## 3 The Method Description  
We use Theorem 2 in [25], bounding the accessible information in new conditions, which we want to achieve in quantum cryptography by simple actions of the legitimate users. Let us briefly describe this result of [25]. The above-mentioned theorem provides a sufficient condition for the additivity of accessible information, which is the independent use of all the states' combinations. To put it in formal terms: if a multipartite ensemble of quantum states \(\mathcal{E}^{N}=\left\{\xi_{i}^{N},\rho_{i}^{N}\right\}_{i}\) has a product form, i.e., if \(\xi_{i}^{N}=\xi_{i_{i}}^{(1)}\cdot\ldots\cdot\xi_{i_{N}}^{(N)}\) and \(\rho_{i}^{N}=\rho_{i_{1}}^{(1)}\otimes\ldots\otimes\rho_{i_{N}}^{(N)}\), the quantum accessible information of the ensemble is additive:  
\[I_{\text{acc}}\Big{(}\mathcal{E}^{N}\Big{)}=I_{\text{acc}}\Big{(}\mathcal{E}^ {(1)}\Big{)}+\ldots+I_{\text{acc}}\Big{(}\mathcal{E}^{(N)}\Big{)}, \tag{3}\]  
where \(\mathcal{E}^{(n)}=\big{\{}\big{(}\xi_{i_{n}}^{(n)}\cdot\rho_{i_{n}}^{(n)} \big{)}\big{\}}_{i_{n}}\) is the \(n\)th partial ensemble describing the \(n\)th system. Thus, for such product-form ensembles, collective measurements do not provide any advantage over a sequence of independent individual measurements in terms of extracted information. If a given QKD protocol is permutation-invariant, the set of considered eavesdropping attacks can be narrowed to collective ones. Thus, after \(N\) channel uses, [PERSON]'s ensemble \(\mathcal{E}_{E}^{N}\) satisfies the conditions of this theorem: the states of the ensemble have product form, as well as the states' probabilities, which are distributed according to the initial probability distribution on the [PERSON] side, as [PERSON] sends the states independently in each position. Hence, if [PERSON] performs the measurement at this time, the mutual information between the result of [PERSON]'s measurement (contained in a classical system E) and the classical value sent by [PERSON] (system X) is bounded by additive accessible information:  
\[I^{N}(\text{X},\text{E})\leq I_{\text{acc}}\Big{(}\mathcal{E}_{\text{E}}^{N} \Big{)}=NI_{\text{acc}}(\mathcal{E}_{\text{E}}). \tag{4}\]  
Now, observe that when [PERSON] and [PERSON] perform the error correction step, they change the probability distribution, as they disclose the set of possible codewords, and the new probabilities do not have the product form. Hence, the estimate (4) do not hold any longer, and [PERSON]'s information may overcome \(NI_{\text{acc}}(\mathcal{E}_{\text{E}})\). This is the subject of the quantum coding theorem [26; 27]: if the sender and the receiver have fixed the set of the codewords, then the receiver may perform a collective measurement which allows the Holevo capacity to be achieved. The result of [25] therefore states that without coding (i.e., without a non-trivial subset of all the possible bit strings to be the codewords), the users cannot achieve any superadditive information, let alone the Holevo capacity. Within our framework, this means that [PERSON], who plays the role of the receiver now, does not get the amount of information characterized by the Holevo quantity and is limited by a more strict bound. Hence, using the Holevo capacity as the estimate for [PERSON]'s information becomes too pessimistic. Disclosing additional information may be regarded as implementing the QDL protocol between [PERSON] and [PERSON], who are now in the conditions of quantum coding theorem. Here, as it happens in QDL, [PERSON] cannot perform the proper measurement without additional information but can do so after obtaining it, namely, after knowing the set of codewords to perform a collective measurement (see Section 4 in [6]). Our idea is that the legitimate users should not change the probabilities of the states available to the eavesdropper. They can avoid doing this by encrypting the information disclosed during error correction.