# Measurement-Device-Independent Two-Party Cryptography with Error Estimation
## 3 Weak String Erasure
### Security Proof of WSE  
Before analyzing the security of WSE protocol, we need to explain the constraint of [PERSON]'s storage capacity under joint state measurement and error estimation. When we remove any assumption about storage devices, we need other approaches to limit [PERSON]'s ability to store quantum states sent by [PERSON]. Due to the constraints of the protocol process, we naturally think that [PERSON] would cause the error rate increasement of the final key when he stores the quantum state and the error estimation is used to detect this attack. Next, we need to explain an important conception of the error correction upper bound of any channel error correction code. From [26] we know that:  
\[\mathrm{f}=\frac{1-\mathrm{R}}{\mathrm{h}(\mathrm{e})}\]  
where \(f\) is the reconciliation efficiency which is given by the redundancy of disclosed information to the theoretical limit necessary for successful error correction, \(R\) is the code rate of a given channel error correction code, \(e\) is the error rate, and function \(h\) is the Shannon binary entropy. Then we can get the error correction upper bound when \(f\) approaches 1, i.e., its Shannon limit:  
\[\mathrm{e_{r}}=\lim_{\mathrm{f}\to 1}\mathrm{e}=\lim_{\mathrm{f}\to 1}\mathrm{h}^{-1}(\frac{1- \mathrm{R}}{\mathrm{f}}).\]  
where \(h^{-1}\) is the inverse function of \(h\). We consider when [PERSON] stores the quantum state because the joint measurement cannot be performed and the published detection results are random. The increasement of error rate is explained the Lemma 3. Assume that [PERSON] has a perfect and unlimited capacity of quantum memory. Our protocol has a storage rate \(v\), where \(v\leq 2e_{r}\). Proof. : In our protocol, the measurement outcomes are jointly measured by a third party in the bell state and published before [PERSON] sends the bases \(\theta_{A}\). [PERSON] will ask [PERSON] to publish partial information for error estimation before sending bases \(\theta_{A}\). Now, we assume that [PERSON]'s storage rate is \(v\), which means [PERSON] will store \(vn\) quantum state in his memory. If [PERSON] stores the quantum states, it means that he can not measure these quantum states, because quantum mechanics tells us that the measurement will cause the collapse of the quantum states and the loss of information. Therefore, [PERSON] can publish a random fake outcome, and we have error rate introduced by this:  
\[Q_{u}=\frac{n(1-v)e_{c}+\frac{1}{2}nv}{n}\leq e_{r},\]  
and we have:  
\[v\leq 2e_{r},\]  
where \(e_{c}\) is error rate that caused by channel noise. In fact, with Lemma 3, we can easily convert our protocol into a WSE protocol under the bounded-storage model. Therefore, we can use the proof methods and results in Ref. [2,17] to prove the security of our protocol. [Security for Alice] Fix \(\delta\in[0,\frac{1}{4}]\), and let,  
\[\varepsilon=2\mathrm{exp}\left(-\frac{(\frac{\delta}{4})^{2}}{32(2+\log_{2} \frac{4}{\delta})^{2}}\right),\]  
then for any attack strategy of dishonest Bob with any storage model \(\mathcal{F}:\mathcal{B}(\mathrm{H}_{\mathrm{in}})\rightarrow\mathcal{B}( \mathrm{H}_{\mathrm{out}})\), we have:  
\(\mathrm{H}_{\mathrm{min}}^{\varepsilon}(X^{n}|B^{\prime})_{\sigma}\geq n( \frac{1}{2}-\delta-v)>0\). Proof. : According to the conclusion in Ref. [2], we have:  
\[\frac{1}{n}\mathrm{H}_{\mathrm{min}}^{\varepsilon}(X^{n}|B^{\prime})_{\sigma} \geq-\frac{1}{n}logP_{\mathrm{succ}}^{\mathcal{F}}\left(\left(\frac{1}{2}- \delta\right)n\right)\geq v\gamma^{\mathcal{N}}\left(\frac{\frac{1}{2}-\delta }{v}\right),\]  
where we have:  
\[\gamma^{\mathcal{N}}(R)=\max_{\alpha\geq 1}\frac{\alpha-1}{\alpha}\bigg{\{}R- \log_{2}d+\frac{1}{1-\alpha}\log_{2}\left[\left(r+\frac{1-r}{d}\right)^{\alpha }+(d-1)\left(\frac{1-r}{r}\right)^{\alpha}\right]\bigg{\}},\]  
and in our protocol, we have parameters \(\delta\in[0,\frac{1}{4}]\), \(v=2e_{r}\mathcal{C}_{\mathcal{N}}=1\), \(r=1\), and \(d=2\).