# A New Security Proof for Twin-Field Quantum Key Distribution (QKD)
## 2 Preliminaries
Then, it holds the following [35]:  
\[\left|\left|\sigma_{KE}-\frac{I}{2^{\ell}}\otimes\sigma_{E}\right|\right|\leq 2 ^{-\frac{1}{2}\left(H_{\infty}^{\epsilon}(A|E)_{\rho}-\ell\right)}+2\epsilon= \epsilon_{PA}. \tag{7}\]  
In particular, after privacy amplification, the resulting output is almost a uniform random \(\ell\)-bit string, independent of [PERSON]'s system. To determine a suitable size for \(\ell\), one only need to measure the min entropy of the state \(\rho_{AE}\) before privacy amplification. For a given \(\epsilon_{PA}\), the final key is said to be \(\epsilon_{PA}\) secure. Quantum min entropy has a number of useful properties that we will require later. First, given a state of the form \(\rho_{AEZ}=\sum_{z}p_{z}\left|z\right>\left<z\right|\otimes\rho_{AE}^{(z)}\) (i.e., a state classical on \(Z\)), the following holds:  
\[\#_{a}(q)=|\{j\;:\;q_{j}=a\}|. \tag{2}\]0  
The following lemma allows us to bound the entropy in a state after performing a certain type of quantum operation on it, if we know the min entropy in a suitable state that is close in trace distance:  
**Lemma 1** (from [36]). : _Let \(\rho\) and \(\sigma\) be two quantum states and \(\mathcal{F}\) be some CPTP map that acts as follows:_  
\[\#_{a}(q)=|\{j\;:\;q_{j}=a\}|. \tag{2}\]1 \[\#_{a}(q)=|\{j\;:\;q_{j}=a\}|. \tag{2}\]2  
_Then, the following holds:_  
\[\#_{a}(q)=|\{j\;:\;q_{j}=a\}|. \tag{2}\]3  
_where the probability is over the outcome \(x\) and \(\epsilon\geq\frac{1}{2}||\rho-\sigma||\)._  
Finally, the following lemma allows us to bind the min entropy of a superposition of Bell states (the lemma is found in [37], though its proof uses techniques similar to those in [29; 35] for bounding the min entropy of a general superposition state):  
**Lemma 2** (from [37] based on a proof in [29; 35]). : _Let \(Q\in[0,1/2]\) and_  
\[\left|\psi\right>_{ABE}=\sum_{ \begin{subarray}{c}i\in A_{A}^{N}\\ \frac{1}{3}\bullet_{13}(i)\leq Q\end{subarray} }\alpha_{i}\left|\phi_{i}\right> _{AB}\left|E_{i}\right>=\sum_{i}\alpha_{i}\left|\phi_{i_{1}}\right>_{A_{1}B_{ 1}}\left|\phi_{i_{2}}\right>_{A_{2}B_{2}}\cdots\left|\phi_{i_{N}}\right>_{A_{N} B_{N}}\left|E_{i}\right>, \tag{10}\]  
_where recall \(\#_{1,3}(i)\) is the number of times \(1\) and \(3\) appear in the string \(i\). Let \(\rho_{AE}\) be the state resulting from taking \(\left|\psi\right>\), measuring all \(A\) particles in the \(Z\) basis and then tracing out the \(B\) register. Then, the following holds:_  
\[H_{\infty}(A|E)_{\rho}\geq N(1-h(Q)). \tag{11}\]  
_Quantum Sampling_  
Our new proof of security will utilize a quantum sampling framework introduced by [PERSON] and [PERSON] in [29]. In this section, we review some of their work that we will need later. A classical sampling strategy over \(\mathcal{A}_{d}^{N}\) is a triple of algorithms. The first is a process that randomly chooses a subset \(t\subset\{1,\cdots,N\}\) with probability \(P_{T}(t)\). The second is a guessing function \(g:\mathcal{A}_{d}^{*}\rightarrow\mathbb{R}\). The third is a target function \(r:\mathcal{A}_{d}^{*}\rightarrow\mathbb{R}\). The strategy will first choose a random subset and observe \(q_{t}\). Next, a guess is computed \(g(q_{t})\); this guess should be \(\delta\) close to the value of the target function, but evaluated on the unobserved portion of the string \(r(q_{-t})\). That is, \(g(q_{t})\sim_{\delta}r(q_{-t})\). Formally, \(\delta>0\) and a subset \(t\) should be fixed. Then, the set of good words should be defined as follows:  
\[\mathcal{G}_{t}=\{q\in\mathcal{A}_{d}^{N}\ :\ g(q_{t})\sim_{\delta}r(q_{-t})\}. \tag{12}\]  
Recall, we wrote that \(x\sim_{\delta}y\) if and only if \(|x-y|\leq\delta\). A good word is one where the guess is always \(\delta\) close to the target for the given subset \(t\).