Quantum cryptographic resource distillation and entanglement

Abstract

We look into multipartite quantum states on which quantum cryptographic protocols including quantum key distribution and quantum secret sharing can be perfectly performed, and define the quantum cryptographic resource distillable rate as the asymptotic rate at which such multipartite state can be distilled from a given multipartite state. Investigating several relations between entanglement and the rate, we show that there exists a multipartite bound entangled state whose quantum cryptographic resource distillable rate is strictly positive, that is, there exists a multipartite entangled state which is not distillable, but can be useful for quantum cryptography such as quantum key distribution and quantum secret sharing.

Introduction

Entanglement is one of the most significant resources for quantum cryptography. In particular, it has been well known that any pure entangled state can be useful in performing quantum cryptographic protocols, such as quantum key distribution¹ and quantum secret sharing². However, it has also been known that there exist mixed states, called the private states^3,4,5 or the (genuine) secret sharing states^6,7, which can distill perfectly secure key bits or secret bits for secret sharing just by measurement. We here call such mixed states the quantum cryptographic resource (QCR) states. Hence, it can be seen that a QCR state is not only considered as a generalized version of the private state or the genuine secret sharing state, but is also regarded as a resource unit in a quantum cryptographic theory, while a pure maximally entangled state plays a role of a resource unit in entanglement theory.

We consider a general form of the QCR states with one dealer party. In other words, the QCR state that we here deal with is a multipartite quantum state, and a private state on the parties can be obtained from the state by local quantum operations and classical communication (LOCC) so that perfectly secure key distribution is feasible between the dealer party and any player party of the state. In addition, complete secret sharing on any number of divided parties together with the dealer party of the QCR state is also possible, although dishonest players cooperating with any exterior eavesdropper exist. Thus, players can select one quantum cryptographic protocol among various kinds of ones with the dealer on the same QCR state, as they want.

As in any resource theories including entanglement theory, it is both natural and important to take into account the quantity representing how much amount of QCR can be extracted from a given state, which we call the QCR distillable rate of the state. We remark that since the simplest QCR state is a maximally entangled state, the QCR distillable rate in entanglement theory is nothing but the distillable entanglement⁸, and since the private state is also a simple form of the QCR state, the QCR distillable rate in quantum key distribution is equal to the distillable key rate^3,5,9. Hence, in this paper, we discover the properties of the QCR distillable rate, and compare the QCR distillable rate with the distillable entanglement and the distillable key rate.

We say that a multipartite state is QCR distillable if its QCR distillable rate is strictly positive. Then it is clear that a QCR distillable state is entangled, since if a multipartite state has a separable bipartite split, then perfectly secure key distribution is impossible between the split, and hence the state is not QCR distillable. However, it does not seem to be true that all entangled states are QCR distillable, because its simplest case is not true, that is, there exists a bipartite bound entangled state with positive secret key distillable rate^3,5,9.

In this paper, we first present necessary and sufficient conditions for the QCR state with a dealer party, and definition of the QCR state, and then show that a given multipartite quantum state is a QCR state if and only if the conditions on the state hold. We also define the QCR distillable rate of a given multipartite state in a mathematical way, and present some properties on the QCR distillable rate. Finally, by providing the method to construct a QCR state with larger number of parties from several QCR states, we prove the existence of multipartite bound entangled but QCR distillable states.

This paper is organized as follows. We first define the QCR state, and justify the definition. After showing the several properties of the QCR states, we also present the mathematical definition of the QCR distillable rate of a given state, and investigate some relations between the QCR distillable rate and other distillable rates such as the entanglement distillable rate and secret key distillable rate. We finally show that there exists a multipartite QCR distillable state without any distillable entanglement.

Results

QCR states

Assume that there are one dealer and N players who participate in a quantum cryptographic protocol, and let $D=\bar{D}\widetilde{D}$ be the dealer’s quantum system with two subsystems $\bar{D}$ of d dimension and $\widetilde{D}$ of arbitrary dimension in the protocol. Similarly, for each $1 \le i \le N$, let $A_{i}=\bar{A}_i\widetilde{A}_i$ be the i-th player’s quantum system with subsystems $\bar{A}_i$ of d dimension and $\widetilde{A}_i$ of arbitrary dimension. Throughout this paper, we denote $\bar{A}_{1} \cdots \bar{A}_{N}$ and $\widetilde{A}_{1} \cdots \widetilde{A}_{N}$ by ${\bar{\mathbf{A}}}$ and $\widetilde{\mathbf {A}}$, respectively, and denote ${\bar{\mathbf{A}}}\widetilde{\mathbf {A}}$ by $\mathbf {A}$. The systems $\bar{\mathbf {A}}$ and $\mathbf {\widetilde{A}}$ are called the information part and the shield part, respectively.

In order to perform the quantum cryptographic protocol, the dealer’s and players’ information should satisfy the following cryptographic conditions:

• (i) The probability distributions of the dealer’s and all players’ information must be unbiased and perfectly correlated.

• (ii) An eavesdropper and dishonest players cannot get any information about the dealer’s information.

• (iii) The dealer and any subset of players can perform the same protocol with smaller number of parties after properly applying LOCC.

When $N=1$, if the dealer and the player share the private states^3,4,5, or when $N\ge 2$, if the dealer and the players share the genuine secret sharing states⁷, then the above three conditions are surely satisfied. However, since any player can be a dealer in the private states and the (genuine) secret sharing states, considering the case where the dealer is predetermined is more general than those in the private states and the (genuine) secret sharing states, Thus, we introduce the class of quantum states suitable for the case where the dealer is determined in advance.

Definition 1

$\Upsilon _{D\mathbf {A}}$ is called a QCR state if for any bipartite split $\{\mathbf {P}_1, \mathbf {P}_2\}$ of the players with $\mathbf {P}_1$ consisting of at least one player and $\mathbf {A}= \mathbf {P}_1\mathbf {P}_2$, the given state $\Upsilon _{D\mathbf {A}}$ can be written as

$$\begin{aligned} \frac{1}{d^{N}} \sum _{iI_{1}I_{2}, jJ_{1}J_{2} \in \mathfrak {S}_{N}^{0}} \left| iI_{1}I_{2} \right\rangle _{\bar{D}{\bar{\mathbf{P}}}_1{\bar{\mathbf{P}}}_2}\left\langle jJ_{1}J_{2} \right| \otimes \left( U_{\widetilde{D}\mathbf {\widetilde{P}}_{1}}^{iI_{1}}V^{{I}_{2}}_{\widetilde{D}\mathbf {\widetilde{A}}}\right) \sigma _{\widetilde{D}\mathbf {\widetilde{A}}} \left( U_{\widetilde{D}\mathbf {\widetilde{P}}_{1}}^{jJ_{1}}V^{J_{2}}_{\widetilde{D}\mathbf {\widetilde{A}}}\right) ^{\dagger }, \end{aligned}$$

(1)

where

$$\begin{aligned} \mathfrak {S}_{N}^{t} \equiv \left\{ jJ=jj_{1}j_{2} \cdots j_{N} \in \mathbb {Z}_{d}^{N+1}: j+\sum _{k=1}^{N}j_{k}\equiv t \pmod {d} \right\} , \end{aligned}$$

(2)

$\bar{D}{\bar{\mathbf{P}}}_1{\bar{\mathbf{P}}}_2=\bar{D}{\bar{\mathbf{A}}}$ and $\widetilde{D}\mathbf {\widetilde{A}}$ are the information part and the shield part of the QCR state $\Upsilon _{D\mathbf {A}}$, respectively, $\sigma _{\widetilde{D}\mathbf {\widetilde{A}}}$ is an arbitrary state, and the $\left\{ U_{\widetilde{D}\mathbf {\widetilde{P}}_{1}}^{iI_{1}}\right\}$ and $\left\{ V^{{I}_{2}}_{\widetilde{D}\mathbf {\widetilde{A}}}\right\}$ are unitary operators on the systems $\widetilde{D}\mathbf {\widetilde{P}}_1$ and $\widetilde{D}\mathbf {\widetilde{A}}$, respectively.

For instance, let $\left| \Upsilon \right\rangle _{\bar{D}\bar{A}\bar{B}\widetilde{D}\widetilde{A}\widetilde{B}}$ be the following state.

$$\begin{aligned} \left| \Upsilon \right\rangle _{\bar{D}\bar{A}\bar{B}\widetilde{D}\widetilde{A}\widetilde{B}}= \frac{1}{2}&(\left| 000 \right\rangle _{\bar{D}\bar{A}\bar{B}}\left| 000 \right\rangle _{\widetilde{D}\widetilde{A}\widetilde{B}} +\left| 011 \right\rangle _{\bar{D}\bar{A}\bar{B}}\left| 100 \right\rangle _{\widetilde{D}\widetilde{A}\widetilde{B}} {+\left| 101 \right\rangle _{\bar{D}\bar{A}\bar{B}}\left| 100 \right\rangle _{\widetilde{D}\widetilde{A}\widetilde{B}} +\left| 110 \right\rangle _{\bar{D}\bar{A}\bar{B}}\left| 000 \right\rangle _{\widetilde{D}\widetilde{A}\widetilde{B}}).} \\ \nonumber \end{aligned}$$

(3)

Then we can readily check that the state $\Upsilon _{\bar{D}\bar{A}\bar{B}\widetilde{D}\widetilde{A}\widetilde{B}} =\left| \Upsilon \right\rangle \left\langle \Upsilon \right|$ is a QCR state, but not a genuine secret sharing state in Reference⁷. Furthermore, when $N=1$, the QCR state $\Upsilon _{\bar{D}\bar{A}\widetilde{D}\widetilde{A}}$ in Definition 1 can be written as

$$\begin{aligned} \frac{1}{d} \sum _{i, j \in \mathbb {Z}_{d}} \left| i, -i \right\rangle _{\bar{D}\bar{A}}\left\langle j, -j \right| \otimes \left( U^{i}_{\widetilde{D}\widetilde{A}}\right) \sigma _{\widetilde{D}\widetilde{A}} \left( U^{j}_{\widetilde{D}\widetilde{A}}\right) ^{\dagger }, \end{aligned}$$

(4)

which is essentially equivalent to a private state, and all genuine secret sharing states in Reference⁷ are QCR states. Hence, the QCR state can be regarded as a generalization of the private states and the genuine secret sharing states with respect to quantum cryptography.

Theorem 1

Suppose that a dealer and N players share a quantum state $\rho _{D\mathbf {A}}$. The dealer and players can obtain information satisfying the above cryptographic conditions (i) and (ii) after they measure their information parts in the computational basis if and only if the state $\rho _{D\mathbf {A}}$ is a QCR state.

Theorem 2

Assume that a dealer D and N players $\mathbf {A}$ share an $(N+1)$-party QCR state. For any bipartite split $\{\mathbf {P}_{1},\mathbf {P}_{2}\}$ of the players $\mathbf {A}=\mathbf {P}_{1}\mathbf {P}_{2}$ with $\left| \mathbf {P}_{1}\right| =M \ge 1$, if players $\mathbf {P}_{2}$ measure their information parts and correctly announce the measurement outcomes, then $D\mathbf {P}_{1}$ can share an $(M+1)$-party QCR state after the dealer applies a proper unitary operation on the dealer’s part.

Theorem 2 tells us that from a given QCR state, a QCR state on any smaller number of players and the dealer as well as a private state between any player and the dealer can be shared by LOCC, as seen in the Fig. 1. In other words, Theorem 2 implies that any QCR state satisfies the cryptographic condition (iii).

Figure 1

As in Theorem 2, from the $\Upsilon _{D\mathbf {A}}$, a private state $\Upsilon _{DA_k}$ or a QCR state $\Upsilon _{D\mathbf {A}'}$ with smaller number of parties can be obtained by LOCC, where $\mathbf {A}'=A_{i_1}A_{i_2}\cdots A_{i_m}$.

Theorem 3

Assume that there are two QCR states $\Upsilon _{D_A\mathbf {A}}$ and $\Upsilon _{D_B\mathbf {B}}$, where both $D_A$ and $D_B$ are the dealer’s parties, and $\mathbf {A}=A_1\cdots A_N$ and $\mathbf {B}=B_1\cdots B_M$ are two different sets of players. Then the dealer and all players share a QCR state $\Upsilon _{D\mathbf {AB}}$ via the dealer’s proper local operations, where $D=D_AD_B$.

Figure 2

Constructing a QCR state with larger number of parties from two QCR states $\Upsilon _{D_A\mathbf {A}}$ and $\Upsilon _{D_B\mathbf {B}}$ in Theorem 3.

By Theorem 3, we can see that a larger QCR state can be obtained from two different QCR states with the same dealer party as seen in the Fig. 2. Furthermore, we note that the private state is considered as a QCR state with one dealer and one player. Hence, by mathematical induction, we have the following corollary.

Corollary 4

Suppose that each of N players shares a private state with one dealer. Then they can have an $(N+1)$-party QCR state by applying the dealer’s proper local operations.

QCR distillable rate and bound entangled states

Before defining the QCR distillable rate, we look at the distillable entanglement and the distillable key rate. Let $\Phi ^{m}_{AB}$ and $\gamma ^{m}_{ABA'B'}$ be denoted by the maximally entangled state with $m=\log \dim (A)=\log \dim (B)$ and the private state with $m=\log \dim (A)=\log \dim (B)$, respectively, where $\dim (\cdot )$ is the dimension of the system. The distillable entanglement $E_{\rm D}$ is defined as the rate at which maximally entangled states can be distilled under LOCC¹⁰, that is,

$$\begin{aligned} E_{\rm D}\left( \rho _{AB}\right) =\lim _{\delta \rightarrow 0}\lim _{n \rightarrow \infty } \sup _{\Lambda _{{A}:{B}}} \left\{ E:\Vert \Lambda \left( \rho _{AB}^{\otimes n}\right) -\Phi _{AB}^{nE}\Vert _{1}\le \delta \right\} , \end{aligned}$$

(5)

where $\Lambda _{{A}:{B}}$ is an LOCC protocol between Alice and Bob. Similarly, the distillable key rate $K_{\rm D}$ is defined as the rate at which private states can be distilled under LOCC^3,5, that is,

$$\begin{aligned} K_{\mathrm {D}}\left( \rho _{AB}\right) =\lim _{\delta \rightarrow 0}\lim _{n \rightarrow \infty } \sup _{\Lambda _{{A}:{B}}} \left\{ K:\big \Vert \Lambda \left( \rho _{AB}^{\otimes n}\right) -\gamma _{AB}^{nK}\big \Vert _{1}\le \delta \right\} . \end{aligned}$$

(6)

Since we can define the QCR distillable rate for any state in a similar way to the above definitions, from the definition, we can know how many copies of the given state are required to asymptotically distill a QCR state through LOCC. The QCR distillable rate $CR_{\rm D}$ of a given multipartite quantum state $\rho _{D\mathbf {A}}$ is defined as

$$\begin{aligned} CR_{\rm D}\left( \rho _{D\mathbf {A}}\right) =\lim _{\delta \rightarrow 0}\lim _{n \rightarrow \infty }\sup _{\Lambda } \left\{ K:\big \Vert \Lambda \left( \rho _{D\mathbf {A}}^{\otimes n}\right) -\Upsilon _{D\mathbf {A}}^{nK}\big \Vert _{1}\le \delta \right\} , \end{aligned}$$

(7)

where $\Lambda$ is the dealer’s and all players’ LOCC operation, and $\Upsilon _{D\mathbf {A}}^{m}$ denotes a QCR state whose information part $\bar{D}\bar{A}_{1}\bar{A}_{2}\cdots \bar{A}_{N}$ satisfies $m=\log \dim (\bar{D})=\log \dim (\bar{A}_{i})$ for all i.

Let us now investigate the connection between the distillable key rate and the QCR distillable rate. It follows from Theorem 2 that

$$\begin{aligned} CR_{\mathrm {D}}\left( \rho _{D\mathbf {A}}\right) \le K^{D\mathbf {P}_{1}:\mathbf {P}_{2}}_{\mathrm {D}}\left( \rho _{D\mathbf {A}}\right) \end{aligned}$$

(8)

for any bipartite split $\{\mathbf {P}_{1}, \mathbf {P}_{2}\}$ of the players $\mathbf {A}=\mathbf {P}_1\mathbf {P}_2$. In addition, by Theorem 3, we have the following theorem.

Theorem 5

Let $\mathbf {A}=A_1\cdots A_N$ and $\mathbf {B}=B_1\cdots B_M$ be two different sets of players, and let $D_A$ and $D_B$ be the dealer’s parties. For given two states $\rho _{D_A\mathbf {A}}$ and ${\rho }_{D_B\mathbf {B}}$,

$$\begin{aligned} CR_{\mathrm {D}}\left( \rho _{D_A\mathbf {A}}\otimes \rho _{D_B\mathbf {B}} \right) \ge \mathrm {min}\{CR_{\mathrm {D}}\left( \rho _{D_A\mathbf {A}}\right) , CR_{\mathrm {D}}\left( \rho _{D_B\mathbf {B}}\right) \}. \end{aligned}$$

(9)

Hence, the following corollary clearly comes from Theorem 5 and Corollary 4.

Corollary 6

For each $i=1, 2, \ldots , N$, let $\rho _{D_iA_i}$ be the quantum state shared by the dealer $D_i$ and the i-th player $A_i$. Then the following inequality holds.

$$\begin{aligned} CR_{\mathrm {D}}\left( \bigotimes ^N_{i=1} \rho _{D_iA_i}\right) \ge \mathrm {min}_{i}\left\{ K_{\mathrm {D}}(\rho _{D_iA_i})\right\} . \end{aligned}$$

(10)

Corollary 6 implies that if each $\rho _{D_iA_i}$ has a positive distillable key rate, then $\bigotimes ^N_{i=1} \rho _{D_iA_i}$ has a positive QCR distillable rate. We note that if each $\rho _{D_iA_i}$ is a bipartite state with positive partial transposition (PPT), then $\bigotimes ^N_{i=1} \rho _{D_iA_i}$ is also an $(N+1)$-partite state with PPT, since it is a PPT state with respect to any bipartite split of $D\mathbf {A}$ with one dealer $D=D_1D_2\cdots D_N$ and N players $\mathbf {A}=A_1A_2\cdots A_N$. Hence, we can readily construct multipartite PPT bound entangled states with positive QCR distillable rate from bipartite PPT bound entangled states with positive distillable key rate, which are presented in References^5,9. Therefore, we can finally present our theorem showing the existence of such states as follows.

Theorem 7

For any natural number $N\ge 2$, there exists an $(N+1)$-partite bound entangled state $\rho _{D\mathbf {A}}$ with $CR_{\rm D}\left( \rho _{D\mathbf {A}}\right) >0$.

Discussion

We have defined the QCR state with a dealer party, and have shown that a given multipartite quantum state is a QCR state if and only if the two cryptographic conditions on the state hold. We have also defined the QCR distillable rate of a given multipartite state, and have presented several important properties on the QCR distillable rate. In the sequel, we have presented how to construct a QCR distillable state with larger number of parties from several QCR distillable states. Moreover, we have proved that there exist multipartite bound entangled states which are QCR distillable. This result implies that there exists a multipartite quantum state on which a dealer and players can perform one of several kinds of quantum cryptographic protocols to some extent, and from which they cannot distill any bipartite nor multipartite entanglement by LOCC. Hence, we can conclude that any bipartite or multipartite distillable entanglement is not necessarily required for quantum cryptography.

The QCR states that we have dealt with in this paper have one specific dealer party. Thus several kinds of perfectly secure classical communication feasible on the quantum state can be performed between the dealer party and any number of players. Therefore, the QCR state can be considered as a resource unit in quantum cryptographic theory, and hence we could construct the quantum cryptographic network consisting of the QCR states instead of the bipartite maximally entangled states or the private states.

Methods

Proof of Theorem 1

This proof is almost the same as that of the theorem related to the genuine secret sharing state in Reference⁷. The details are as follows.

Let us consider the state

$$\begin{aligned} \left| \Gamma _\rho \right\rangle _{\bar{D}{\bar{\mathbf{A}}}\widetilde{D}\mathbf {\widetilde{A}}E} =\sum _{I \in \mathbb {Z}_{d}^{N+1}} \sqrt{p_{I}}\left| I \right\rangle _{\bar{D}{\bar{\mathbf{A}}}}\left| \psi _{I} \right\rangle _{\widetilde{D}\mathbf {\widetilde{A}}E}, \end{aligned}$$

(11)

which is a purification of $\rho _{D\mathbf {A}}$. Assume that the dealer and players can have cryptographic information that satisfies the cryptographic condition (i) by measuring the information part of $\rho _{D\mathbf {A}}$. Then we have $p_{I}=1/d^{N}$ for $I \in \mathfrak {S}_{N+1}^{0}$ and $p_{I}=0$ for $I \notin \mathfrak {S}_{N+1}^{0}$.

Regarding the condition (ii), we first take account of the worst case that all players except one player, say $A_{k}$, are dishonest. Then the subsystem ${\bar{\mathbf{A}}}'=\bar{A}_1\cdots \bar{A}_{k-1}\bar{A}_{k+1}\cdots \bar{A}_N$ is the information part of the dishonest players.

Let i be the dealer’s measurement outcome. Then the eavesdropper and dishonest players’ state after measurement becomes

$$\begin{aligned} \gamma _{{\bar{\mathbf{A}}'}\widetilde{D}\mathbf {\widetilde{A}}E}^{(i)} =\frac{1}{d^{N-1}}\sum _{i_k\in \mathbb {Z}_{d}} \sum _{\xi ,\xi ' \in \mathfrak {S}_{N-1}^{-i-i_k}} \left| \xi \right\rangle _{{\bar{\mathbf{A}}'}}\left\langle \xi ' \right| \otimes \mathrm{{tr}}_{\widetilde{D}\widetilde{A}_{k}} \left| \psi _{i,i_k,\xi } \right\rangle _{\widetilde{D}\mathbf {\widetilde{A}}E}\left\langle \psi _{i,i_k,\xi '} \right| \end{aligned}$$

(12)

if reordering the systems. From the cryptographic condition (ii), we have $\gamma _{{\bar{\mathbf{A}}'}\widetilde{D}\mathbf {\widetilde{A}}E}^{(i)} =\gamma _{{\bar{\mathbf{A}}'}\widetilde{D}\mathbf {\widetilde{A}}E}^{(i')}$ for any $i,i' \in \mathbb {Z}_{d}$. It follows from the Hughston-Jozsa-Wootters theorem¹¹ that for $i,i_k, i',i_k' \in \mathbb {Z}_{d}$ with $i+i_k=i'+i_k' \pmod {d}$, there is a unitary operator $U_{\widetilde{D}\widetilde{A}_{k}}^{i,i_k \rightarrow i',i_k'}$ on the system $\widetilde{D}\widetilde{A}_{k}$ such that

$$\begin{aligned} U_{\widetilde{D}\widetilde{A}_{k}}^{i,i_k \rightarrow i',i_k'} \left| \psi _{i,i_k,\xi } \right\rangle _{\widetilde{D}\mathbf {\widetilde{A}}E} =\left| \psi _{i',i_k',\xi } \right\rangle _{\widetilde{D}\mathbf {\widetilde{A}}E} \end{aligned}$$

(13)

for all $\xi \in \mathfrak {S}_{N-1}^{-i-i_k}$.

Let $\{\mathbf {P}_1, \mathbf {P}_2\}$ be an arbitrary bipartite split of the players with $\mathbf {P}_1$ consisting of at least one player and $\mathbf {A}= \mathbf {P}_1\mathbf {P}_2$. Without loss of generality, we may assume that $\mathbf {P}_1=A_{1}\cdots {A}_{M}$ and $\mathbf {P}_{2}={A}_{M+1}\cdots {A}_{N}$. Then by Eq. (13), it can be shown that if $iI_{1}I_{2}=ii_{1}\cdots i_{M} i_{M+1} \cdots i_{N} \in \mathfrak {S}_{N+1}^{0}$, then

$$\begin{aligned} \left| \psi _{00\cdots 0} \right\rangle _{\mathbf {A'}E} =U_{\widetilde{D}\widetilde{A}_{N}}^{j_{N-1},i_{N}} \cdots U_{\widetilde{D}\widetilde{A}_{2}}^{j_{1},i_{2}} U_{ \widetilde{D}\widetilde{A}_{1}}^{i,i_{1}} \left| \psi _{ii_{1}i_{2}\cdots i_{N}} \right\rangle _{\mathbf {A'}E}, \end{aligned}$$

(14)

where $U_{\widetilde{D}\widetilde{A}_{k}}^{i,j}=U_{\widetilde{D}\widetilde{A}_{k}}^{i,j \rightarrow i+j,0}$ and $j_{t}\equiv i+i_{1}+\cdots +i_{t} \pmod {d}$. Let $\mathrm{{tr}}_{\widetilde{D}\mathbf {\widetilde{A}}}\left( \left| \psi _{00\cdots 0} \right\rangle \left\langle \psi _{00\cdots 0} \right| \right) =\sum _{x}\lambda _{x}\left| \eta _{x} \right\rangle _{E}\left\langle \eta _{x} \right|$ be its spectral decomposition. Then we have

$$\begin{aligned} \left| \psi _{iI_{1}I_{2}} \right\rangle _{\widetilde{D}\mathbf {\widetilde{A}}E} =\sum _{x}\sqrt{\lambda _{x}} U_{\widetilde{D}\mathbf {\widetilde{P}}_{1}}^{iI_{1}}V_{\widetilde{D}\mathbf {\widetilde{A}}}^{I_{2}} \left| \phi _{x} \right\rangle _{\widetilde{D}\mathbf {\widetilde{A}}}\left| \eta _{x} \right\rangle _{E} \end{aligned}$$

(15)

for some unitary operators $U_{\widetilde{D}\mathbf {\widetilde{P}}_{1}}^{iI_{1}}$, $V_{\widetilde{D}\mathbf {\widetilde{A}}}^{I_{2}}$ and orthonormal set $\{\left| \phi _{x} \right\rangle \}$ for the system $\widetilde{D}\mathbf {\widetilde{A}}$. Therefore, $\rho _{D\mathbf {A}}$ is of the form in Eq. (1).

Conversely, assume that $\rho _{D\mathbf {A}}$ has the form in Eq. (1). Then it can be readily shown that players have cryptographic information that obeys the cryptographic condition (i) after measuring their information parts in the computational basis.

We now show that players’ cryptographic information satisfies the condition (ii). Suppose that $\{\mathbf {P}_1, \mathbf {P}_2\}$ is a bipartite split of the players $\mathbf {A}= \mathbf {P}_1\mathbf {P}_2$ with $\mathbf {P}_1$ consisting of at least one player and $\mathbf {P}_{2}$ representing K dishonest players. Let $\sigma _{\widetilde{D}\mathbf {\widetilde{A}}}=\sum _{x}\kappa _{x}\left| \mu _{x} \right\rangle _{\widetilde{D}\mathbf {\widetilde{A}}}\left\langle \mu _{x} \right|$ be a spectral decomposition of $\sigma _{\widetilde{D}\mathbf {\widetilde{A}}}$, and let

$$\begin{aligned} \left| \varphi _{iI_{1}I_{2}} \right\rangle _{\widetilde{D}\mathbf {\widetilde{A}}E} =\sum _{x}\sqrt{\kappa _{x}} U_{\widetilde{D}\mathbf {\widetilde{P}}_{1}}^{iI_{1}}V_{\widetilde{D}\mathbf {\widetilde{A}}}^{I_{2}} \left| \mu _{x} \right\rangle _{\widetilde{D}\mathbf {\widetilde{A}}}\left| \nu _{x} \right\rangle _{E}, \end{aligned}$$

(16)

where $\left\{ \left| \nu _{x} \right\rangle \right\}$ forms an orthonormal set for the eavesdropper’s system E. Then the state

$$\begin{aligned} \left| \Upsilon \right\rangle _{D\mathbf {P_{1}}\mathbf {P_{2}}E} =\frac{1}{\sqrt{d^{N}}}\sum _{iI_{1}I_{2} \in \mathfrak {S}_{N+1}^{0}} \left| iI_{1} \right\rangle _{\bar{D}{\bar{\mathbf{P}}_{1}}}\left| I_{2} \right\rangle _{{\bar{\mathbf{P}}_{2}}}\left| \varphi _{iI_{1}I_{2}} \right\rangle _{\widetilde{D}\mathbf {\widetilde{A}}E} \end{aligned}$$

(17)

is a purification of $\rho _{D\mathbf {A}}$. If the dealer has the measurement outcome i after measuring the dealer’s information part in the computational basis, then the quantum state of dishonest players and eavesdropper after the measurement becomes

$$\begin{aligned} \Upsilon _{\mathbf {P}_{2}E}^{(i)} =\frac{1}{d^{K}}\sum _{\alpha \in \mathbb {Z}_{d}}\sum _{I_{2},J_{2} \in \mathfrak {S}_{K}^{-\alpha }} \left| I_{2} \right\rangle _{{\bar{\mathbf{P}}}_{2}}\left\langle J_{2} \right| \otimes \mathrm {tr}_{\widetilde{D}\mathbf {\widetilde{P}}_{1}}\left| \varphi _{I_{2}} \right\rangle _{\widetilde{D}\mathbf {\widetilde{P}}E}\left\langle \varphi _{J_{2}} \right| , \end{aligned}$$

(18)

where $\left| \varphi _{I_{2}} \right\rangle _{\widetilde{D}\mathbf {\widetilde{P}}E} =\sum _{x}\sqrt{\kappa _{x}}V_{\widetilde{D}\mathbf {\widetilde{P}}}^{I_{2}} \left| \xi _{x} \right\rangle _{\widetilde{D}\mathbf {\widetilde{P}}}\left| e_{x} \right\rangle _{E}.$ Since $\Upsilon _{\mathbf {P}_{2}E}^{(i)} =\Upsilon _{\mathbf {P}_{2}E}^{(j)}$ for any $i, j \in \mathbb {Z}_{d}$, dishonest players and eavesdropper cannot get any information about the dealer’s cryptographic information.

Proof of Theorem 2

The proof of Theorem 2 is also similar to that of the theorem associated with the genuine secret sharing states in Reference⁷. However, we here present its simple proof compared to that in Reference⁷ as follows.

Without loss of generality, we may assume that $\mathbf {P}_{1}={A}_{1}\cdots {A}_{M}$ and $\mathbf {P}_{2}={A}_{M+1}\cdots {A}_{N}$. Let $\Upsilon _{D\mathbf {A}}$ be an $(N+1)$-party QCR state shared by a dealer and N players. Since $\Upsilon _{D\mathbf {A}}$ has the form in Eq. (1), if let $I_{2} \in \mathfrak {S}_{N-M}^{\beta }$ be the measurement outcomes for some $\beta$ when players $\mathbf {P}_{2}$ measure their information parts in the computational basis, then the resulting state of the dealer D and the players $\mathbf {P}_{1}$ after the measurement becomes

$$\begin{aligned} {\Upsilon _{D\mathbf {P}_{1}}^{(I_{2})}} =\frac{1}{d^{M}}\sum _{iI_{1},jJ_{1} \in {\mathfrak {S}_{M+1}^{-\beta }}} \left| iI_{1} \right\rangle _{\bar{D}{\bar{\mathbf{P}}}_{1}}\left\langle jJ_{1} \right| \otimes {U_{\widetilde{D}\mathbf {\widetilde{P}}_{1}}^{iI_{1}}} {{\tilde{\sigma }}_{\widetilde{D}\mathbf {\widetilde{P}}_{1}}} \left({ U_{\widetilde{D}\mathbf {\widetilde{P}}_{1}}^{jJ_{1}}}\right) ^{\dagger }, \end{aligned}$$

(19)

where ${\tilde{\sigma }}_{\widetilde{D} {\widetilde{\bf P}}_{1}}= {\rm tr}_{{\widetilde{\bf P}}_{2}}\tilde{V}_{\widetilde{D} {\widetilde{\bf A}}}^{I_{2}} \sigma _{\widetilde{D} {\widetilde{\bf A}}} \left( \tilde{V}_{\widetilde{D}{\widetilde{\bf A}}}^{I_{2}}\right) ^{\dagger}$.

We note that unitary operators on the shield part of the state $\Upsilon _{D\mathbf {A}}$ can be expressed as in Eq. (14), and it can be easily shown that $W_{\bar{D}}\Upsilon _{D\mathbf {P}_{1}}^{(I_{2})}W_{\bar{D}}^{\dagger }$ is an $(M+1)$-party QCR state, where $W=\sum _{i=0}^{d-1}\left| i+\beta \right\rangle \left\langle i \right|$. Therefore, if the players $\mathbf {P}_{2}$ announces the value $\beta$, then the dealer D and the players $\mathbf {P}_{1}$ can share the $(M+1)$-party QCR state after applying the unitary operator W on the dealer’s information part.

Proof of Theorem 3

Let

$$\begin{aligned} \left| \Upsilon \right\rangle _{D_A\mathbf {A}E_{A}}= \frac{1}{\sqrt{d^{N}}} \sum _{iI \in \mathfrak {S}_{N+1}^{0}} \left| iI \right\rangle _{\bar{D}_A\bar{\mathbf {A}}} \otimes \left| \psi _{iI} \right\rangle _{\widetilde{D}_A\mathbf {\widetilde{A}}E_{A}} \end{aligned}$$

(20)

be a purification of the QCR state $\Upsilon _{D_A\mathbf {A}}$, and let

$$\begin{aligned} \left| \Upsilon \right\rangle _{D_B\mathbf {B}E_{B}}= \frac{1}{\sqrt{d^{M}}} \sum _{jJ \in \mathfrak {S}_{M+1}^{0}} \left| jJ \right\rangle _{\bar{D}_B\bar{\mathbf {B}}} \otimes \left| \phi _{jJ} \right\rangle _{\widetilde{D}_B\mathbf {\widetilde{B}}E_{B}} \end{aligned}$$

(21)

be a purification of the QCR state $\Upsilon _{D_B\mathbf {B}}$. For $I=i_1i_2\cdots i_L \in \mathbb {Z}_d^{L}$, let |I| be defined as $|I|=i_{1}+\cdots +i_{L}$. Then the states $\left| \Upsilon \right\rangle _{D_A\mathbf {A}E_{A}}$ and $\left| \Upsilon \right\rangle _{D_B\mathbf {B}E_{B}}$ in Eqs. (20) and (21) can be rewritten as

$$\begin{aligned} \left| \Upsilon \right\rangle _{D_A\mathbf {A}E_{A}}= \frac{1}{\sqrt{d^{N}}} \sum _{I \in \mathbb {Z}_{d}^{N}} \left| -|I|,I \right\rangle _{\bar{D}_A\bar{\mathbf {A}}} \otimes \left| \psi _{-|I|,I} \right\rangle _{\widetilde{D}_A\mathbf {\widetilde{A}}E_{A}} \end{aligned}$$

(22)

and

$$\begin{aligned} \left| \Upsilon \right\rangle _{D_B\mathbf {B}E_{B}}= \frac{1}{\sqrt{d^{M}}} \sum _{J \in \mathbb {Z}_{d}^{M}} \left| -|J|,J \right\rangle _{\bar{D}_B\bar{\mathbf {B}}} \otimes \left| \phi _{-|J|,J} \right\rangle _{\widetilde{D}_B\mathbf {\widetilde{B}}E_{B}} \end{aligned}$$

(23)

respectively.

Let cX be the unitary operator defined as

$$\begin{aligned} cX=\sum _{j,k=0}^{d-1}\left| j+k,k \right\rangle \left\langle j,k \right| . \end{aligned}$$

(24)

If the dealer applies the unitary operator $cX_{\bar{D}_{A}\bar{D}_{B}}$ on the system $\bar{D}_{A}\bar{D}_{B}$ in the state $\left| \Upsilon \right\rangle _{D_A\mathbf {A}E_{A}} \otimes \left| \Upsilon \right\rangle _{D_B\mathbf {B}E_{B}}$, then after properly rearranging the order of the systems, the state becomes

$$\begin{aligned} \frac{1}{\sqrt{d^{N+M}}} \sum _{I \in \mathbb {Z}_{d}^{N}} \sum _{J \in \mathbb {Z}_{d}^{M}}&\left| -|I|-|J|,I,J \right\rangle _{\bar{D}_{A}{{\bar{\mathbf{A}}}}{{\bar{\mathbf{B}}}}} {\otimes \left| -|J| \right\rangle _{\bar{D}_{B}} \otimes \left| \psi _{-|I|,I} \right\rangle _{\widetilde{D}_A\mathbf {\widetilde{A}}E_{A}} \otimes \left| \phi _{-|J|,J} \right\rangle _{\widetilde{D}_B\mathbf {\widetilde{B}}E_{B}}.} \end{aligned}$$

(25)

We remark that if the dealer and all players measure their information part $\bar{D}_{A}{{\bar{\mathbf{A}}}}{{\bar{\mathbf{B}}}}$ in the computational basis, then they have cryptographic information that satisfies the cryptographic condition (i). In order to show that the cryptographic information obeys the cryptographic condition (ii), we consider the worst case as in the proof of Theorem 1.

Let us assume that the dealer measures the information part $\bar{D}_{A}$, and let i be the dealer’s measurement outcome. By tracing out the system $\bar{D}_{A}\bar{D}_{B}\widetilde{D}_A\widetilde{D}_B$ of the resulting state, we have

$$\begin{aligned} \frac{1}{d^{N+M-1}} \sum _{\alpha \in \mathbb {Z}_{d}} \sum _{I, I' \in \mathfrak {S}_{N}^{\alpha }}\sum _{J, J' \in \mathfrak {S}_{M}^{-\alpha -i}}&\left| I,J \right\rangle _{\bar{\mathbf {A}}\bar{\mathbf {B}}} \left\langle I',J' \right| {\otimes \mathrm {tr}_{\widetilde{D}_A}\left| \psi _{-\alpha ,I} \right\rangle _{\widetilde{D}_A\mathbf {\widetilde{A}}E_{A}} \left\langle \psi _{-\alpha ,I'} \right| \otimes \mathrm {tr}_{\widetilde{D}_B}\left| \phi _{\alpha +i,J} \right\rangle _{\widetilde{D}_B\mathbf {\widetilde{B}}E_{B}} \left\langle \phi _{\alpha +i,J'} \right| .} \end{aligned}$$

(26)

Let us now consider the situation where all players except the dealer and one player are dishonest as the worst case. Without loss of generality, we may assume that the honest player is $A_1$, by symmetry. When $N \ge 2$, after tracing out the system $A_{1}$, the dishonest players and eavesdropper’s state becomes

$$\begin{aligned} \frac{1}{d^{N+M-1}} \sum _{\alpha , \beta \in \mathbb {Z}_{d}} \sum _{{\hat{I}}, {\hat{I}}' \in \mathfrak {S}_{N-1}^{\alpha -\beta }}\sum _{J, J' \in \mathfrak {S}_{M}^{-\alpha -i}}&\left| {\hat{I}} \right\rangle _{\hat{\mathbf {A}}} \left\langle {\hat{I}}' \right| \otimes \left| J \right\rangle _{\bar{\mathbf {B}}} \left\langle J' \right| {\otimes {\rm tr}_{\widetilde{D}_{A}\widetilde{A}_{1}} \left| \psi_{-\alpha ,\beta,{\hat{I}}} \right\rangle _{\widetilde{D}_A {\widetilde{\bf A}}E_{A}} \left\langle \psi_{-\alpha,\beta,{\hat{I}}'} \right| \otimes {\rm tr}_{\widetilde{D}_B}\left| \phi _{\alpha +i,J} \right\rangle _{\widetilde{D}_B {\widetilde{\bf B}}E_{B}} \left\langle \phi _{\alpha +i,J'} \right| }, \\ \nonumber \end{aligned}$$

(27)

where ${\hat{I}}=i_2\cdots i_L\in \mathbb {Z}_d^{L-1}$ for $I=i_1i_2\cdots i_L\in \mathbb {Z}_d^L$ and $\hat{\mathbf {A}}=\bar{A}_2\cdots \bar{A}_L$ for $\bar{\mathbf {A}}=\bar{A}_1\bar{A}_2\cdots \bar{A}_L$. Since $\Upsilon _{D_A\mathbf {A}}$ is a QCR state,

$$\begin{aligned} {{\mathrm {tr}}_{\widetilde{D}_{A} \widetilde{A}_{1}}} \left| \psi _{-\alpha ,\beta ,{\hat{I}}} \right\rangle _{\widetilde{D}_A {\widetilde{\bf A}}E_{A}} \left\langle \psi _{-\alpha ,\beta ,{\hat{I}}'} \right| = {{\rm tr}_{\widetilde{D}_{A}\widetilde{A}_{1}}} \left| \psi _{0,\beta -\alpha ,{\hat{I}}} \right\rangle _{\widetilde{D}_A {\widetilde{\bf A}}E_{A}} \left\langle \psi _{0,\beta -\alpha ,{\hat{I}}'} \right| \end{aligned}$$

(28)

for any $\alpha ,\beta \in \mathbb {Z}_{d}$ and ${\hat{I}}, {\hat{I}}' \in \mathfrak {S}_{N-1}^{\alpha -\beta }$. Hence, the state in Eq. (27) can be rewritten as

$$\begin{aligned} \frac{1}{d^{N+M-1}} \sum _{s, t \in \mathbb {Z}_{d}} \sum _{{\hat{I}}, {\hat{I}}' \in \mathfrak {S}_{N-1}^{s}}\sum _{J, J' \in \mathfrak {S}_{M}^{t}}&\left| {\hat{I}} \right\rangle _{\hat{\bf{A}}} \left\langle {\hat{I}}' \right| \otimes \left| J \right\rangle _{\bar{\bf{B}}} \left\langle J' \right| {\otimes {\rm tr}_{\widetilde{D}_{A}\widetilde{A}_{1}} \left| \psi _{0,-s,{\hat{I}}} \right\rangle _{\widetilde{D}_A {\widetilde{\bf A}}E_{A}} \left\langle \psi _{0,-s,{\hat{I}}'} \right| \otimes {\rm tr}_{\widetilde{D}_B}\left| \phi _{-t,J} \right\rangle _{\widetilde{D}_B {\widetilde{\bf B}}E_{B}} \left\langle \phi _{-t,J'} \right| .} \end{aligned}$$

(29)

We can here see that the state in Eq. (29) is independent on the dealer’s measurement outcome i. In other words, the dealer’s cryptographic information is perfectly secure against the dishonest players and any exterior eavesdropper, which implies that the dealer’s and all players’ cryptographic information satisfies the cryptographic condition (ii).

Now assume that $N=1$, that is, $\mathbf {A}=A_1$. Then the state of the dishonest players $\mathbf {B}$ and eavesdropper $E_AE_B$ after the dealer’s measurement is

$$\begin{aligned} \frac{1}{d^{M}} \sum _{\alpha \in \mathbb {Z}_{d}} \sum _{J, J' \in \mathfrak {S}_{M}^{-\alpha -i}}&\left| J \right\rangle _{\bar{\mathbf {B}}} \left\langle J' \right| {\otimes \mathrm {tr}_{\widetilde{D}_{A}\widetilde{\mathbf {A}}}\left| \psi _{-\alpha ,\alpha } \right\rangle _{\widetilde{D}_A\mathbf {\widetilde{A}}E_{A}} \left\langle \psi _{-\alpha ,\alpha } \right| \otimes \mathrm {tr}_{\widetilde{D}_B}\left| \phi _{\alpha +i,J} \right\rangle _{\widetilde{D}_B\mathbf {\widetilde{B}}E_{B}} \left\langle \phi _{\alpha +i,J'} \right| ,} \end{aligned}$$

(30)

where the dealer’s measurement outcome is i. Since

$$\begin{aligned} \mathrm {tr}_{\widetilde{D}_{A}\widetilde{\mathbf {A}}}\left| \psi _{-\alpha ,\alpha } \right\rangle _{\widetilde{D}_A\mathbf {\widetilde{A}}E_{A}} \left\langle \psi _{-\alpha ,\alpha } \right| =\mathrm {tr}_{\widetilde{D}_{A}\widetilde{\mathbf {A}}}\left| \psi _{0,0} \right\rangle _{\widetilde{D}_A\mathbf {\widetilde{A}}E_{A}} \left\langle \psi _{0,0} \right| \end{aligned}$$

(31)

for all $\alpha \in \mathbb {Z}_{d}$, the state in Eq. (30) does not depend on the measurement outcome i, and hence the cryptographic information is perfectly secure against the dishonest players and any exterior eavesdropper.

Let $\left| \Upsilon \right\rangle _{D\mathbf {AB}E}$ be the pure state in Eq. (25), which is the resulting state after the dealer applies the unitary operator $cX_{\bar{D}_{A}\bar{D}_{B}}$ on the system $\bar{D}_{A}\bar{D}_{B}$ in the state $\left| \Upsilon \right\rangle _{D_A\mathbf {A}E_{A}} \otimes \left| \Upsilon \right\rangle _{D_B\mathbf {B}E_{B}}$, where $D=D_AD_B$ and $E=E_AE_B$. Then, for any cases, the cryptographic information from the state $\left| \Upsilon \right\rangle _{D\mathbf {AB}E}$ obeys the cryptographic conditions (i) and (ii). Therefore, the state $cX_{\bar{D}_{A}\bar{D}_{B}}\left( \Upsilon _{D_A\mathbf {A}} \otimes \Upsilon _{D_B\mathbf {B}}\right) cX^\dagger _{\bar{D}_{A}\bar{D}_{B}}$ is an $(N+M+1)$-party QCR state by Theorem 1, since the state is equal to $\mathrm {tr}_E\left| \Upsilon \right\rangle _{D\mathbf {AB}E}\left\langle \Upsilon \right|$.

Proof of Theorem 5

We first note that the set of all LOCC operations $\Lambda _{D\mathbf {AB}}$ on the dealer $D=D_AD_B$ and all players $\mathbf {AB}$ contains LOCC operations of the form $\Lambda _{D_A\mathbf {A}}\otimes {\Lambda }_{D_B\mathbf {B}}$. Hence, $CR_{\rm D}\left( \rho _{D_A\mathbf {A}}\otimes {\rho }_{D_B\mathbf {B}} \right)$ is lower bounded by

$$\begin{aligned} \lim _{\delta \rightarrow 0}\lim _{n \rightarrow \infty } \sup _{U_{D}}\sup _{\Lambda _{D_A\mathbf {A}}, {\Lambda }_{D_B\mathbf {B}}} \left\{ K:\Big \Vert U_{D}\left( \Lambda _{D_A\mathbf {A}}\left( \rho ^{\otimes n}_{D_A\mathbf {A}}\right) \otimes {\Lambda }_{D_B\mathbf {B}}\left( {\rho }_{D_B\mathbf {B}}^{\otimes n}\right) \right) U^\dagger _D -\Upsilon _{D\mathbf {AB}}^{nK}\Big \Vert _{1}\le \delta \right\} , \end{aligned}$$

(32)

where $U_{D}$’s are unitary operators acting on the system D. In addition, as seen in the proof of Theorem 3, there exists a unitary operator $\bar{U}_D$ such that

$$\begin{aligned} \bar{U}_D\left( \Upsilon ^{nK}_{D_A\mathbf {A}}\otimes {\Upsilon }^{nK}_{D_B\mathbf {B}} \right) \bar{U}^\dagger _D = \Upsilon ^{nK}_{D\mathbf {AB}}. \end{aligned}$$

(33)

Then it follows from Eq. (33) that

$$\begin{aligned} \Big \Vert \bar{U}_{D}\left( \Lambda _{D_A\mathbf {A}}\left( \rho ^{\otimes n}_{D_A\mathbf {A}}\right) \otimes {\Lambda }_{D_B\mathbf {B}}\left( {\rho }_{D_B\mathbf {B}}^{\otimes n}\right) \right) \bar{U}^\dagger _{D} -\Upsilon _{D\mathbf {AB}}^{nK}\Big \Vert _{1} = \Big \Vert \Lambda _{D_A\mathbf {A}}\left( \rho ^{\otimes n}_{D_A\mathbf {A}}\right) \otimes {\Lambda }_{D_B\mathbf {B}}\left( {\rho }_{D_B\mathbf {B}}^{\otimes n}\right) -\Upsilon ^{nK}_{D_A\mathbf {A}}\otimes {\Upsilon }^{nK}_{D_B\mathbf {B}} \Big \Vert _{1}. \end{aligned}$$

(34)

By the telescoping property of the trace distance^12,13, that is,

$$\begin{aligned} \Vert \sigma _{1}\otimes \sigma _{2}-\tau _{1}\otimes \tau _{2}\Vert _{1} \le \Vert \sigma _{1}-\tau _{1}\Vert _{1}+\Vert \sigma _{2}-\tau _{2}\Vert _{1}, \end{aligned}$$

(35)

we can see that the lower bound on $CR_{\rm D}\left( \rho _{D_A\mathbf {A}}\otimes {\rho }_{D_B\mathbf {B}} \right)$ in Eq. (32) is also lower bounded by

$$\begin{aligned} \lim _{\delta \rightarrow 0}\lim _{n \rightarrow \infty } \sup _{\Lambda _{D_A\mathbf {A}}, \Lambda _{D_B\mathbf {B}}} \left\{ K:\Big \Vert \Lambda _{D_A\mathbf {A}}\left( \rho ^{\otimes n}_{D_A\mathbf {A}}\right) -\Upsilon ^{nK}_{D_A\mathbf {A}} \Big \Vert _{1} \le \frac{\delta }{2}, \Big \Vert {\Lambda }_{D_B\mathbf {B}}\left( {\rho }_{D_B\mathbf {B}}^{\otimes n}\right) -{\Upsilon }^{nK}_{D_B\mathbf {B}} \Big \Vert _{1} \le \frac{\delta }{2}\right\} , \end{aligned}$$

(36)

which is greater than or equal to both $CR_{\mathrm {D}}\left( \rho _{D_A\mathbf {A}}\right)$ and $CR_{\mathrm {D}}\left( \rho _{D_B\mathbf {B}}\right)$. This completes the proof, that is,

$$\begin{aligned} CR_{\mathrm {D}}\left( \rho _{D_A\mathbf {A}}\otimes \rho _{D_B\mathbf {B}} \right) \ge \mathrm {min}\{CR_{\mathrm {D}}\left( \rho _{D_A\mathbf {A}}\right) , CR_{\mathrm {D}}\left( \rho _{D_B\mathbf {B}}\right) \}. \end{aligned}$$

(37)