in Lemma 5. The size of H E ′ is arbitrar y . Pr o of . Let n be the smallest integer s uch that there exist op erations M A : H ⊗ n A → B A and N B : H ⊗ n B → B B such that λ [ M A N B P ⊗ n AB E ] > λ 0 (following Definition 4 ). According to Lemma 5 ther e ar e ma ps M ′ A , N ′ B such that M A = U A M ′ A , N B = U B N ′ B , and the distr ibution Q AB E ′ = M ′ A N ′ B P ⊗ ( n − 1) AB E has alphab et ( B A ⊗ H A ) ⊗ ( B B ⊗ H B ) ⊗ H E ′ , as we want to show. Because Λ is defined throug h an optimization (Definit ion 3), w e hav e Λ[ P ⊗ ( n − 1) AB E ] ≥ Λ[ M ′ A N ′ B P ⊗ ( n − 1) AB E ] = Λ[ Q AB E ′ ] . (7) The definition of n implies that Λ[ P ⊗ ( n − 1) AB E ] ≤ λ 0 , which together with (7), implies (5). Using the prop erties of the maps U , M ′ , N ′ shown in Le mma 5, one can chec k that U A U B Q AB E ′ ⊗ P AB E = M A N B P ⊗ n AB E . (8) Recall that the maps M A , N B are the ones for which λ [ M A N B P ⊗ n AB E ] > λ 0 , whic h together with (8), implies (6). ✷ In other words, what Le mma 6 tells is that if a distri- bution P AB E is distillable , then it can a ctiv ate the se- crecy of another dis tr ibution Q AB E . Here b y activ a tio n we mea n enhancement of the maximal extractable secret bit fr action Λ[ · ]. The impo rtant po in t is that Alice’s and Bob’s alpha be ts in Q AB E are b ounded. Unfortunately , Lemma 6 do es not tell a nything a bo ut the siz e of Eve’s alphab et in Q AB E ′ , that is H E ′ , but this problem will later sor t out itself. IV. NON-DISTILLABILITY CRITERION In o r der to certify that a given distr ibutio n G AB E ∈ H A ⊗ H B ⊗ H E is undistillable, it suffices to obtain a c ontradiction b etw een the inequalities (5) a nd (6). How ever, the c ha r acterizatio n of the set o f distributions Q AB E ′ ∈ ( B A ⊗ H A ) ⊗ ( B B ⊗ H B ) ⊗ H E ′ , where the size of H E ′ is arbitrar y , satisfying λ [ M A N B Q AB E ′ ] ≤ λ 0 for an y pair o f maps M A , N B is not av ailable. Instead, we conside r a larger (but simpler) s e t. F o r any given finite family o f pair s of maps F = { ( M i A , N i B ) : i = 1 , . . . M } , we consider the set of dis tr ibutions which sa t- isfy λ [ M i A N i B Q AB E ′ ] ≤ λ 0 for i = 1 , . . . M . In what follows w e particularize to λ 0 = 1 / 2, although differ e n t criteria could b e obtained for different v alues of λ 0 . An- other big simplification is to write the inequalities (5) and (6) a s “a lmost”-linear in the vector Q AB E ′ . If we denote by e the v ariable of H E , and b y e ′ the v ar iable of H E ′ , we c a n write (5) and (6) as 2 X e ′ ,e min a ∈{ 0 , 1 } n [ U A U B Q AB E ′ ⊗ G AB E ]( a, a, e ′ , e ) o − 1 2 X a,b,e ′ ,e [ U A U B Q AB E ′ ⊗ G AB E ]( a, b, e ′ , e ) > 0 (9 ) 2 X e ′ min a ∈{ 0 , 1 } n [ M i A N i B Q AB E ′ ]( a, a, e ′ ) o − 1 2 X a,b,e ′ [ M i A M i B Q AB E ′ ]( a, b, e ′ ) ≤ 0 , (10) for i = 1 , . . . M . This is obtained by using the ex plic it form of λ [ · ] g iven in (2 ), and setting λ 0 = 1 / 2. Denote b y d the dimension o f H E . In (9) a nd (10) the summation over e runs over d v alues , while the summa- tion ov er e ′ is unbounded (like the dimension of H E ′ ). In what follows we tra nsform the summation ov er e ′ int o one ov er 2 d + M v a lues. F o r e a ch e = 1 , . . . d , define the function r e ( e ′ ) =  0 if P a ( − 1) a [ U A U B Q AB E ′ ⊗ G AB E ]( a, a, e ′ , e ) < 0 1 if P a ( − 1) a [ U A U B Q AB E ′ ⊗ G AB E ]( a, a, e ′ , e ) > 0 for all e ′ . Analogous ly , for each i = 1 , . . . M define the function s i ( e ′ ) =  0 if P a ( − 1) a [ M i A N i B Q AB E ′ ]( a, a, e ′ ) < 0 1 if P a ( − 1) a [ M i A N i B Q AB E ′ ]( a, a, e ′ ) > 0 for all e ′ . Using these definitions we can write, for a ny v a lue of e , i, e ′ , min a ∈{ 0 , 1 } n [ U A U B Q AB E ′ ⊗ G AB E ]( a, a, e ′ , e ) o = [ U A U B Q AB E ′ ⊗ G AB E ]( r e ( e ′ ) , r e ( e ′ ) , e ′ , e ) , (1 1) min a ∈{ 0 , 1 } n [ M i A M i B Q AB E ′ ]( a, a, e ′ ) o = [ M i A M i B Q AB E ′ ]( s i ( e ′ ) , s i ( e ′ ) , e ′ ) , (12) which allows to get rid o f the min-functions in (9) a nd (10). L e t us define the new v ariable k in the following wa y k ( e ′ ) = ( r 0 ( e ′ ) , r 1 ( e ′ ) , . . . r d ( e ′ ) , s 1 ( e ′ ) , . . . s M ( e ′ )) , (13) 4 which has the na tur al distribution a nd corr elations with A, B , Q AB K ( a, b, k 0 ) = X e ′ : k ( e ′ )= k 0 Q AB E ′ ( a, b, e ′ ) . (14) This allows to write the ident ities X e ′ ,e min a ∈{ 0 , 1 } n [ U A U B Q AB E ′ ⊗ G AB E ]( a, a, e ′ , e ) o = X k ,e [ U A U B Q AB K ⊗ G AB E ]( k e , k e , k , e ) , (15) X e ′ min a ∈{ 0 , 1 } n [ M i A M i B Q AB E ′ ]( a, a, e ′ ) o = X k [ M i A M i B Q AB K ]( k d + i , k d + i , k ) , (16) where we hav e used the fact that when { x 0 ≤ x 1 and y 0 ≤ y 1 } or { x 0 ≥ x 1 and y 0 ≥ y 1 } the eq uality min { x 0 , x 1 } + min { y 0 , y 1 } = min { x 0 + y 0 , x 1 + y 1 } (17 ) holds. After grouping the different v alues of e ′ as in (14), we o nly need to consider distributions Q AB K where the v a riable k runs over 2 d + M different v alues. How ever, the new (bo unded in s ize) distribution Q AB K m ust satisfy the constr aints X a ( − 1) a [ U A U B Q AB K ⊗ G AB E ]( k e ⊕ a, k e ⊕ a, k , e ) < 0 , X a ( − 1) a [ M i A M i B Q AB K ]( k d + i ⊕ a, k d + i ⊕ a, k ) < 0 , for all e , i, k . Now ev er ything is finite. Q AB K is a vector from the space (dim H A × dim H B × 2 d + M +2 ) with non-neg ative comp onents, that is Q AB K ( a, b, k ) ≥ 0 for all a, b, k . Hence, the s et of allow ed dis tributions Q AB K is charac- terized b y a finite set of linea r inequalities. Then, maxi- mizing the left-hand side of (9) is a linear programming problem. LINEAR PROGRAMMING: (18) [If the maxim um is zer o then G AB E is undistillable.] max Q ABK X k ,e  4[ U A U B Q AB K ⊗ G AB E ]( k e , k e , k , e ) − − X a,b [ U A U B Q AB K ⊗ G AB E ]( a, b, k , e )  with constr ains 4 X k [ M i A M i B Q AB K ]( k d + i , k d + i , k ) − − X a,b, k [ M i A M i B Q AB K ]( a, b, k ) ≤ 0 , X a ( − 1) a [ U A U B Q AB K ⊗ G AB E ]( k e ⊕ a, k e ⊕ a, k , e ) < 0 , X a ( − 1) a [ M i A M i B Q AB K ]( k d + i ⊕ a, k d + i ⊕ a, k ) < 0 , X a,b, k Q AB K ( a, b, k ) = 1 Q AB K ( a, b, k ) ≥ 0 , for all i = 1 , . . . M , all k ∈ { 0 , 1 } d + M , and all a, b ∈ { 0 , 1 } in the last inequality . If the given distr ibution G AB E has ra tional co effi- cients, the ab ov e linear progr amming can be solved by exact methods like the simplex algorithm [6]. Or by quasi-exa ct metho ds like the in terior p oint algorithm [4], whose solution can alw ays be certified exactly . The last metho d is faster, a nd hence can deal with lar ger v alues of M . A key feature of this metho d is to choo se a suitable family F of pairs of maps . The larg er the size of this family ( M ) the mor e constrains on the ab ove maximiza- tion, and more chances to get the maximum equal to zero. V. REMARKS If the maximum of the linear pr ogra mming (18) is zero then we know for sure that G AB E is undistillable. But actually , we know something muc h stro nger: G AB E can- not a ctiv a te any o ther no n-distillable distribution. In other words, the cor relations in G AB E are co mpletely useless. Lemma 7. L et the distribution G AB E b e such that the maximum of the line ar pr o gr amming (18) is zer o. If P AB E is a non-distil lable distribution, then the t ensor- pr o duct P AB E ⊗ G AB E is also non-distil lable. Pr o of . B y a ssumption, for any distribution Q AB E such that Λ[ Q AB E ] ≤ 1 / 2 we ha ve Λ [ Q AB E ⊗ G AB E ] ≤ 1 / 2 . In particular , if w e chose Q AB E = P ⊗ n AB E we hav e 5 Λ[ P ⊗ n AB E ⊗ G AB E ] ≤ 1 / 2, for any n . But this also implies Λ[( P ⊗ n AB E ⊗ G AB E ) ⊗ G AB E ] ≤ 1 / 2, and pro ceeding by induction, we obtain Λ [( P AB E ⊗ G AB E ) ⊗ n ] ≤ 1 / 2. ✷ An in teresting p oss ibilit y is that for any distribution G AB E with po sitive secrecy cost all linear pro g ramming problems (18) hav e a la rger than zero maximum. This would imply that our cr iterion do es not detect any non- distillable distribution, and hence it is us eless. But this would a lso imply that any dis tribution G AB E with p osi- tive secrecy co st (even though it may b e non-distillable) can increa s e the qua lit y of the secret bits distilled from a single copy of another distribution Q AB E . Actually , an analog of the la st sta temen t is true in the q uantu m case [14, 15]. That is, all entangled states (of a n y num b er of parties) can increase the q uality of the ent anglement that ca n b e distilled from a sing le copy of another state. VI. CONCLUSION In this pa per , we have pr esented the first cr iterion which certifies that a given dis tribution G AB E has no distillable key . In fact, this metho d co nsists o n show- ing that G AB E do es no t improv e the key conten t of any other distribution (i.e., it do es not br ing the maximally extractable s ecret bit fr action ab ov e 1 / 2). It is an op en q uestion whether all correla tions with po sitive secrecy conten t can inc r ease the secrecy of other correla tions. This very in teresting feature of secret cor- relations would inv alidate the criterion presented here . Finally , and per haps most interestingly: do es our tech- nique hav e a quantum a nalogue, which could b e used to prov e the existence o f entangled quant um states that do not contain secret key? This would present a c omple- men t to the work by Horo decki et al. [10], who show the existence of b ound entangled states that do nevertheless contain secr et k ey: p erhaps there ex is ts c ompletely b ound entanglement which neither contains distillable key nor enhances key conten t of other states. Ac knowledgmen ts. LlM is supp or ted by the span- ish MEC (FIS2005-0 4 627, FIS2007-6 0182, Consolider QOIT), a nd Caixa Manresa . A W is supp orted by the U.K. E PSRC (pro ject ”QIP IRC” and a n Advenced Re- search F ellowship), and by a Roy al So ciety W olfson Merit Aw ard. [1] A. Ac ´ ın, J. I. Cirac, Ll. Masanes, “Multipartite Bound Information Exists and Can Be Activa ted”, Ph ys. Rev. Lett., vol. 92, n o. 10, 107903, 2004. [2] R. Ahlswede, I. Csisz´ ar, “Common R andomness in In- formation Theory and Cryp tograph y — P art I: Secret Sharing”, IEEE T rans. In f. Theory , vol. 39, no. 4, p p. 1121-1132 , 1993. [3] C. H. Bennett, D . P . DiVincenzo, J. A. Smolin, W. K. W o otters, “Mixed-state entanglemen t and quantum er- ror correction”, Phys. R ev. A, v ol. 54, no. 5, pp . 38 24- 3851, 1996. [4] S. Boyd, L. V and enberghe, “Con vex Optimization”, Cam b ridge Universit y Press, Cambridge 2000. [5] M. Christandl, R. Renner, S. W olf, “A prop erty of the intrinsi c information”, in: Pro c. ISI T 2003, p . 258, 2003. [6] V. Chv´ atal, Line ar Pr o gr am ming , W. H. F reeman, New Y ork, 1983. [7] I. Csisz´ ar and J K¨ orner, “Broadcast c hannels with confi- dential messages”, IEEE T rans. I n f. Theory , vol. 24, no. 3, pp. 339-348, 1978. [8] N. Gisin, S. W olf, “Linking classical and qu antum ke y agreemen t : is there ‘b ound information’ ?”, in: Pro c. Ad- v ances in Cryptology — CR YPTO 2000 (S anta Barbara, 20-24 August 2000), LNCS 1880, pp. 48 2-500, Springer V erlag, Berlin, 2000. [9] M. Horod ec ki, P . Horodecki, R. H orodecki, “Mixed-state entangl ement and distillation: is there a ‘b ound’ entan- glemen t in n ature?”, Phys. Rev. Lett., vol. 80, no. 24, pp. 5239-5242, 1998. [10] K. Horod ec ki, M. H orodecki, P . H oro decki, J. Opp en - heim, “Secure Key from Bound Enta nglemen t”, Phys. Rev. Lett., vol . 94, no. 16, 160502, 2005. [11] M. Horod ec ki, P . Horodecki, R. Horo decki, “General teleportation channel, singlet fraction, and qu asidistil- lation”, Phys. Rev. A , vol. 60, pp. 1888-1898, 1999. [12] N. S . Jones, Ll. Masanes, “Key D istillation and the Secret-Bit F raction”, IEEE T rans. I n f. Theory , V ol. 54 , No. 2, pp 680-691 (2008). [13] Ll. Masanes, A. Ac ´ ın, “Multipartite Secret Correlations and Bound I nformation”, e-print cs.CR/0 501008 , 2005. [14] Ll. Masanes, “All bip artite entangled states are useful for information p rocessing”, Phys. Rev. Lett. 96, 150501 (2006). [15] Ll. Masanes, “U seful entangleme nt can b e extracted from all nonseparable states”, J. Math. Phys. 49, 022102 (2008). [16] U. Maurer, “Secret Key Agreement by Public Discussion from Common Information”, I EEE T rans. Inf. Theory , vol . 39, no. 3, pp. 733-742, 1993. [17] U. Maurer, S. W olf, “Unconditionally secure k ey agre e- ment and the intrinsic conditional information”, I EEE T rans. In f. Theory , vol. 45, no. 2, pp. 499-514, 1999. [18] A. Pere s, “Sep arabilit y Criteri on for Density Matrices”, Phys. Rev . Lett., vol. 77, no. 8, pp. 1413-1415, 1996. [19] R. Renner, S . W olf, “New Bounds in Secret-Key Agree- ment: The Gap Betw een F ormation and Secrecy Ex- traction”, in: Proc. Adv ances in Cryptolog y — EURO- CR YPT 2003, LNCS 2656, pp. 562-577, Springer V erlag, Berlin, 2003. [20] C. E. Shannon, “Communication Theory of Secrecy Sys- tems”, Bell Syst. T ech. Journal, vol. 28, no. 4, pp. 656- 715, 1949. [21] G. V idal, J. I. Cirac, “Irreversibilit y in Asymptotic Ma- nipulations of Entanglemen t”, Phys. Rev. Lett., vol. 86, no. 25, p p. 5803-5806, 2001. [22] A. Winter, “Secret, pub lic, and q uantum correlation cost 6 of triples of random v ariables”, ISIT 2005. [23] A. D. Wyner, “The Wire-T ap Channel”, Bell Sy s. T ec h. J., vol. 54, pp. 1355-1387, 1975.