Device-Independent QKD

Device-independent quantum key distribution takes the strangest fact in physics — that nature violates Bell inequalities — and turns it into the strongest cryptographic guarantee anyone knows how to make. Ordinary QKD, from BB84 to E91, buys its security with trust: it assumes the Hilbert-space dimension, the exact observables the detectors measure, and often a characterized source. Every one of those assumptions is a door a manufactured backdoor can walk through. DIQKD slams every door at once by trusting nothing about the internals. Alice and Bob each hold a sealed box that takes a classical input (a measurement setting) and returns a classical output (a result); the only audited quantity is the joint input–output distribution collected over many rounds. The engine is a Bell test, almost always the CHSH game. From the four two-setting correlators Alice and Bob form a single number, the CHSH score S. Any strategy built from shared classical instructions — exactly the resource an eavesdropper commands — is capped at S ≤ 2. Quantum mechanics reaches S ≤ 2√2, Tsirelson's bound. Seeing S above 2 therefore certifies genuine nonlocal correlation no pre-agreed classical script could fake, and by the monogamy of entanglement it simultaneously bounds how much any third party can know. The proof rides on the statistics alone, and this article shows exactly how much secrecy each value of S is worth.

Key takeaways

DIQKD certifies a secret key from observed statistics alone — a Bell violation S > 2 — treating the quantum hardware as untrusted black boxes that the adversary may have built.
The security engine is the monogamy of nonlocal correlations: a strong CHSH violation bounds the eavesdropper's knowledge, because quantum theory forbids Alice–Bob and Alice–Eve correlations from both being strong.
At Tsirelson's bound S = 2√2 the box is self-tested to a maximally entangled pair in optimal bases; Eve is then fully decoupled and the asymptotic key rate reaches one bit per round.
The price of assuming nothing about the devices is a punishing detection-efficiency threshold — the detection loophole — which kept DIQKD theoretical until the first loophole-free demonstrations in 2022.
Compared with BB84 and E91, DIQKD assumes no Hilbert-space dimension, no calibrated measurements, and no trusted state — only isolated labs, private randomness, and quantum theory (or just no-signaling); modern proofs use the entropy accumulation theorem to make this finite-key secure against coherent attacks.
Key idea: a Bell violation S > 2 is a self-testing certificate that, by monogamy, bounds the eavesdropper's uncertainty H(A|E) directly from the observed statistics — with no assumption whatsoever about what is inside the boxes.

The core insight

A Bell violation S > 2 is a self-testing certificate: it forces the boxes to behave, up to a local isometry, like maximally entangled qubits measured in fixed bases, and by monogamy this bounds the eavesdropper's knowledge H(A|E) directly from observed statistics, with no assumption on the device internals.

Where this lives today

For over two decades DIQKD was a theorem in search of an experiment: the detection-efficiency threshold put a loophole-free photonic Bell violation, sustained long enough to distil a key, out of reach. That changed in 2022. A trapped-ion team at Oxford (Nadlinger et al., Nature 607, 682) entangled two ⁸⁸Sr⁺ ions in separate traps by heralding on interfering photons, ran a CHSH test whose score sat near 2.6 — well above the classical bound of 2 — with near-unit-efficiency ion readout that closes the detection loophole, and extracted a device-independently secure key. In parallel a single-atom experiment in Munich (Zhang et al., Nature 607, 687) reported the same feat by a different route. All lean on the primitives this chapter's neighbours own: entanglement swapping to distribute the Bell pair, and a Bell-state measurement to herald the rare successful pairs — the machinery of quantum repeaters, repurposed for security. The frontier now is rate and range: heralded matter-qubit links are slow, so lifting the entanglement-generation rate and pushing beyond a single laboratory is where the effort sits. The same self-testing mathematics also powers device-independent randomness expansion and the practical middle ground of measurement-device-independent QKD, which already runs at metropolitan scale.

The physical picture

Picture each device as a sealed vending machine. You press one of two buttons — the measurement setting — and a single bit drops out; you never open the machine or inspect its wiring. The only thing you can audit is the ledger of buttons-pressed against bits-returned over many rounds. A Bell violation is a statistical fingerprint that no machine stuffed with a pre-printed list of answers could leave behind: a local hidden-variable table — the exact model an eavesdropper who kept a classical copy is restricted to — can never push the CHSH score above 2. So when the ledger reports S above 2, it retroactively certifies that the machine was running genuine quantum entanglement, with no assumption about the hardware. Monogamy is the moral of the story. Maximal nonlocal correlation between Alice and Bob is like a maximally jealous bond: once their outcomes are locked at S = 2√2, there is simply no correlation left for Eve to share with either of them. As S drifts down toward the classical value 2 the bond loosens and Eve creeps in; at S = 2 she may know everything and no key survives. Self-testing makes this rigorous — the extremal statistics can be produced, up to a local basis change Eve cannot touch, only by the singlet measured at 0 and π/2 for Alice and ±π/4 for Bob.

The second figure is the quantity the whole security proof computes: how many secret bits each CHSH value is worth. The privacy of Alice's raw bit against a quantum Eve is her conditional entropy H(A|E), and the Devetak–Winter bound makes it a rising function of S — exactly zero at the classical edge S = 2, where Eve may own a perfect copy, and a full bit at Tsirelson's bound S = 2√2, where she is completely in the dark. The curve between is the exchange rate from observed nonlocality to guaranteed secrecy.

Figure

The security curve: Eve's guaranteed uncertainty about Alice's bit rises from 0 bits at the classical bound S = 2 to a full 1 bit at Tsirelson's bound S = 2√2 ≈ 2.828, and a positive secret-key rate exists only where this privacy exceeds the reconciliation cost h(Q)

The core equations

The starting point is the CHSH combination. Alice and Bob each choose between two dichotomic (±1-valued) measurements and, from many rounds, estimate the four correlators. One particular signed sum is the CHSH score.

S = \langle A_0 B_0\rangle + \langle A_0 B_1\rangle + \langle A_1 B_0\rangle - \langle A_1 B_1\rangle \qquad (1)

where: $A_x$ — Alice's ±1-valued observable for setting $x\in\{0,1\}$ ; $B_y$ — Bob's ±1-valued observable for setting $y\in\{0,1\}$ ; $\langle A_x B_y\rangle$ — the correlator $\sum_{a,b} ab\,P(a,b\mid x,y)$ . Read it as: one number, built only from inputs and outputs, that scores how nonlocal the boxes are. The value of that single number is bounded twice — once by all classical strategies, and once, higher, by all quantum ones. The gap between the two bounds is the entire resource DIQKD spends.

S_{\mathrm{LHV}} \le 2, \qquad S_{\mathrm{QM}} \le 2\sqrt{2}\approx 2.828 \qquad (2)

where: $S_{\mathrm{LHV}}$ — the maximum over every local hidden-variable (classical) model, also the maximum available to an eavesdropper holding a classical copy; $S_{\mathrm{QM}}$ — Tsirelson's bound, the maximum over all quantum states and measurements. A value between 2 and 2√2 is quantum but not maximal. The cryptographic content is the map from S to Eve's ignorance. The Devetak–Winter analysis, reduced to qubits by Jordan's lemma, gives Alice's conditional von Neumann entropy given Eve's quantum side information as a function of the observed score.

H(A|E) \ge 1 - h\!\left(\tfrac{1}{2} + \tfrac{1}{2}\sqrt{\tfrac{S^2}{4} - 1}\,\right) \qquad (3)

where: $H(A|E)$ — conditional von Neumann entropy of Alice's raw bit given Eve's system; $h(p)=-p\log_2 p-(1-p)\log_2(1-p)$ — the binary entropy; $S$ — observed CHSH value, with $2\le S\le 2\sqrt2$ . Read it as: the more nonlocal the boxes, the less Eve can know. It equals 0 at $S=2$ and 1 at $S=2\sqrt2$ . A key needs both privacy from Eve and agreement between Alice and Bob. The Devetak–Winter formula subtracts the cost of the second from the value of the first.

r = H(A|E) - H(A|B) \qquad (4)

where: $r$ — asymptotic secret bits per round under one-way reconciliation; $H(A|E)$ — the privacy term above; $H(A|B)$ — Bob's residual uncertainty about Alice's bit, the reconciliation cost, approximately $h(Q)$ for a bit-error rate $Q$ . A positive rate demands Eve's ignorance exceed the leakage spent correcting Bob's errors. Substituting the CHSH entropy bound and the Shannon reconciliation cost gives the rate purely in terms of two measured quantities: the CHSH score on the test rounds and the error rate on the key rounds.

r \ge 1 - h\!\left(\tfrac{1}{2} + \tfrac{1}{2}\sqrt{\tfrac{S^2}{4}-1}\,\right) - h(Q) \qquad (5)

where: $Q$ — the quantum bit-error rate between Alice's and Bob's key-generating settings; $S$ — CHSH value from the test rounds. This is the working formula of DIQKD: two numbers in, a guaranteed key rate out. Real runs are finite and the adversary may attack all rounds jointly. The entropy accumulation theorem promotes the single-round bound to the whole string, replacing ideal privacy by the smooth min-entropy up to a finite-size penalty.

\ell \approx H_{\min}^{\varepsilon}(A^n|E) - \mathrm{leak}_{\mathrm{EC}} - 2\log_2\tfrac{1}{\varepsilon_{\mathrm{PA}}}, \qquad H_{\min}^{\varepsilon}(A^n|E)\ge n\,f(\omega_{\exp}) - O(\sqrt{n}) \qquad (6)

where: $\ell$ — extractable secret bits; $n$ — number of rounds; $H_{\min}^{\varepsilon}$ — smooth conditional min-entropy; $f$ — the single-round min-tradeoff function of the observed CHSH winning frequency $\omega_{\exp}$ ; $\mathrm{leak}_{\mathrm{EC}}$ — bits revealed in reconciliation; $\varepsilon_{\mathrm{PA}}$ — privacy-amplification failure probability. The $O(\sqrt n)$ term vanishes as the run lengthens, recovering the asymptotic rate (5). Finally, the reason DIQKD is hard: detector inefficiency dilutes S. If every no-click is deterministically binned to a fixed outcome (the only device-independent option), the apparent score degrades with the single-arm efficiency η.

S_{\eta} = \eta^2\, S_{\mathrm{ideal}} + 2\eta(1-\eta)\,c + (1-\eta)^2\cdot 2 \qquad (7)

where: $\eta$ — single-photon detection efficiency; $S_{\mathrm{ideal}}$ — the CHSH value with perfect detection; $c$ — the contribution of one-arm-missed events under the no-click→fixed-outcome rule. Requiring $S_\eta>2$ sets the efficiency threshold derived below.

Derivation ATsirelson's bound from the operator norm

The goal is to show, with no hidden-variable model, that quantum mechanics caps the CHSH score at exactly 2√2 — the number that defines the maximally secure edge of every DIQKD proof. The strategy is purely algebraic: promote the four correlators to a single Hermitian CHSH operator, square it, and bound its operator norm using only that each local observable is dichotomic. No state is chosen and no dimension is assumed, which is precisely why the bound survives into the device-independent setting.

Step 1. Assemble the CHSH operator $\mathcal{B} = A_0\otimes B_0 + A_0\otimes B_1 + A_1\otimes B_0 - A_1\otimes B_1$ , where each $A_x,B_y$ is Hermitian and dichotomic, so $A_x^2 = B_y^2 = \mathbb{1}$ and $\|A_x\|,\|B_y\|\le 1$ . The score is $S=\langle\mathcal{B}\rangle\le\|\mathcal{B}\|$ . Why: bounding the largest eigenvalue of one operator bounds S over every state at once, which is what a device-independent claim needs.

Step 2. Square it. Group $\mathcal{B}=A_0\otimes(B_0+B_1)+A_1\otimes(B_0-B_1)$ ; the diagonal terms give $A_0^2\otimes(B_0+B_1)^2 + A_1^2\otimes(B_0-B_1)^2 = 4\,\mathbb{1}$ after using $B_y^2=\mathbb{1}$ , and the cross terms collapse to a single commutator product, giving $\mathcal{B}^2 = 4\,\mathbb{1} - [A_0,A_1]\otimes[B_0,B_1]$ . Why: everything except one commutator term is forced to a constant, so the whole quantum advantage lives in how much Alice's two measurements fail to commute.

Step 3. Bound the commutators. For any two operators of norm at most 1, $\|[A_0,A_1]\| \le 2\|A_0\|\|A_1\| \le 2$ , and likewise for Bob, so $\|\mathcal{B}^2\| \le 4 + \|[A_0,A_1]\|\,\|[B_0,B_1]\| \le 8$ . Why: the commutator norm is the only free quantity left, and it is capped by the dichotomic property alone.

Step 4. Take the square root: $\|\mathcal{B}\| \le \sqrt{8} = 2\sqrt2$ , so $S\le 2\sqrt2$ . Equality is reached by the singlet with Alice measuring at angles 0 and π/2 and Bob at ±π/4. Why: this is the ceiling every real experiment approaches from below, and the value at which Eve is provably fully decoupled. *Note: $\sqrt{8} = 2\sqrt{2} \approx 2.828$ , and the singlet measured at Alice's angles 0 and $\pi/2$ and Bob's $\pm\pi/4$ saturates this bound exactly.*

Go deeper · Derivation B · 2 minMonogamy of the CHSH violation and the threshold error rate

Derivation BMonogamy of the CHSH violation and the threshold error rate

The goal is to make the security intuition quantitative: to show that if Alice and Bob violate CHSH strongly, Eve is algebraically barred from also being strongly correlated with Alice, and then to combine that with the Devetak–Winter rate and find the largest error rate DIQKD can tolerate. The monogamy relation is the cryptographic heart of the scheme — the reason observed nonlocality becomes guaranteed privacy — and the threshold it implies is the honest cost of assuming nothing about the devices.

Step 1. Let Alice's two observables $A_0,A_1$ be shared between the real CHSH game with Bob, scored by $\mathcal{B}_{AB}$ , and a hypothetical one with Eve, scored by $\mathcal{B}_{AE}$ , in which Eve tries to guess Alice's bits. The same Step-2 squaring gives $\mathcal{B}_{AB}^2 + \mathcal{B}_{AE}^2 = 8\,\mathbb{1} - [A_0,A_1]\otimes([B_0,B_1]+[E_0,E_1])$ , whose norm is at most 8. Using $\langle X\rangle^2\le\langle X^2\rangle$ yields the Toner–Verstraete monogamy relation $S_{AB}^2 + S_{AE}^2 \le 8$ . Why: the single Alice commutator appears in both games, so a large Alice–Bob violation literally uses up the resource Eve would need.

Step 2. Read off the extreme case. At $S_{AB}=2\sqrt2$ the relation forces $S_{AE}^2\le 0$ , i.e. $S_{AE}=0$ : Eve's CHSH correlation with Alice is annihilated. Maximal Alice–Bob nonlocality leaves Eve exactly zero nonlocal grip on Alice's bit. Why: this is monogamy made sharp — perfect nonlocal jealousy — and it is why $H(A|E)$ reaches a full bit at Tsirelson's bound.

Step 3. Now spend the privacy against the reconciliation cost. The Devetak–Winter rate (4) with the CHSH entropy bound (3) and Shannon cost $H(A|B)\approx h(Q)$ gives $r = 1 - h(\tfrac12+\tfrac12\sqrt{S^2/4-1}) - h(Q)$ . For a Werner state of visibility $V$ the two measured numbers are tied together as $S = 2\sqrt2\,V$ and $Q = (1-V)/2$ . Why: a single noise parameter now drives both the test score and the key error, so the threshold becomes a one-variable root-find.

Step 4. Set $r=0$ and solve. The privacy term and $h(Q)$ cross at $Q\approx 0.0715$ , so DIQKD tolerates a bit-error rate up to about 7.1%. This sits well below BB84's ≈ 11.0% ceiling — the measurable price of trusting nothing about the hardware. Why: device independence costs roughly a third of the error budget. *Note: setting $r=0$ numerically with $S=2\sqrt{2}\,V$ and $Q=(1-V)/2$ gives the threshold at $Q\approx 0.0715$ (≈ 7.1%); for comparison, BB84's one-way threshold from $1-2h(Q)=0$ gives $Q\approx 0.110$ .*

Go deeper · Derivation C · 1 minThe detection loophole and the efficiency threshold

Derivation CThe detection loophole and the efficiency threshold

The goal is to compute why DIQKD demands near-perfect detectors. A device-independent proof forbids post-selection: you cannot discard the rounds where a photon went missing, because an adversary controlling the loss channel could sculpt the survivors to counterfeit a violation. The honest fix is to bin every no-click to a fixed outcome, which injects noise and dilutes S. We track that dilution and solve for the minimum efficiency at which a maximally entangled CHSH test still clears the classical bound.

Step 1. Split each round by how many arms clicked. Both-click rounds, of probability $\eta^2$ , carry the full quantum correlation; rounds with a missed click, of total probability $1-\eta^2$ , carry the deterministic binned value. The effective correlators are $\langle A_x B_y\rangle_\eta = \eta^2\langle A_x B_y\rangle + (\text{binned loss terms})$ . Why: no-click is data, so it enters the score with a fixed, adversary-known value rather than being thrown away.

Step 2. Impose the security requirement $S_\eta > 2$ : the diluted score must still beat every classical strategy, or the certificate is void. Why: below 2 there is a local model reproducing the statistics, and no secrecy can be claimed.

Step 3. For the symmetric, maximally entangled configuration the both-click term contributes $\eta^2\cdot 2\sqrt2$ and the loss terms drag the rest toward the classical value; solving $S_\eta>2$ gives $\eta > \dfrac{2}{1+\sqrt2}\approx 0.828$ . Why: at 82.8% efficiency the quantum surplus exactly cancels the binned-noise penalty, which is a brutal target for photonic links.

Step 4. Relax it with cleverer states. Eberhard's construction, using a non-maximally entangled pair with optimized settings, lowers the threshold toward $\eta\to 2/3\approx 0.667$ — which is why loophole-free Bell tests and the 2022 DIQKD demonstrations engineered their states and heralded entanglement rather than relying on bare photon pairs. Why: trading a little violation for a lot of loss tolerance is what made the experiments feasible. *Note: $2/(1+\sqrt{2}) = 2/2.4142 \approx 0.828$ ; the Eberhard asymptotic limit is $2/3 \approx 0.667$ .*

Limiting cases

DIQKD lives between two extreme values of the CHSH score, with two more regimes setting the theory's boundaries.

Case	Result	Meaning
Classical / insecure	$S \le 2$	Local hidden-variable regime. Eve may hold a classical copy; $H(A\|E)=0$ and the key rate is zero. No secrecy can be certified.
Tsirelson / maximally secure	$S = 2\sqrt2$	The box self-tests to a maximally entangled pair. Eve is fully decoupled, $H(A\|E)=1$ bit per round, and the rate is maximal.
No-signaling adversary	$S \le 4$	Assuming only no-signaling (not full quantum theory), Eve may use Popescu–Rohrlich boxes; security is weaker and rates lower, but a positive rate survives for large enough $S$ .
Detection threshold	$\eta \gtrsim 0.83$	With maximally entangled states and no-click→fixed-outcome binning, efficiency must clear ≈ 0.828 for a loophole-free violation; non-maximal Eberhard states relax it toward $\eta\approx 2/3$ .

Worked examples

1 · The key rate at a realistic operating point (fully worked)

A DIQKD run reports a CHSH score S = 2.70 on the test rounds and a bit-error rate Q = 2.5% on the key rounds. Find the asymptotic secret-key rate, and check whether the link produces a key at all.

Step 1. Eve's guaranteed ignorance from equation (3): with $S=2.70$ , $S^2/4 = 1.8225$ , so $\sqrt{S^2/4-1} = \sqrt{0.8225} = 0.9069$ and the entropy argument is $\tfrac12 + \tfrac12(0.9069) = 0.9535$ . Then $h(0.9535) = 0.2715$ , giving privacy $H(A|E) = 1 - 0.2715 = \mathbf{0.729}$ bits.

Step 2. The reconciliation cost at $Q = 0.025$ is $h(0.025) = -0.025\log_2 0.025 - 0.975\log_2 0.975 = \mathbf{0.169}$ bits — the price Bob pays to correct his errors.

Step 3. Subtract, per Devetak–Winter (5): $r = 0.729 - 0.169 = \mathbf{0.560}$ secret bits per round. Comfortably positive, so the link keys. The run yields ≈ 0.56 secret bits per generated round.

Step 4. Check sensitivity. Drop the score to $S = 2.40$ at the same $Q$ : privacy falls to $0.346$ and $r = 0.177$ bits — a third of the rate. Push to $S=2.20$ and $r = 0.157 - 0.169 < 0$ : no key. A modest loss of CHSH violation collapses the rate far faster than the same change in Q — nonlocality is the scarce resource.

2 · The tolerable error rate versus BB84

Model the channel as a depolarizing (Werner) channel of visibility V, so the test score is S = 2√2 V and the key error is Q = (1−V)/2. Find the largest Q at which DIQKD still keys, and compare it with BB84.

Step 1. The rate becomes a single-variable function of V: as V drops from 1, the score $S=2\sqrt2 V$ falls from Tsirelson's bound while the error $Q=(1-V)/2$ rises from 0, and both erode $r$ .

Step 2. Find the root $r=0$ . Numerically the privacy term $1-h(\tfrac12+\tfrac12\sqrt{2V^2-1})$ meets the cost $h(Q)$ at $V\approx 0.857$ , i.e. $Q\approx (1-0.857)/2 \approx \mathbf{0.0715}$ . So DIQKD tolerates about a 7.1% bit-error rate.

Step 3. Compare with prepare-and-measure BB84, whose one-way threshold solves $1-2h(Q)=0$ at $Q\approx \mathbf{0.110}$ (11.0%). Trusting nothing about the devices costs roughly a third of the error budget — the reason DIQKD needs exceptionally clean links.

Physics of the portrait

Behind the whole scheme stands a single ceiling, and it carries a name. Tsirelson's bound is the number at which Eve vanishes — proved decades before cryptographers needed it, by a mathematician mapping how far quantum correlations can go.

Origins · 1 minBoris Tsirelson and how this was discovered

Boris Tsirelson

1950–2020 · the quantum bound on Bell correlations

Boris Tsirelson — born in Leningrad, later a professor at Tel Aviv University — was a probabilist whose 1980 paper "Quantum generalizations of Bell's inequality" answered a question John Bell had left open. Bell showed in 1964 that local hidden variables cannot reproduce all quantum correlations; CHSH cast this in 1969 as the testable inequality $S\le 2$ . But how far could quantum mechanics itself push S? Tsirelson proved the answer is exactly $2\sqrt2$ , and that no state or measurement in any dimension can do better — the bound now universally called Tsirelson's bound. His proof, essentially the operator-norm argument in this article, was pure functional analysis with no cryptographic motive; decades later that boundary became the foundation of an entire field. The gap between 2 and 2√2 is the resource DIQKD spends; the value 2√2 is where Eve is provably annihilated; and self-testing — that saturating the bound pins down the state up to isometry — is why black boxes can be trusted from their statistics alone. Tsirelson remains a rare figure whose abstract theorem became, verbatim, the security parameter of a technology.

History

1964

— Bell proves that local hidden variables cannot reproduce all quantum correlations

1969

— Clauser, Horne, Shimony and Holt cast Bell's result as a two-setting testable inequality

1980

— Tsirelson proves quantum correlations are bounded by 2√2

2007

— Acín and collaborators establish device-independent security against collective attacks

2022

— first loophole-free DIQKD demonstrations with trapped ions and single atoms

Going further

Texts. Nielsen & Chuang, Quantum Computation and Quantum Information (10th anniv. ed.), Ch. 12 — EPR, Bell inequalities, cryptography · Preskill, Lecture Notes on Quantum Computation, Ch. 4 — quantum cryptography and Bell inequalities · Wilde, Quantum Information Theory (2nd ed.) — private classical communication and the Devetak–Winter rate · Watrous, The Theory of Quantum Information — nonlocal games and semidefinite bounds · Kitaev, Shen & Vyalyi, Classical and Quantum Computation — measurement and entropic tools · Acín, Brunner, Gisin, Massar, Pironio & Scarani, "Device-Independent Security of QKD Against Collective Attacks," PRL 98, 230501 (2007). Key checkpoints for the core results: Tsirelson's bound $2\sqrt{2}$ follows from $\mathcal{B}^2 = 4 - [A_0,A_1]\otimes[B_0,B_1]$ ; the entropy bound $H(A|E)=1-h(\tfrac{1}{2}+\tfrac{1}{2}\sqrt{S^2/4-1})$ has endpoints $H=1$ at $S=2\sqrt{2}$ and $H=0$ at $S=2$ ; the Toner–Verstraete monogamy $S_{AB}^2+S_{AE}^2\le 8$ forces $S_{AE}=0$ at Tsirelson's bound; the Werner parametrisation $S=2\sqrt{2}\,V$ , $Q=(1-V)/2$ yields a threshold QBER of ≈ 7.1% against BB84's ≈ 11.0%; the efficiency threshold is $2/(1+\sqrt{2})\approx 0.828$ , with the Eberhard limit $2/3$ . The worked example ( $S=2.70$ , $Q=2.5\%$ $\to$ $r\approx 0.56$ bits) follows directly from equation (5). The 2022 demonstrations are cited by reference; the CHSH score "near 2.6" is quoted as reported, not derived.

Builds on: E91 Protocol · No-Cloning Theorem in Cryptography · Quantum Bit Error Rate and Sifting · Information Reconciliation and Privacy Amplification. Leads to: Entanglement Swapping · Bell-State Measurement.

Ask the tutor: Ask me to walk through the CHSH squaring line by line, plug your own measured S and Q into the key-rate formula, or explain why the 2022 ion experiments finally beat the detection loophole.

How is DIQKD different from ordinary entanglement-based QKD like E91?

E91 also uses entangled pairs and a Bell test, but its security proof still trusts the device model — the qubit dimension, the specific measurement bases, and often a characterized source. If a manufacturer secretly builds the boxes to leak the key through an uninspected degree of freedom, E91's proof can be void even while the Bell test looks fine. DIQKD removes that trust entirely: the proof references only the classical inputs and outputs and the CHSH score they produce, treating the boxes as adversarially built. The cost is a much harder experiment — you must close the detection and locality loopholes for real — but the guarantee is qualitatively stronger: security that holds even against hardware you did not design.

Why does a Bell violation bound what the eavesdropper can know?

Through monogamy of nonlocal correlations. Quantum theory forbids the same system from being strongly nonlocally correlated with two parties at once. The Toner–Verstraete relation $S_{AB}^2 + S_{AE}^2 \le 8$ says that if Alice and Bob's CHSH score is large, Eve's possible CHSH correlation with Alice is small; at the extreme, $S_{AB}=2\sqrt2$ forces $S_{AE}=0$ , leaving Eve no nonlocal grip on Alice's bit at all. This is not an assumption about the devices — it is a theorem about quantum states — so it converts an observed statistic directly into the bound on Eve's knowledge, $H(A|E)$ .

Why is the detection-efficiency requirement so severe?

Because device independence forbids post-selection. In a trusted-device test you might discard rounds where a detector failed to fire, assuming loss is unbiased. But an adversary who controls the loss channel can arrange for exactly the "inconvenient" rounds to go missing, sculpting the survivors into a fake violation — the detection loophole. The only safe response is to keep every round and bin each no-click to a fixed outcome, which injects deterministic noise that dilutes the CHSH score. For maximally entangled states the score clears the classical bound only above about 82.8% efficiency; cleverer non-maximal states relax that toward 66.7%, but either target is punishing for photons, which is why the first demonstrations used matter qubits with near-perfect readout.

What is self-testing, and why does it let us trust a black box?

Self-testing is the fact that certain extremal quantum statistics can be produced in essentially only one way. If two boxes achieve the maximal CHSH score 2√2, then — up to a local change of basis that no external party can influence — they must contain a maximally entangled pair measured in the specific optimal bases. The internal Hilbert space could be enormous, but whatever it is, it is equivalent to the ideal qubit device plus some inaccessible junk. That rigidity is what lets a proof reason about a device it never opened: the outputs alone certify the physics inside, up to an isometry Eve cannot exploit. Self-testing is the mathematical backbone of both DIQKD and device-independent randomness generation.

Does the security still hold against an adversary who attacks every round together?

Yes, and this is the role of the entropy accumulation theorem. The simple CHSH entropy bound concerns a single round against a collective attack, but real adversaries may entangle their probe across all n rounds — a coherent attack. Entropy accumulation shows the total smooth min-entropy of the raw key still grows linearly, bounded by n times a single-round min-tradeoff function of the observed average CHSH score, minus a finite-size correction of order √n. Because the penalty shrinks with the number of rounds, a long enough run recovers essentially the asymptotic rate while staying secure against the most general attack — which is what makes finite-key DIQKD a rigorous, not merely asymptotic, guarantee.

If DIQKD is so strong, why isn't it deployed everywhere?

Because it is extraordinarily demanding to run. You need a genuine loophole-free Bell violation — closing both detection and locality loopholes — sustained over enough rounds to distil a key, at a rate and distance that make communication practical. The 2022 experiments proved it possible, but with heralded matter-qubit links whose entanglement-generation rates are far too slow for a working system. For real networks today engineers reach for measurement-device-independent QKD, which removes every detector-side attack (the historically most exploited class) while still trusting the sources, and runs at metropolitan scale. DIQKD is the gold standard the field is building toward, not yet the everyday tool.