Multipartite Hardy paradox unlocks device-independent key sharing
Pith reviewed 2026-05-22 14:56 UTC · model grok-4.3
The pith
The multipartite Hardy paradox certifies a device-independent protocol that generates shared keys directly from the parties' choices of measurement settings.
A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.
Core claim
The central claim is that the maximal violation of the multipartite Hardy paradox certifies genuine multipartite nonlocality sufficient to extract a shared secret key directly from the N parties' measurement settings, achieving a positive key rate while also enabling any two parties to form a higher-rate pairwise key from the same correlations.
What carries the argument
The multipartite Hardy paradox, whose maximal violation certifies the nonlocality used to derive the key from setting choices alone.
If this is right
- The protocol produces a positive key rate for the full N-party shared secret.
- Any pair of parties obtains a secret key at a rate substantially higher than the N-party rate.
- The method works with non-maximally entangled states in a device-independent setting.
- It supplies a settings-based alternative to outcome-based conference key agreement.
Where Pith is reading between the lines
- The same experimental setup could support dynamic switching between group-wide and pairwise keys without additional entanglement.
- Extending the method to other multipartite paradoxes might trade off key rate against noise tolerance.
- Network architectures could assign different key rates to different subgroups by choosing which Hardy correlations to certify.
Load-bearing premise
That the maximal violation of the multipartite Hardy paradox certifies genuine multipartite nonlocality sufficient to extract a secure key from measurement settings without further assumptions on states or devices.
What would settle it
An explicit attack that extracts a positive key rate from the settings even when the multipartite Hardy violation is strictly below its maximum value.
read the original abstract
We introduce a device-independent quantum key distribution protocol for N parties, using the multipartite Hardy paradox to certify genuine multipartite nonlocality. Unlike traditional multipartite protocols that extract the key from measurement outcomes, our approach generates the shared secret key directly from the parties' choices of measurement settings. This settings-based method, certified by the maximal violation of the multipartite Hardy paradox, achieves a positive key rate and offers a fresh perspective on secure key distribution. Notably, the Hardy paradox enables any two parties to create a secret key with a rate much higher than the N-party key, due to more robust pairwise correlations. This unique capability, inherent to the multipartite Hardy paradox, allows for tailored key distribution within the group, enhancing flexibility. Our work establishes a new paradigm for device-independent conference key agreement, where keys are generated directly from measurement settings using non-maximally entangled states. This approach ensures robust security in untrusted quantum networks and enables pairwise key rates that surpass the N-party rate, offering unprecedented flexibility in key distribution. By challenging conventional methods, it paves the way for scalable, noise-resilient multiparty quantum communication systems.
Editorial analysis
A structured set of objections, weighed in public.
Referee Report
Summary. The manuscript introduces a device-independent N-party QKD protocol that certifies genuine multipartite nonlocality via maximal violation of the multipartite Hardy paradox. The shared secret key is extracted directly from the parties' local choices of measurement settings (rather than outcomes), with the claim that this yields a positive key rate for the full group and substantially higher rates for any chosen pair due to more robust pairwise correlations. The approach is presented as using non-maximally entangled states and offering a new paradigm for conference key agreement in untrusted networks.
Significance. If the security reduction holds, the work would establish a settings-based route to device-independent multipartite key distribution that enables flexible pairwise keys within an N-party group. This could complement existing outcome-based DI protocols by providing noise resilience and tailored distribution, particularly when non-maximal entanglement is advantageous.
major comments (2)
- [Abstract / security analysis] The central claim of a positive key rate (both N-party and pairwise) requires an explicit security reduction showing that the observed maximal Hardy violation implies a positive lower bound on the conditional entropy of the settings string given Eve's side information. No such reduction, entropy bound, or numerical key-rate calculation appears in the abstract or is referenced in the provided description, leaving the load-bearing security argument unverifiable.
- [Protocol and security model] Because each party chooses its setting locally and independently, an eavesdropper controlling the devices could in principle correlate her information with the chosen inputs without necessarily violating the observed output correlations. The manuscript must demonstrate why the Hardy probability (or its maximal value) nevertheless bounds Eve's knowledge of the settings string; this step is essential for both the conference key and the claimed higher pairwise rates.
minor comments (2)
- [Abstract] The abstract states that pairwise rates 'much higher' than the N-party rate are achieved but supplies no quantitative comparison, no explicit rates, and no reference to a table or figure containing the numerical results.
- [Introduction / protocol definition] Notation for the multipartite Hardy paradox and the precise mapping from settings to key bits should be introduced with an equation or diagram early in the manuscript to clarify how the shared key is assembled from independent local choices.
Simulated Author's Rebuttal
We thank the referee for the careful and constructive review of our manuscript. We address each major comment below and indicate the revisions we will incorporate to strengthen the security analysis.
read point-by-point responses
-
Referee: [Abstract / security analysis] The central claim of a positive key rate (both N-party and pairwise) requires an explicit security reduction showing that the observed maximal Hardy violation implies a positive lower bound on the conditional entropy of the settings string given Eve's side information. No such reduction, entropy bound, or numerical key-rate calculation appears in the abstract or is referenced in the provided description, leaving the load-bearing security argument unverifiable.
Authors: We agree that an explicit security reduction is essential to substantiate the positive key-rate claims. The manuscript establishes that maximal violation of the multipartite Hardy paradox certifies genuine multipartite nonlocality, which in turn guarantees that the chosen settings carry positive entropy with respect to any eavesdropper consistent with the observed correlations. To make this argument fully verifiable, we will add a dedicated subsection in the revised manuscript that derives a concrete lower bound on the conditional entropy H(settings | E) from the Hardy probability and provides numerical key-rate estimates for both the N-party conference key and the pairwise keys under realistic noise. revision: yes
-
Referee: [Protocol and security model] Because each party chooses its setting locally and independently, an eavesdropper controlling the devices could in principle correlate her information with the chosen inputs without necessarily violating the observed output correlations. The manuscript must demonstrate why the Hardy probability (or its maximal value) nevertheless bounds Eve's knowledge of the settings string; this step is essential for both the conference key and the claimed higher pairwise rates.
Authors: We thank the referee for raising this important point about the security model. Although each party selects its measurement setting locally, the device-independent certification rests on the fact that the maximal Hardy violation is incompatible with any local hidden-variable model in which Eve could possess complete knowledge of the input string. The specific structure of the Hardy paradox—requiring the impossibility of certain outcome combinations for particular input combinations—forces any eavesdropper strategy that correlates with the inputs to reduce the observed violation below its quantum maximum. We will expand the security analysis section with a formal argument showing how the observed Hardy probability directly bounds the mutual information between the settings string and Eve’s side information, thereby supporting both the N-party and the higher pairwise key rates. revision: yes
Circularity Check
No circularity: derivation relies on external Hardy paradox and standard DI assumptions
full rationale
The provided abstract and context contain no equations, fitted parameters, or self-citations that reduce the claimed key rate or security bound to a quantity defined by the authors' own prior results. The protocol is presented as using the (externally known) multipartite Hardy paradox to certify nonlocality, with the key extracted from settings under standard device-independent assumptions. No self-definitional loop, fitted-input prediction, or load-bearing self-citation chain is visible. The central claim therefore remains independent of the paper's own inputs and is scored as self-contained.
Axiom & Free-Parameter Ledger
axioms (1)
- domain assumption Maximal violation of the multipartite Hardy paradox certifies genuine multipartite nonlocality sufficient for device-independent security
Reference graph
Works this paper leans on
-
[1]
The fraction of runsA 1 keeps is P(+1, . . . ,+1|A 0 1, . . . ,A0 N) P(+1, . . . ,+1|A 1 1, . . . ,A1 N) . A1 then publicly communicates the list of these selected runs to A2, . . ., AN. As P(+1, . . . ,+1|A 0 1, . . . ,A0 N)< P(+1, . . . ,+1|A 1 1, . . . ,A1 N) for t∈(0, 1) , A1 keeps P(+1,...,+1|A 0 1,...,A 0 N ) P(+1,...,+1|A 1 1,...,A 1 N ) many round...
-
[2]
=p max 3 −ε 1, PAB (+1,+1|A 1 1,A 0 2)≤ε 2, PBC(+1,+1|A 1 2,A 0 3)≤ε 2, PAC(+1,+1|A 0 1,A 1 3)≤ε 2, P(−1,−1,−1|A 1 1,A 1 2,A 1 3)≤ε 2, (19) where ε1,ε 2 ≥0 quantify imperfections. These deviation parameters (ε1,ε 2) therefore determine the operational region in which the protocol proceeds: as long as the observed correlations satisfy the noisy Hardy const...
-
[3]
of the(A 1 1,A 1 2,A 1 3)rounds is retained. After dropping, the probability per experimental round that a key bit is generated is Ω= 1 8 P(+1,+1,+1|A 0 1,A 0 2,A 0
-
[4]
+ d 8 P(+1,+1,+1|A 1 1,A 1 2,A 1
-
[5]
(22) Under noiseΩbecomes, Ω(ε 1) = pmax 3 −ε 1 4
= P(+1,+1,+1|A 0 1,A 0 2,A 0 3) 4 . (22) Under noiseΩbecomes, Ω(ε 1) = pmax 3 −ε 1 4 . (23) B. Quantum Bit Error Rate In the ideal tripartite Hardy protocol, a key bit is generated only when all three parties obtain the outcome +1, and this event occurs exclusively for the input settings (A0 1,A 0 2,A 0
-
[6]
In this ideal case the inputs are perfectly correlated and therefore no errors arise
or (A1 1,A 1 2,A 1 3). In this ideal case the inputs are perfectly correlated and therefore no errors arise. In the presence of noise, however, the Hardy-zero conditions are no longer strictly satisfied. Consequently, it becomes possible that the outcome (+1,+1,+1) occurs for other input combinations. Such events lead to inconsistencies in the inferred ke...
-
[7]
corresponding to key bit 0, and (A1 1,A 1 2,A 1 3) corresponding to key bit 1. Eve therefore performs a binary measurement on her system, which we represent by a dichotomic observable E=E 0 −E 1, where the outcomes +1 and −1 correspond to her guesses of key bit 0 and 1, respectively. Eve’s strategy is successful if her outcome +1 coincides with the honest...
-
[8]
+dP(+1,+1,+1,E=−1|A 1 1,A 1 2,A 1 3). (27) Since a key bit is produced only with probability Ω(ε 1), Eve’s relevant success probability is the conditional probability that she correctly guesses the key bit given that a key-generating event has occurred. This quantity defines the device-independent guessing probability, PG(ε1,ε 2) = Pjoint Ω(ε 1) . (28) In...
-
[9]
=p max 3 −ε 1, for several values of the noise parameterε 2. The curves show how the achievable key rate decreases as the Hardy correlations deviate from their ideal values. A positive key rate is obtained only within a finite noise regime; beyond the point where the curves reach zero, the protocol must abort. Furthermore, under the assumption of symmetri...
-
[10]
=p A1 pA2 pA3, P(A 0 1,A 1 2,A 0
-
[11]
=p A1 (1−p A2 )p A3, P(A 1 1,A 0 2,A 0
-
[12]
= (1−p A1 )p A2 pA3, P(A 1 1,A 1 2,A 0
-
[13]
= (1−p A1 )(1−p A2 )p A3, P(A 0 1,A 0 2,A 1
-
[14]
=p A1 pA2 (1−p A3 ), P(A 0 1,A 1 2,A 1
-
[15]
=p A1 (1−p A2 )(1−p A3 ), P(A 1 1,A 0 2,A 1
-
[16]
= (1−p A1 )p A2 (1−p A3 ), P(A 1 1,A 1 2,A 1
-
[17]
= (1−p A1 )(1−p A2 )(1−p A3 ), (36) withp A1 =p A2 =p A3 = 1 2 in the uniform case. Here, however, we focus on the more realistic scenario where the average distribution still coincides with (36), but in individual runs the RNGs may be biased in a way known to the eavesdropper. For simplicity, we model this bias by shifting pA1, pA2, and pA3 by ±ε, which ...
-
[18]
=P(A 1 1,A 1 2,A 1 3)P(+1,+1,+1|A 1 1,A 1 2,A 1 3). So that A1 does not have to drop some of the runs where +1 outcome of the measurement A1 1 gets clicked. In that case, all the parties choose measurement A0 i with probability rH ≈0.6478024 . We are considering an Eve that can control the RNG in such a way that the parties on average sees their input ran...
-
[19]
=q , and P(+1,+1,+1|A 1 1,A 1 2,A 1
-
[20]
= ˜q. Under biased distributionsP b,i, the probability that the key bit equals 0 is Pi,key=0 = qPb,i(A0 1,A 0 2,A 0 3) qPb,i(A0 1,A 0 2,A 0
-
[21]
+ ˜qPb,i(A1 1,A 1 2,A 1
-
[22]
The eavesdropper maximizes her advantage by guessing the more probable key value, giving Pguess,i =max Pi,key=0, 1−P i,key=0 . Averaging uniformly over all eight biased cases yields the overall guessing probability: Pguess = 1 8 8 ∑ i=1 Pguess,i . (38) The resulting guessing probabilities as a function ofεare shown in Fig.5. For comparison, we apply the m...
work page 2024
-
[23]
H. J. Kimble, The quantum internet, Nature453,1023(2008)
work page 2008
- [24]
-
[25]
M. R. Clarkson, S. Chong, and A. C. Myers, Civitas: Toward a secure voting system, in2008IEEE Symposium on Security and Privacy (sp2008)(IEEE,2008) pp.354–368
work page 2008
-
[26]
W. Diffie and M. Hellman, New directions in cryptography, IEEE Trans. Inf. Theory22,644(1976)
work page 1976
-
[27]
R. L. Rivest, A. Shamir, and L. Adleman, A method for obtaining digital signatures and public-key cryptosystems, Comm. ACM21,120(1978)
work page 1978
-
[28]
P . W. Shor, Polynomial-time algorithms for prime factorization and discrete logarithms on a quantum computer, SIAM Review41,303(1999)
work page 1999
- [29]
-
[30]
C. H. Bennett, Quantum cryptography using any two nonorthogonal states, Phys. Rev. Lett.68,3121(1992)
work page 1992
-
[31]
M. Christandl, R. König, and R. Renner, Postselection technique for quantum channels with applications to quantum cryptography, Phys. Rev. Lett.102,020504(2009)
work page 2009
-
[32]
C. Portmann and R. Renner, Security in quantum cryptography, Rev. Mod. Phys.94,025008(2022)
work page 2022
- [33]
-
[34]
Masanes, Universally composable privacy amplification from causality constraints, Phys
L. Masanes, Universally composable privacy amplification from causality constraints, Phys. Rev. Lett.102,140501(2009)
work page 2009
-
[35]
R. Colbeck and R. Renner, No extension of quantum theory can have improved predictive power, Nat. Commun.2,411 (2011)
work page 2011
-
[36]
V . Scarani and C. Kurtsiefer, The black paper of quantum cryptography: Real implementation problems, Theor. Comput. Sci. 560,27(2014)
work page 2014
-
[37]
S. Pirandola, U. L. Andersen, L. Banchi, M. Berta, D. Bunandar, R. Colbeck, D. Englund, T. Gehring, C. Lupo, C. Ottaviani, J. L. Pereira, M. Razavi, J. S. Shaari, M. Tomamichel, V . C. Usenko, G. Vallone, P . Villoresi, and P . Wallden, Advances in quantum cryptography, Adv. Opt. Photon.12,1012(2020). 16
work page 2020
-
[38]
C. H. Bennett and G. Brassard, Quantum cryptography: public key distribution and coin tossing,Revised reprint of the Proceedings of the International Conference on Computers, Systems and Signal Processing (1984),175–179, Theoret. Comput. Sci. 560,7(2014)
work page 1984
-
[39]
J. S. Bell, On the einstein podolsky rosen paradox, Physics Physique Fizika1,195(1964)
work page 1964
-
[40]
B. Toner, Monogamy of non-local quantum correlations, Proceedings of the Royal Society A: Mathematical, Physical and Engineering Sciences465,59(2009)
work page 2009
-
[41]
A. Einstein, B. Podolsky, and N. Rosen, Can quantum-mechanical description of physical reality be considered complete?, Physical Review47,777(1935)
work page 1935
-
[42]
J. S. Bell,Speakable and unspeakable in quantum mechanics(Cambridge University Press,1987)
work page 1987
-
[43]
J. Barrett, N. Linden, S. Massar, S. Pironio, S. Popescu, and D. Roberts, Nonlocal correlations as an information-theoretic resource, Physical Review A71,022101(2005)
work page 2005
-
[44]
A. Acín, N. Brunner, N. Gisin, S. Massar, S. Pironio, and V . Scarani, Device-independent security of quantum cryptography against collective attacks, Physical Review Letters98,230501(2007)
work page 2007
-
[45]
A. K. Ekert, Quantum cryptography based on Bell’s theorem, Phys. Rev. Lett.67,661(1991)
work page 1991
-
[46]
J. Barrett, L. Hardy, and A. Kent, No signalling and quantum key distribution, Physical Review Letters95,010503(2005)
work page 2005
-
[47]
S. Pironio, A. Acin, N. Brunner, N. Gisin, S. Massar, and V . Scarani, Device-independent quantum key distribution secure against collective attacks, New Journal of Physics11,045021(2009)
work page 2009
-
[48]
J. Barrett, R. Colbeck, and A. Kent, Unconditionally secure device-independent quantum key distribution with only two devices, Physical Review A86,062326(2012)
work page 2012
-
[49]
U. Vazirani and T. Vidick, Fully device-independent quantum key distribution, Phys. Rev. Lett.113,140501(2014)
work page 2014
-
[50]
C. A. Miller and Y. Shi, Robust protocols for securely expanding randomness and distributing keys using untrusted quantum devices, J. ACM63,1(2016)
work page 2016
-
[51]
R. Arnon-Friedman, F. Dupuis, O. Fawzi, R. Renner, and T. Vidick, Practical device-independent quantum cryptography via entropy accumulation, Nature Communications9,1(2018)
work page 2018
-
[52]
E. Woodhead, A. Acín, and S. Pironio, Device-independent quantum key distribution with asymmetric CHSH inequalities, Quantum5,443(2021)
work page 2021
-
[53]
P . Sekatski, J.-D. Bancal, X. Valcarce, E. Y.-Z. Tan, R. Renner, and N. Sangouard, Device-independent quantum key distribution from generalized CHSH inequalities, Quantum5,444(2021)
work page 2021
-
[54]
J. Ribeiro, G. Murta, and S. Wehner, Fully device-independent conference key agreement, Phys. Rev. A97,022307(2018)
work page 2018
-
[55]
fully device-independent conference key agreement
T. Holz, D. Miller, H. Kampermann, and D. Bruß, Comment on “fully device-independent conference key agreement”, Phys. Rev. A100,026301(2019)
work page 2019
-
[56]
comment on ‘fully device-independent conference key agreement
J. Ribeiro, G. Murta, and S. Wehner, Reply to “comment on ‘fully device-independent conference key agreement”’, Phys. Rev. A100,026302(2019)
work page 2019
-
[57]
T. Holz, H. Kampermann, and D. Bruß, Genuine multipartite Bell inequality for device-independent conference key agreement, Phys. Rev. Res.2,023251(2020)
work page 2020
-
[58]
F. Grasselli, G. Murta, H. Kampermann, and D. Bruß, Boosting device-independent cryptography with tripartite nonlocality, Quantum7,980(2023)
work page 2023
-
[59]
F. Grasselli, G. Murta, H. Kampermann, and D. Bruß, Entropy bounds for multiparty device-independent cryptography, PRX Quantum2,010308(2021)
work page 2021
-
[60]
E. Woodhead, B. Bourdoncle, and A. Acín, Randomness versus nonlocality in the Mermin-Bell experiment with three parties, Quantum2,82(2018)
work page 2018
- [61]
-
[62]
L. Wooltorton, P . Brown, and R. Colbeck, Bipartite entanglement is sufficient for standard device-independent conference key agreement (2025), arXiv preprint arXiv:2503.21290
-
[63]
G. Carrara, H. Kampermann, D. Bruß, and G. Murta, Genuine multipartite entanglement is not a precondition for secure conference key agreement, Phys. Rev. Res.3,013264(2021)
work page 2021
-
[64]
F. Grasselli, H. Kampermann, and D. Bruß, Finite-key effects in multipartite quantum key distribution protocols, New J. Phys.20,113014(2018)
work page 2018
-
[65]
M. Navascués, E. Wolfe, D. Rosset, and A. Pozas-Kerstjens, Genuine network multipartite entanglement, Phys. Rev. Lett.125, 240505(2020)
work page 2020
-
[66]
S. Das, S. Bäuml, M. Winczewski, and K. Horodecki, Universal limitations on quantum key distribution over a network, Phys. Rev. X11,041016(2021)
work page 2021
-
[67]
K. Horodecki, M. Winczewski, and S. Das, Fundamental limitations on the device-independent quantum conference key agreement, Phys. Rev. A105,022604(2022)
work page 2022
-
[68]
R. Rahaman, M. Wie´ sniak, and M. ˙Zukowski, True multipartite entanglement hardy test, Phys. Rev. A90,062338(2014)
work page 2014
-
[69]
R. Adhikary, Self-testing of genuine multipartite non-local and non-maximally entangled states, Physics Letters A520,129731 (2024)
work page 2024
-
[70]
Hardy, Nonlocality for two particles without inequalities for almost all entangled states, Phys
L. Hardy, Nonlocality for two particles without inequalities for almost all entangled states, Phys. Rev. Lett.71,1665(1993)
work page 1993
-
[71]
R. Rahaman, M. G. Parker, P . Mironowicz, and M. Pawłowski, Device-independent quantum key distribution based on measurement inputs, Phys. Rev. A92,062304(2015). 17
work page 2015
- [72]
-
[73]
M. Huber and M. Pawłowski, Weak randomness in device-independent quantum key distribution and the advantage of using high-dimensional entanglement, Phys. Rev. A88,032309(2013)
work page 2013
-
[74]
D. Mayers and A. Yao, Quantum cryptography with imperfect apparatus, inProceedings39th Annual Symposium on Foundations of Computer Science (Cat. No.98CB36280)(1998) pp.503–509
work page 1998
-
[75]
D. Mayers and A. Yao, Self testing quantum apparatus, Quantum Info. Comput.4,273–286(2004)
work page 2004
- [76]
-
[77]
R. Adhikary, S. Sasmal, and A. Roy, Self-testing of nonmaximal genuine entangled states using tripartite hardy relations (2025), arXiv preprint arXiv:2504.19491
-
[78]
I. Šupi´ c and J. Bowles, Self-testing of quantum systems: a review, Quantum4,337(2020)
work page 2020
-
[79]
R. Adhikary, A. Mishra, and R. Rahaman, Self-testing of genuine multipartite entangled states without network assistance, Phys. Rev. A110, L010401(2024)
work page 2024
-
[80]
T. H. Yang, T. Vértesi, J.-D. Bancal, V . Scarani, and M. Navascués, Robust and versatile black-box certification of quantum devices, Phys. Rev. Lett.113,040401(2014)
work page 2014
discussion (0)
Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.