Limitations on Quantum Key Repeaters

A major application of quantum communication is the distribution of entangled particles for use in quantum key distribution (QKD). Due to noise in the communication line, QKD is in practice limited to a distance of a few hundred kilometres, and can only be extended to longer distances by use of a quantum repeater, a device which performs entanglement distillation and quantum teleportation. The existence of noisy entangled states that are undistillable but nevertheless useful for QKD raises the question of the feasibility of a quantum key repeater, which would work beyond the limits of entanglement distillation, hence possibly tolerating higher noise levels than existing protocols. Here we exhibit fundamental limits on such a device in the form of bounds on the rate at which it may extract secure key. As a consequence, we give examples of states suitable for QKD but unsuitable for the most general quantum key repeater protocol.

depending on a threshold, replaces it by a stronger signal. When the signal is quantum mechanical (e.g. encoded in non-orthogonal polarisations of a single photon), such an amplifier cannot work anymore, since the measurement inevitably disturbs the signal [1]. Sending a quantum mechanical signal, however, is the basis of quantum key distribution (QKD), a method to distribute a key which can later be used for perfectly secure communication between sender and receiver [2]. The degradation of sent quantum signals therefore seems to place a fundamental limit on the distance at which secure communication is possible thereby severely limiting its applicability in the internet [3,4].
A way around this limitation is the use of an entanglement-based quantum key distribution scheme [5,6] in conjunction with a so-called quantum repeater [7]. Here, many entangled pairs of particles are being distributed between the sender (Alice) and an intermediate station (Charlie), and between Charlie and the receiver (Bob) (see Fig. 1). Charlie, who plays the role of an untrusted telecom provider, for instance, prepares n Einstein-Podolsky-Rosen (EPR) entangled pairs of photons and sends one photon of each pair to Alice. In the same fashion he distributes n pairs between himself and Bob. Noise, of course, will degrade the quality of the EPR pairs during the transmission process. If the distances between Charlie and Alice/Bob are small enough, however, the noisy pairs remain distillable, this means that they can be transformed into ≈ E D × n perfect EPR pairs, where E D is known as the distillable entanglement of the quantum state of the noisy pair. The EPR pairs between Charlie and Bob are then used to quantum teleport the state of Charlie's other particles to Bob. This process, known as entanglement swapping, results in EPR pairs between Alice and Bob [8]. When Alice and Bob make appropriate measurements on the EPR pairs they obtain a sequence of secret key bits, that is, an identical but random sequence of bits that is uncorrelated with the rest of the universe (including Charlie's systems). This secure key can later be used for perfectly secure communication. The described scheme with one intermediate station effectively doubles the distance over which QKD can be carried out and more repeater stations can be inserted to efficiently extend the distance arbitrarily. The implementation of quantum repeaters is therefore one of the focal points of the experimental quantum information science community [9,10].
As this explanation illustrates, and as it was realised early on in quantum cryptography, entanglement distillation and QKD are tightly connected [11,12]; and indeed it is clear that entanglement is a necessary prerequisite for privacy [13]. It therefore came as a surprise to many researchers in 2005 that there are undistillable entangled states (so-called bound entangled states that have E D = 0) from which secret key can be obtained [14]. With the help of a quantum repeater as distributing general private states (not necessarily maximally entangled ones). c) States containing privacy (e.g. p-bit) which cannot be successfully used in a quantum key repeater.
described above, however, the secret key contained in such states cannot be extended to larger distances, as the states do not allow for the distillation of EPR pairs.
The present paper raises the question of whether there may be other ways to extend the secret key to arbitrary distances than by distillation and swapping of entanglement, other quantum key repeaters. More formally, we analyse the quantum key repeater rate K A↔C↔B at which a protocol is able to extract private bits between Alice and Bob from entangled states which they shared with Charlie by local operations and classical communication (LOCC) among the three of them. Note that just as the definition of the distillable key [14,15], the definition of this rate is information-theoretic in nature. By using quantum tomography, the post-selection technique [16], error correction and privacy amplification [17], this rate can be made robust in a cryptographic sense, therefore leading to unconditional security of the obtained secret key. For unconditional security in relation to pbits see also [18,19]. By a private bit we mean an entangled state representing a unit of privacy paralleling the EPR pair as a unit of entanglement [14,20]. Mathematically, private bits are entangled states of the form where A and B are qubits that contain the key bits, corresponding to the rows and columns in the matrix. A and B are each a d-dimensional systems, called the shield. X is a d 2 -by-d 2 matrix with X 1 = 1. In the following we will describe our main results which demonstrate that the performance of quantum key repeaters beyond the use of entanglement distillation is severely limited.
Our first result takes its starting point in the observation that there are private bits that are almost indistinguishable from separable states by local operations and classical communication. An example is the choice X = 1 d √ d ij u ij |i j| ⊗ |j i|, where the u ij are the entries in the quantum Fourier transform in dimension d. This can be easily seen as the LOCC distinguishability of two states is upper bounded by the distinguishability under operations that preserve the positivity of the partial transpose, and the latter is bounded by X Γ 1 = 1 √ d , where Γ indicates the transpose of one of the systems [21]. Imagine that such private bits are the entangled states that are distributed between Alice and Charlie, and between Bob and Charlie, and that a quantum repeater protocol using local operations and classical communication between Alice, Bob and Charlie, transforms them successfully into a private bit between Alice and Bob. Then, by Alice and Bob joining their labs, they can distinguish this resulting state from a separable state using a measurement (this is done by untwisting the shield A'B' to obtain an EPR pair which can be distinguished, for instance by a Bell measurement, from separable states [14]). This would imply an LOCC procedure for Alice-Bob (when they join their labs) and Charlie to distinguish the initial private bits ρ ⊗ ρ from separable states: first run the quantum key repeater protocol and then perform the measurement.
This, however, is in contradiction to the assumption that the private state ρ (and hence ρ ⊗ ρ) is almost indistinguishable from separable states under LOCC. In conclusion this shows that such private bits cannot be successfully extended to a private bit between Alice and Bob by any quantum key repeater protocol. A direct mathematical formulation of this explanation is given in Section III B, but applies only to protocols acting on single copies of the states ρ ⊗ ρ and therefore does not give a bound on K A↔C↔B , which allows joint operations on an arbitrary number of copies.
The language of entanglement measures allows us to formulate this argument asymptotically as a rigorous distinguishability bound on K A↔C↔B (see Section III C): where the RHS is the regularised LOCC-restricted relative entropy distance to the closest separable state [22]. Arguably, it is difficult if not impossible to compute this expression (there is a regularisation, a maximisation over LOCC measurements and a minimisation over separable states). But noting that this bound is invariant under partial transposition of the C system, we can easily upper bound the quantity for all known bound entangled states (these are the ones with positive partial transpose) in terms of the relative entropy of entanglement of the partially transposed state ρ Γ : E R (ρ Γ ) + E R (ρ Γ ); if we restrict to forward communication from Charlie and ρ AC A =ρ BC B , some more effort shows that squashed entanglement provides a bound: As we show, D ∞ is a robust quantity in that it does not decrease by too much when a qubit is lost (it is not lockable). This fact can be used to extend our results to states that are not exactly but only close to states having a positive partial transpose.
We also use this fact to improve the squashed entanglement bound to the reduced squashed entanglement [23]. Both the relative entropy bound and the reduced squashed entanglement bound can be regularised.
Extracting the algebraic content of the idea of the partial transposition of the C system we are bound to loose the intuition behind our results, but are able to circumvent the quantity D and directly obtain for PPT states ρ andρ (see Section III A): where K D is the key rate, the rate at which two parties can extract key from ρ. This bound (and its similar version where we swap the roles of A and B) leads to improved relative entropy and squashed entanglement bounds, as these entanglement measures are the well-known upper bounds on the key rate K D [14,24]. We leave open the question of whether the reduced squashed entanglement bound can be obtained and improved in the same way.
We will now give an example of a state ρ AC A =ρ BC B for which the key rate is large, but the bounds, and hence the quantum key repeater rate are arbitrarily small. Guided by our intuition, we would like to consider the private bit from above whose partial transpose is close to a separable state.
The only caveat here is that the state is not PPT (no private bit can be PPT [14]). Fortunately, our state turns into a PPT state ρ under adding a little bit of noise. Since its partial transpose ρ Γ is almost separable, the key rate, the relative entropy of entanglement and the squashed entanglement are close to zero and we find K A↔C↔B (ρ ⊗ ρ) ≈ 0. Since a small amount of noise can easily be removed [15], the state continues to have almost one bit of key: K D (ρ) ≈ 1. This leads us to the main conclusion of our paper: there exist entangled quantum states that are useful for quantum key distribution at small distances but that are virtually useless for long-distance quantum key distribution.
There is another type of bound, based on the direct analysis of the entanglement of a concrete output state of a quantum repeater protocol (see Section III D). More precisely, by considering the state that Alice and Bob have conditioned on Charlie's measurement, we find In contrast to the bounds presented above, which mainly apply to PPT states and are able to deliver maximal limitations, this bound appears weaker but applies to all quantum states ρ andρ.
The bound is maximally strong for ρ an EPR pair, since then K A←C↔B is bounded by 1 2 regardless of how much key the bound entangled stateρ contains. The multiplicative constants in (4) are tight which can be seen by inserting for both ρ andρ an EPR pair. We also apply this bound to states ρ andρ that are locally equivalent to their partial transposition, thereby giving non-trivial limitations in the regime where the bounds based on the partial transposition fail to deliver nontrivial results. Note that in the case of PPT states, one may also partially transpose the states appearing on the right hand side since K A←C↔B is invariant under partial transposition.
The proof of this result is obtained by upper bounding the squashed entanglement of the output state of the protocol using a manipulation of entropies resulting in the RHS of (4). The squashed entanglement in turn upper bounds the distillable key of the output state (which upper bounds the LHS) [24]. This raises the question, of whether there are other inequalities relating the output state of such protocols by entanglement measures of the input states. In the context of algebro-geometric measures of entanglement, this question has been raised and relations among the concurrence of input and output states have been found [25][26][27][28]. In our context, we have focused on operational entanglement measures and we may ask in particular, whether our result can be made stronger by replacing the LHS by the entanglement cost of the output state. Based on a random construction we show that this is not true, therefore giving a further indication of the tightness of our result. When restricting the attention to PPT states, one may ask whether Alice and Bob's post-measurement state conditioned on any measurement by Charlie is always separable [29][30][31]. If this was true, the quantum key repeater rate would vanish for all PPT states. The upper bounds presented in this work may therefore be seen as information-theoretic evidence for the truth of this P P T 2 conjecture. Reaching even further, and consistent with our findings, we may speculate that perhaps the only "transitive" entanglement in quantum states, i.e. entanglement suitable for repeaters, is their distillable entanglement.
With this paper we initiate a study of long-distance quantum communication and cryptography beyond the use of entanglement distillation. Even though the reported results provide limitations rather than new possibilities, we hope that this work will lead to a rethinking of the currently used protocols resulting in procedures for long-distance quantum communication that are both more efficient and that can operate in noisier environments. More abstractly, our results can be viewed as a step towards an entanglement theory for networks of communicating parties with inequalities relating initial and final entanglements.
intermediate station and formally introduce the corresponding information theoretic rate of secure key.
A private state can be constructed from a maximally entangled state |Ψ AB by tensoring some state σ A B and performing a so-called "twisting" operation. A twisting operation is a controlled A B that spreads the entanglement over the enlarged Hilbert space. Formally It has been shown that even if Eve is in possession of the entire purification of γ m , Alice and Bob will still be able to obtain m bits of perfect key by measuring the AB subsystem in the computational basis, while keeping the A B part away from Eve. As all the correlation the key has with the outside world is contained in A B , it is called the "shield part", whereas AB is called the "key part". For m = 1, γ 1 is also called a "private bit" or "p-bit" which can alternatively be represented in the form of (1). As the twisting operations can be non-local, not every private state can be obtained from a single rank 2 m maximally entangled state via LOCC. This shows that privacy is a truly different property of a quantum state than its distillable entanglement, motivating the introduction of a quantity known as "distillable key" [14] K D (ρ) = inf in analogy to the distillable entanglement With α ≈ β we mean α − β 1 ≤ . Clearly K D (γ m ) ≥ m. As every rank 2 m -dimensional maximally entangled state is a private state, Surprisingly there exist bound entangled states that are arbitrarily close to private states in trace distance [14]. A natural question arising now is how such nearly bound entangled private states can be distributed between distant parties. Of course it would be possible to distribute maximal entanglement using a conventional repeater and then distill the state needed. This would, however, have no advantage over using the maximal entanglement directly for QKD. Here, we deal with the question whether there are other, not maximally entangled, possibly even bound entangled states that could be initially distributed between the nodes and then swapped yielding a state useful for cryptography. In order to study this question, we introduce the following quantity. For input the quantum key repeater rate of ρ andρ with respect to arbitrary LOCC operations among Alice, Bob and Charlie. If we restrict the protocols to one-way communication from Charlie to Alice we write K A←C↔B and if all communication is one-way from Charlie we write K A←C→B . It is the goal of this paper to find significant upper bounds on this quantity.

III. BOUNDS ON THE QUANTUM KEY REPEATER RATE
This section is structured into four parts. First, we will explain the partial transpose idea which is mathematically straightforward and delivers strong bounds on the key rate for PPT states. Then, we will explain the distinguishability idea (for single copy and multiple copy repeaters), which is more intuitive but also technically more involved. Finally, we present the entanglement measures idea, which analyses the output state of a protocol without reference to partial transposition. All sections contain examples illustrating and comparing the different bounds.

A. Partial Transpose Idea
Let us assume that Alice shares a PPT state ρ with Charlie and that Bob shares a PPT statẽ ρ with Charlie and that they apply an LOCC operation Λ among the three of them at the end of which Charlie traces out his part of the system. It is the observation of this section that they obtain the identical output state had they applied the LOCC operation Λ Γ (the operation where Charlie's Kraus operators are complex conjugated) to the partially transposed states ρ Γ andρ Γ instead. As a consequence, the quantum key repeater rate is invariant under partial transposition: The invariance remains true when restricting partially or fully to one-way communication. In the following, we make this statement precise and use it to find upper bounds. We then give examples illustrating the power of the idea and comparing the obtained bounds.

Bounds by Key, Relative Entropy of Entanglement and Squashed Entanglement
We start with the above mentioned invariance property.
Lemma 1 Let ρ andρ be PPT. Then where the transpose is taken w.r.t. Charlie's subsystems.
Proof Note that every LOCC protocol can be implemented by many rounds of local POVMs and classical communication. If Charlie uses the complex conjugate of all of his Kraus operators S (k) C , we have another valid LOCC protocol. Since every protocol applied to copies of ρ ⊗ρ has the same output as when the protocol with complex conjugated Kraus operators is applied to ρ Γ ⊗ρ Γ . Consequently, we find Recall that this statement only makes sense for PPT states ρ andρ.
By the monotonicity of distillable key, we have K A↔C↔B (ρ⊗ρ) ≤ K D (ρ AC A ). Since the relative entropy of entanglement and squashed entanglement are upper bounds on the key rate [14,24], i.e.
the RHS, we obtain the following bounds Theorem 2 Let ρ andρ be PPT. Then where the transpose is taken w.r.t. Charlie's subsystems.
The relative entropy of entanglement [32] is given by where SEP denotes the set of separable states. Since it is subadditive, it upper bounds its regularised version The squashed entanglement [33,34] is given by where ρ ABE is an arbitrary extension of ρ AB .

Example: PPT state close to p-bit
In the following we exhibit an example, where the RHSs of our bounds are very small, but where the state itself has a high key rate. The idea here is simple, we find PPT states that have high key but whose partial transpose is close to a separable state [35]. More precisely, we present a family of states {ρ ds } s of increasing dimension which asymptotically reach the gap of 1 between K D (ρ ds ) and K A↔C↔B (ρ ⊗2 ds ). Their construction is based on [21]; there, two private bits were mixed to give a PPT key distillable state. Here we take only one of the p-bits and admix the block-diagonal part of the second one. Alternatively, one may use the family of PPT key distillable states introduced in [14,20], but we omit this argument, since it is more involved.
Proposition 3 There are PPT states ρ ds ∈ B(C 2 ⊗ C 2 ⊗ C ds ⊗ C ds ), obtained by admixing a p sfraction of a separable state to a p-bit, such that ρ Γ ds is p s -close to a separable state in trace norm. Furthermore, p s = 1 √ ds+1 and d s → ∞ for large s.
Proof Our construction of ρ ds is based on [21]. Consider and Here, p s = 1 √ ds+1 and u ij are the matrix elements of some (arbitrary) unitary matrix U acting on C ds that satisfies For example, we may set U to be quantum Fourier Note that ρ ds is a mixture of private state (defined by X) with probability 1 − p and a with It is easy to see that the state is PPT, as (1 − p)X Γ = pY . So after partial transposition of BB : which is evidently non-negative, as √ XX † and √ X † X are non-negative by definition, and the middle block is (up to normalisation factor p) a private bit defined by operator Y [20].
Consider now the state ρ ds dephased on the first qubit of Alice's system (this state is also known as "key attacked state"). It reads: and is clearly separable. It is easy to see that This concludes the proof.
Since the states ρ s are obtained by admixing a small fraction of a separable state to a p-bit, the key rate of the state is high: Alice and Bob's mutual information in fact equals 1 − h(p s ) and the quantum mutual information of Alice and Eve is bounded by h(p s ). Hence, by [15], and E sq (ρ Γ ) are small. A particularly good bound is obtained with help of the following lemma.
be a PPT(AA : BB ) state and assume that its key where η( ) = − log .
Proof We start by noting that σ and hence σ Γ are separable, therefore we have We write out the RHS and find, since tr ρ Γ log σ Γ = tr σ Γ log σ Γ (due to the fact that σ is block diagonal) that An application of Fannes' inequality [36] gives the result.
and h the binary Shannon entropy, such that K A↔C↔B (ρ ds ⊗ ρ ds ) ≤ 2p log(2d s ) + η(p) where η(p) = −p log p. In summary, there exist states with

Comparison of the Bounds: Werner States
In the following we show that the bound by the squashed entanglement can be smaller than the one by the relative entropy of entanglement. Recall that it was previously known that squashed entanglement of the antisymmetric Werner state is smaller than its relative entropy of entanglement [24,37]. Since the antisymmetric Werner state is not PPT, however, this example does not apply directly to our situation. Using a related PPT state from [38], we are able to obtain our goal.
We leave open the question of whether the relative entropy of entanglement can be smaller than squashed entanglement. This, however, seems very plausible, as squashed entanglement is lockable [39], and the relative entropy is not [23]. The challenge therefore remains to show locking of squashed entanglement for a PPT state.
Let τ ± be the symmetric and antisymmetric Werner state. In [38] it is shown that is since τ is separable. By a result of [24], Let us now derive a lower bound on the regularised relative entropy of this state. Since the relative entropy is not lockable we find where we used the separability of τ in the first equality and the law of large numbers in the second.
Taking the large k limit we find By [24], Since ρ :=ρ Γ is again a PPT state we also find that there are PPT states ρ for which This shows that the squashed entanglement bound may be stronger than the regularised relative entropy bound.
B. Distinguishability Idea: Single Copy

Trace Norm Bound
The distinguishability bound that we present below is based on the notion of distinguishing entangled states from separable states by means of restricted measurements (e.g. LOCC measurements). Let us briefly describe the derivation of the bound. Consider a state, ρ in = ρ AC A ⊗ρ BC B , and suppose ρ in is highly indistinguishable by LOCC operations between C and AB from some triseparable state σ in . Examples of states ρ in with this property were given in [35]: the states are in fact identical private bits ρ AC A =ρ BC B = ρ (K D (ρ) = 1) and σ in is of the form σ AC A ⊗σ BC B with σ AC A = σ BC B identical and separable. One may think of them as states that hide entanglement.
Consider now any quantum key repeater protocol Λ. Since Λ is an LOCC operation (between C and A and B), its output when acting on ρ in has to be highly indistinguishable by arbitrary CPTP quantum operations from its output when acting on σ in . But this means that ρ out and σ out are close in trace norm. Since σ out is separable this means that ρ out is close to separable and therefore contains almost no key (and is certainly no p-bit).
To show the above reasoning formally, we first recall the notion of maximal probability of discrimination between two states ρ and σ, using some set S of two-outcome POVMs 35,40]. By definition we have: In what follows we will consider several sets of operations: LOCC, SEP, PPT and ALL. The set ALL is the set of all two-outcome POVMs. PPT consists only of elements that have a positive partial transpose and SEP contains only separable elements, whereas LOCC are those POVMs that can be implemented by an LOCC protocol. Note that LOCC ⊂ SEP ⊂ PPT ⊂ ALL.
Lemma 6 For any two states ρ,ρ, two separable states σ,σ and any Λ ∈ LOCC(A : C : B), are the AB outputs of the protocol.
Proof Since Λ is LOCC, it is a tri-separable map, i.e. has its Kraus representation Λ(ρ) = In particular it is separable in the cut AB : C, which will be crucial in what follows. Moreover, upon input of any two separable states σ AC A ⊗ σ B C B , the map outputs a state ρ ABC with Tr C ρ ABC separable. We now prove the following chain of (in)equalities and comment on them below: = sup The first equality is the well known Helstrom formula for optimally distinguishing two quantum states. Subsequently, we simply insert the definitions step by step. Inequality (45) follows from the fact that Λ is a tri-separable map. In the next inequality we use SEP ⊂ PPT. Then we write this explicitly out and partially transpose all the C systems. Then we drop the positivity constraint on the POVM elements and see that the remaining maximisation extends over all POVMs. Using Helstrom once again concludes the calculation.
The above lemma shows that the trace norm distance between the output states of any quantum key repeater protocol is upper bounded by the trace norm distance of the partially transposed input states of it. Combining this result with asymptotic continuity of relative entropy of entanglement gives the following theorem: Theorem 7 Consider any two states ρ,ρ, and separable states σ, with η(x) = −x log x. Here, K single copy A↔C↔B is the quantum key repeater rate, i.e. the repeater is restricted to act on single copies ρ ⊗ρ only.

Example: p-bit with X = SWAP
Since the single copy quantum key repeater rate is upper bounded by the general quantum key repeater rate, the example from Section III A 2 can also be used to illustrate the above theorem.
We therefore choose to provide an example in this section, which, we believe, is not amenable to the bounds from Section III A nor the techniques we present later on in this paper [42].
We consider ρ =ρ = γ V , where γ V is the private state from [14], shown to be entanglement hiding in [35]. It is defined by (1) |ij ji| the swap operator. Note, that for any private bit described by operator X as in (1), we have γ Γ 1 = 1 + X Γ 1 (see proof of Theorem 6.5 of [35]). Now, following [35], as a state which is separable and highly indistinguishable from γ V , we take γ V dephased on the key part of Alice: σ :=σ : Note that the RHS of the above inequality vanishes with large d s . It cannot be exactly zero, though, because perfect p-bits always have some non-zero, albeit sometimes small, distillable entanglement [43]. This means that γ V , although being a private bit (K D (γ V ) ≥ 1 by definition), in fact with [20], cannot be extended by a single copy quantum key repeater for large enough d s .
C. Distinguishability Idea: Many Copies

Restricted Relative Entropy Bound
In this section we derive an asymptotic version of the distinguishability bound, that is, one We denote by D ∞ the regularised versions of the above quantities. Note that for trivialρ, the measures reduce to the measures defined in [22]. Sometimes, we omit the minimisation over separable states in which case we write D C↔AB (ρ AC A ⊗ρ C B B σ ACB ).
Before we prove the bound we need an easy lemma that shows that D ALL (as defined by Piani [22]) is normalised to (at least) m on private states γ m [14,20] containing at least m bits of pure privacy.
Lemma 8 Forγ m ≈ γ m and σ separable we have Proof Recall that γ m is of the form U P m ⊗ ρ A B U † for P m the projector onto the maximally entangled state in dimension 2 m on systems AB and U a controlled unitary with control A and target A B . ρ A B is arbitrary. We calculate: The first inequality holds due to monotonicity of D ALL . Note thatP m := tr A B Uγ m U † is a state close to P m . We also definedσ = tr A B U σU † . The second inequality is again an application of monotonicity, this time with the measurement map given by the POVM {P m , 1 1 − P m }. The last inequality follows from proof of [20,Lemma 7] which says that tr P mσ ≤ 1/2 m and tr P mPm ≥ 1− , which follows fromγ m ≈ γ m .
We now come to the main result of this section.

Theorem 9
The following inequalities hold for all states ρ andρ: Proof We will start with proving the first bound. Fix > 0. Then, there is an n and a Λ ∈ LOCC(A n : C n : B n ) (in the following we will suppress n if obvious from the context), such that The first inequality is true as M • tr C •Λ ∈ LOCC(C : AB). The first equality follows as the arguments have no system C anymore (or equivalently a one-dimensional system C) and since in Combining the bounds, minimizing over σ and taking the limit n → ∞ gives Since r ≥ K A↔C↔B (ρ AC A ⊗ρ C B B ) − and was arbitrary we have proven the first claim.
The second claim follows by slight modification: restrict Λ to be in LOCC(A ← C → B) and note that M • tr C •Λ ∈ LOCC(C → AB) and that LOCC(C → AB) = ALL(AB) for trivial system C. Then K A↔C↔B will turn into K A←C→B and D C↔AB into D C→AB .

Properties of the Restricted Relative Entropy Measure
In this section we present three properties of the distinguishability measure, its invariance under partial transposition of the C system, its non-lockability (i.e. the fact that the measure does not decrease too much when a qubit on Alice's or Bob's side is lost) and its LOCC monotonicity.
Lemma 10 For all states ρ andρ, Proof It is sufficient to observe that the sets of measurements which we denote by LOCC as a By the monotonicity of the relative entropy, we can upper bound D ∞ C↔AB by the relative entropy of entanglement and, using the invariance of D ∞ C↔AB under partial transpose of the C system (Lemma 10), obtain E ∞ R (ρ) + E ∞ R (ρ) and thereby almost recover the relative entropy bound from Theorem 2.
This lets us also conclude that D ∞ A↔B (ρ), which can similarly be upper bounded by E R (ρ Γ ), can be made strictly smaller than K D (ρ): simply take the states from Proposition 3. This observation was first made in [44] in order to answer a question posed in [45].
Following [23] we will now prove that D ∞ is not lockable.
A similar bound holds when part of C A is lost. In summary, D ∞ M is non-lockable.
Proof Let us fix > 0, a state σ ∈ SEP(A : C A : C B : B) and a POVM given by CPTP map E.
for some states ω A 2 and ω A 1 C A , where we introducedρ Since the decorrelation map acts as identity on systems A 1 B we find, using the triangle inequality, By a theorem from [47] the following holds where X is a random variable with distribution {p i }. Since we have a bound on the number of unitaries, we can bound H(X) and find Observe that LHS is an average. Hence, there exists an event i 0 such that Taking the supremum over E, allows us to shift the unitary U (i 0 ) fromρ Taking the infimum over σ ∈ SEP(A : C A : C B : B) on both sides, noting in particular that Now, by asymptotic continuity of D M [45, Proposition 3], and inequality (80) this gives where in the last equation we used the fact that D M stays unchanged when we add or remove a local tensor product state. Taking the limit n → ∞ and subsequently → 0 we have proved the claim.
We conclude with proving the monotonicity of the bound.
Proof We prove the statements for the → case.
where we used Λ(σ) = i q i |i i| ⊗ σ i and without loss of generality M = i |i i| ⊗ M i . This is lower bounded by The other cases are similar.

Reduced Squashed Entanglement Bound
It is the goal of this section to derive a bound on the one-way quantum key repeater rate by the reduced squashed entanglement. This will be done in two steps. First, we will prove that the one-way LOCC restricted relative entropy measure is upper bounded by squashed entanglement. Second, we will employ the non-lockability of this measure in order to unlock the squashed entanglement.
For the first step, we need two lemmas in order to prepare for the key lemma, Lemma 15.

Lemma 13
For any two states ρ ABE and σ ABE and for every M ∈ LOCC(A 2 → B 2 ) with output denoted by X there is a sequence T n ∈ LOCC(A n → B n ) with cq output X n B n such that where we defined T q n = tr X n •T n and T c n = tr B n •T n .
Proof Apply [45, Lemma 5] to the states ρ → ρ ⊗2 and σ → σ ⊗2 . Then manipulate the LHS of their first equation: First, we use the additivity of the relative entropy in order to conclude lim n→∞ 1 n D(T c n (ρ ⊗2n AB ) T c n (σ ⊗2n AB )) = lim In a next step we restrict the limit to even n (thereby not changing the limiting value) and make the replacement n → n/2 to obtain Finally, we redefine T n/2 → T n and obtain the claim.

Lemma 14
For any tri-partite state ρ, Proof For a state σ ∈ SEP(B : AE), The first inequality follows from the monotonicity of the relative entropy under CPTP maps, the following equality is a direct calculation, where the ensemble {p i , ρ i } ({q i , σ i }) is the output of the instrument T n ⊗ id E when applied to ρ ⊗n ABE and σ ⊗n ABE , respectively. The subsequent inequality is due to convexity of the relative entropy, where we defined the stateσ := T q n ⊗ id E (σ ⊗n ). Since T q ⊗ id E ∈ LOCC(B : AE) and σ ∈ SEP(B : AE), we findσ ∈ SEP(B : E). This explains the last inequality. Using Lemma 13, the asymptotic continuity of the relative entropy of entanglement [41] and taking the limit n → ∞ proves We now maximise this statement over measurements, then minimise over σ. This proves The RHS is lower bounded by D A 2 →B 2 (ρ AB ⊗ ρ AB ) + 2E ∞ R (ρ B:E ). Regularizing this result we obtain the claimed bound.

Lemma 15
Proof From Lemma 14 we have Since squashed entanglement is lockable [39] but D ∞ M is not, we can improve the squashed entanglement bound. For this we define the reduced squashed entanglement [23,49]: where the infimum goes over all splits of A into two subsystems A 1 A 2 (likewise for B). Note that, trivially, reduced squashed entanglement is smaller than squashed entanglement. By construction this measure is not lockable and subadditive. Since for every split of the A system (and similarly for the B system) we obtain the following improved bound.
Combining Lemma 16 with Theorem 9 and Lemma 10 we get the following bound.

Corollary 17
The following inequality holds for all PPT states ρ C A A = ρ C B B : We leave it as an open question whether the relative entropy of entanglement can be much smaller than reduced squashed entanglement, or, in other words, whether the E ∞ R -bound in Theorem 2 gives a bound stronger than the first bound in Corollary 17.
Interestingly, reduced squashed entanglement can also be used as an upper bound for the traditional distillable entanglement. For this we chooseρ to be the trivial state and apply Lemma 11 and [45,Theorem 2] in order to obtain: When combined with the bound D ∞ A→B ≥ E D (from [45]) and regularisation we find: Corollary 18 We conjecture that the constant 2 can be replaced by a 1. Note that we could have used 1 2 I(A 1 :

Extensions For Almost PPT States
It is the purpose of this section to extend the squashed entanglement and relative entropy bounds to NPT states that are close to being PPT. We start with some technical lemmas.
The following bounds follow easily from the monotonicity of the relative entropy.

Lemma 19
For positive p,p we have where we defined Proof We start by applying Lemma 11 to the state ρ ⊗n 0| A 2 and similarly forρ. We have for all > 0 and sufficiently large n where we used the fact that I(A 2 : . We now bound the LHS from below. Note that by Lemma 12 a measurement of the flags results in By Lemma 12 we can locally apply partial traces resulting in By the Chernoff bound k > n(p − ) with probability 1 − e −2n 2 . Hence we find Combining this bound with (120) and taking the limit n(p − ) = ñ(p − ) = m → ∞ results in which proves the statement, since was arbitrary.
Combining this statement with Theorem 9 and Lemma 19 we find the following result.
Corollary 21 Let ρ ∈ N P T be such that ρ + = pρ + (1 − p)ρ ∈ PPT for some state ρ (and likewise forρ). Then Similarly we can derive a squashed entanglement bound for NPT states.

Example: Exact p-bit close to being PPT
In previous examples, we had to admix some noise to the p-bits in order to make them PPT and thereby amenable to the bounds. We can now use our bounds for NPT states that are close to being PPT in order directly obtain bounds for exact p-bits.
Proof Take γ ds to be equal to a private bit defined by X from eq. (19). Its matrix reads By [20,Theorem 4], K D (γ ds ) ≤ 1. Since γ ds is a private bit we find K D (γ ds ) = 1. Theorem 5 shows that γ ds becomes PPT if mixed with probability p with the separable state σ = 1 Moreover, resulting PPT state after partial transposition is highly indistinguishable from the separable state σ ds presented in (23), as it satisfies (24). Since probability with which σ is admixed q = 1 √ ds+1 is small, we can apply Corollary 21 (with p = 1−q), and Lemma 4 in order to obtain the desired bound.

Entanglement Distillation and Cost Bound
We will now present an upper bound on the quantum key repeater rate that depends on the distillable entanglement of the input state.

Theorem 24 For input states ρ AC
In case of PPT states, we may also transpose the states on the C system.
Our result implies that if one of the input states is bound entangled or has small distillable entanglement, the other state has to 'compensate' this lack of distillability by its entanglement cost.
Before proving Theorem 24, we consider the classical squashed entanglement [34], denoted by E sq,c , a variant of the squashed entanglement where the extensions are restricted to being classical, i.e.
If we further restrict ourselves to ρ ABE = i p i |Ψ (i) Ψ (i) | AB ⊗ |i i| E , i.e. pure states ρ i = |Ψ (i) Ψ (i) |, we get the entanglement of formation as shown in [34]. Clearly, E sq ≤ E sq,c ≤ E F , and all inequalities can be strict, for example for the antisymmetric state [24,37].
Furthermore, in [24,37,50] it was shown that K D ≤ E sq . The proof of Theorem 24 is based on the following Lemmas. First, a small technical observation: Proof Using the definition of the classical squashed entanglement and the hashing inequality [15], Lemma 25 gives us the following upper bound on the classical squashed entanglement of τ : In a second step, Alice performs a local operation that can depend on i, resulting in state τ A B .
AB . By Lemma 25, for every i, j, we have By the concavity of the von Neumann entropy and the fact that the A subsystem remains untouched in the first step, we find As the second step of the protocol is local, using the convexity and LOCC monotonicity of the classical squashed entanglement [51], we obtain ij p . Note that if Alice and Charlie share a lab they will be able to locally create the ensemble {q j , |Ψ j Ψ j |}. This combined with the first part of the protocol provides an (AC : B)-LOCC protocol, transferring AB ), finishing the proof. Similarly, we can show the following where E C A →A D describes the one way distillable entanglement.
AB . By Lemma 25, for every i, j, we have By the concavity of the von Neumann entropy and the fact that the B subsystem remains untouched in the first step, As the second step of the protocol is local, using the convexity and LOCC monotonicity of the classical squashed entanglement, we obtain ij p . Note that if Charlie and Bob share a lab they will be able to locally create the ensemble {q j , |Ψ j Ψ j |}. This combined with the first part of the protocol provides an (A ← CB)-LOCC protocol, transferring AB }. By the LOCC monotonicity of the one-way distillable entanglement we have AB ), finishing the proof.

Proof of Theorem 24
Let M be the class of allowed LOCC protocols and let > 0. Then there exists n and an M-protocol Λ M such that Tr C Λ M (ρ ⊗ρ) ⊗n ≈ γ nr and r ≥ K M (ρ ⊗ρ) − .
Hence, using the fact that E sq (γ m ) ≥ m for any γ m [37], as well as the LOCC monotonicity and asymptotic continuity of E sq , it holds where f ( ) → 0 as → 0. By Lemma 26 and 27 for respective classes M and the fact that and Let us now divide by n and let → 0 and n → ∞. Our bounds then follow from the extensitivity of E D and the fact that the regularised entanglement of formation equals the entanglement cost. If ρ andρ are PPT, it can be shown analogously to Lemma 1 that K A←C↔B (ρ⊗ρ) = K A←C↔B (ρ Γ ⊗ρ Γ ) and K A←C→B (ρ ⊗ρ) = K A←C→B (ρ Γ ⊗ρ Γ ), hence we can also partially transpose ρ andρ.

Example: PPT invariant approximate p-bit (based on data hiding states)
Note that, even though the results in Section III C may be computed for states without the use of the partial transpose, all examples were in fact computed using that idea. Therefore, until now, we have not been able to demonstrate a nontrivial bound for states that are invariant under the partial transpose operation. It is the goal of this section to demonstrate such an example by help of Theorem 24.
In order to do so, we choose a family of states ρ m and based on this, consider states of the form Note thatρ m is locally equivalent (by bilocal swap) to its partial transposition and therefore our previous bounds based on the partial transpose idea give no nontrivial results.
As we show below, however, for our choice ofρ m we find E D (ρ m ) = 0 and E C (ρ m ) 1. Inserting this into Theorem 24, we find which is significantly smaller than K D (ρ m ) 1 (see below).
The stateρ p,d,k,m is PPT iff p ≤ 1 3 and 1−p p ≥ ( d d−1 ) k [14]. We satisfy this condition by setting p = 1 3 , d = m 2 and k = m, as then ( d d−1 ) k < 2 for m ≥ 2. Then we define with m ≥ 2. Since alsoρ m is PPT, it is bound entangled and we find E D (ρ m ) = 0. The following lemma assures us of the fact that entanglement of formation ofρ m is bounded by approximately one.
Lemma 28ρ m = ρ m ⊗ρ Γ m for ρ m defined in eq. (150) satisfies Note that this bound is approximately equal to one for large m.
Proof Observe first that E F (ρ m ) ≤ E F (ρ m ) + E F (ρ Γ m ) due to the subadditivity of E F . We show now, that E F (ρ m ) ≤ 1. Indeed, observe that (for where S even is a uniform mixture (with probability 2 −(m−1) ) of all states τ i 1 ⊗ · · · ⊗ τ im such that 2 occurs even number of times in string (i 1 , . . . , i m ), and S odd is defined analogously, but with number of 2 being odd, |ψ ± = 1 √ 2 (|00 ± |11 ). It is clear from the above formula, that the state ρ m can be created from 2-qubit maximally entangled state appropriately correlated to the sequences of length m of separable hiding states τ i , and mixed with probability 2x with a separable We now bound E F (ρ Γ m ) from above. Note that Observe, that [( τ 1 +τ 2 2 ) Γ ] is a separable state, and, therefore, by the convexity of entanglement of formation, where the state ρ m is formed by middle block of the above matrix: Since x ≤ 1 2 m , we can safely bound E F (ρ m ) by the logarithm of the local dimension of ρ m , which equals 2m 2m 2 : The assertion follows by inserting p = 1/3 and observing that the entanglement cost is upper bounded by the entanglement of formation.
In the following we show that K D (ρ m ) 1 in the limit of large m. We start by noting that K D (ρ m ) ≥ K D (ρ m ) and it therefore suffices to lower bound K D (ρ m ). We first apply a privacy squeezing operation to ρ m , which gives ρ ps m [20]. Note, that this operation on ρ m amounts to the replacement of the blocks of the matrix given in eq. (149) by their respective trace norms. In turn, the ρ ps m is a 2-qubit state described by the matrix:  where a = p m Nm , x = (1/2−p) m Nm and (by eq. 141 of [20]

Nm
. Now, using the fact that the distillable key of ρ m is lower bounded by the Devetak-Winter quantity of a ccq state of the ρ ps m (see Corollary 4.26 of [35]), we observe that: where H is the Shannon entropy. This is what we aimed to prove, as in the limit of large m the above considered distribution approaches (1, 0, 0, 0) for our choice of p.
for some measure E and some weight p. If we had a quantum repeater that iterates the swapping operation many times, and bound entangled input states, E would be reduced by a factor 1 − p with every step. For measures that upper bound the distillable key, such as E C , E F , E sq , E sq,c , E R or E ∞ R , this would be a significant limitation to quantum key repeaters with bound entangled input states. The same would hold, if we replaced E D by E N or E R,PPT .
We will now show that for E = E F , the entanglement of formation, and E = E C , the entanglement cost, (157) cannot hold for all input states. Assume that Bob and Charlie apply the following LOCC protocol. Charlie performs a generalised Bell state measurement |Ψ νµ Ψ νµ | C , Charlie's subsystem is then discarded, i.e. given to Eve.
Proposition 29 For the protocol described above, and any 0 < p ≤ 1, there exist states ρ,ρ such where τ is the state resulting from the protocol.
Our counterexamples are of the form ρ AB = d−1 i,k=0 a ik |ii kk|, which admits a purification |Φ ABE = 1 √ d i |ii ⊗ |u i , where a ik = 1 d u k |u i and the |u i are normalised. Such states are called maximally correlated. It is easy to see that ρ A = ρ B = 1 1 d . For maximally correlated states the entanglement measures involved simplify and τ can be easily calculated. In particular (see [52] and references therein), and where I acc 1 d , |u i = sup {A j }POVM I(i : j) is the accessible information. Before proceeding with our counterexample for E F and E C let us note that (157) with E R is trivially fulfilled for all maximally correlated states. This can be seen by using the fact that for maximally correlated states E R = E D and a simple application of the LOCC monotonicity of E D .
Lemma 30 Let ρ AC A andρ C B B be maximally correlated, with purifications |Φ 1 Proof Let 0 < p ≤ 1. Let us first show that maximally correlated states preserve their structure under the protocol assumed in Proposition 29. The protocol results in a state τ AA BB purified by Clearly, τ µ AB := Tr E A E B |Φ µ Φ µ | is maximally correlated and {|w µ } are orthogonal. Therefore Alice and Bobs final state is given by τ AaBb = 1 d µ τ µ AB ⊗ |µµ µµ| ab . By the convexity and LOCC monotonicity of E F , it holds that E F (τ ) = 1 d µ E F (τ µ ). Since we are dealing with maximally correlated states, the same holds true for E C . Now, assume that we have (157) with E = E F or E = E C . Inserting (159) and (160) into (157) gives us and the same for ρ and |v i . Since the accessible information is always non-negative, this implies the Lemma.
Hence, if we can find an example such that I acc ({ 1 d , |u i ⊗ |v i+µ }) < pS(ρ) and I acc ({ 1 d , |u i ⊗ |v i+µ }) < pS(ρ) for all µ we will have Proposition 29. For this, we make the following ansatz: where U j , V j are unitaries. This is a generalisation of the flower states introduced in [23] (see [39]).
Replacing the index i with (i, j), hence also d with dn, it is easy to see that those are maximally correlated states. Since Consequently, Proposition 29 follows from Lemma 30 and the next proposition.
Next, we lower bound inf |ϕ H αβ ϕ,δ (U, V) using the following concentration of measure result: Theorem 34 (Theorem 2.4 in [54]) Let (X , g) be a compact connected smooth Riemannian manifold with Ricci curvature ≥ Ric min (X ) > 0 equipped with the normalised Riemannian volume element dµ = dv V . Then for any λ-Lipschitz function F on X and any r ≥ 0, In order to apply Theorem 34 we need to lower bound the expectation value ofH.
where we are using the Haar measure on SU(d) 2n .
For the proof see Section III D 4. We also need the fact that SU(d) 2n is a compact connected The proof can be found in Section III D 4. Apart from applying Theorem 34 toH, we will need the following net result: Finally, we will need the Lipschitz constant ofĤ UV : H E A E B → R,Ĥ UV (|ϕ ) =H αβ ϕ,δ (U, V).
Proof of Proposition 31 Let 0 < r < 1, 0 < δ < 1 4 , d ≥ 8 and n = d 8 . By Lemma 37 there exists an Proof It is known that SU(d) is a real semi-simple compact connected Lie group [56]. Every real Lie group is a real smooth manifold. Clearly, the Hilbert-Schmidt inner product is a positive definite bilinear form. It is also easy to see that it is smooth. Let U ∈ SU(d) and X, Y be some smooth vector fields on SU(d), i.e. smooth mappings of SU(d) into its tangent bundle. As it is a composition of smooth maps, the map U → Tr X(U ) † , Y (U ) is smooth. Hence the Hilbert-Schmidt inner product on the tangent spaces is what is referred to as a "Riemannian metric". A smooth manifold endowed with a Riemannian metric is a Riemannian manifold [57].
The infimum is taken over all tangent unit vectors and Ric denotes the Ricci curvature.
Now we can define a Riemannian distance, which is a metric, for SU(d) The Cartesian product SU(d) 2n is a Riemannian manifold as well [54]. As for its metric, we have for U,Ũ ∈ M, V,Ṽ ∈ N .
The minimum Ricci curvature for a Cartesian product of manifolds is just the smallest curvature of the factors. Hence Theorem 34 can be applied toH.
Let us now present the proofs that were omitted in the previous section.