# A New Security Proof for Twin-Field Quantum Key Distribution (QKD)
## 2 Preliminaries  
We now introduce some notation and other preliminary concepts and technical lemmas that will be important in our work later. Let \(\mathcal{A}_{d}=\{0,1,\cdots,d-1\}\) be a \(d\)-dimensional alphabet. Given a word \(q\in\mathcal{A}_{d}^{N}\) and a subset \(t\subset\{1,\cdots,N\}\), we write \(q_{t}\) to denote the substring of \(q\) which is indexed by \(t\) and \(q_{-t}\) to mean the substring indexed by the complement of \(t\). If \(t\) is a singleton \(t=\{i\}\), we often simply write \(q_{i}\) to represent the \(i\)'th character of \(q\). Given \(\delta>0\) and two real numbers, \(x\) and \(y\), we write the following:  
\[x\sim_{\delta}y\iff|x-y|\leq\delta. \tag{1}\]  
Given a word \(q\in\mathcal{A}_{d}^{N}\) and a particular character \(a\in\mathcal{A}_{d}\), we write \(\#_{a}(q)\) to denote the number of times \(a\) appears in the word \(q\):  
\[\#_{a}(q)=|\{j\;:\;q_{j}=a\}|. \tag{2}\]  
We use \(\#_{a,b}(q)\) to denote the number of times \(a\) and \(b\) appear in \(q\):  
\[\#_{a,b}(q)=|\{j\;:\;q_{j}=a\;\text{or}\;q_{j}=b\}|. \tag{3}\]  
Let \(X\) be a random variable taking value \(x_{i}\), with probability \(p_{i}\). Then, \(H(X)\) denotes the Shannon entropy of \(X\), namely \(H(X)=-\sum_{i}p_{i}\log_{2}p_{i}\). All logarithms in the paper are base two, unless otherwise specified. We use \(h(x)\) to denote the binary Shannon entropy, defined as \(h(x)=-x\log_{2}x-(1-x)\log_{2}(1-x)\). A quantum state or density operator is a Hermitian positive semi-definite operator of unit trace, acting on some Hilbert space \(\mathcal{H}\). If \(\rho_{AE}\) acts on \(\mathcal{H}_{A}\otimes\mathcal{H}_{E}\), we write \(\rho_{A}\) to denote the quantum state resulting from a partial trace over \(E\), namely \(\rho_{A}=tr_{E}\rho_{AE}\). This notation is similar for states acting on additional Hilbert spaces. The Bell basis [32; 33; 34] is spanned by states \(\{|\phi_{0}\rangle,\cdots,|\phi_{3}\rangle\}\):  
\[|\phi_{0}\rangle =\frac{1}{\sqrt{2}}(|00\rangle+|11\rangle)=\frac{1}{\sqrt{2}}(|++ \rangle+|--\rangle) \tag{4}\] \[|\phi_{1}\rangle =\frac{1}{\sqrt{2}}(|00\rangle-|11\rangle)=\frac{1}{\sqrt{2}}(|+ -\rangle+|-+\rangle)\] \[|\phi_{2}\rangle =\frac{1}{\sqrt{2}}(|01\rangle+|10\rangle)=\frac{1}{\sqrt{2}}(|++ \rangle-|--\rangle)\] \[|\phi_{3}\rangle =\frac{1}{\sqrt{2}}(|01\rangle-|10\rangle)=\frac{1}{\sqrt{2}}(|+ -\rangle-|-+\rangle)\]  
where \(|+\rangle\) and \(|-\rangle\) are the Hadamard basis states, \(|\pm\rangle=\frac{1}{\sqrt{2}}(|0\rangle\pm|1\rangle)\). Given a word \(i\in\mathcal{A}_{4}^{N}\), we write \(|\phi_{i}\rangle\) to denote \(|\phi_{i}\rangle=|\phi_{i_{1}}\rangle\otimes\cdots|\phi_{i_{N}}\rangle\). Given a density operator \(\rho_{A}\), we write \(H(A)_{\rho}\) to be the von Neumann entropy of \(\rho_{A}\) defined as \(H(A)_{\rho}=-tr(\rho_{A}\log_{2}\rho_{A})\). The conditional quantum min entropy is defined as follows [35]:  
\[H_{\infty}(A|E)_{\rho}=\sup_{\sigma_{E}}\max\Bigl{\{}\lambda\in\mathbb{R}\;:\; 2^{-\lambda}I_{A}\otimes\sigma_{E}\geq\rho_{AE}\Bigr{\}}, \tag{5}\]  
where \(A\geq B\) is used to indicate that the operator \(A-B\) is positive semi-definite. The smooth conditional min entropy, denoted as \(H_{\infty}^{\epsilon}(A|E)_{\rho}\), is defined as follows [35]:  
\[H_{\infty}^{\epsilon}(A|E)_{\rho}=\sup_{\sigma_{AE}}H_{\infty}(A|E)_{\sigma}, \tag{6}\]  
where the supremum is over all density operators \(\sigma_{AE}\) such that \(||\rho_{AE}-\sigma_{AE}||\leq\epsilon\), where \(||A||\) is the trace distance of operator \(A\). Quantum min entropy is a vital quantity in quantum cryptography as it relates directly to the number of uniform random secret bits one may extract from a quantum state [35]. In particular, given \(\rho_{AE}\) where the \(A\) register is classical and the \(E\) register is quantum, _privacy amplification_ may be used to extract a uniform secret bit string. Let \(\sigma_{KE}\) be the result after applying the privacy amplification process to \(\rho_{AE}\).