End-to-end capacities of a quantum communication network

In quantum mechanics, a fundamental law prevents quantum communications to simultaneously achieve high rates and long distances. This limitation is well known for point-to-point protocols, where two parties are directly connected by a quantum channel, but not yet fully understood in protocols with quantum repeaters. Here we solve this problem bounding the ultimate rates for transmitting quantum information, entanglement and secret keys via quantum repeaters. We derive single-letter upper bounds for the end-to-end capacities achievable by the most general (adaptive) protocols of quantum and private communication, from a single repeater chain to an arbitrarily complex quantum network, where systems may be routed through single or multiple paths. We analytically establish these capacities under fundamental noise models, including bosonic loss which is the most important for optical communications. In this way, our results provide the ultimate benchmarks for testing the optimal performance of repeater-assisted quantum communications. The aim of quantum communications is to transmit quantum information at high rate over long distances, something that can only be achieved by quantum repeaters and quantum networks. Here the author presents the ultimate end-to-end capacities of a quantum network, also showing the advantages of multipath network routing versus single repeater chains.

Today quantum technologies are being developed at a rapid pace [1][2][3][4].In this scenario, quantum communications are very advanced, with the development and implementation of a number of point-to-point protocols of quantum key distribution (QKD) [5], based on discrete variable (DV) systems [6][7][8], such as qubits, or continuous variable (CV) systems, such as bosonic modes [9,10].Recently, we have also witnessed the deployment of highrate optical-based secure quantum networks [11,12].These are advantageous not only for their multiple-user architecture but also because they may overcome the fundamental limitations that are associated with point-topoint protocols of quantum and private communication.
After a long series of studies that started back in 2009 with the introduction of the reverse coherent information of a bosonic channel [13,14], Ref. [15] finally showed that the maximum rate at which two remote parties can distribute quantum bits (qubits), entanglement bits (ebits), or secret bits over a lossy channel (e.g., an optical fiber) is equal to − log 2 (1 − η), where η is the channel's transmissivity.This limit is the Pirandola-Laurenza-Ottaviani-Banchi (PLOB) bound [15] and cannot be surpassed even by the most powerful strategies that exploit arbitrary local operations (LOs) assisted by two-way classical communication (CC), also known as adaptive LOCCs [16].
To beat the PLOB bound, we need to insert a quantum repeater [17] in the communication line.In information theory [18][19][20][21], a repeater or relay is any middle node helping the communication between two endparties.This definition is extended to quantum information theory, where quantum repeaters are middle nodes equipped with both classical and quantum operations, and may be arranged to compose linear chains or more general networks.In general, they do not need to have quantum memories (e.g., see Ref. [22]) even though these are required for guaranteeing an optimal performance.
In all the ideal repeater-assisted scenarios, where we can beat the PLOB bound, it is fundamental to determine the maximum rates that are achievable by two end-users, i.e., to determine their end-to-end capacities for transmitting qubits, distributing ebits, and generating secret keys.Finding these capacities not only is important to establish the boundaries of quantum network communications but also to benchmark practical implementations, so as to check how far prototypes of quantum repeaters are from the ultimate theoretical performance.
Here we address this fundamental problem.By combining methods from quantum information theory [6][7][8][9][10] and classical networks [18][19][20][21], we derive tight singleletter upper bounds for the end-to-end quantum and private capacities of repeater chains and, more generally, quantum networks connected by arbitrary quantum channels (these channels and the dimension of the quantum systems they transmit may generally vary across the network).More importantly, we establish exact formulas for these capacities under fundamental noise models for both DV and CV systems, including dephasing, erasure, quantum-limited amplification, and bosonic loss which is the most important for quantum optical communications.Depending on the routing in the quantum network (single-or multi-path), optimal strategies are found by solving the widest path [23][24][25] or the maximum flow problem [26][27][28][29] suitably extended to the quantum communication setting.
Our results and analytical formulas allow one to assess the rate performance of quantum repeaters and quantum communication networks with respect to the ultimate limits imposed by the laws of quantum mechanics.
pleted by outgoing ones.As also depicted in Fig. 1, the chain is connected by N + 1 quantum channels {E i } = {E 0 , . . ., E i , . . ., E N } through which systems are sequentially transmitted.This means that Alice transmits a system to repeater r 1 , which then relays the system to repeater r 2 , and so on, until Bob is reached.
Note that, in general, we may also have opposite directions for some of the quantum channels, so that they transmit systems towards Alice; e.g., we may have a middle relay receiving systems from both Alice and Bob.For this reason, we generally consider the "exchange" of a quantum system between two points by either forward or backward transmission.Under the assistance of two-way CCs, the optimal transmission of quantum information is related to the optimal distribution of entanglement followed by teleportation, so that it does not depend on the physical direction of the quantum channel but rather on the direction of the teleportation protocol.
In a single end-to-end transmission or use of the chain, all the channels are used exactly once.Assume that the end-points aim to share target bits, which may be ebits or private bits [30,31].The most general quantum distribution protocol P chain involves transmissions which are interleaved by adaptive LOCCs among all parties, i.e., LOs assisted by two-way CCs among end-points and repeaters.In other words, before and after each transmission between two nodes, there is a session of LOCCs where all the nodes update and optimize their registers.The chain is connected by N + 1 quantum channels {Ei}.

Alice
After n adaptive uses of the chain, the end-points share an output state ρ n ab with nR n target bits.By optimizing the asymptotic rate lim n R n over all protocols P chain , we define the generic two-way capacity of the chain C({E i }).If the target are ebits, the repeater-assisted capacity C is an entanglement-distribution capacity D 2 .The latter coincides with a quantum capacity Q 2 , because distributing an ebit is equivalent to transmitting a qubit if we assume two-way CCs.If the target are private bits, C is a secret-key capacity K ≥ D 2 (with the inequality holding because ebits are specific private bits).Exact definitions and more details are given in Supplementary Note 1.
To state our upper bound for C({E i }), we introduce the notion of channel simulation, as generally formulated by Ref. [15] (see also Refs.[32][33][34][35][36][37] for variants).Recall that any quantum channel E is simulable by applying a tracepreserving LOCC T to the input state ρ together with some bipartite resource state σ, so that E(ρ) = T (ρ ⊗ σ).The pair (T , σ) represents a possible "LOCC simulation" of the channel.In particular, for channels that suitably commute with the random unitaries of teleportation [4], called "teleportation-covariant" channels [15], one finds that T is teleportation and σ is their Choi matrix σ E := I ⊗ E(Φ), where Φ is a maximally-entangled state.The latter is also known as "teleportation simulation".
For bosonic channels, the Choi matrices are energyunbounded, so that simulations need to be formulated asymptotically.In general, an asymptotic state σ is defined as the limit of a sequence of physical states σ µ , i.e., σ := lim µ σ µ .The simulation of a channel E over an asymptotic state takes the form ||E(ρ)− T (ρ⊗ σ µ )|| 1 µ → 0 where the LOCC T may also depend on µ in the general case [15].Similarly, any relevant functional on the asymptotic state needs to be computed over the defining sequence σ µ before taking the limit for large µ.These technicalities are fully accounted in the Methods section.
The other notion to introduce is that of entanglement cut between Alice and Bob.In the setting of a linear chain, a cut "i" disconnects channel E i between repeaters r i and r i+1 .Such channel can be replaced by a simulation with some resource state σ i .After calculations (see Methods), this allows us to write where E R (•) is the relative entropy of entanglement (REE).Recall that the REE is defined as [38][39][40] E R (σ) = inf γ∈SEP S(σ||γ), where SEP represents the ensemble of separable bipartite states and S(σ||γ) := Tr [σ(log 2 σ − log 2 γ)] is the relative entropy.In general, for any asymptotic state defined by the limit σ := lim µ σ µ , we may extend the previous definition and consider where γ µ is a converging sequence of separable states [15].By minimizing Eq. ( 1) over all cuts, we may write which establishes the ultimate limit for entanglement and key distribution through a repeater chain.For a chain of teleportation-covariant channels, we may use their teleportation simulation over Choi matrices and write Note that the family of teleportation-covariant channels is large, including Pauli channels (at any dimension) [7] and bosonic Gaussian channels [9].Within such a family, there are channels E whose generic two-way capacity C = Q 2 , D 2 or K satisfies where D 1 (σ E ) is the one-way distillable entanglement of the Choi matrix (defined as an asymptotic functional in the bosonic case [15]).These are called "distillable channels" and include bosonic lossy channels, quantumlimited amplifiers, dephasing and erasure channels [15].For a chain of distillable channels, we therefore exactly establish the repeater-assisted capacity as In fact the upper bound (≤) follows from Eqs. (5) and (6).
The lower bound (≥) relies on the fact that an achievable rate for end-to-end entanglement distribution consists in: (i) each pair, r i and r i+1 , exchanging D 1 (σ Ei ) ebits over E i ; and (ii) performing entanglement swapping on the distilled ebits.In this way, at least min i D 1 (σ Ei ) ebits are shared between Alice and Bob.

Lossy chains
Let us specify Eq. ( 7) to an important case.For a chain of quantum repeaters connected by lossy channels with transmissivities {η i }, we find the capacity Thus, the minimum transmissivity within the lossy chain establishes the ultimate rate for repeater-assisted quantum/private communication between the end-users.For instance, consider an optical fiber with transmissivity η and insert N repeaters so that the fiber is split into N +1 lossy channels.The optimal configuration corresponds to equidistant repeaters, so that η min = N +1 √ η and the maximum capacity of the lossy chain is This capacity is plotted in Fig. 2 and compared with the point-to-point PLOB bound C(η) = C loss (η, 0).A simple calculation shows that if we want to guarantee a performance of 1 target bit per use of the chain, then we may tolerate at most 3dB of loss in each individual link.This "3dB rule" imposes a maximum repeater-repeater distance of 15km in standard optical fibre (at 0.2dB/km).

Quantum networks under single-path routing
A quantum communication network can be represented by an undirected finite graph [18] N = (P, E), where P is the set of points and E the set of all edges.Each point p has a local register of quantum systems.Two points p i and p j are connected by an edge (p i , p j ) ∈ E if there is a quantum channel E ij := E pipj between them.By simulating each channel E ij with a resource state σ ij , we simulate the entire network N with a set of (1) (2) (10) (100) n o re p e a te rs FIG.2: Optimal performance of lossy chains.Capacity (target bits per chain use) versus total loss of the line (decibels, dB) for N = 1, 2, 10 and 100 equidistant repeaters.Compare the repeater-assisted capacities (solid curves) with the point-to-point repeater-less bound [15] (dashed curve).Let us remark that the quantum network is here described by an undirected graph where the physical direction of the quantum channels E ij can be forward (p i → p j ) or backward (p j → p i ).As said before for the repeater chains, this degree of freedom relies on the fact that we consider assistance by two-way CC, so that the optimal transmission of qubits can always be reduced to the distillation of ebits followed by teleportation.The logical flow of quantum information is therefore fully determined by the LOs of the points, not by the physical direction of the quantum channel which is used to exchange a quantum system along an edge of the network.This study of an undirected quantum network under twoway CC clearly departs from other investigations [41][42][43].
In a sequential protocol P seq , the network is initialized by a preliminary network LOCC, where all the points communicate with each other via unlimited two-way CCs and perform adaptive LOs on their local quantum systems.With some probability, Alice exchanges a quantum system with repeater p i , followed by a second network LOCC; then repeater p i exchanges a system with repeater p j , followed by a third network LOCC and so on, until Bob is reached through some route in a complete sequential use of the network (see Fig. 4).The routing is itself adaptive in the general case, with each node updating its routing table (probability distribution) on the basis of the feedback received by the other nodes.For large n uses of the network, there is a probability distribution associated with the ensemble Ω, with the generic route ω being used np ω times.Alice and Bob's output state ρ n ab will approximate a target state with nR n bits.By optimizing over P seq and taking the limit of large n, we define the sequential or single-path capacity of the network C(N ), whose nature depends on the target bits.
To state our upper bound, let us first introduce the flow of REE through a cut.Given an entanglement cut C of the network, consider its cut-set C. For each edge (x, y) in C, we have a channel E xy and a corresponding resource state σ xy associated with a simulation.Then we define the single-edge flow of REE across cut C as The minimization of this quantity over all entanglement cuts provides our upper bound for the single-path capacity of the network, i.e., which is the network generalization of Eq. ( 4).For proof see Methods and further details in Supplementary Note 4. In Eq. ( 11), the quantity E R (C) represents the maximum entanglement (as quantified by the REE) "flowing" through a cut.Its minimization over all the cuts bounds the single-path capacity for quantum communication, entanglement distribution and key generation.For a network of teleportation-covariant channels, the resource state σ xy in Eq. ( 10) is the Choi matrix σ Exy of the channel E xy .In particular, for a network of distillable channels, we may also set for any edge (x, y).Therefore, we may refine the previous bound of Eq. ( 11) into C(N ) ≤ min C C(C) where is the maximum (single-edge) capacity of a cut.
Let us now derive a lower bound.First we prove that, for an arbitrary network, min C C(C) = max ω C(ω), where C(ω) := min i C(E ω i ) is the capacity of route ω (see Methods).Then, we observe that C(ω) is an achievable rate.In fact, any two consecutive points on route ω may first communicate at the rate C(E ω i ); the distributed resources are then swapped to the end-users, e.g., via entanglement swapping or key composition at the minimum rate min i C(E ω i ).For a distillable network, this lower bound coincides with the upper bound, so that we exactly establish the single-path capacity as Finding the optimal route ω * corresponds to solving the widest path problem [24] where the weights of the edges (x, y) are the two-way capacities C(E xy ).Route ω * can be found via modified Dijkstra's shortest path algorithm [25], working in time O(|E| log 2 |P |), where |E| is the number of edges and |P | is the number of points.Over route ω * a capacity-achieving protocol is non adaptive, with point-to-point sessions of one-way entanglement distillation followed by entanglement swapping [4].In a practical implementation, the number of distilled ebits can be computed using the methods from Ref. [44].Also note that, because the swapping is on ebits, there is no violation of the Bellman's optimality principle [45].
An important example is an optical lossy network N loss where any route ω is composed of lossy channels with transmissivities {η ω i }.Denote by η ω := min i η ω i the endto-end transmissivity of route ω.The single-path capacity is given by the route with maximum transmissivity In particular, this is the ultimate rate at which the two end-points may generate secret bits per sequential use of the lossy network.

Quantum networks under multi-path routing
In a network we may consider a more powerful routing strategy, where systems are transmitted through a sequence of multipoint communications (interleaved by network LOCCs).In each of these communications, a number M of quantum systems are prepared in a generally multipartite state and simultaneously transmitted to M receiving nodes.For instance, as shown in the example of Fig. 4, Alice may simultaneously sends systems to repeaters p 1 and p 2 , which is denoted by a → {p 1 , p 2 }.Then, repeater p 2 may communicate with repeater p 1 and Bob b, i.e., p 2 → {p 1 , b}.Finally, repeater p 1 may communicate with Bob, i.e., p 1 → b.Note that each edge of the network is used exactly once during the end-to-end transmission, a strategy known as "flooding" in computer networks [46].This is achieved by nonoverlapping multipoint communications, where the receiving repeaters choose unused edges for the next transmissions.More generally, each multipoint communication is assumed to be a point-to-multipoint connection with a logical sender-to-receiver(s) orientation but where the quantum systems may be physically transmitted either forward or backward by the quantum channels.Thus, in a general quantum flooding protocol P flood , the network is initialized by a preliminary network LOCC.Then, Alice a exchanges quantum systems with all her neighbor repeaters a → {p k }.This is followed by another network LOCC.Then, each receiving repeater exchanges systems with its neighbor repeaters through unused edges, and so on.Each multipoint communication is interleaved by network LOCCs and may distribute multi-partite entanglement.Eventually, Bob is reached as an end-point in the first parallel use of the network, which is completed when all Bob's incoming edges have been used exactly once.In the limit of many uses n and optimizing over P flood , we define the multi-path capacity of the network C m (N ).
As before, given an entanglement cut C, consider its cut-set C. For each edge (x, y) in C, there is a channel E xy with a corresponding resource state σ xy .We define the multi-edge flow of REE through C as which is the total entanglement (REE) flowing through a cut.The minimization of this quantity over all entanglement cuts provides our upper bound for the multi-path capacity of the network, i.e., which is the multi-path generalization of Eq. (11).For proof see Methods and further details in Supplementary Note 5.In a teleportation-covariant network we may simply use the Choi matrices σ xy = σ Exy .Then, for a distillable network, we may use E R (σ Exy ) = C(E xy ) from Eq. ( 12), and write the refined upper bound is the total (multi-edge) capacity of a cut.
To show that the upper bound is achievable for a distillable network, we need to determine the optimal flow of qubits from Alice to Bob.First of all, from the knowledge of the capacities C(E xy ), the parties solve a classical problem of maximum flow [26][27][28][29] compatible with those capacities.By using Orlin's algorithm [47], the solution can be found in O(|P | × |E|) time.This provides an optimal orientation for the network and the rates R xy ≤ C(E xy ) to be used.Then, any pair of neighbor points, x and y, distill nR xy ebits via one-way CCs.Such ebits are used to teleport nR xy qubits from x to y according to the optimal orientation.In this way, a number nR of qubits are teleported from Alice to Bob, flowing as quantum information through the network.Using the max-flow min-cut theorem [26][27][28][29][47][48][49][50][51][52][53], we have that the maximum flow is nC m (C min ) where C min is the minimum cut, i.e., C m (C min ) = min C C m (C).Thus, that for a distillable N , we find the multi-path capacity which is the multi-path version of Eq. ( 14).This is achievable by using a non adaptive protocol where the optimal routing is given by Orlin's algorithm [47].
As an example, consider again a lossy optical network N loss whose generic edge (x, y) has transmissivity η xy .Given a cut C, consider its loss and define the total loss of the network as the maximization L N := max C L C .We find that the multi-path capacity is just given by It is interesting to make a direct comparison between the performance of single-and multi-path strategies.For this purpose, consider a diamond network N ♦ loss whose links are lossy channels with the same transmissivity η.In this case, we easily see that the multi-path capacity doubles the single-path capacity of the network, i.e., As expected the parallel use of the quantum network is more powerful than the sequential use.

Formulas for distillable chains and networks
Here we provide explicit analytical formulas for the end-to-end capacities of distillable chains and networks, beyond the lossy case already studied above.In fact, examples of distillable channels are not only lossy channels but also quantum-limited amplifiers, dephasing and erasure channels.First let us recall their explicit definitions and their two-way capacities.
A lossy (pure-loss) channel with transmissivity η ∈ (0, 1) corresponds to a specific phase-insensitive Gaussian channel which transforms input quadratures x = (q, p) T as x → √ ηx + √ 1 − ηx E , where E is the environment in the vacuum state [9].Its two-way capacities (Q 2 , D 2 and K) all coincide and are given by the PLOB bound [15] C A quantum-limited amplifier with an associated gain g > 1 is another phase-insensitive Gaussian channel but realizing the transformation x → √ gx+ √ g − 1x E , where the environment E is in the vacuum state [9].Its two-way capacities all coincide and are given by [15] C A dephasing channel with probability p ≤ 1/2 is a Pauli channel of the form ρ → (1 − p)ρ + pZρZ, where Z is the phase-flip Pauli operator [7].Its two-way capacities all coincide and are given by [15] where Consider now a repeater chain {E i }, where the channels E i are distillable of the same type (e.g., all quantumlimited amplifiers with different gains g i ).The repeaterassisted capacity can be computed by combining Eq. (7) with one of the Eqs.( 22)- (25).The final formulas are shown in the first column of Table I.Then consider a quantum network N = (P, E), where each edge (x, y) ∈ E is described by a distillable channel E xy of the same type.For network N , we may consider both a generic route ω ∈ Ω, with sequence of channels E ω i , and a entanglement cut C, with corresponding cut-set C. By combining Eqs. ( 14) and (19) with Eqs. ( 22)-( 25), we derive explicit formulas for the single-path and multi-path capacities.These are given in the second and third columns of Table I where we set p N := min Let us note that the formulas for dephasing and erasure channels can be easily extended to arbitrary dimension d.In fact, a qudit erasure channel is formally defined as before and its two-way capacities are [15,54,55] Therefore, it is sufficient to multiply by log 2 d the corresponding expressions in Table I.Then, in arbitrary dimension d, the dephasing channel is defined as where p k is the probability of k phase flips and Z k d |i = exp(2πikd −1 ) |i .Its generic two-way capacity is [15] where Here the generalization is also simple.For instance, in a chain {E i } of such d-dimensional dephasing channels, we would have N + 1 distributions {p i k }.We then compute the most entropic distribution, i.e., we take the maximization max i H({p i k }).This is the bottleneck that determines the repeater capacity, so that Generalization to dimension d is also immediate for the two network capacities C and C m .

DISCUSSION
This work establishes the ultimate boundaries of quantum and private communications assisted by repeaters, from the case of a single repeater chain to an arbitrary quantum network under single-or multi-path routing.Assuming arbitrary quantum channels between the nodes, we have shown that the end-to-end capacities are bounded by single-letter quantities based on the relative entropy of entanglement.These upper bounds are very general and also apply to chains and networks with untrusted nodes (i.e., run by an eavesdropper).Our theory is formulated in a general information-theoretic fashion which also applies to other entanglement measures, as discussed in our Methods section.The upper bounds are particularly important because they set the tightest upper limits on the performance of quantum repeaters in various network configurations.For instance, our benchmarks may be used to evaluate performances in relay-assisted QKD protocols such as MDI-QKD and variants [56][57][58].Related literature and other developments [59][60][61][62][63][64][65][66] are discussed in Supplementary Note 6.
For the lower bounds, we have employed classical composition methods of the capacities, either based on the widest path problem or the maximum flow, depending on the type of routing.In general, these simple and classical lower bounds do not coincide with the quantum upper bounds.However this is remarkably the case for distillable networks, for which the ultimate quantum communication performance can be completely reduced to the resolution of classical problems of network information theory.For these networks, widest path and maximum flow determine the quantum performance in terms of secret key generation, entanglement distribution and transmission of quantum information.In this way, we have been able to exactly establish the various end-toend capacities of distillable chains and networks where the quantum systems are affected by the most fundamental noise models, including bosonic loss, which is the most important for optical and telecom communications, quantum-limited amplification, dephasing and erasure.In particular, our results also showed how the parallel or "broadband" use of a lossy quantum network via multipath routing may greatly improve the end-to-end rates.

METHODS
We present the main techniques that are needed to prove the results of our main text.These methods are here provided for a more general entanglement measure E M , and specifically apply to the REE.We consider a quantum network N under single-or multi-path routing.In particular, a chain of quantum repeaters can be treated as a single-route quantum network.
For the upper bounds, our methodology can be broken down in the following steps: (i) Derivation of a general weak converse upper bound in terms of a suitable entanglement measure (in particular, the REE); (ii) Simulation of the quantum network, so that quantum channels are replaced by resource states; (iii) Stretching of the network with respect to an entanglement cut, so that Alice and Bob's shared state has a simple decomposition in terms of resource states; (iv) Data processing, subadditivity over tensor-products, and minimization over entanglement cuts.These steps provide entanglementbased upper bounds for the end-to-end capacities.For the lower bounds, we perform a suitable composition of the point-to-point capacities of the single-link channels by means of the widest path and the maximum flow, de-pending on the routing.For the case of distillable quantum networks (and chains), these lower bounds coincide with the upper bounds expressed in terms of the REE.

General (weak converse) upper bound
This closely follows the derivation of the corresponding point-to-point upper bound first given in the second 2015 arXiv version of Ref. [15] and later reported as Theorem 2 in Ref. [16].Consider an arbitrary end-to-end (n, R ε n , ε) network protocol P (single-or multi-path).This outputs a shared state ρ n ab for Alice and Bob after n uses, which is ε-close to a target private state [30,31] φ n having nR ε n secret bits, i.e., in trace norm we have ||ρ n ab − φ n || 1 ≤ ε.Consider now an entanglement measure E M which is normalized on the target state, i.e., Assume that E M is continuous.This means that, for ddimensional states ρ and σ that are close in trace norm as ρ − σ 1 ≤ ε, we may write with the functions g and h converging to zero in ε.Assume also that E M is monotonic under trace-preserving LOCCs Λ, so that a property which is also known as data processing inequality.Finally, assume that E M is subadditive over tensor products, i.e., All these properties are certainly satisfied by the REE E R and the squashed entanglement (SQ) E SQ , with specific expressions for g and h (e.g., these expressions are explicitly reported in Sec.VIII.A of Ref. [16]).
Using the first two properties (normalization and continuity), we may write where d is the dimension of the target private state.We know that this dimension is at most exponential in the number of uses, i.e., log 2 d ≤ αnR ε n for constant α (e.g., see Ref. [15] or Lemma 1 in Ref. [16]).By replacing this dimensional bound in Eq. (39), taking the limit for large n and small ε (weak converse), we derive Finally, we take the supremum over all protocols P so that we can write our general upper bound for the endto-end secret key capacity (SKC) of the network In particular, this is an upper bound to the single-path SKC K if P are single-path protocols, and to the multipath SKC K m if P are multi-path (flooding) protocols.
In the case of an infinite-dimensional state ρ n ab , the proof can be repeated by introducing a truncation tracepreserving LOCC T , so that δ n ab = T (ρ n ab ) is a finitedimensional state.The proof is repeated for δ n ab and finally we use the data processing E M (δ n ab ) ≤ E M (ρ n ab ) to write the same upper bound as in Eq. ( 41).This follows the same steps of the proof given in the second 2015 arXiv version of Ref. [15] and later reported as Theorem 2 in Ref. [16].It is worth mentioning that Eq. ( 41) can equivalently be proven without using the exponential growth of the private state, i.e., using the steps of the third proof given in the Supplementary Note 3 of Ref. [15].

Network simulation
Given a network N = (P, E) with generic point x ∈ P and edge (x, y) ∈ E, replace the generic channel E xy with a simulation over a resource state σ xy .This means to write E xy (ρ) = T xy (ρ ⊗ σ xy ) for any input state ρ, by resorting to a suitable trace-preserving LOCC T xy (this is always possible for any quantum channel [15]).If we perform this operation for all the edges, we then define the simulation of the network σ(N ) = {σ xy } (x,y)∈E where each channel is replaced by a corresponding resource state.If the channels are bosonic, then the simulation is typically asymptotic of the type for some sequence of simulating LOCCs T µ xy and sequence of resource states σ µ xy .Here the parameter µ is usually connected with the energy of the resource state.For instance, if E xy is a teleportation-covariant bosonic channel, then the resource state σ µ xy is its quasi-Choi matrix σ µ Exy := I ⊗ E xy (Φ µ ), with Φ µ being a two-mode squeezed vacuum state (TMSV) state [9] whose parameter µ = n + 1/2 is related to the mean number n of thermal photons.Similarly, the simulating LOCC T µ xy is a Braunstein-Kimble protocol [67,68] where the ideal Bell detection is replaced by the finite-energy projection onto α-displaced TMSV states D(α)Φ µ D(−α), with D being the phase-space displacement operator [9].
Given an asymptotic simulation of a quantum channel, the associated simulation error is correctly quantified by employing the energy-constrained diamond distance [15], which must go to zero in the limit, i.e., Recall that, for any two bosonic channels E and E ′ , this quantity is defined as where D N is the compact set of bipartite bosonic states with N mean number of photons (see Ref. [69] for a later and slightly different definition, where the constraint is only on the B part).Thus, in general, if the network has bosonic channels, we may write the asymptotic simulation σ(N ) = lim µ σ µ (N ) where σ µ (N ) := {σ µ xy } (x,y)∈E .

Stretching of the network
Once we simulate a network, the next step is its stretching, which is the complete adaptive-to-block simplification of its output state (for the exact details of this procedure see Supplementary Note 3).As a result of stretching, the n-use output state of the generic network protocol can be decomposed as where Λ represents a trace-preserving LOCC (which is local with respect to Alice and Bob).The LOCC Λ includes all the adaptive LOCCs from the original protocol besides the simulating LOCCs.In Eq. ( 44), the parameter n xy is the number of uses of the edge (x, y), that we may always approximate to an integer for large n.We have n xy ≤ n for single-path routing, and n xy = n for flooding protocols in multi-path routing.
In the presence of bosonic channels and asymptotic simulations, we modify Eq. ( 44) into the approximate stretching which tends to the actual output ρ n ab for large µ.In fact, using a "peeling" technique [15,16] which exploits the triangle inequality and the monotonicity of the trace distance under completely-positive trace-preserving maps, we may write the following bound which goes to zero in µ for any finite input energy N , finite number of uses n of the protocol, and finite number of edges |E| in the network (the explicit steps of the proof can be found in Supplementary Note 3).

Stretching with respect to entanglement cuts
The decomposition of the output state can be greatly simplified by introducing cuts in the network.In particular, we may drastically reduce the number of resource states in its representation.Given a cut C of N with cutset C, we may in fact stretch the network with respect to that specific cut (see again Supplementary Note 3 for exact details of the procedure).In this way, we may write where Λab is a trace-preserving LOCC with respect to Alice and Bob (differently from before, this LOCC now depends on the cut C, but we prefer not to complicate the notation).Similarly, in the presence of bosonic channels, we may consider the approximate decomposition which converges in trace distance to ρ n ab (C) for large µ.

Data processing and subadditivity
Let us combine the stretching in Eq. ( 47) with two basic properties of the entanglement measure E M .The first property is the monotonicity of E M under tracepreserving LOCCs; the second property is the subadditivity of E M over tensor-product states.Using these properties, we can simplify the general upper bound of Eq. ( 41) into a simple and computable single-letter quantity.In fact, for any cut C of the network N , we write where Λab has disappeared.Let us introduce the probability of using the generic edge (x, y) so that we may write the limit Using the latter in Eq. ( 41) allows us to write the following bound, for any cut In the case of bosonic channels and asymptotic simulations, we may use the triangle inequality Then, we may repeat the derivations around Eqs. ( 39)-( 41) for ρ n,µ ab instead of ρ n ab , where we also include the use of a suitable truncation of the states via a tracepreserving LOCC T (see also Sec.VIII.D of Ref. [16] for a similar approach in the point-to-point case).This leads to the µ-dependent upper-bound Because this is valid for any µ, we may conservatively take the inferior limit in µ and consider the upper bound Finally, by introducing the stretching of Eq. ( 48) with respect to an entanglement cut C, and using the monotonicity and subadditivity of E M with respect to the decomposition of ρ n,µ ab (C), we may repeat the previous reasonings and write which is a direct extension of the bound in Eq. ( 53).We may formulate both Eqs. ( 53) and ( 57) in a compact way if we define the entanglement measure E M over an asymptotic state σ := lim µ σ µ as It is clear that, for a physical (non-asymptotic) state, we have the trivial sequence σ µ = σ for any µ, so that Eq. ( 58) provides the standard definition.In the specific case of REE, we may write where γ µ is a sequence of separable states that converges in trace norm; this means that there exists a separable state γ such that ||γ µ −γ|| 1 µ → 0. Employing the extended definition of Eq. ( 58), we may write Eq. ( 53) for both nonasymptotic σ xy and asymptotic states σ xy := lim µ σ µ xy .

Minimum entanglement cut and upper bounds
By minimizing Eq. ( 53) over all possible cuts of the network, we find the tightest upper bound, i.e., Let us now specify this formula for different types of routing.For single-path routing, we have p xy ≤ 1, so that we may use in Eq. ( 53).Therefore, we derive the following upper bound for the single-path SKC where we introduce the single-edge flow of entanglement through the cut In particular, we may specify this result to a single chain of N points and N + 1 channels {E i } with resource states {σ i }.This is a quantum network with a single route, so that the cuts can be labelled by i and the cut-sets are just composed of a single edge.Therefore, Eqs. ( 62) and ( 63) become For multi-path routing, we have p xy = 1 (flooding), so that we may simplify (65) in Eq. (53).Therefore, we can write the following upper bound for the multi-path SKC where we introduce the multi-edge flow of entanglement through the cut In these results, the definition of E M (σ xy ) is implicitly meant to be extended to asymptotic states, according to Eq. ( 58).Then, note that the tightest values of the upper bounds are achieved by extending the minimization to all network simulations σ(N ), i.e., by enforcing min C → min σ(N ) min C in Eqs. ( 62) and (66).Specifying Eqs. ( 62), (64), and (66) to the REE, we get the single-letter upper bounds which are Eqs.( 4), ( 11) and ( 17) of the main text.The proofs of these upper bounds in terms of the REE can equivalently be done following the "converse part" derivations in Supplementary Note 1 (for chains), Supplementary Note 4 (for networks under single-path routing), and Supplementary Note 5 (for networks under multi-path routing).Differently from what presented in this Methods section, such proofs exploit the lower semi-continuity of the quantum relative entropy [8] in order to deal with asymptotic simulations (e.g. for bosonic channels).

Lower bounds
To derive lower bounds we combine the known results on two-way assisted capacities [15] with classical results in network information theory.Consider the generic twoway assisted capacity C xy of the channel E xy (in particular, this can be either D 2 = Q 2 or K).Then, using the cut property of the widest path (Supplementary Note 4), we derive the following achievable rate for the generic single-path capacity of the network N For a chain {E i }, this simply specifies to Using the classical max-flow min-cut theorem (Supplementary Note 5), we derive the following achievable rate for the generic multi-path capacity of Simplifications for teleportation-covariant and distillable networks Recall that a quantum channel E is said to be teleportation-covariant [15] when, for any teleportation unitary U (Weyl-Pauli operator in finite dimension or phase-space displacement in infinite dimension), we have for some (generally-different) unitary transformation V .In this case the quantum channel can be simulated by applying teleportation over its Choi matrix σ E := I ⊗ E(Φ), where Φ is a maximally-entangled state.Similarly, if the teleportation-covariant channel is bosonic, we can write an approximate simulation by teleporting over the quasi-Choi matrix σ µ E := I ⊗E(Φ µ ), where Φ µ is a TMSV state.For a network of teleportation-covariant channels, we therefore use teleportation to simulate the network, so that the resource states in the upper bounds of Eqs. ( 68)-(70) are Choi matrices (physical or asymptotic).In other words, we write the sandwich relations with the REE taking the form of Eq. ( 59) on an asymptotic Choi matrix σ Exy := lim µ σ µ Exy .As a specific case, consider a quantum channel which is not only teleportation-covariant but also distillable, so that it satisfies [15] C where D 1 (σ E ) is the one-way distillability of the Choi matrix σ E (with a suitable asymptotic expression for bosonic Choi matrices [15]).If a network (or a chain) is composed of these channels, then the relations in Eqs. ( 75)-( 77) collapse and we fully determine the capacities These capacities correspond to Eqs. ( 7), (14), and (19) of the main text.They are explicitly computed for chains and networks composed of lossy channels, quantumlimited amplifiers, dephasing and erasure channels in Table I of the main text.

Regularizations and other measures
It is worth noticing that some of the previous formulas can be re-formulated by using the regularization of the entanglement measure, i.e., In fact, let us go back to the first upper bound in Eq. ( 49), which implies For a network under multi-path routing we have n xy = n, so that we may write By repeating previous steps, the latter equation implies the upper bound which is generally tighter than the result in Eqs.(66) and (67).The same regularization can be written for a chain {E i }, which can also be seen as a single-route network satisfying the flooding condition n xy = n.Therefore, starting from the condition of Eq. ( 83) with n xy = n, we may write which is generally tighter than the result in Eq. ( 64).These regularizations are important for the REE, but not for the squashed entanglement which is known to be additive over tensor-products, so that E ∞ SQ (σ) = E SQ (σ).Another extension is related to the use of the relative entropy distance with respect to partial-positivetranspose (PPT) states.This quantity can be denoted by RPPT and is defined by [31] with an asymptotic extension similar to Eq. ( 59) but in terms of converging sequences of PPT states γ µ .The RPPT is tighter than the REE but does not provide an upper bound to the distillable key of a state, but rather to its distillable entanglement.This means that it has normalization E P (φ n ) ≥ nR n on a target maximallyentangled state φ n with nR n ebits.
The RPPT is known to be monotonic under the action of PPT operations (and therefore LOCCs); it is continuous and subadditive over tensor-product states.Therefore, we may repeat the derivation that leads to Eq. ( 41) but with respect to protocols P of entanglement distribution.This means that we can write Using the decomposition of the output state ρ n ab as in Eqs. ( 47) and (48), and repeating previous steps, we may finally write for a chain {E i } with resource states {σ i }, and for the single-and multi-path entanglement distribution capacities of a quantum network N with resource states σ(N ) = {σ xy } (x,y)∈E .
Consider Alice and Bob to be end-points of a chain of N + 2 points with N repeaters in the middle.For i = 0, . . ., N we assume that point i is connected with point i + 1 by a quantum channel E i which can be forward or backward, for a total of N + 1 channels {E 0 , . . .E i , . . .E N }.Each point has a local register which is a countable ensemble of quantum systems, denoted by r i for the i-th point.In particular, we set a = r 0 for Alice and b = r N +1 for Bob.Registers are updated.For instance, if Alice sends a system a, then we update a → aa; if Bob receives a system b, then we update bb → b.For this formalism see also Ref. [S1].The channels are completely arbitrary even though our following formulas will simplify for teleportation-covariant channels, and the sub-class of distillable channels (see Ref. [S1] or the main paper for the exact definitions of these channels).
The most general distribution protocol over the chain is based on adaptive LOs and unlimited two-way CC involving all the points in the chain.In other words, each point broadcasts classical information and receives classical feedback from all the other points, which is used to perform conditional LOs on the local registers.In the following we always assume these "network" adaptive LOCCs, unless we specify otherwise.The first step is the preparation of the registers by an LOCC Λ 0 whose application to some fundamental state provides an initial separable state σ ar1•••rN b .Then, Alice and the first repeater exchange a quantum system through channel E 0 (via forward or backward transmission).This is followed by an LOCC Λ 1 on the updated registers ar 1 r 2 . . .r N b.Next, the first and the second repeaters exchange another quantum system through channel E 1 followed by another LOCC Λ 2 , and so on.Finally, Bob exchanges a system with the N th repeater through channel E N and the final LOCC Λ N +1 provides the output state This procedure completes the first use of the chain.In the second use, the initial state is the (non-separable) output state of the first round The protocol goes as before with each pair of points i and i + 1 exchanging one system between two LOCCs.The second use ends with the output state ρ 2 which is the input for the third use and so on.After n uses, the points share an output state ρ n ar1•••rN b .By tracing out the repeaters, we get Alice and Bob's final state ρ n ab , which depends on the sequence of LOCCs In general, in each use of the chain, the order of the transmissions can also be permuted.Both the order of these transmissions and the sequence of LOCCs L defines the adaptive protocol P chain generating the output ρ n ab .See Fig. S1 for an example.In particular, here we show two uses of the chain, with total output state ρ 2 arb .Note that, if the parties want to distribute ebits or private bits, they may also use a different order of transmissions in each use.For instance, in the first use, the first transmission could be between the repeater r and Bob b, followed by that between Alice a and the repeater r.The order of the transmissions and the sequence of LOCCs defines the adaptive protocol P over the chain.
We say that an adaptive protocol where φ n is a target state with nR ε n bits.By taking the limit of n → +∞, ε → 0 (weak converse), and optimizing over P chain , we define the generic two-way capacity of the chain, i.e., C({E i }) := sup This capacity has different nature depending on the task of the distribution protocol.For QKD, the target state is a private state [S2] with secret key rate R ε,key n (bits per chain use).In this case C({E i }) is the secret key capacity of the chain K({E i }).Under two-way CCs, this is also equal to the maximum rate at which Alice can deterministically send a secret message to Bob through the chain, i.e., its two-way private capacity P 2 ({E i }).For entanglement distribution (ED), the target state is a maximallyentangled state with rate Under twoway CCs, D 2 is equal to the maximum rate at which Alice can reliably send a qubits to Bob through the chain, i.e., its two-way quantum capacity Q 2 ({E i }).
We can build an upper bound for all the previous capacities, i.e., for the generic C({E i }).In fact, as shown in the Methods section of our manuscript, we may write the following weak converse bound in terms of the relative entropy of entanglement (REE) Recall that the REE is defined as where SEP is the set of separable bipartite states and S(σ||γ) := Tr [σ(log 2 σ − log 2 γ)] is the relative entropy.
In general, for an asymptotic state σ := lim µ σ µ , we may extend the previous definition and consider where γ µ is a converging sequence of separable states [S1], so that there is a separable γ such that ||γ µ − γ|| 1 µ → 0. Both the definitions in Eqs. ( 93) and (94) can be regularized, so that we have In order to reduce the latter bound to a single-letter quantity we simulate the chain, by replacing each channel E i with a simulation S i = (T i , σ i ) for some LOCC T i and resource state σ i .The next step is to use teleportation stretching [S1] to re-organize the adaptive protocol into a block version, where the output state is expressed in terms of a tensor product of resource states.A direct application of this procedure will allow us to write for a trace-preserving LOCC Λab (this reduction is proven afterwards).By using Eq. ( 95), we may then write Unfortunately, this bound is too large.To improve it, we need to perform cuts of the chain, such that Alice and Bob end up to be disconnected.In a linear chain, the situation is particularly simple, because any cut disconnects the two end-points.The refined procedure consists of cutting channel E i , stretching the protocol with respect to that channel and finally minimizing over all cuts.Let us start with the formal definition of cut of a chain.
By performing entanglement cuts in the chain, we may state the following result which correctly extends teleportation stretching to chains of quantum repeaters.
Lemma 2 (Chain stretching) Consider a chain of N repeaters as in Definition 1.Given an arbitrary entanglement cut i, consider the disconnected channel E i and its simulation via a resource state σ i .For any such cut i = 0, . . ., N the output of the most general adaptive protocol P chain over n uses of the chain can be decomposed as where Λi is a trace-preserving LOCC.In particular, for a chain of teleportation-covariant channels, we may write Eq. ( 97) using the Choi-matrices σ Ei (with asymptotic formulations for bosonic channels).
Proof.For simplicity let us start with the simple case of a 3-point chain (N = 1), where Alice a and Bob b are connected with a middle repeater r by means of two channels E and E ′ as in Fig. S1 (the direction of the channels may be different as well as the order in which they are used).Assume two adaptive uses of the chain (n = 2) starting from a fundamental state ρ 0 a ⊗ ρ 0 r ⊗ ρ 0 b .As depicted in Fig. S2, we replace each channel with a corresponding simulation: E → (T , σ) and E ′ → (T ′ , σ ′ ).Then, the resource states are stretched back in time before the LOCCs which are all collapsed into a single LOCC Λ (trace-preserving after averaging over all measurements).After two uses of the repeater we have the output state ρ 2 arb = Λ σ ⊗2 ⊗ σ ′⊗2 .By tracing the repeater r, we derive ρ 2 ab = Λab σ ⊗2 ⊗ σ ′⊗2 up to redefining the LOCC.By extending the procedure to an arbitrary number of repeaters N and uses n, we get and tracing out all the repeaters, we derive Eq. (95).Therefore, thanks to teleportation stretching, the quantum transmissions between each pair of nearneighbor points have been replaced with tensor-products of resource states, followed by a single but complicated trace-preserving LOCC.In this reduction, the resource states are responsible for distributing entanglement between the points of the chain.In order to get tight upper bounds we need to perform entanglement cuts.
Let us perform a cut "i" of the chain, so that channel E i is disconnected between r i and r i+1 .This cut can be done directly on the stretched chain as in Fig. S3.This cut defines super-Alice A and super-Bob B. Now, let us include all the resource states σ ⊗n k with k < i in the LOs of super-Alice, and all the resource states with k > i+1 in the LOs of super-Bob.This operation has two outcomes: (i) it defines a novel trace-preserving LOCC Λi which is local with respect to the super-parties; and (ii) it leaves with a reduced number of resource states σ ⊗n i , i.e., only those associated with the cut.For the superparties, we may write ρ n AB = Λi AB (σ ⊗n i ).By tracing out all the middle repeaters r 1 r 2 . . .r N , the resulting LOCC Λi remains local with respect to a and b, and we get the end-to-end output ρ n ab as in Eq. (97), for any cut i.The extension of the proof to bosonic channels exploits asymptotic simulations.For each channel E i in the chain we may consider its approximation E µ i with simulation (T µ i , σ µ i ).This leads to the output state ρ n,µ ab = Λµ i (σ µ⊗n i ) for a trace-preserving LOCC Λµ i .Since E i is the pointwise limit of E µ i for large µ, if we consider the energyconstrained diamond distance ε i N := E i − E µ i ⋄ N , we have ε i N → 0 for any energy (mean number of photons) N and cut i (see Ref. [S1, Eq. ( 98)] or the Methods section of the main manuscript for the definition of this distance).By directly extending a "peeling" argument given in Ref. [S1, Eq. ( 103)], we easily show that the trace-distance between the actual output ρ n ab and the simulated one ρ n,µ ab is controlled as follows Clearly, this distance goes to zero in µ, for any number of uses n, number of repeaters N and energy N .In other words, given an arbitrary cut i we have or, more compactly, for any number of uses n, repeaters N , and energy N .By using the previous lemma, we can now prove the following result which establishes a single-letter REE upper bound for the generic two-way capacity C({E i }) of a chain of quantum repeaters.This is a bound for the maximal rates for entanglement distribution (D 2 ), quantum communication (Q 2 ), secret key generation (K) and private communication (P 2 ) through the repeater chain.The formula simplifies for a teleportation-covariant chain and even more for a distillable chain, for which the repeaterassisted capacity is found to be the minimum among the two-way capacities of the individual distillable channels.
Theorem 3 (Single-letter REE bound) Consider a chain of N repeaters as in Definition 1.The generic two-way capacity of the chain must satisfy the following minimization over the entanglement cuts where σ i is the resource state of an arbitrary LOCC simulation of E i .For a chain of teleportation-covariant channels (e.g.Pauli, Gaussian channels), we may write the bound in terms of their Choi matrices, i.e., where the REE is intended to be asymptotic for bosonic channels.In particular, for a chain of distillable channels (e.g., lossy channels, quantum-limited amplifiers, dephasing and erasure channels), we establish the capacity as where C(E i ) are the individual two-way capacities associated with each distillable channel E i in the chain.In this case, we also have C({E i }) = min i D 1 (σ Ei ), so that the capacity may be achieved by using one-way entanglement distillation followed by entanglement swapping.
Proof.For an arbitrary chain, perform the stretching of the protocol for any entanglement cut i, so that we may write Eq. (97).Because the REE is non-decreasing under trace-preserving LOCCs, we get E R (ρ n ab ) ≤ E R (σ ⊗n i ).By replacing the latter inequality in the general weak converse bound of Eq. (92), we may drop the supremum over the protocols P chain and derive the following bound in terms of the regularized REE of the resource state By minimizing over all the entanglement cuts, we get where the last inequality is due to the subadditivity of the REE over tensor-product states.
For teleportation-covariant channels, we may set σ i = σ Ei [S1], so that Eq. (103) holds.Then, for distillable channels, we have [S1] It is clear that min i D 1 (σ Ei ) is also an achievable lower bound so that it provides the capacity and we may also write Eq. (104).In fact, in the ith point-to-point connection, points r i and r i+1 may distill D 1 (σ Ei ) ebits via one-way CCs.After this is done in all the connections, sessions of entanglement swapping will transfer at least min i D 1 (σ Ei ) ebits to the end points.
To extend the result to bosonic channels with asymptotic simulations, we adopt a weaker definition of REE as given in Eq. ( 94).Consider the asymptotic stretching of the output state ρ n ab as in Eq. ( 100) which holds for any number of uses n, repeaters N , and energy N .Then, for any cut i, the simplification of the REE bound E R (ρ n ab ) goes as follows ≤ inf ≤ inf ≤ inf where: (1) γ µ is a generic sequence of separable states converging in trace norm, i.e., such that there is a separable state γ := lim µ γ µ so that γ − γ µ µ → 0; (2) we use the lower semi-continuity of the relative entropy [S6]; (3) we use that Λµ i (γ µ ) are specific types of converging separable sequences within the set of all such sequences; (4) we use the monotonicity of the relative entropy under trace-preserving LOCCs; and (5) we use the regularized definition of REE for asymptotic states.
For any energy N , we may apply the general weak converse bound of Eq. ( 92), so that we may again write Eq. ( 105) in terms of the regularized REE E ∞ R (σ i ).Since this upper bound does no longer depend on the protocols P chain , it applies to both energy-constrained and energy-unconstrained registers (i.e., we may relax the constraint N ).The proof of the further condition ) is based on the subadditivity of the REE over tensor product states, which holds for asymptotic states too [S1].Thus, the minimization over the cuts provides again Eq. ( 106).The remaining steps of the proof for teleportation and distillable channels are trivially extended to asymptotic simulations.In particular, one can define an asymptotic notion of one-way distillable entanglement D 1 for an unbounded Choi matrix as explained in Ref. [S1].

Capacities for distillable chains
Let us specify our results for various types of distillable chains.Let us start by considering a lossy chain, where Alice and Bob are connected by N repeaters and each connection E i is a lossy (pure-loss) channel with transmissivity η i .By combining Eq. (104) of Theorem 3 with the PLOB bound C(η i ) = − log 2 (1−η i ) [S1], we find that the capacity of the lossy chain is given by where η min := min i η i .Therefore, no matter how many repeaters we use, the minimum transmissivity in the chain fully determines the ultimate rate of quantum or private communication between the two end-points.Suppose that we require a minimum performance of 1 bit per use of the chain (this could be 1 secret bit or 1 ebit or 1 qubit).From Eq. ( 108), we see that we need to ensure at least η min = 1/2, which means at most 3dB of loss in each link.This "3dB rule" implies that 1 bit rate communication can occur in chains whose maximum point-to-point distance is 15km (assuming fiber connections at the loss rate of 0.2dB/km).
Consider now an amplifying chain, i.e., a chain connected by quantum-limited amplifiers with gains {g i }.Using Eq. (104) and , we find that the repeater-assisted capacity is fully determined by the highest gain g max := max i g i , so that In the DV setting, start with a spin chain where the state transfer between the ith spin and the next one is modeled by a dephasing channel with probability p i ≤ 1/2.Using Eq. (104) and C(p i ) = 1 − H 2 (p i ) [S1], we find the repeater-assisted capacity where p max := max i p i is the maximum probability of phase flipping in the chain, and H 2 is the binary Shannon entropy.When the spins are connected by erasure channels with probabilities {p i }, we combine Eq. (104) and . Therefore we derive where p max is the maximum probability of an erasure.Note that the latter results for the spin chains can be readily extended from qubits to qudits of arbitrary dimension d, by using the corresponding two-way capacities proven in Ref. [S1].See Table I of the main paper for a schematic representations of these formulas.Finally, note that Eq. (104) of Theorem 3 may be applied to hybrid distillable chains, where channels are distillable but of different kind between each pair of repeaters, e.g., we might have erasure channels alternated with dephasing channels or lossy channels, etc.

Quantum repeaters in optical communications
Let us discuss in more detail the use of quantum repeaters in the bosonic setting.Suppose that we are given a long communication line with transmissivity η, such as an optical/telecom fiber.A cut of this line generates two lossy channels with transmissivities η ′ and η ′′ such that η = η ′ η ′′ .Suppose that we are also given a number N of repeaters that we could potentially insert along the line.The question is: What is the optimal way to cut the line and insert the repeaters?
From the formula in Eq. ( 108), we can immediately see that the optimal solution is to insert N equidistant repeaters, so that the resulting N + 1 lossy channels have identical transmissivities This leads to the maximum repeater-assisted capacity This capacity has been plotted in Fig. 2 of the main text for increasing number of repeaters N as a function of the total loss of the line, which is expressed in decibel (dB) by η dB := −10 log 10 η.In particular, we compare the repeater-assisted capacity with the point-to-point benchmark, i.e., the maximum performance achievable in the absence of repeaters (PLOB bound [S1]).
Let us study two opposite regimes that we may call repeater-dominant and loss-dominant.In the former, we fix the total transmissivity η of the line and use many equidistant repeaters N ≫ 1.We then have which means that the capacity scales logarithmically in the number of repeaters, independently from the loss.In the second regime (loss-dominant), we fix the number of repeaters N and we consider high loss η ≃ 0, in such a way that each link of the chain is very lossy, i.e., we may set N +1 √ η ≃ 0. We then find which is also equal to N +1 √ η nats per use.This is the fundamental rate-loss scaling which affects long-distance repeater-assisted quantum optical communications.
In the bosonic setting, it is interesting to compare the use of quantum repeaters with the performance of a multi-band communication, where Alice and Bob can exploit a communication line which is composed of M parallel and independent lossy channels with identical transmissivity η.For instance, M can be interpreted as the frequency bandwidth of a multimode optical fiber.The capacity of a multiband lossy channel is given by [S1] Using Eqs. ( 113) and (116) we may compare the use of N equidistant repeaters with the use of M bands.In Fig. S4, we clearly see that multiband quantum communication provides an additive effect on the capacity which is very useful at short-intermediate distances.However, at long distances, this solution is clearly limited by the same rate-loss scaling which affects the single-band quantum channel (point-to-point benchmark) and, therefore, it cannot compete with the long-distance performance of repeater-assisted quantum communication.FIG.S4: Capacity (bits per use) versus distance (km) assuming the standard loss rate of 0.2 dB/km.We compare the use of repeaters (N = 1, 2) with that of a point-to-point multiband communication (for M = 10, 100, and 1000 bands or parallel channels).Dashed line is the point-to-point benchmark (single-band, no repeaters).We see how the multiband strategy increases the capacity in an additive way but it clearly suffers from a poor long-distance rate-loss scaling with respect to the use of quantum repeaters.

Multiband repeater chains
In general, the most powerful approach consists of relaying multiband quantum communication, i.e., combining multiband channels with quantum repeaters.In this regard, let us first discuss how Theorem 3 can be easily extended to repeater chains which are connected by multiband quantum channels.Then, we describe the performances in the bosonic setting.
Consider a multiband channel E band which is composed of M independent channels (or bands) E k , i.e., Assume that each band E k can be LOCC-simulated with some resource state σ k .From Ref. [S1] and the subadditivity of the REE, we may write the following bound for its two-way capacity A multiband channel E band is said to be teleportationcovariant (distillable) if all its components E k are teleportation-covariant (distillable).
In a distillable E band , for each band E k we may write where σ E k is its Choi matrix (with suitable asymptotic description in the bosonic case).Then, it is straightforward to prove that [S1] Similarly, we can extend Theorem 3. Consider an adaptive protocol over a repeater chain connected by multiband channels {E band i }.We can define a corresponding two-way capacity for the multiband chain C({E band i }) and derive the upper bound For a distillable multiband chain, we then have In the bosonic setting, consider a chain of N quantum repeaters with N + 1 channels {E i }, where E i is a multiband lossy channel with M i bands and constant transmissivity η i (over the bands).The two-way capacity of the ith link is therefore given by C loss (η i , M i ) as specified by Eq. (116).Because multiband lossy channels are distillable, we can apply Eq. ( 121) and derive the following repeater-assisted capacity of the multiband lossy chain As before, it is interesting to discuss the symmetric scenario where the N repeaters are equidistant, so that entire communication line is split into N + 1 links of the same optical length.Each link "i" is therefore associated with a multiband lossy channel, with bandwidth M i and constant transmissivity η i = N +1 √ η (equal for all its bands).In this case, we have θ max = (1− N +1 √ η) min i Mi in previous Eq.(122).In other words, the repeater-assisted capacity of the chain becomes where M min := min i M i is the minimum bandwidth along the line, as intuitively expected.
In general, the capacity is determined by an interplay between transmissivity and bandwidth of each link.This is particularly evident in the regime of high loss.By setting η i ≃ 0 in Eq. (122), we in fact derive where the constant c is equal to 1.44 bits or 1 nat.

SUPPLEMENTARY NOTE 2: QUANTUM NETWORKS
We now consider the general case of a quantum network, where two end-users are connected by an arbitrary ensemble of routes through intermediate points or repeaters.Our analysis combines tools from quantum information theory (in particular, the generalization of the tools developed in Ref. [S1], needed for the converse part) and elements from classical network information theory (necessary for the achievability part).In this section, we start by introducing the main adaptive protocols based on sequential (single-path) or parallel (multi-path) routing of quantum systems.We also give the corresponding definitions of network capacities.Then, in Supplementary Note 3, we will show how to simulate and "stretch" quantum networks, so that the output of an adaptive protocol is completely simplified into a decomposition of tensor-product states.This tool will be exploited to derive single-letter REE upper bounds in the subsequent sections.In particular, in Supplementary Note 4 we will present the results for single-path routing, while in Supplementary Note 5 we will present results for multi-path routing.The upper bounds will be combined with suitable lower bounds, and exact formulas will be established for quantum networks connected by distillable channels.

Notation and general definitions
Consider a quantum communication network N whose points are connected by memoryless quantum channels.The quantum network can be represented as an undirected finite graph [S7] N = (P, E) where P is the finite set of points of the network, also known as vertices, and E is the set of all connections, also known as edges (without loss of generality, the graph may be considered to be acyclic).Every point x ∈ P has a local register of quantum systems x to be used for the quantum communication.To simplify notation, we identify a point with its local register x = x.Two points x, y ∈ P are connected by an undirected edge (x, y) ∈ E if there is a memoryless quantum channel E xy between x and y, which may be forward E x→y or backward E y→x .
In general, there may be multiple edges between two points, with each edge representing an independent quantum channel.For instance, two undirected edges between x and y represent two channels E xy ⊗ E ′ xy and these may be associated with a double-band quantum communication (in one of the two directions) or a two-way quantum communication (forward and backward channels).While we allow for the possibility of multiple edges in the graph (so that it is more generally a multi-graph) we may also collapse multiple edges into a single edges to simplify the complexity of the network and therefore notation.
In the following, we also use the labeled notation p i for the generic point of the graphical network, so that two points p i and p j are connected by an edge if there is a quantum channel E ij := E pipj .We also adopt the specific notation a and b for the two end-points, Alice and Bob.An end-to-end route is an undirected path between Alice and Bob, which is specified by a sequence of edges {(a, p i ), • • • , (p j , b)}, simply denoted as a−p i − • • • − p j − b.This may be interpreted as a linear chain of N repeaters between Alice and Bob, connected by a sequence of N + 1 channels {E k }, i.e., where the same repeater may appear at different positions (in particular, this occurs when the route is not a simple path, so that there are cycles).
In general, the two end-points may transmit quantum systems through an ensemble of routes Ω = {1, . . ., ω, . ..}.Note that this ensemble is generally large but can always be made finite in a finite network, by just reducing the routes to be simple paths, void of cycles (without losing generality).Different routes ω and ω ′ may have collisions, i.e., repeaters and channels in common.Generic route ω involves the transmission through N ω + 1 channels {E ω 0 , . . ., E ω k , . . ., E ω Nω }.In general, we assume that each quantum transmission through each channel is alternated with network LOCCs: These are defined as adaptive LOs performed by all points of the network on their local registers, which are assisted by unlimited two-way CC involving the entire network.Finally, we consider two possible fundamental strategies for routing the systems through the network: Sequential or parallel.In a sequential or single-path routing, quantum systems are transmitted from Alice to Bob through a single route for each use of the network.This process is generally stochastic, so that route ω is chosen with some probability p ω .By contrast, in a parallel or multi-path routing, systems are simultaneously transmitted through multiple routes for each use of the network.This may be seen as a "broadband use" of the quantum network.We now explain these two strategies in detail.

Sequential (single-path) routing
The most general network protocol for sequential quantum communication involves the use of generallydifferent routes, accessed one after the other.The network is initialized by means of a first LOCC Λ 0 which prepares an initial separable state.With probability π 1 0 , Alice a exchanges one system with repeater p i .This is followed by another LOCC Λ 1 .Next, with probability π 1  1 , repeater p i exchanges one system with repeater p j and so on.Finally, with probability π 1 N1 , repeater p k exchanges one system with Bob b, followed by a final LOCC Λ N1+1 .Thus, with probability p 1 = Π i π 1 i , the end-points exchange one system which has undergone N 1 + 1 transmissions {E 1  i } along the first route.Let us remark that the various probabilities π 1 i are more precisely conditional probabilities, so that each repeater generally updates its probability distribution on the basis of the previous steps and the CCs received from all the other repeaters.
The next uses may involve different routes.After many uses n, the random process defines a sequential routing table R = {ω, p ω }, where route ω is picked with probability p ω and involves N ω + 1 transmissions {E ω i }.Thus, we have a total of N tot = Σ ω np ω (N ω + 1) transmissions and a sequence of LOCCs L = {Λ 0 , . . ., Λ Ntot }, whose output provides Alice and Bob's final state ρ n ab .Note that we may weaken the previous description: While maintaining the sequential use of the routes, in each route we may permute the order of the transmissions (as before for the case of a linear chain of repeaters).
The sequential network protocol P seq is characterized by R and L, and its average rate is R ε n if ρ n ab − φ n 1 ≤ ε, where φ n is a target state of nR ε n bits.By taking the asymptotic rate for large n, small ε (weak converse), and optimizing over all the sequential protocols, we define the sequential or single-path capacity of the network The capacity C(N ) provides the maximum number of (quantum, entanglement, or secret) bits which are distributed per sequential use of the network or single-path transmission.In particular, by specifying the target state, we define the corresponding network capacities for quantum communication, entanglement distillation, key generation and private communication, which satisfy It is important to note that the sequential use is the best practical strategy when Alice and the other points of the network aim to optimize the use of their quantum resources.In fact, C(N ) can also be expressed as maximum number of target bits per quantum system routed.Assuming that the points have deterministic control on the routing, they can adaptively select the best routes based on the CCs received by the other repeaters.Under such hypothesis, they can optimize the protocol on the fly and adapt the routing table so that it converges to the use of an optimal route ω * .See Fig. S5 for an example of sequential use of a simple network.In a diamond network with four points p0 = a, p1, p2, and p3 = b, we may identify four basic routes ω = 1, 2, 3, 4 (see list on the right).These are simple paths between Alice and Bob with the middle points p1 and p2 acting as quantum repeaters in different succession.For instance, p1 is the first repeater in route 3 and the second repeater in route 4. Note that we may consider further routes by including loops between p1 and p2.These other solutions are non-simple paths that we may discard without losing generality.

Parallel (multi-path) routing
Here we consider a different situation where Alice, Bob and the other points of the network do not have restrictions or costs associated with the use of their quantum resources, so that they can optimize the use of the quantum network without worrying if some of their quantum systems are inefficiently transmitted or even lost (this may be the practical scenario of many optical implementations, e.g., based on cheap resources like coherent states).In such a case, the optimal use of the quantum network is parallel or broadband, meaning that the quantum systems are simultaneously routed through multiple paths each time the quantum network is accessed.
In a parallel network protocol, Alice sends quantum systems to all repeaters she has a connection with.Such a simultaneous transmission to her "neighbor" repeaters can be denoted by a → {p k } and may be called "multipoint (quantum) communication".In turn, each of the receiving repeaters sends quantum systems to another set of neighbor repeaters p k → {p j } and so on, until Bob b is reached as an end-point.This is done in such a way that each multipoint communication occurs between two network LOCCs, and different multipoint communications do not overlap, so that all edges of the network are used exactly once at the end of each end-to-end transmission.This condition is assured by imposing that new multpoint communications may only involve unused edges, a strategy commonly known as "flooding" [S8].
In general, each multipoint communication must be intended in a weaker sense as a point-to-multipoint connection where quantum systems may be exchanged through forward or backward transmissions, following different physical directions of the available quantum channels.Independently from these physical directions, we may always assign a common sender-receiver direction to all the edges involved in the process, so that there will be a logical sender-receiver orientation associated with the multipoint communication.For this reason, the notation a → {p k } must be generally interpreted as a process where Alice "connects to" repeaters {p k }.As a result of these multiple connection, Alice may share ebits or secret bits with each of the receivers, or she may teleport qubits to each of them (independently from the actual physical direction of the quantum channels).
To better explain this broadband use, let us formalize the notion of orientation.Recall that a directed edge is an ordered pair (x, y), where the initial vertex x is called "tail" and the terminal vertex y is called "head".Let us transform the undirected graph of the network N = (P, E) into a directed graph by randomly choosing a direction for all the edges, while keeping Alice as tail and Bob as head.The goal is to represent the quantum network as a flow network where Alice is the source and Bob is the sink [S9, S10].In general, there are many solutions for this random orientation.In fact, consider the subnetwork where Alice and Bob have been disconnected, i.e., N ′ = (P ′ , E ′ ) with P ′ = P \ {a, b}.There are 2 |E ′ | possible directed graphs that can be generated, where |E ′ | is the number of undirected edges in N ′ .Thus, we have 2 |E ′ | orientations of the original network N .Each of these orientations defines a flow network and provides possible strategies for multi-path routing.See Fig. S6 for an example.
Then, let us us introduce the notions of in-and outneighborhoods.Given an orientation of N , we have a corresponding flow network, denoted by N D = (P, E D ), where E D is the set of directed edges.For arbitrary point p, we define its out-neighborhood as the set of heads going from p and its in-neighborhood as the set of tails going into p A multipoint communication from point p is logically defined as a point-to-multipoint connection from p to all its out-neighborhood N out (p), i.e., p → N out (p), with quantum systems exchanged along the available quantum channels.A multi-path routing strategy can therefore be defined as an ordered sequence of such multipoint communications.See Fig. S6.
Using these definitions we may easily formalize the multi-path network protocol that we may simply call "flooding protocol".Suppose that we have |P | = Z + 2 points in the network (Z repeaters plus the two endpoints).The first step of the protocol is the agreement of a multi-path routing strategy R m 1 by means of preliminary CCs among all the points.This is part of an initialization LOCC Λ 0 which prepares an initial separable state for the entire network.Then, Alice a exchanges quantum systems with all her out-neighborhood N + (a).This multipoint communication is followed by a network LOCC Λ 1 .Next, repeater p 1 ∈ N + (a) exchanges quantum systems with all its out-neighborhood N + (p 1 ), which is followed by another LOCC Λ 2 and so on.At some step Z + 1, Bob b will have exchanged quantum systems with all his in-neighborhood N − (b), after which there is a final LOCC Λ Z+1 .This completes the first multi-path transmission between the end-points by means of the routing R m 1 and the sequence of LOCCs {Λ 0 , . . ., Λ Z+1 }.Then, there is the second use of the network with a generally different routing strategy R m 2 etc. See Fig. S7.
Let us note that the points of the network may generally update their routing strategy "on the fly", i.e., while the protocol is running; then, the various multipoint communications may be suitably permuted in their order.In any case, for large number of uses n, we will have a sequence of multi-path routings R m = {R m 1 , . . ., R m n } and network LOCCs L = {Λ 0 , . . ., Λ n(Z+1) } whose output provides Alice and Bob's final state ρ n ab .The flooding protocol P flood will be fully described by R m and L. By definition, its average rate is In the upper multi-path routing R m 1 , after the initial LOCC Λ0, there is the first multipoint communication a → {p1, p2}, followed by the LOCC Λ1.Then, we have the second multipoint communication p1 → {b, p2} followed by Λ2.Finally, we have p2 → b followed by the final LOCC Λ3.This completes a single end-to-end transmission.In the lower multi-path routing R m 2 , p1 and p2 are inverted.
where φ n is a target state of nR ε n bits.The multi-path capacity of the network is defined by optimizing the weakconverse asymptotic rate over all flooding protocols, i.e., C m (N ) := sup By specifying the target state, we define corresponding capacities for quantum communication, entanglement distillation, key generation and private communication, satisfying Before proceeding, some other considerations are in order.Note that the parallel uses of the network may also be re-arranged in such a way that each point performs all its multipoint communications before another point.For instance, in the example of Fig. S7, we may consider Alice performing all her n multipoint communications a → {p 1 , p 2 } as a first step.Suppose that routes R m 1 and R m 2 are chosen with probability p and 1 − p.Then, after Alice has finished, point p 1 performs its np multipoint communications and p 2 performs its n(1 − p) ones, and so on.We may always re-arrange the protocol and adapt the LOCC sequence L to include this variant.
there is a simplified formulation to keep in mind.In fact, we may consider a special case where the various multipoint communications, within the same routing strategy, are not alternated with network LOCCs but they are all performed simultaneously, with only the initial and final LOCCs to be applied.For instance, for the routing R m 1 of Fig. S7, this means to set Λ 1 = Λ 2 = I and assume that the multipoint communications a → {p 1 , p 2 }, p 1 → {b, p 2 } and p 2 → b occur simultaneously, after the initialization Λ 0 and before Λ 3 .In general, any variant of the protocol may be considered as long as each quantum channel (edge) is used exactly n times at the end of the communication, i.e., after n uses of the quantum network.
In the following Supplementary Note 3, we show how to simulate a quantum network and then exploit teleportation stretching to reduce adaptive protocols (based on single-or multi-path routings) into much simpler block versions.By combining this technique with entanglement cuts of the quantum network, we will derive very useful decompositions for Alice and Bob's output state.These decompositions will be later exploited in Supplementary Notes 4 and 5 to derive single-letter upper bounds for the network capacities C(N ) and C m (N ).Corresponding lower bounds will also be derived by combining point-topoint quantum protocols with classical routing strategies, with exact results for distillable networks.

General approach
Consider a quantum network N which is connected by arbitrary quantum channels.Given two points x and y connected by channel E xy , we consider its simulation S xy = (T xy , σ xy ) for some LOCC T xy and resource state σ xy .Repeating this for all connected points (x, y) ∈ E, we define an LOCC simulation of the entire network S(N ) = {S xy } (x,y)∈E and a corresponding resource representation of the network σ(N ) = {σ xy } (x,y)∈E .For a network of teleportation-covariant channels, its simulation S(N ) is based on teleportation over Choi matrices, so that we may consider σ(N ) = {σ Exy } (x,y)∈E , i.e., we have a "Choi-representation" of the network.Note that the simulation may be asymptotic for a network of bosonic channels, following the same treatment previously explained for a linear chain of repeaters.
By adopting a network simulation S(N ), we may simplify adaptive protocols via teleportation stretching, by extending the procedure employed for a linear chain of quantum repeaters, with the important difference that we now have many possible chains (the network routes) and these may also have collisions, i.e., repeaters and channels in common.The stretching of a quantum network is performed iteratively, i.e., transmission after transmission.Suppose that the jth transmission in the network occurs between points x and y via channel E xy with associated resource state σ xy .Call ρ j a...b the global state of the network after this transmission.Then, we may write where Λj is a trace-preserving LOCC (see Fig. S8 for a schematic visualization).By iterating Eq. ( 131) and considering that the initial state of network ρ 0 a...b is separable, we may then write the network output state after n transmissions as where n xy is the number of uses of channel E xy or, equivalently, edge (x, y).Then, by tracing out all the points but Alice and Bob, we get their final shared state for another trace-preserving LOCC Λab .Note that the decompositions of Eqs. ( 132) and (133) can be written for any adaptive network protocol (sequential or flooding).For a sequential protocol n xy = np xy ≤ n, where p xy is the probability of using edge (x, y).For a flooding protocol, we instead have n xy = n, because each edge is used exactly once in each end-toend transmission.In particular, in a flooding protocol, we have the parallel use of several channels E x1y1 , E x2y2 , . . .within each multipoint communication, which means that trivial LOCCs (identities) are applied between every two transmissions within the same multipoint communication.We have therefore proven the following result (see also Fig. S9 for a simple example).
Lemma 4 (Network stretching) Consider a quantum network N = (P, E) which is simulable with some resource representation σ(N ) = {σ xy } (x,y)∈E .Then, consider n uses of an adaptive protocol so that edge (x, y) ∈ E is used n xy times.We may write the global output state of the network as for a trace-preserving LOCC Λ.Similarly, Alice and Bob's output state ρ n ab is given by Eq. ( 134) up to a different trace-preserving LOCC Λab .In particular, we have n xy ≤ n (n xy = n) for a sequential (flooding) protocol.Formulations may be asymptotic for bosonic channels.E) with resource representation σ(N ⋄ ) = {σ01, σ02, σ12, σ13, σ23}.Before stretching, an arbitrary edge (x, y) with channel Exy is used nxy times.After stretching, the same edge (x, y) is associated with nxy copies of the resource state σxy.The latter is the Choi matrix σE xy if Exy is teleportation-covariant.The global state of the network is expressed as in Eq. ( 134), which may take an asymptotic form for a network of bosonic channels.
As we state in the lemma, the stretching procedure also applies to networks of bosonic channels with asymptotic simulations.This can be understood by extending the argument already given for linear chains.For the sake of clarity, we make this argument explicit here.Consider again the jth transmission in the network occurring via channel E xy as in Fig. S8.For the global state of the network, we may write Suppose that we replace each channel E xy in the network with an approximation E µ xy , with point-wise limit → 0 for any state ρ.We may build the approximate network state Now assume that all the registers in the network are bounded by a large but finite mean number of photons N , so that we may write → 0 in energyconstrained diamond distance.By using the monotonicity under CPTP maps and the triangle inequality, we then compute By iterating the previous formula for all the transmissions in the network, we derive This distance goes to zero in µ for any number of uses n, any finite number of edges |E|, and any energy N .Now suppose that the generic approximate channel E µ xy has LOCC simulation with some resource state σ µ xy .Then, we may write the approximate network stretching for a trace-preserving LOCC Λµ .Combining Eqs. ( 138) and (139), we may therefore write the asymptotic version of network stretching where the limit in µ is intended in trace norm and holds for any finite n, |E| and N .
Similarly, let us consider Alice and Bob's reduced state ρ n ab and its approximation ρ n,µ ab .As a result of the partial trace, we may write so that we may apply the bound in Eq. ( 138) and write If the generic channel E µ xy has LOCC simulation with some resource state σ µ xy , then we may write where the limit in µ is intended in trace norm and holds for any finite n, |E| and N .

Network stretching with entanglement cuts
We may achieve a non-trivial simplification of previous Lemma 4 in such a way that we greatly reduce the number of resource states in the decomposition of Alice and Bob's output state ρ n ab .This is possible using Alice-Bob entanglement cuts of the quantum network.These types of cuts will enable us to include many resource states in Alice's and Bob's LOs, while preserving the locality between the two end-points.
By definition, an Alice-Bob entanglement cut C of the quantum network is a bipartition (A, B) of all the points P of the network such that a ∈ A and b ∈ B. Then, the cut-set C of C is the set of edges with one end-point in each subset of the bipartition, so that the removal of these edges disconnects the network.Explicitly, Note that the cut-set C identifies an ensemble of channels {E xy } (x,y)∈ C .Similarly, we may define the following complementary sets To simplify the stretching of the network, we then adopt the following procedure.Given an arbitrary cut C = (A, B), we extend Alice and Bob to their corresponding partitions.This means that we consider super-Alice with global register A, and super-Bob with global register B. Then, all the resource states {σ xy } (x,y)∈ Ã are included in the LOs of super-Alice, and all those {σ xy } (x,y)∈ B are included in the LOs of super-Bob.Note that the only resource states not absorbed in LOs are those in the cut-set {σ xy } (x,y)∈ C .These states are the only ones responsible for distributing entanglement between the super-parties.The inclusion of all the other resource states into the global LOCC Λ leads to another trace-preserving quantum operation ΛAB which remains local with respect to A and B. Thus, for any cut C, we may write the following output state for super-Alice A and Bob B after n uses of an adaptive protocol The next step is tracing out all registers but the original Alice's a and Bob's b.This operation preserves the locality between a and b.In other words, we may write the following reduced output state for the two end-points where Λab is a trace-preserving LOCC.All these reasonings automatically transform Lemma 4 into the following improved Lemma.See also Fig. S10 for an example.
Lemma 5 (Network stretching with cuts) Consider a quantum network N = (P, E) simulable with a resource representation σ(N ) = {σ xy } (x,y)∈E .For a teleportation-covariant network, σ(N ) is a Choirepresentation, i.e., σ xy = σ Exy .Then, consider n uses of an adaptive protocol so that edge (x, y) ∈ E is used n xy times.For any entanglement cut C and corresponding cut-set C, we may write Alice and Bob's output state as for a trace-preserving LOCC Λab .In particular, we have n xy ≤ n (n xy = n) for a sequential (flooding) protocol.Formulations may be asymptotic for bosonic channels.  .This subset of states can be used to decompose the output state of Alice and Bob ρ n ab (C) according to Eq. ( 149).
As stated in this improved lemma, the decomposition in Eq. ( 149) can be extended to networks of bosonic channels with asymptotic simulations.We can adapt the previous reasoning to find the cut-version of Eq. (140), i.e., the trace-norm limit for suitable sequences of trace-preserving LOCC Λµ ab and resource states σ µ xy (with the result holding for any n, number of edges |E| and mean number of photons N ).
With Lemma 5 in our hands, we have the necessary tool to derive our single-letter upper bounds for the single-and multi-path capacities of an arbitrary quantum network.This tool needs to be combined with a general weak converse upper bound based on the REE.In the following Supplementary Note 4, we derive our results for the case of single-path routing over the network.The results for multi-path routing will be given in Supplementary Note 5.In both these Supplementary Notes, the upper bounds will be compared with suitable lower bounds that are derived by mixing point-to-point quantum protocols with classical routing strategies (widest path and maximum flow of a network).In order to write a single-letter upper bound for the single-path capacity of the quantum network, we need to introduce the notion of REE flowing through a cut under some simulation.Consider an arbitrary quantum network N = (P, E) with a resource representation σ(N ) = {σ xy } (x,y)∈E .Then, consider an arbitrary entanglement cut C with corresponding cut-set C.Under the simulation considered, we define the single-edge flow of REE through the cut as the following quantity By minimizing E R (C) over all possible entanglement cuts of the network, we build our upper bound for the singlepath capacity.In fact, we may prove the following.
In particular, σ(N ) may be a Choi-representation for a teleportation-covariant network.Then, the single-path capacity of N must satisfy the single-letter bound where the single-edge flow of REE in Eq. ( 151) is minimized across all cuts of the network.Formulations may be asymptotic for networks of bosonic channels.
Proof.We start from the general weak converse upper bound proven in the Methods section of the paper.In terms of the REE and for network sequential protocols P seq , this bound takes the form According to previous Lemma 5, for any sequential protocol P seq and entanglement cut C of the network, we may write Eq. ( 149).Computing the REE on this decomposition and exploiting basic properties (monotonicity of REE under Λab and subadditivity over tensor products), we derive the following inequality where n xy = np xy and p xy being the probability of using edge (x, y) according to protocol P seq .By maximizing over the convex combination, we get rid of p xy and write By using Eq.(155) in Eq. ( 153), we see that both the optimization over P seq and the limit over n disappear, and we are left with the bound By minimizing over all cuts, we therefore prove Eq. ( 152).Note that, from Eq. ( 154) we may also derive where pxy is the optimal use of edge (x, y) over all possible P seq .Here ĒR (C) represents the average flow of REE through C under the chosen simulation and optimized over P seq .By minimizing over all cuts, we get This may be tighter than Eq. ( 152) but difficult to compute due to residual optimization over the protocols.Finally, note that Eq. ( 152) can be extended to considering asymptotic simulations, following the same ideas in the proof of Theorem 3. Let us compute the REE on the asymptotic state ρ n ab (C) of Eq. ( 150).We may write ≤ inf ≤ inf γ µ lim inf where: (1) γ µ is a generic sequence of separable states converging in trace norm, i.e., such that there is a separable state γ := lim µ γ µ so that γ − γ µ 1 µ → 0; (2) we use the lower semi-continuity of the relative entropy [S6]; (3) we use that Λµ ab (γ µ ) are specific types of converging separable sequences within the set of all such sequences; (4) we use the monotonicity of the relative entropy under trace-preserving LOCCs; (5) we use the definition of REE for asymptotic states σ xy := lim µ σ µ xy ; (6) we use the subadditivity over tensor products.
Therefore, we have again Eq. ( 154) but where the REE is written as in the weaker formulation for asymptotic states given in Eq. ( 94).The next steps of the proof are exactly as before, and they lead to Eq. (156).Alice-Bob cut C as W (C) = max e∈ C W (e).The weight of the widest path is equal to that of the minimum cut Finding the optimal route ω * in a quantum network (Theorem 7) is equivalent to finding the widest path ω wide in a weighted network (Proposition 8), i.e., solving the well-known widest path problem [S17].Using a modified Dijkstra's algorithm, the solution is found in time O(|E| log 2 |P |) (see Chapter 2.7.1 of Ref. [S18], and below for a description of this modified algorithm).In practical cases, this algorithm can be optimized and its asymptotic performance becomes O(|E|+|P | log 2 |P |) [S19].Another possibility is using an algorithm for finding a maximum spanning tree of the network, such as the Kruskal's algorithm [S17, S20].The latter has the asymptotic complexity O(|E| log 2 |P |) for building the tree.This step is then followed by the search of the route within the tree which takes linear time O(|P |) [S11].
For clarity here we briefly recall the modified Dijkstra's algorithm for computing the widest path, which is not so known as the most popular version for computing the shortest path.Consider an undirected graph N = (P, E) where each edge e ∈ E has an associated width w(e) and consider a start point s.Given another point p ∈ P , let us call w to(p) the width of a path from s to p (as given by the minimum width of the edges along the path).We impose w to(s) = ∞.Then, let us initialize a tree T = {s} with no edges.A point p = s will be inserted in the tree if it has maximum w to(p).This is done by repeating the following steps: 1.For each neighbor-point p of the tree T , compute: w to(p) = max e=(q,p):q∈T {min [w to(q), w(e)]} .
2. Insert the neighbor-point p with the maximum w to(p) into the tree T .
After iteration, this algorithm creates a tree T which specifies the widest path in the graph.The running time is the same of the original Dijkstra's algorithm.

Formulas for teleportation-covariant and distillable networks
The results of Theorems 6 and 7 can be specified for quantum networks which are connected by teleportationcovariant channels.Given a teleportation-covariant network N = (P, E) whose teleportation simulation has an associated Choi-representation σ(N ) = {σ Exy } (x,y)∈E , we may write the following for the single-path capacity with C(C) being defined in Eq. ( 160), and The latter may have an asymptotic formulation for networks of bosonic channels, with the REE taking the form as in Eq. ( 94) over σ Exy := lim µ σ µ Exy , where σ µ Exy is a sequence of Choi approximating states with finite energy.
In particular, consider a network connected by distillable channels.This means that for any edge (x, y) ∈ E, we may write (exactly or asymptotically) By imposing this condition in Eq. ( 168), we find that upper and lower bounds coincide.We have therefore the following result which establishes the single-path capacity C(N ) of a distillable network and fully extends the widest path problem [S21] to quantum communications.
Corollary 9 (Single-path capacities) Consider a distillable network N = (P, E), where two end-points are connected by an ensemble of routes Ω = {ω} and may be disconnected by an entanglement cut C.An arbitrary edge (x, y) ∈ E is connected by a distillable channel E xy with two-way capacity C xy and Choi matrix σ Exy .Then, the single-path capacity of the network is equal to with an implicit asymptotic formulation for bosonic channels.Equivalently, C(N ) is also equal to the minimum (single-edge) capacity of the entanglement cuts and the maximum capacity of the routes, i.e., The optimal end-to-end route ω * achieving the capacity can be found in time O(|E| log 2 |P |), where |E| is the number of edges and |P | is the number of points.Over this route, a capacity-achieving protocol is based on oneway entanglement distillation sessions between consecutive points, followed by entanglement swapping.
The proof of this corollary is a direct application of the previous reasonings.We see that it first reduces the routing problem to a classical optimization problem, i.e., finding the widest path.Then, over this optimal route, the single-path capacity is achieved by a non-adaptive protocol based on one-way CCs.In fact, we have that any two consecutive points r i and r i+1 along ω * may distill ebits at the rate of D 1 (σ E ω * i ), where E ω * i is the connecting channel.Then, sessions of entanglement swapping (also based on one-way CCs), distribute ebits at the end-points with a rate of at least min i D 1 (σ E ω * i ).Due to Eq. ( 170), this rate is equal to min i C(E ω * i ) = C(ω * ), which corresponds to the capacity C(N ).

Single-path capacities of fundamental networks
Let us specify the result of Corollary 9 to fundamental scenarios such as bosonic networks subject to pure-loss or quantum-limited amplification, or spin networks affected by dephasing or erasure.These are in fact all distillable networks.We find extremely simple formulas for their single-path capacities, setting their ultimate limit for quantum communication, entanglement distribution, key generation and private communication under singlepath routing.
Start with a network connected by lossy channels N loss , which well describes both free-space or fiber-based optical communications.According to Corollary 9, we may compute its capacity C(N loss ) by minimizing over the cuts or maximizing over the routes.Generic edge (x, y) ∈ E has an associated lossy channel with transmissivity η xy and capacity C xy = − log 2 (1 − η xy ).Therefore, an entanglement cut has single-edge capacity where η C may be identified as the (single-edge) transmissivity of the cut.By minimizing over the cuts, we may write the single-path capacity of the lossy network as where ηC is the minimum transmissivity of the cuts.Consider now a generic end-to-end route ω along the lossy network.This route is associated with a sequence of lossy channels with transmissivities {η ω i }.We then compute the route capacity as where η ω is the route transmissivity.By maximizing over the routes, we may equivalently write the single-path ca-pacity of the lossy network as where η is the maximum transmissivity of the routes.Similar conclusions can be derived for bosonic networks which are composed of other distillable Gaussian channels, such as multiband lossy channels, quantum-limited amplifiers or even hybrid combinations.In particular, consider a network of quantum-limited amplifiers N amp , where the generic edge (x, y) ∈ E has gain g xy with capacity C xy = − log 2 (1 − g −1 xy ), and the generic end-to-end route ω is associated with a sequence of gains {g ω i }.We can repeat the previous steps of the lossy network but setting g −1 = η, so that max η = min g.Thus, for an entanglement cut C, we may write For a route ω, we have the capacity By minimizing over the cuts or maximizing over the routes, we derive the two equivalent formulas where gC := max C g C and g := min ω g ω .We can also compute the single-path capacities of DV networks where links between qudits are affected by dephasing or erasure or a mix of the two errors.For simplicity, consider the case of qubits, such as spin 1/2 or polarized photons.In a qubit network with dephasing channels N deph , the generic edge (x, y) ∈ E has a dephasing probability p xy ≤ 1/2 and capacity C xy = 1 − H 2 (p xy ).The generic end-to-end route ω is associated with a sequence of such dephasing probabilities {p ω i }.For an entanglement cut C, we have For a generic route ω, we may write By minimizing over the cuts or maximizing over the routes, we then derive the single-path capacity where we have set pC Finally, for a qubit network affected by erasures N erase we have that edge (x, y) ∈ E is associated with an erasure channel with probability p xy and corresponding capacity C xy = 1 − p xy .As a result, we may repeat all the previous derivation for the dephasing network N deph up to replacing H 2 (p) with p.For a cut and a route, we have where p C and p ω are defined as in Eqs. ( 180) and (181).Thus, the single-path capacity of the erasure network simply reads where pC and p are defined as in Eq. ( 183).See Table I of the main text for a schematic presentation of these analytical formulas.In order to write a single-letter upper bound for the multi-path capacity of a quantum network, we need to introduce the concept of multi-edge flow of REE through a cut, under some simulation of the network.Consider an arbitrary quantum network N = (P, E) whose simulation has an associate resource representation σ(N ) = {σ xy } (x,y)∈E .Then, consider an arbitrary entanglement cut C with corresponding cut-set C.Under the simulation considered, we define the multi-edge flow of REE through the cut as the following quantity By minimizing E m R (C) over all possible entanglement cuts of the network, we build our upper bound for the multi-path capacity.In fact, we may prove the following.
Theorem 10 (Converse for multi-path capacity) Consider an arbitrary quantum network N = (P, E) with some resource representation σ(N ) = {σ xy } (x,y)∈E .In particular, σ(N ) may be a Choi-representation for a teleportation-covariant network.Then, the multi-path capacity of N must satisfy the single-letter bound where the multi-edge flow of REE in Eq. ( 186) is minimized across all cuts of the network.Formulations may be asymptotic for networks of bosonic channels.
Proof.Let us start from the general weak converse upper bound proven in the Methods section of the main manuscript.In terms of the REE and for flooding protocols P flood , it takes the following form According to previous Lemma 5, for any flooding protocol P flood and entanglement cut C, we may write Eq. ( 149) with n xy = n.Computing the REE on this decomposition and exploiting basic properties of the REE, we derive By using Eq.(189) in Eq. ( 188), both the supremum and the limit disappear, and we are left with the bound By minimizing over all cuts, we therefore prove Eq. ( 187).The extension to asymptotic simulations follows the same derivation in the proof of Theorem 6 but setting n xy = n.We find again Eq. ( 187) but where the REE takes the weaker formulation for asymptotic states of Eq. (94).

Direct part (achievable rate)
We now provide a general lower bound to the multipath capacity.Consider an arbitrary quantum network N = (P, E) where edge (x, y) ∈ E is connected by channel E xy with two-way capacity C xy = C(E xy ).Given an arbitrary entanglement cut C of the network, we define its multi-edge capacity as the total number of target bits distributed by all the edges across the cut, i.e., In this setting, a minimum cut C min is such that We now prove that the later is an achievable rate for multi-path quantum/private communication.
Theorem 11 (Lower bound) Consider an arbitrary quantum network N = (P, E) where two end-points may be disconnected by an entanglement cut C.The multipath capacity of the network satisfies In other words, the minimum multi-edge capacity of the entanglement cuts is an achievable rate.This rate is achieved by a flooding protocol whose multi-path routing can be found in O(|P | × |E|) time by solving the classical maximum flow problem.
Proof.To show the achievability of the rate in Eq. (192), we resort to the classical max-flow min-cut theorem [S14].In the literature, this theorem has been widely adopted for the study of directed graphs.In general, it can also be applied to directed multi-graphs as well as undirected graphs/multi-graphs (e.g., see [S15,Sec. 6]).The latter cases can be treated by splitting the undirected edges into directed ones (e.g., see [S15, Sec.2.4]).
Our first step is therefore the transformation of the undirected graph of the quantum network N = (P, E) into a suitable directed graph (in general, these may be multi-graphs, in which case the following derivation still holds but with more technical notation).Starting from (P, E), we consider the directed graph where Alice's edges are all out-going (so that she is a source), while Bob's edges are all in-going (so that he is a sink).Then, for any pair x and y of intermediate points P \{a, b}, we split the undirected edge (x, y) ∈ E into two directed edges e := (x, y) ∈ E D and e ′ := (y, x) ∈ E D , having capacities equal to the capacity C xy of the original undirected edge.(Note that one may always enforce a single direction between x and y by introducing an artificial point z in one of the two directed edges.For instance, we may keep (x, y) as is, while replacing (y, x) with (y, z) and (z, x), both having the same capacity of (y, x).This further modification does not affect the maximum flow value and the minimum cut capacity, but increases the complexity of the network.)These manipulations generate our flow network N flow = (P, E D ).See Fig. S12 for a simple example.We then adopt the standard definition of cut-set for flow networks, here called "directed cut-set".Given an Alice-Bob cut C of the flow network, with bipartition (A, B) of the points P , its directed cut-set is defined as CD = {(x, y) ∈ E D : x ∈ A, y ∈ B}.This means that directed edges of the type (y ∈ B, x ∈ A) do not belong to this set (see Fig. S12).Using this definition, the cutproperties of the flow network N flow are exactly the same as those of the original undirected graph N , for which we used the "undirected" definition of cut-set.For this reason, we have where the first quantity is computed on N , while the second one is computed on the flow network N flow .We aim to show that the latter is an achievable rate.
Let us now define the "flow" in the network N flow as the number of qubits per use which are reliably transmitted from x to y along the directed edge e = (x, y) ∈ E D , denoted by R e xy ≥ 0. This quantum transmission is performed by means of a point-to-point protocol where x and y exploit adaptive LOCCs, i.e., unlimited two-way CCs and adaptive LOs, without the help of the other points of the network.It is therefore bounded by the two-way quantum capacity of the associated channel E xy , i.e., R e xy ≤ Q 2 (E xy ).The actual physical direction of the channel does not matter since it is used with two-way CCs, so that the two points x and y first distill entanglement and then they teleport qubits in the "logical direction" specified by the directed edge.
Since every directed edge e = (x, y) between two intermediate points x, y ∈ P \{a, b} has an opposite counterpart e ′ := (y, x), we may simultaneously consider an opposite flow of qubits from y to x with rate 0 ≤ R e ′ yx ≤ Q 2 (E xy ).As a result, there will be an "effective" point-to-point rate between x and y which is defined by the difference of the two "directed" rates It is important to note that {R e xy } e∈ED represents a "legal" flow vector in N flow only if we impose the property of flow conservation [S15].This property can be stated for {R e xy } e∈ED or, equivalently, for the effective vector {R xy } (x,y)∈E .At any intermediate point, the number of qubits simultaneously received must be equal to the number of qubits simultaneously transmitted through all the point-to-point communications with neighbor points.
In other words, for any x ∈ P \{a, b}, we must impose where |R| is known as the value of the flow.This is an achievable end-to-end rate since it represents the total number of qubits per network use which are transmitted by Alice and correspondingly received by Bob via all the end-to-end routes, where the intermediate points quantum-communicate at the rates {R xy } (x,y)∈E .Now, from the classical max-flow min-cut theorem, we know that the maximum value of the flow in the network |R| max is equal to the capacity of the minimum cut [S14, S15], i.e., we may write Thus, by construction, we have that |R| max is an achievable rate for quantum communication.The previous reasoning can be repeated for private bits by defining a corresponding flow of private information through the network.Thus, in general, we may write that is an achievable rate for any of the quantum tasks.This proves that Eq. ( 194) is an achievable rate.
In order to better understand the flooding protocol that achieves |R| max , call { Re xy } e∈ED the optimal flow vector in N flow .There is a corresponding vector { Rxy } (x,y)∈E which determines an optimal orientation N D = (P, E ′ D ) for the quantum network N = (P, E), besides providing the optimal rates {| Rxy |} (x,y)∈E to be reached by the point-to-point connections.In other words, starting from the capacities C xy , the points solve the maximum flow problem and establish an optimal multi-path routing R m opt .After this, each point x ∈ P communicates with its out-neighborhood N out (x), according to the optimal rates and the optimal orientation.( As usual, the latter may have an asymptotic formulation for networks of bosonic channels, with the REE taking the form as in Eq. ( 94) over σ Exy := lim µ σ µ Exy , where σ µ Exy is a sequence of states with finite energy.
In particular, consider now a distillable network.This means that, for any edge (x, y) ∈ E, we may write Eq. (170), exactly or asymptotically.By imposing this condition in Eq. (199), we find that upper and lower bounds coincide.We have therefore the following result which establishes the multi-path capacity C m (N ) of a distillable network and fully extends the max-flow min-cut theorem [S13, S14, S16] to quantum communications.
Corollary 12 (multi-path capacities) Consider a distillable network N = (P, E), whose arbitrary edge (x, y) ∈ E is connected by a distillable channel E xy with two-way capacity C xy and Choi matrix σ Exy .Then, the multi-path capacity of the network is equal to with an implicit asymptotic formulation for bosonic channels.Equivalently, C m (N ) is also equal to the minimum (multi-edge) capacity of the entanglement cuts The optimal multi-path routing can be found in O(|P | × |E|) time by solving the classical maximum flow problem.A capacity-achieving flooding protocol corresponds to performing one-way entanglement distillation between neighbor points, followed by multiple sessions of teleportation in the direction of the optimal network orientation.
The proof is a direct application of the previous reasonings.In particular, from Theorem 11, we have that the routing problem is reduced to the solution of a classical optimization problem, i.e., finding the maximum flow in a flow network.This solution provides an optimal orientation N D of the quantum network and also the point-to-point rates | Rxy | to be used in the various multipoint communications.Under this optimal routing, the multi-path capacity is achieved by a non-adaptive flooding protocol based on one-way CCs.In fact, because the channels are distillable, each pair of points x and y may distill n| Rxy | ebits.By using the distilled ebits, Alice's qubits are teleported to Bob along the multi-path routes associated with the maximum flow.Since Alice's qubits can be part of ebits and, therefore, private bits, this protocol can also distill entanglement and keys at the same end-to-end rate.
Thus, Corollary 12 reduces the computation of the multi-path capacity of a distillable quantum network to the determination of the maximum flow in a classical network.In this sense the max-flow min-cut theorem is extended from classical to quantum communications.In particular, the distillable network can always be transformed in a teleportation network, where quantum information is teleported as a flow from Alice to Bob.

Multi-path capacities of fundamental networks
Consider the practical scenario of quantum optical communications affected by loss, e.g., free-space or fiberbased.A specific distillable network is a bosonic network connected by lossy channels N loss , so that each undirected edge (x, y) has an associated lossy channel E xy with transmissivity η xy or equivalent "loss parameter" 1 − η xy .We may then apply Corollary 12 and express the multi-path capacity C m (N loss ) in terms of the loss parameters of the network.
Let us define the loss of an Alice-Bob entanglement cut C as the product of the loss parameters of the channels in the cut-set, i.e., we set l(C) :=  In particular, suppose that we have the same loss in each edge of the multiband network, i.e., η xy := η for any (x, y) ∈ E, which may occur when points x and y are equidistant.Then, we may simply write (212) Similar expressions may be derived for qudit networks of dephasing and erasure channels in arbitrary dimension.See Table I of the main text for a list of formulas.

SUPPLEMENTARY NOTE 6: RELATED LITERATURE
Independently from this work, and simultaneously with its first appearance on the arXiv in 2016 [S27], Azuma et al. [S28] also studied upper bounds for private communication over quantum networks in the singlepath configuration.They specifically employed the squashed entanglement and adopted different techniques (not based on the simplification of an entanglement measure via channel simulation).Because of these choices, they derived completely different single-path upper bounds.In particular, their bounds are not as tight as ours for networks connected by teleportationcovariant channels, such as Pauli, erasure or Gaussian channels.The methodology of Ref. [S28] cannot identify the single-path capacities for networks connected by distillable channels (such as lossy channels, quantumlimited amplifiers, dephasing or erasure channels).These capacities were instead established in our work thanks to the use of the REE as entanglement measure and the network generalization of the channel simulation techniques introduced by PLOB [S1].
Later, in another work, Azuma and Kato [S29] studied upper bounds for multi-path routing, mainly using the squashed entanglement but also resorting to the REE as a consequence of the results in PLOB [S1].Differently from our work, they did not consider flooding protocols, where each edge is used exactly once in each parallel use of the quantum network.The imposition of this flooding condition is essential for finding our general upper bound for the multi-path capacity.Flooding is also essential for extending the max-flow/min-cut theorem to quantum communications and therefore establishing the formulas of the multi-path capacities for distillable networks, all results which have been found here in our work.

Followup works and recent developments
The methods and results of this work [S27] have been already exploited in a number of recent studies.Rigovacca et al. [S30] combined the REE approach of this work (based on channel simulation) and the squashedentanglement approach of Refs.[S28, S29] (not based on channel simulation) to provide versatile bounds.On the other hand, the present author [S31] investigated the endto-end capacities of networks composed of Holevo-Werner channels by considering both the REE and the squashed entanglement while using channel simulation and teleportation stretching (these network results of Ref. [S31] were directly based on the techniques devised here).
In another study, Pant et al. [S32] further explored one of the results of the present work [S27]: the superiority of multi-path versus single-path protocols for distributing entanglement and secret keys between endusers.Differently from here, where this advantage is shown in an information-theoretic sense with ideal quantum repeaters, Pant et al. [S32] studies this advantage by considering realistic/practical models of repeater nodes.
Among other recent developments, let us also men-tion the recent work by Bäuml et al. [S33], which has defined different types of network capacities.In Bäuml et al. [S33], the network capacities are not defined per network use but rather per total number of channel uses (which is based on counting the number of channels that are sequentially used in a route between the end-parties).
Finally, the limits established by this work for the optimal performance of quantum repeaters have been already considered in works of quantum key distribution (QKD), including the relay-assisted protocols of twinfield QKD [S34] and Phase-Matching QKD [S35].

FIG. 3 :
FIG. 3: Diamond quantum network N ⋄ .(a) This is a quantum network of four points P = {p0, p1, p2, p3}, with endpoints p0 = a (Alice) and p3 = b (Bob).Two points pi and pj are connected by an edge (pi, pj ) if there is an associated quantum channel Eij .This channel has a corresponding resource state σij in a simulation of the network.There are four (simple) routes: 1 : a−p1 −b, 2 : a−p2 −b, 3 : a−p2−p1 −b, and 4 : a − p1 − p2 − b.As an example, route 4 involves the transmission through the sequence of quantum channels {E 4 k } which is defined by E 4 0 := E01, E 4 1 := E12 and E 4 2 := E23.(b) We explicitly show route ω = 4.In a sequential protocol, each use of the network corresponds to using a single route ω between the two end-points, with some probability pω.(c) We show an entanglement cut C of the network, with super Alice A and super Bob B made by the points in the two clouds.These are connected by the cut-set C composed by the dotted edges.

FIG. 4 :
FIG. 4: Network protocols of quantum and private communication.(a) In a sequential protocol, systems are routed through a single path probabilistically chosen by the points.Here it is a − p1 − p2 − b.Each transmission occurs between two adaptive LOCCs, where all points of the network perform LOs assisted by two-way CC.(b) In a flooding protocol, systems are simultaneously routed from Alice to Bob through a sequence of multipoint communications in such a way that each edge of the network is used exactly once in an end-to-end transmission.Here we show a possible sequence a → {p1, p2}, p2 → {p1, b}, p1 → {b}.Each multipoint communication occurs between two adaptive LOCCs.

FIG. S1 :
FIG.S1: Chain with a single repeater r and connected by two forward channels E and E ′ .Each transmission k through one of the two channels occurs between two instances of adaptive local operations and classical communication (LOCCs) Λ k−1 and Λ k .In particular, here we show two uses of the chain, with total output state ρ 2 arb .Note that, if the parties want to distribute ebits or private bits, they may also use a different order of transmissions in each use.For instance, in the first use, the first transmission could be between the repeater r and Bob b, followed by that between Alice a and the repeater r.The order of the transmissions and the sequence of LOCCs defines the adaptive protocol P over the chain.

FIG. S3 :
FIG. S3: Reduction of the stretched scenario per use) p o in tto -p o in t b e n c h m

− p 1 − p 2 − b 4 : a − p 2 − p 1
FIG.S5: Sequential use of a diamond quantum network.Each use of the network corresponds to routing a quantum system between the two end-points Alice a and Bob b.In a diamond network with four points p0 = a, p1, p2, and p3 = b, we may identify four basic routes ω = 1, 2, 3, 4 (see list on the right).These are simple paths between Alice and Bob with the middle points p1 and p2 acting as quantum repeaters in different succession.For instance, p1 is the first repeater in route 3 and the second repeater in route 4. Note that we may consider further routes by including loops between p1 and p2.These other solutions are non-simple paths that we may discard without losing generality.

FIG. S6 :
FIG.S6: Orientations of a diamond quantum network.There are only two possible orientations that transform the original undirected network (left) into a flow network (right).Within an orientation, there is a well-defined logical multipoint communication from each point to all its out-neighborhood (empty for Bob).A multi-path routing strategy (flooding) is defined as a sequence of such multipoint communications.Therefore, in the upper orientation, we may identify the basic multi-path routing a → {p1, p2}, p1 → {p2, b}, and p2 → b.Other routings are given by permutation in the sequence.For instance, we may have the different sequence p1 → {p2, b}, p2 → b and a → {p1, p2} for the upper orientation.In the lower orientation, we have the basic multi-path routing a → {p1, p2}, p2 → {p1, b} and p1 → b, plus all the possible permutations.

2 FIG. S7 :
FIG.S7: Two possible parallel uses of a diamond quantum network.In the upper multi-path routing R m 1 , after the initial LOCC Λ0, there is the first multipoint communication a → {p1, p2}, followed by the LOCC Λ1.Then, we have the second multipoint communication p1 → {b, p2} followed by Λ2.Finally, we have p2 → b followed by the final LOCC Λ3.This completes a single end-to-end transmission.In the lower multi-path routing R m 2 , p1 and p2 are inverted.

FIG. S8 :
FIG.S8: Stretching of a network.Consider the jth transmission between points x and y, so that the network state ρ j−1 a...b is transformed into ρ j a...b .By introducing the simulation (Txy, σxy) of channel Exy, we may stretch the resource state σxy out of the LOCCs and collapse Λj−1, Txy and Λj into a single LOCC Λj applied to ρ j−1 a...b ⊗ σxy, as in Eq. (131).

FIG. S9 :
FIG.S9: Network stretching.Consider a diamond quantum network N ⋄ = ({p0, p1, p2, p3}, E) with resource representation σ(N ⋄ ) = {σ01, σ02, σ12, σ13, σ23}.Before stretching, an arbitrary edge (x, y) with channel Exy is used nxy times.After stretching, the same edge (x, y) is associated with nxy copies of the resource state σxy.The latter is the Choi matrix σE xy if Exy is teleportation-covariant.The global state of the network is expressed as in Eq. (134), which may take an asymptotic form for a network of bosonic channels.

FIG. S10 :
FIG. S10: Network stretching with entanglement cuts.We show one of the possible entanglement cuts C of the diamond quantum network N ⋄ .This cut creates super-Alice A = {a, p1} and super-Bob B = {b, p2}.The resource states σ ⊗n 01 01 are absorbed in the local operations (LOs) of A, while the resource states σ ⊗n 23 23 are absorbed in the LOs of B. The cut-set is composed by the set of edges C = {(p0, p2), (p1, p2), (p1, p3)} with corresponding resource states σ ⊗n 02 02 , σ ⊗n 12 12 and σ ⊗n 13

SUPPLEMENTARY NOTE 4 :
RESULTS FOR SINGLE-PATH ROUTING Converse part (upper bound)

C
n xy E R (σ xy ),

FIG. S11 :
FIG.S11: Example of a network and its maximum spanning tree (red edges).The optimal route ω * between Alice and Bob is a unique path within this tree (highlighted by the asterisks).The critical edge e(ω * ) is the one maximizing the capacity, i.e., realizing the condition C e(ω * ) = C(ω * ).Wherever the critical edge might be along the optimal route, we can always make an Alice-Bob entanglement cut C * which crosses that specific edge and no other edge of the spanning tree.This property leads to C(C * ) = C(ω * ).
SUPPLEMENTARY NOTE 5: RESULTS FOR MULTI-PATH ROUTINGConverse part (upper bound)

FIG. S12 :
FIG. S12: Manipulations of the undirected diamond network.(Left) Original undirected quantum network N ⋄ .(Middle) Flow network N ⋄ flow with Alice a as source and Bob b as sink, where the middle undirected edge (x, y) has been split in two directed edges e and e ′ with the same capacity.(Right) Assuming the displayed Alice-Bob cut, the dotted edge does not belong to the directed cut-set CD.

)
Its absolute value |R xy | provides the effective number of qubits transmitted between x to y per use of the undirected edge.For R xy ≥ 0, effective qubits flow from x to y, while R xy ≤ 0 means that effective qubits flow from y to x.The effective rate is correctly bounded|R xy | ≤ Q 2 (E xy) and we set R xy = 0 if two points are not connected.The ensemble of positive directed rates {R e xy } e∈ED represents a flow vector in N flow .For any choice of this vector, there is a corresponding ensemble of effective rates {R xy } (x,y)∈E for the original network N .The signs {sgn(R xy )} (x,y)∈E specify an orientation N D = (P, E ′ D ) for N , and the absolute values {|R xy |} (x,y)∈E provide point-to-point quantum communication rates for the associated protocol.
not hold for Alice a (source) and Bob b (sink), for which we impose y∈P R ay = − y∈P R by := |R|, Finally, let us discuss the complexity of finding the optimal multi-path routing R m opt .By construction, the flow network N flow = {P, E D } has only a small overhead with respect to the original network N = {P, E}.In fact, we just have |E D | ≤ 2|E|.Within N flow , the maximum flow can be found with classical algorithms.If the capacities are rational, we can apply the Ford-Fulkerson algorithm [S14] or the Edmonds-Karp algorithm [S10], the latter running in O(|P | × |E D | 2 ) time.An alternative is Dinic's algorithm [S9], which runs in O(|P | 2 ×|E D |) time.More powerful algorithms are available [S22-S24] and the best running performance is currently O(|P | × |E D |) time [S25, S26].Thus, adopting Orlin's algorithm [S26], we find the solution in O(|P | × |E D |) = O(|P | × |E|) time.Formulas for teleportation-covariant and distillable networksConsider a teleportation-covariant quantum network N = (P, E) whose teleportation simulation has an associated Choi-representation σ(N ) = {σ Exy } (x,y)∈E .Then, from Theorems 10 and 11, we may write the following sandwich for the multi-path capacity minC C m (C) ≤ C m (N ) ≤ min C E m R (C) ,(199)with C m (C) being defined in Eq. (191), andE m R (C) = (x,y)∈ C E R (σ Exy ) .
the multi-edge capacity of the cut, since we have C m (C) = − log 2 l(C).By applying Eq. (202), we find that the multi-path capacity of the lossy network is given byC m (N loss ) = min C [− log 2 l(C)] = − log 2 max C l(C) .
(204) Thus, we may define the total loss of the network as the maximization of l(C) over all cuts, i.e.,l(N loss ) := max C l(C),(205)and write the simple formulaC m (N loss ) = − log 2 l(N loss ).(206)In general, we may consider a multiband lossy network N band loss , where each edge (x, y) represents a multiband lossy channel E band xy with bandwidth M xy and constant transmissivity η xy .In other words, each single edge (x, y) corresponds to M xy independent lossy channels with the same transmissivity η xy .In this case, we have C(E band xy ) = −M xy log 2 (1 − η xy ) and we write C m (N band loss ) = − log 2 max C (x,y)∈ C(1 − η xy ) Mxy , (207) which directly generalizes Eq. (206).

M
min := min C (x,y)∈ C M xy ,(209)where M min is the effective bandwidth of the network.Consider now other types of distillable networks.Start with a bosonic network of quantum-limited amplifiers N amp , where the generic edge (x, y) has an associated gain g xy .Its multi-path capacity is given byC m (N amp ) = − log 2 max C (x,y)∈ C(1 − g −1 xy ) .(210)For a qubit network of dephasing channels N deph , where the generic edge (x, y) has dephasing probability p xy , we may write the multi-path capacityC m (N deph ) = min C (x,y)∈ C [1 − H 2 (p xy )] .(211)Finally,for a qubit network of erasure channels N erase with erasure probabilities p xy , we simply haveC m (N erase ) = min C (x,y)∈ C(1 − p xy ).

TABLE I :
Analytical formulas for the end-to-end capacities of distillable chains and networks.