## 2 Background
However, on the basis of the quantum version of the de Finetti representation theorem [16; 17], it was shown that coherent attacks are not more powerful than collective ones and, thus, the considered set can be narrowed: the only condition required for the statement to be true is that a given QKD protocol is permutation-invariant, i.e., invariant under arbitrary permutations of quantum channel uses [18]. The condition can be satisfied for the majority of standard QKD protocols including BB84 [4], six-state [19], and B92 [20] by introducing an additional step to their structure: legitimate users should publicly agree on a random permutation of raw key bits right after the first stage [18; 21]. The secret key generation rate of a QKD protocol is defined as the maximum speed (per bit) at which a secret key can be distributed--here, secret means that the eavesdropper's knowledge about it is asymptotically small. In the case of classical key distribution protocols, the secret key rate can be calculated according to the [PERSON]'s equation [22]:  
\[\text{rate}=I(\text{X},\text{Y})-I(\text{X},\text{Z}), \tag{1}\]  
where \(I\) is mutual information between two classical systems (X, Y, and Z stand for the random variable describing [PERSON]'s, [PERSON]'s, and [PERSON]'s systems, respectively): \(I(\text{X}_{1},\text{X}_{2})=H(\text{X}_{1})+H(\text{X}_{2})-H(\text{X}_{1} \text{X}_{2})\), with \(H\) being the Shannon entropy of a random variable. The legitimate users are to estimate the range of attacks that can be feasibly conducted by [PERSON] (using the assumptions concerning her computational powers) and use the value of mutual information \(I(\text{X},\text{Z})\) for the most effective one. The expression (1) should be implemented in the case of direct reconciliation--when [PERSON]'s bit string is considered to be correct and [PERSON] has to amend his string. Although, the equation can be easily modified for the case of reverse reconciliation, which corresponds to [PERSON] and [PERSON] changing roles and thus leads to switching X and Y in the equation. Transitioning into the quantum cryptography framework implies that legitimate users no longer use any assumptions related to the eavesdropper's computational powers; they rely only on the laws of quantum mechanics in order to determine the range of attacks that could have been conducted. They have to determine the set \(\Gamma\) of all quantum states \(\rho_{\text{AB}}\) that can be shared between them according to the set of observed data. For each state \(\rho_{\text{AB}}\) describing the system shared between [PERSON] and [PERSON], \(\rho_{\text{ABE}}\) is defined as its arbitrary purification and includes [PERSON]. Then, after the measurements conducted on [PERSON]'s and [PERSON]'s ends combined with the reconciliation procedure, the final state \(\rho_{\text{XYE}}\) describes the system shared between [PERSON], [PERSON], and [PERSON] right after stage 1 (conditioned on the conclusive result, i.e., when the position survived key sifting):  
\[\rho_{\text{XYE}}=\sum_{x,y}p_{xy}\left|x\right\rangle\left\langle x\right|_ {\text{A}}\otimes\left|y\right\rangle\left\langle y\right|_{\text{B}}\otimes \rho_{\text{E}}^{xy}.\]  
where \(p_{xy}\) is the joint probability of [PERSON] sending classical value \(x\) and [PERSON] obtaining the result \(y\); \(\left|x\right\rangle_{\text{A}}\) and \(\left|y\right\rangle_{\text{B}}\) denote the classical states of the legitimate user's systems corresponding to the values. Then, [PERSON]'s ensemble \(\mathcal{E}_{\text{E}}=\{(p_{x},\rho_{x})\}_{x}\) of quantum states \(\rho_{x}\) corresponding to different bit values on [PERSON]'s side reads  
\[\mathcal{E}_{\text{E}}=\left\{\left(p_{x}\equiv\sum_{y}p_{xy},\;\rho_{x}\equiv \sum_{y}p_{xy}\cdot p_{\text{E}}^{xy}\right)\right\}_{x}.\]  
This knowledge is sufficient to upper bound the information available to [PERSON].