R Beichner, Yehudit Judy Dori, and John Belcher, "New Physics Teaching and Assessment: Laboratory and Technology Enhanced Active Learning," in Handbook of College Science Teaching, edited by J. Mintzes and W. J. Leonard (National Science Teachers Association, Washington, D.C., In Press).
M. Dancy and R Beichner, "Impact of animation on assessment of conceptual understanding in physics," Phys. Rev. ST Phys. Educ. Res. 2 (2006).
*L. Ding, R. Chabay, B. A. Sherwood, and R Beichner, "Evaluating an electricity and magnetism assessment tool: Brief electricity and magnetism assessment," Phys. Rev. ST Phys. Educ. Res. 2 (2006).
*Paula Vetter Engelhardt and Robert J. Beichner, "Students' understanding of direct current resistive electrical circuits," American Journal of Physics 72 (1), 98-115 (2004).
Scott W. Bonham, Duane L. Deardorff, and Robert J. Beichner, "Comparison of student performance using web and paper-based homework in college-level physics," Journal of Research in Science Teaching 40 (10), 1050-1071 (2003).
Melissa Dancy, "But are they learning? Getting started in classroom evaluation," Cell Biology Education 1, 87-94 (2002).
Duane Deardorff, Introductory physics students' treatment of measurement uncertainty, North Carolina State University, 2001.
Rhett J. Allain, Investigating the relationship between student difficulties with the concept of electric potential and the concept of rate of change, PhD, North Carolina State University, 2001.
Melissa Dancy, Investigating Animations for Assessment with an Animated Version of the Force Concept Inventory, Ph. D., North Carolina State University, 2000.
Paula Engelhardt, Examining Students' Understanding of Electrical Circuits through Multiple-choice Testing and Interviews, PhD, North Carolina State University, 1997.
*Robert J. Beichner, "Testing student interpretation of kinematics graphs," American Journal of Physics 62 (8), 750-762 (1994).
Lots of other tests, some of which we have influenced, are available at AAPT's PhysPort. There is a nice article about Assessment Instruments in the American Journal of Physics. Of the 50 instruments described in the paper, only seven earned a "Gold" rating. Of those seven, three were developed at NCSU.
Click here for old, depricated test information. Note that most of the links are no longer active.
Please do not allow students to keep copies of any of these tests. It takes years of development effort to create and validate a reliable assessment instrument. If it is released to the public domain, students will locate it and all that work will be for naught. In fact, you might not want to use the formal name of the test on the versions you have students take. None of these tests are to be incorporated into a web-based question delivery system without adequate security to prevent printing or other unauthorized access by students. Contact the authors for more details.
TUG-K Beichner's Test of Understanding Graphs in Kinematics is available in English, Spanish, French, German, Finnish, and Portugese by sending e-mail to beichner@ncsu.edu. A discussion of the test is in R. Beichner, "Testing student interpretation of kinematics graphs," Am. J. Phys., 62, 750-762, (1994).
For graphing also see the FMCE, below.
Deardorff & Beichner's Test of Measurement Uncertainty Concepts can be requested from beichner@ncsu.edu.
FCI The Force Concept Inventory (1995 revision -- I. Halloun, R.R. Hake, E.P. Mosca, and D. Hestenes) is available (as.pdf) to educators. Visit <http://modeling.asu.edu> and click on "Research and Evaluation". It is available in the following languages:Arabic, Chinese, Croatian, Czech, English, Finnish (Suomi), French (Canadian), French (France), German (Deutsch), Greek, Italian (Italiano), Japanese, Malaysian (Bahasa), Persian, Portuguese, Russian, Slovak, Spanish (Espanol), Swedish, Turkish (Turkce). Note: you will need the password to view any of these files. For the password, please e-mail David Koch <FCIMBT@verizon.net>. David is a retired physics teacher who kindly volunteered in August 2009 for this service. When you e-mail him, please use your SCHOOL email address, or provide the URL of your school so that we can confirm that you are a teacher, rather than a student.
R-FCI The Representational Variant of the Force Concept Inventory by Nieminen, Savinainen & Viiri is available from PER-CENTRAL. More details are in P. Nieminen, A. Savinainen and J. Viiri, "Force Concept Inventory-based multiple-choice test for investigating students' representational consistency" Phys. Rev. ST Physics Ed. Research 6, 020109 (2010).
MBT The Mechanics Baseline Test (MBT; Hestenes & Wells) is available (as .pdf). Visit <http://modeling.asu.edu> and click on "Research and Evaluation". It is available in the following languages: English, Finnish (Suomi), French (France), German (Deutsch), Italian (Italiano), Malaysian (Bahasa), Persian, Portuguese, Spanish (Espanol), Turkish (Turkce.) For the password, please e-mail David Koch <FCIMBT@verizon.net>. David is a retired physics teacher who kindly volunteered in August 2009 for this service. When you e-mail him, please use your SCHOOL email address, or provide the URL of your school so that we can confirm that you are a teacher, rather than a student.
FMCE The Force and Motion Conceptual Evaluation was developed by Ron Thornton & David Sokoloff. Information can be see in R. Thornton, and D. Sokoloff, "Assessing student learning of Newton's laws: The Force and Motion Conceptual Evaluation and the Evaluation of Active Learning Laboratory and Lecture Curricula", Am. J. Phys., 66, Issue 4, 338-352 (1998).
RRMCS Rotational and Rolling Motion Conceptual Survey written by Chandralekha Singh and Lorenzo G. Rimoldini is available from PER-CENTRAL. This 30-question research-based multiple-choice test is designed to evaluate students' conceptual understanding of rotational and rolling motion.
EMCS The Energy and Momentum Conceptual Survey looks at concepts in energy and momentum, and was written by David Rosengrant and Chandralekha Singh, University of Pittsburgh. It is available from PER-CENTRAL. A Finnish version is available.
HCTE The Heat and Temperature Conceptual Evaluation is available from the Workshop Physics site. You'll need a password.
TCI Midkiff created an upper division engineering thermodynamics concept test. Contact Clark Midkiff or visit the website.
TTCI Thermal and Transport Concept Inventor (separate surveys also exist for thermo, heat, and fluids). More info is at this website. Contact Ron Miller. A password is required to see survey questions and Ron will be happy to provide one.
BEMA Chabay & Sherwood's Brief Electricity and Magnetism Assessment attempts to assess what students know about the most basic and central concepts of the calculus-based introductory E&M course. It is comprehensive, covering topics from the Coulomb force law to magnetic induction, but omitting radiation because it is so common for the intro course not to get that far. It has been used by various instructors in various settings and has been judged an appropriate and fair assessment of introductory E&M by physicists experienced in teaching E&M at various levels. It is not aimed at any particular curriculum but contains only those elements common to all calculus-based introductory courses. You will see on the cover page that some special grading can be imposed to make a more accurate measurement, and a spreadsheet is available from rwchabay@unity.ncsu.edu and basherwo@unity.ncsu.edu that performs these adjustments. Details about the test can be found in L. Ding, R. Chabay, B. Sherwood, and R. Beichner, "Evaluating an electricity and magnetism assessment tool: Brief electricity and magnetism assessment", Phys. Rev. ST Phys. Educ. Res. 2, 010105 (2006).
CURrENT Colorado UppeR-division ElectrodyNamics Test is a free-response assessment on basic topics from junior-level electrodynamics, where the focus is on gauging student understanding of fundamental concepts, and whether they can complete basic advanced E&M tasks. The post-assessment can be completed by students in less than 50 minutes; the pre-instruction version can be done in less than 15 minutes. More info available.
CSEM The Maloney, van Heuvelen, Hieggelke, and O'Kuma Conceptual Survey in Electricity and Magnetism (along with a separate test on electricity and another on magnetism) is available from maloney@ipfw.edu. More info can be found at the Two Year College Physics website and from D. Maloney, T. O'Kuma, C. Hieggelke, and A. Van Heuvelen, "Surveying students' conceptual knowledge of electricity and magnetism", Am. J. Phys. 69, S12 (2001).
DEEM Marx and Wilson have developed an E & M test that is available by contacting Jeff Marx at jmarx@mcdaniel.edu.
DIRECT 1.2 Engelhardt & Beichner's test of simple resistive electrical circuit concepts is available in English, Spanish, Greek, and Finnish by mailing a request to Engelhar@tntech.edu. More details are in P. Engelhardt, and R. Beichner, "Students' understanding of direct current resistive electrical circuits", Am. J. of Phys, 72, 98-115, (2004).
ECCE The Electric Circuits Conceptual Evaluation is available from the Workshop Physics site. You'll need a password.
SGLCE Symmetry and Gauss's Law Conceptual Evaluation written by Chandralekha Singh is available from PER-CENTRAL. This 30-question research-based multiple-choice test is designed to evaluate students' conceptual understanding of symmetry and Gauss's Law. The test may be administered to students in calculus-based introductory physics courses or upper-level undergraduate E&M courses.
MCS Magnetism Conceptual Survey written by Chandralekha Singh and Jing Li is available from PER-CENTRAL.This 30-question research-based multiple-choice test is designed to evaluate students' conceptual understanding of magnetism in algebra- and calculus-based introductory courses.
EMCI Notaros has created an instrument to assess learning in upper division E & M courses...the Electromagnetics Concept Inventory. Contact him at Branislav Notaros or visit the website.
CUE Colorado Upper Division Electrostatics (CUE) Asssessment was developed for upper division E&M I. It consists of a 17-item open-ended test with optional 9-item pretest. The test has good inter-rater reliability and has been validated using multiple measures. It tests student understanding of core learning goals in junior-level E&M, and allows one to probe common student ideas. Two papers have been published on the CUE: One on the preliminary validation and results, and another on common student ideas illuminated by the CUE. For more info, visit their info page. To receive a copy of the test to use in your course, contact Stephanie Chasteen at steven.pollock@Colorado.EDU.
Light and Optics: Rumor has it that a light & optics test is in the works from the Workshop Physics site.
LSCI The Light and Spectroscopy Concept Inventory was developed by Erin Bardar. An article, including a link to the instrument, is available online.
An intermediate geometric optics test is described in this article: Mark F. Masters and Timothy T. Grove, "Active learning in intermediate optics through concept building laboratories," Am. J. Phys. 78, 485-491 (2010).
QMVI The Quantum Mechanics Visualization Instrument by Robinett is available.
QMS Quantum Mechanics Survey written by Chandralekha Singh and Guangtian Zhu is available from PER-CENTRAL. This 31-question research-based multiple-choice test is designed to evaluate students' conceptual understanding of quantum mechanics in junior-level courses.
QMCS The Quantum Mechanics Conceptual Survey is availbable from the authors, McKagan, Perkins, and Wieman. A paper describing the test is online.
ADT Mike Zeilik and others have developed an astronomy diagnostic test. It is available from Mike Zeilik at MZeilik@aol.com. (You can copy it directly from a web page, if you'd like.) A collection of classroom assessment instruments can be found at FLAG.
AMS Michael LoPresto and Steven Murrell present their Astronomical Misconceptions Survey in the Journal of College Science Teaching, Vol 40, 5, pp 14-22.
LPCI Rebecca Lindell has created The Lunar Phases Concept Inventory, which is available from us.
TOAST Stephanie J. Slater and colleagues developed a next generation astronomy conceptual survey designed primarily for use with the introductory astronomy survey course, ASTRO 101. The test and its development are available at: Slater, S. J. (2015). The Development And Validation Of The Test Of Astronomy STandards (TOAST). Journal of Astronomy & Earth Sciences Education (JAESE), 1(1), 1-22.
Another SPCI is the Space Physics Concept inventory, created through a collaboration of the University of Colorado, UCLA, and the University of Texas. it is available online.
WDT The Wave Diagnostic Test written by Michael Wittman is located here.
The Solomon & Felder Index of Learning Styles is available on the web. Information giving many details on the Felder & Silverman Learning Styles Model is also available.
VASS Views About Science Survey is available from http://modeling.asu.edu/R&E/Research.html.You'll need to request a password to open the file.
CLASS Colorado Learning Attitudes about Science Survey and a scoring spreadsheet are available from http://CLASS.colorado.edu. Additional information can be found in W. K. Adams, K. K. Perkins, N. S. Podolefsky, M. Dubson, N. D. Finkelstein, and C. E. Wieman, "New instrument for measuring student beliefs about physics and learning physics: The Colorado Learning Attitudes about Science Survey", Phys. Rev. ST Phys. Educ. Res. 2, 010101 (2006).
EBAPS The Epistomological Beliefs Assessment for Physical Sciences is a forced-choice instrument designed to probe students' epistemologies, their views about the nature of knowledge and learning in the physical sciences. It was initially developed and validated by Andrew Elby, John Frederiksen, Christina Schwarz, and Barbara White at the University of California, Berkeley.
VNOS The Views of Nature of Science Questionnaire is widely cited, and according to the authors, "provides authentic assessment of students' views of the nature of science." A paper describing the develoment and validation of the survey is available here.
VOSE The Views on Science and education has a high reliability and is available from here. There is a paper describing the development of the instrument here.
MMCE The Mathematical Modeling Conceptual Evaluation is available from the Workshop Physics site. You'll need a password.
Jerome Epstein has been working on the Calculus Concept Inventory for a long time.
Two tests related to collaborative teams are available by contacting Ted Powers.
RAPT Two parallel versions of Allain & Beichner's Rate and Potential Test is available by sending e-mail to beichner@ncsu.edu.
CINS Conceptual Inventory of Natural Selection from Anderson DL, Fisher KM, Norman GJ. 2002. "Development and Evaluation of the Conceptual Inventory of Natural Selection". Journal of Research in Science Teaching 39(10): 952-978 (Dec. 2002). Also discussed in Nehm, R., & Schonfeld, I.S. (2008). Measuring knowledge of natural selection: A comparison of the C.I.N.S., an open-response instrument, and an oral interview. Journal of Research in Science Teaching, 45, 1131-1160.
GECI The Greenhouse Effect Concept Inventory was developed by John Keller. Contact him for more information.
Lawson's Classroom Test of Scientific Reasoning is available from Anthony Lawson by e-mailing him directly. Tell him we sent you!
Folks at Purdue have assembled a list of engineering concept inventories that you may find useful. The Foundation Coalition has created a sizable number of additional engineering tests.
Some folks have expressed interest in tests of biology concepts. Info is available online or by contacting Mike Klymkowsky of the University of Colorado at Boulder.
There are several systematic approaches to observing what goes on in a classroom. The most popular of theseis the RTOP (Reformed Teaching Observation Protocol). Information about it and the training to use it is available from Dan MacIsaac at SUNY College at Buffalo. A more recent tool is COPUS (Classroom Observation Protocol for Undergraduate STEM). An article describing its use is available.


text:
ACLU of Northern California & Amnesty International USA to San Francisco Police Commission: "Table the Taser Debate"
For Immediate Release: Feb 23, 2011
San Francisco – The ACLU of Northern California and Amnesty International USA will urge the San Francisco Police Commission at its meeting tonight to prioritize implementation of a new crisis intervention program instead of acquiring Tasers. Both groups point to the Commission's recent adoption of the "Memphis Model" of crisis intervention training for the police force as a crucial step that should be fully implemented before adding new weapons.
The SFPD renewed its request for Tasers following two officer-involved shootings in January of mentally ill individuals. The ACLU of Northern California and Amnesty International note the dangers of considering Tasers a panacea for dealing with mentally ill suspects.
"People with mental health issues are among the most likely to be subjected to Tasers, and are potentially at greater risk of being injured by them," said Rini Chakraborty, Western Regional Director for Amnesty International USA. "The SFPD should focus on giving its officers the best training to deescalate situations with mentally ill San Franciscans."
The Memphis Model, which originated in the Memphis Police Department in 1988, is a comprehensive approach to interacting with community members with mental health issues. The approach has received nationwide acclaim for its success in training officers and dispatchers, and developing sound protocol. Positive outcomes include fewer officer injuries as well as less need for use of force. Additionally, Memphis police have achieved these outcomes without the use of Tasers. In February, the San Francisco Police Commission voted unanimously to adopt the Memphis Model here, a move the ACLU of Northern California and Amnesty International USA applaud.
"The SFPD should give the Memphis Model a chance before moving on to Tasers," said Allen Hopper, Police Practices Policy Director at the ACLU of Northern California. "The idea that Tasers are harmless is false. They can cause serious and fatal injuries."
Tasers are controversial devices and a relatively new technology. The science about their effects continues to evolve. They potentially pose even greater risks when used on people with mental or physical health problems. The devices can be especially lethal for people taking medications or who are under the influence of drugs and alcohol – the very people who are most likely to have a Taser used on them.
ACLU of Northern California Memorandum to San Francisco Police Commission
San Francisco Chronicle Op-Ed, "SFPD needs to explain how it would use Tasers" (March 16, 2010)

redpajama_set_name: RedPajamaCommonCrawl


text:
\section{Introduction}

Quantum key distribution (QKD) \cite{BB84} is a technique for distributing information-theoretically secure secret keys between two parties connected by a quantum channel.
Beginning from the Bennett-Brassard 1984 (BB84) \cite{BB84}, and the Ekert 1991 protocols \cite{E91}, there is now a variety of  protocols proposed, e.g., \cite{B92,IWY02,GG02,HYAKN03,SYM14}.
Several different approaches have been advanced for proving the security of QKD systems using the ideal qubit detectors \cite{SP00,KGR05, Koashi}.

The squash operation, or the squashing model, is a useful mathematical tool for proving the security of QKD systems using practical (i.e., non-ideal) detectors \cite{TT08,BML08}.
Once its existence is proved for a given practical detector, one can incorporate it into a conventional type of security proof where receivers have ideal qubit detectors, and automatically obtains a new proof that remains valid even if the practical detectors are used.
The squash operation literally {\it squashes} an incoming state to a qubit, and also has a property that, when followed by qubit measurements, it acts exactly the same way as the practical detector.
In security proofs, there is no loss of generality in supposing that the squash operation is conducted by the attacker, and as the result of that, the security of a protocol using practical detectors is reduced to that using ideal qubit detectors.

A type of squash operation was first assumed in the security proof by Gottesman et al. \cite{GLLP02}, however, its existence was only conjectured, no proof was given.
The first proof was given by one of the present authors and Tamaki \cite{TT08}, for the case of the threshold detector of the BB84 type measurement.
This result was also verified independently by Beaudry, Moroder, and L\"utkenhaus \cite{BML08}.
There were also efforts toward constructing squash operations for a wider class of practical detectors.
For example, Beaudry et al. gave an explicit condition for the existence of a squash operation, and used it to show positive and negative results on the six-state protocol with threshold detectors \cite{BML08}.
Later their techniques were refined further and applied to other types of measurement devices \cite{GBNAML14}.
In Ref. \cite{T10}, one of the present authors discussed whether symmetries of a given detector can imply the existence of the squash operation corresponding to it, and also showed that the above result on the BB84 type measurement is valid even for multi-mode cases.
In addition to these uses in quantum cryptography, Moroder et al. applied the squash operation to entanglement verification with realistic measurement devices \cite{MGBPL10}.

Despite all these efforts, however, the method of the squash operation is still applicable only to a limited class of measurement devices.
In fact, even if we restrict ourselves to qubit measurements of the BB84 type, we can easily construct counterexamples to its existence (see Lemma \ref{lmm:no-go_theorem} in Section \ref{sec:multi-partite_squash_operations}).

In this paper, we demonstrate that the situation changes drastically by considering a generalized case where multi-partite measurements are involved.
That is, while all previous studies on the squash operation were concerned only with detectors used by a single player, we here consider a generalization including global measurements performed jointly by two players or more, such as the Clauser-Horne-Shimony-Holt (CHSH) measurement \cite{CHSH69}, used e.g. in the E91 protocol.
This approach allows us to relax mathematical conditions required for the existence of the squash operation, such that they can be fulfilled for a wider class of detectors.
Perhaps this is most easily illustrated by considering the CHSH measurement as an example.
If one regards the CHSH measurement as a mixture of local  $x,z$-basis measurements performed by Alice and Bob, there are two  basis for each player, which together yield four conditions that the squash operation has to satisfy.
On the contrary, if one regards the same measurement as one global measurement, there is no basis choice, and thus only one condition is required for the existence of the squash operation.

As an evidence of the effectiveness of this generalization, we apply it to the device-independent security analysis of the E91 protocol, and improve the key generation rate known so far:
The security of the E91 protocol using arbitrary detectors can be reduced to that of the BB84 protocol using single photon detectors,
and that allows us to prove the asymptotic key generation rate $R=1-h((2+\sqrt2)p)-f_{\rm ec}h(p)$, with $p$ being the quantum error rate (QBER), $h(p)$ the binary entropy, and $f_{\rm ec}$ the efficiency of error correction.
This rate $R$ is higher than in the previous literature on the device-independent E91 protocol \cite{HRW10, MPA11, BCK12, RUV13, VV14,VV14Erata}, except the one assuming collective attacks, a very limited attack scenario \cite{PABGSV09} (see Figure \ref{fig:key_rate}).
For example, when the optimal error correcting code with $f_{\rm ec}=1$ is available, one can generate the secret key with the QBER up to 5.4\%.

For obtaining this result, we use the same physical assumptions as in Ref. \cite{MPA11}.
Namely, we assume that quantum mechanics is valid, and that Alice's and Bob's detectors are memoryless, i.e., different detectors operate on different Hilbert spaces.
In comparison with the other existing literature, these assumptions are weaker than in Ref. \cite{PABGSV09}, where collective attacks are assumed, but stronger than in Refs. \cite{BCK12,RUV13,VV14, VV14Erata}, where detectors are not necessarily memoryless.
They are also stronger than in Ref. \cite{HRW10}, which does not assume quantum mechanics.

Our security proof of the E91 protocol proceeds as follows.
In the first step, we convert the E91 protocol using arbitrary detectors into a simplified version where uncharacterized qubit detectors are used.
For this purpose we borrow the technique used in Ref. \cite{PABGSV09}, and the result is that, without loss of security, we may restrict ourselves to a protocol where Alice and Bob use qubit detectors, parameterized by complex numbers $\alpha,\beta$.
In the next step, we eliminate the $\alpha,\beta$-dependence by applying a bipartite squash operation $F_{\alpha,\beta}$, which is designed such that the CHSH measurement, jointly performed by Alice and Bob, is transformed to the phase error measurement of the BB84 type, also jointly performed by the two players.
$F_{\alpha,\beta}$ is also designed so that it leaves Alice's sifted-key measurement unchanged.
As a consequence, the original E91 protocol is transformed to the BB84 protocol, which can readily be shown secure by referring to the existing literature, e.g., \cite{SP00,RennerPhD,HT12,TLGR12}.

The crucial observation here is that the minimum entropy of Alice's sifted key depends only on the results of Alice's sifted-key measurement, and of the CHSH measurements on sample pulses.
No other measurements affect the sifted key as they are performed locally and remotely from it.
Hence for proving the security of the E91 protocol, it suffices to find a squash operation that properly transforms the CHSH and Alice's sifted-key measurement.
While the previous formulation based on the one-partite squash operation demands four conditions, corresponding to Alice's and Bob's choices of $x,z$ basis, which cannot be fulfilled in general, the bipartite generalization demands only two.
This is why this new setting realizes the security proofs that were not possible previously.

\section{Review of concepts regarding quantum key distribution and the security}

In this section, we clarify the notation and concepts to be used in this paper.
In particular, we explain the security criteria of QKD protocols, and review the previous method of the squash operation, restricted to one-partite measurement.

\subsection{$\varepsilon$-security and the smooth minimum entropy}
\label{sec:epsilon_security}

For the sake of simplicity, we restrict ourselves to entanglement-based QKD protocols.
Also for the sake of simplicity, we assume that the secret key length is constant; i.e., we only consider the type of protocols where Alice and Bob decide whether the protocol is aborted or not, by checking the measurement results of randomly chosen sample pulses, and when it continues, the generated secret key has a fixed bit length $l$.
Such protocols can typically be described as follows.

\begin{oframed}
\noindent {\bf Procotol 1 (PR1)}: Typical entanglement-based protocol using detector $M_c$.
\begin{enumerate}
\item (Quantum communication) Eve generates quantum state $\rho^{ABE}$, and sends its sub-states in ${\cal H}^A$ and ${\cal H}^B$, each consisting of $N$ tensor products of a Hilbert space ${\cal H}^M$, to Alice and Bob, respectively.
\item (Basis choice) For each pulse $i\in\{1,\dots,N\}$, Alice (resp., Bob) chooses bases $c_{A,i}\in\{z, x\}$ (resp., $c_{B,i}\in\{z, x\}$).
\item (Quantum measurement) Alice (resp., Bob) measures them using operators $M^A_{i}\left(r_{A,i}|c_{A,i}\right)$ (resp., $M^B_{i}\left(r_{B,i}|c_{B,i}\right)$), and record the results $r_{A,i}$ (resp., $r_{B,i}$).
\item (Determining whether continuing the protocol or not) Alice and Bob communicate through the public channel, and decides sample pulses $I_{\rm smp}\subset\{1,\dots,N\}$, and sifted key pulses $I_{\rm sif}\subset\{1,\dots,N\}$ in such a way that $I_{\rm smp}\cap I_{\rm sif}=\emptyset$.
By checking the measurement results of sample pulses $I_{\rm smp}$, they decide whether they continue or abort the protocol.

If they continue, Alice lets her measurement results of sifted key pulses $I_{\rm sif}$ be her sifted key $u$.
\item (Alice's privacy amplification)
Alice randomly selects hash function $f_{\rm pa}$ and announces it to Bob.
She then inputs her sifted key $u$ to $f_{\rm pa}$ and obtains her secret key $k=f_{\rm pa}(u)$ of $l$ bits, and stores it in ${\cal H}^K$.

\item (Bob's post-processing)
Alice calculates syndrome of her sifted key $u$, and announces it to Bob.
Bob lets his measurement results of sifted key pulses $I_{\rm sif}$ be his sifted key $u'$.
He corrects errors in $u'$ using syndrome, and by inputting the outcome to a hash function $f_{\rm pa}$, he obtains his secret key.
\end{enumerate}
\end{oframed}

In what follows, we denote all data announced in the public channel by a random variable $V$, Alice's secret key by $K$, and the final state corresponding to the initial state by $\rho^{ABE}$.
Eve eavesdrops information regarding the secret key $K$ by referring to $V$ and measuring her sub-state in ${\cal H}^E$.
The security against this attack is usually analyzed by defining the ideal state, and then evaluating how close it is with the actual state.
It is customary to define the ideal state to be where Alice's secret key $K$ seen from Eve is the perfectly uniform random source, i.e., $\rho_{\rm mix}^{K}\otimes \rho^{VE}$ with $\rho_{\rm mix}^K=2^{-l}\sum_{k=0}^{2^l-1}|k\rangle\langle k|$.
It is also customary to use the trace distance for evaluating the closeness with the actual state.
\begin{Dfn}
\label{def:security_criteria}
We say that a given QKD protocol is $\varepsilon$-secure if the following relation holds for an arbitrary attack by Eve:
\begin{equation}
d_1(\rho^{KVE}|VE):=\left\|\rho^{KVE}-\rho_{\rm mix}^{K}\otimes \rho^{VE}\right\|_1\le \varepsilon.
\label{eq:security_criteria}
\end{equation}
\end{Dfn}
As shown in Ref. \cite{BHLMO05}, this definition of security satisfies universal composability.

As emphasized by Renner \cite{RennerPhD}, in evaluating the trace distance $d_1(\rho^{KVE}|VE)$,
it is useful to consider the smooth minimum entropy $H_{\rm min}^{\varepsilon'}(\rho^{UVE}|VE)$ of sifted key $U$, because it allows the use of  mathematical tools similar to those of the Shannon theory.
This property is sufficient for bounding the trace distance from above, i.e.,
\begin{Lmm}
\label{lmm:leftoverhashing}
If function $f_{{\rm pa},V}$ for privacy amplification is randomly chosen from a universal$_2$ function family \cite{CW79}, then for any (sub-normalized) sifted key state $\rho^{UVE}$,
\begin{equation}
d_1(\rho^{KVE}|VE)=d_1(\rho^{f_{{\rm pa},V}(U)VE}|VE)
\le 2\varepsilon'+2^{-\frac12\left(H_{\rm min}^{\varepsilon'}(\rho^{UVE}|VE)-l\right)}.
\label{eq:quantum_leftover_hashing}
\end{equation}
\end{Lmm}
Here we denoted hash function $f_{\rm pa}$ by $f_{{\rm pa},V}$ in order to emphasize that it is determined uniquely by the public communication $V$.
We note that there is a useful generalization for this lemma using {\it dual} universal$_2$ functions \cite{FS08,TH13}, which allows the use of practically useful hash functions \cite{HT13}.

According to this lemma, once a lower bound on $H_{\rm min}^{\varepsilon'}(\rho^{UVE}|VE)$ is obtained for a given protocol, its security follows immediately.
For example,
if one can somehow prove that
\begin{equation}
H_{\rm min}^{\varepsilon/4}(\rho^{UVE}|VE)\ge l+2\log_2\frac1{\varepsilon}+6
\label{eq:security_intermsof_H_min}
\end{equation}
holds for an arbitrary attack by Eve, then Lemma \ref{lmm:leftoverhashing} guarantees that condition (\ref{eq:security_criteria}) of Definition \ref{def:security_criteria}, and thus the protocol is $\varepsilon$-secure.

As we restrict ourselves to entanglement-based protocols in this paper, once Eve fixes the initial state $\rho^{ABE}$,
the state $\rho^{UVE}$ describing Alice's sifted key and Eve is uniquely determined, as well as $\rho^{KVE}$ describing Alice's secret key and Eve.
This fact can be used to simplify the notation to some extent.
Define a (not necessarily trace preserving) completely positive map $\Pi_{\rm sif}$ for describing Alice's sifted key generation, $\Pi_{\rm pa}$ for her privacy amplification, and $\Pi_{\rm sec}=\Pi_{\rm pa}\circ\Pi_{\rm sif}$ for secret key generation.
Then $\rho^{UVE}$ can be denoted as $\rho^{UVE}=\Pi_{\rm sif}(\rho^{ABE})$, $\rho^{KVE}=\Pi_{\rm sec}(\rho^{ABE})$.
Here we use a convention that $\rho^{U,V=v',E}=\rho^{K,V=v',E}=0$ when protocol is aborted and no secret key is generated (i.e., $v'$ denotes a record of public communication that includes ``abort'').
We also use the notations, $\rho_*^{KVE}$, $\rho_*^{UVE}$, $\Pi_{{\rm sec},*}$, $\Pi_{{\rm sif},*}$, with symbol $*$ specifying the protocol or game used.
For example, $\rho_{\rm PR1}^{KVE}$ is the final state generated by Protocol 1 (PR1) from the initial state $\rho^{ABE}$, i.e., $\rho_{\rm PR1}^{KVE}=\Pi_{\rm sec,PR1}(\rho^{ABE})$.

In these notations, condition (\ref{eq:security_criteria}) of Definition \ref{def:security_criteria} can be rewritten as
\begin{equation}
\max_{\rho^{ABE}}d_1(\Pi_{\rm sec}(\rho^{ABE})|VE)\le\varepsilon.
\label{eq:security_criteria_rewritten}
\end{equation}
Similarly, eq. (\ref{eq:security_intermsof_H_min}), which is a sufficient condition for (\ref{eq:security_criteria_rewritten}), can be rewritten as
\begin{equation}
\min_{\rho^{ABE}}H_{\rm min}^{\varepsilon/4}(\Pi_{\rm sif}(\rho^{ABE})|VE)\ge l+2\log_2\frac1{\varepsilon}+6.
\end{equation}

\subsection{Previous method using squash operations}
\label{sec:one_partite_squash}

As mentioned in Introduction, the squash operation is a mathematical tool that translates the security of a given QKD system using  practical detectors into that of qubit-based protocol.
In this subsection we review this method, based on the results of Ref. \cite{TT08}.
For the sake of simplicity, we will continue to restrict ourselves to entanglement-based protocols, although the method presented below can also be applied to prepare-and-measure protocols.

Consider a QKD system where Alice's and Bob's detectors are not necessarily ideal qubit detectors, and denote the Hilbert space of their input by ${\cal H}^{M}$.
For instance, for the threshold detector (see, e.g., Ref. \cite{TT08}), ${\cal H}^{M}$ is the Fock space representing multi-photons.
For the sake of simplicity, we will further assume that measurement basis $c$ is chosen from $\{x, z\}$, and that the measurement outcome is $r\in\{\pm1\}$.
We denote the corresponding POVM in ${\cal H}^M$ by $M(r|c)$.
For later convenience, we also define operator $M(c):=M(+1|c)-M(-1|c)$.
In this setting, the squash operation is defined as follows.
\begin{Dfn}[1-partite squash operation]
\label{dfn:one-partite_squash}
A squash operation is a quantum operation (i.e., a trace-preserving and completely positive (TPCP) map) $F:{\cal H}^M\to {\cal H}^2$,
satisfying,
\begin{eqnarray}
M(x)=F^\dagger(X),\label{eq:dfn:one-partite_squash_x}\\
M(z)=F^\dagger(Z),\label{eq:dfn:one-partite_squash_z}
\end{eqnarray}
where $X$, $Z$ denote the Pauli matrices of the $x,z$ basis.
\end{Dfn}
Here, $F^\dagger$ denotes the Hermitian conjugate of $F$, i.e., the operator satisfying ${\rm tr}(MF(\rho))={\rm tr}(F^\dagger(M)\rho)$ for arbitrary state $\rho$ and measurement $M$.

Definition \ref{dfn:one-partite_squash} demands that measuring any state with an arbitrary basis $c\in\{x,z\}$ using $M(c)=M(+1|c)-M(-1|c)$ is equivalent to performing squash operation $F$ on the state and then measuring the resulting qubit state with the Pauli operators $X,Z$.
If such operation $F$ exists, all measurements in Protocol 1 performed by Alice and Bob using $M(r|c)$ ($c\in\{X,Z\}$) can be decomposed into $F$ followed by the normal qubit measurements using $X,Z$.
In security proofs, there is no loss of generality in supposing that $F$ is conducted by the attacker, so the security of Protocol 1 above can be reduced to that of the following protocol \cite{TT08}.
\begin{oframed}
\noindent {\bf Protocol 2 (PR2)}: A qubit-based protocol.

Same as Protocol 1 except
\begin{enumerate}
\item Eve generates quantum state $\rho^{\bar{A}\bar{B}E}$, where ${\cal H}^{\bar{A}}$ and ${\cal H}^{\bar{B}}$ consists of qubit spaces.
Then she sends its sub-states in ${\cal H}^{\bar{A}}$ and ${\cal H}^{\bar{B}}$ to Alice and Bob, respectively.
\setcounter{enumi}{2}
\item Alice (Bob) measures pulse $i$ using the Pauli operators $X^A, Z^A$ (resp., $X^B, Z^B$) corresponding to basis $c_{A,i}=x,z$ ($c_{B,i}=x,z$), and record the results $r_{A,i}$ ($r_{B,i}$).
\end{enumerate}
\end{oframed}
In terms of the trace distance and the smooth minimum entropy, we have the following relations.
\begin{Lmm}
\label{lmm:one_partite_squash_operation}
Let $\rho^{KVE}_{\rm PR1}$ and $\rho^{KVE}_{\rm PR2}$ be the final states generated as a result of Protocol 1 and 2, respectively, then we have
\begin{equation}
\max_{\rho^{ABE}} d_1(\rho^{KVE}_{\rm PR1}|VE)\le \max_{\rho^{\bar{A}\bar{B}E}} d_1(\rho^{KVE}_{\rm PR2}|VE).
\end{equation}
Similarly, let $\rho^{UVE}_{\rm PR1}$ and $\rho^{UVE}_{\rm PR2}$ be the sifted-key states generated by Protocol 1 and 2, respectively, then
\begin{equation}
\min_{\rho^{ABE}}H_{\min}(\rho^{UVE}_{\rm PR1})\ge \min_{\rho^{\bar{A}\bar{B}E}}H_{\min}(\rho^{UVE}_{\rm PR2}).
\end{equation}
\end{Lmm}
In \ref{sec:proof_of_lemma2}, we give a formal proof of this lemma.

According to Lemma \ref{lmm:one_partite_squash_operation}, once the squash operation $F$ is shown to exist for a given detector $M(r|c)$, any security proof of a qubit-based protocol remains valid even when the qubit detectors are replaced with $M(r|c)$.
In other words, once $F$ is known to exist for a practical detector $M(r|c)$,  it always suffices to consider the simplified case where the ideal qubit detectors are used; all analyses related with $M(r|c)$ become unnecessary.
This is the advantage of considering the squash operation.

\section{Multi-partite squash operations}
\label{sec:multi-partite_squash_operations}

\subsection{Motivation}
As we have seen in the previous section, once the squash operation $F$ is shown to exist for a practical detector $M(r|c)$, it serves as a very useful tool for analyzing protocols involving $M(r|c)$.
At the present, however, $F$ is shown to exist for a relatively limited class of detectors, e.g., the threshold detector of the BB84 type measurement \cite{TT08,BML08,T10}, and of the six-state measurement with a passive basis choice \cite{BML08}, and a few others \cite{GBNAML14}.
In fact, even if we restrict ourselves to qubit measurements of the BB84 type, we can easily construct counterexamples of $F$:
\begin{Lmm}[limitation of the 1-partite squash operation for a qubit]
\label{lmm:no-go_theorem}
In the notation of Definition \ref{dfn:one-partite_squash}, let $M(x)=X_\alpha$, $M(z)=Z$ with $X_{\alpha}$ being the generalized $X$ operator, defined in \ref{app:Pauli_matrices}.
If $\alpha\ne i,-i$, there exists no squash operation $F$ satisfying conditions (\ref{eq:dfn:one-partite_squash_x}), (\ref{eq:dfn:one-partite_squash_z}).
\end{Lmm}
This can be verified readily by checking conditions (3a), (3b), (3c) of Ref. \cite{BML08}.
The lemma says that even if one uses perfectly sensitive qubit detectors $X_{\alpha},Z$, the corresponding $F$ does not exist unless the alignment of the $x, z$ axes (corresponding to $\alpha$) is also perfect\footnote{It should be noted that the lemma may not be true if the $x, z$ measurements are embedded in more than two dimensions, or if their sensitivities are not perfect. In fact this is why $F$ exists for many practical cases listed above the lemma.}.
Hence one cannot hope to apply the method of the 1-partite squash operation to general detectors and reduce the security proof to qubit spaces.
Note that this difficulty applies to any protocol using measurements of the BB84 type, including the E91 protocol.

In the rest of this paper, we show that this situation changes drastically by considering a generalized setting where multi-partite measurements are involved.
That is, while all previous studies of the squash operation were concerned with a detector used by a single player, we here consider a generalization including measurements performed jointly by two players or more, such as the Bell and the CHSH measurements.
This approach allows us to relax mathematical conditions required for the existence of the squash operation, such that they can be fulfilled for a wider class of measurements.

\subsection{Definition}
We write down the definition for the multi-partite case.
This is a simple generalization of the one-partite squash operation of the previous section.
Consider a situation where $n$ players $P_1,\dots,P_n$ agree on a basis choice $c$ and perform (possibly non-local) $n$-partite measurements in the Hibert state ${\cal H}^{P_1}\otimes\cdots\otimes {\cal H}^{P_n}$ using operator $M(r|c)$ to obtain an outcome $r$.
Here the basis choice $c$ can be a list $(c_1,\dots,c_n)$ consisting of $P_i$'s choices $c_i$, but is not limited to this type.
More generally, it may also specify non-local measurements, such as the CHSH measurement, denoted by $c={\rm CHSH}$.
We assume that $c$ is chosen from a predetermined set $C$.
We also assume there are measurement operators $m(r|c)$ defined for the same variables $r,c$, which operate in $n$-qubit spaces $\bar{\cal H}^{P_1}\otimes\cdots\otimes \bar{\cal H}^{P_n}$.
In this setting, the multi-partite squash operation is defined as follows.
\begin{Dfn}[$n$-partite squash operation]
The squash operation for $n$-partite measurements $M(r|c)$ and $m(r|c)$ is a quantum operation $F:{\cal H}^{P_1}\otimes\cdots\otimes {\cal H}^{P_n}\to \bar{\cal H}^{P_1}\otimes\cdots\otimes \bar{\cal H}^{P_n}$ which satisfies an equality
\begin{equation}
M(r|c)=F^\dagger(m(r|c))
\label{eq:multi_partite_squash_operation}
\end{equation}
or an inequality
\begin{equation}
M(r|c)\ge F^\dagger(m(r|c))
\label{eq:multi_partite_squash_operation_inequality}
\end{equation}
for each basis choice $c\in C$.
\end{Dfn}

In the following sections, we show that this generalized approach can be used to prove the security of the E91 protocol using any detectors.
This is an evidence that our approach indeed allows to apply the squash operation to a wider class of protocols or detectors than previously possible, including the counterexample given in Lemma \ref{lmm:no-go_theorem}.

\section{Application of bipartite squash operation: device-independent QKD protocol}

In order to demonstrate the effectiveness of the multi-partite squash operation, introduced in the previous section, we apply it to the device-independent security proof of the E91 protocol using arbitrary detectors, and obtain the device-independent key generation rate $R=1-h\left((2+\sqrt2)p\right)-f_{\rm ec}h(p)$, improved upon those obtained in the previous literature.

\subsection{Outline of the proof}

In this paper we only consider the types of post-processing algorithms which execute bit error correction and privacy amplification as independent processes and do not exploit their correlations.
Hence the security analysis amounts to evaluating the minimum entropy $H_{\min}(\rho^{UVE}|VE)$ associated with the joint state $U$ $\rho^{UVE}$ of Alice's sifted key and Eve's quantum state $VE$, conditioned on the result of the CHSH test performed by Alice and Bob.
Then by assuming that Alice's and Bob's detectors are memoryless, we can neglect back reactions from Bob's sifted key measurement (the $z'$-basis measurement), since it does not affect $\rho^{UVE}$, to be evaluated.
Hence it suffices to analyze how $\rho^{UVE}$ behaves under Alice's sifted-key measurement and the CHSH measurement, both consisting only of the $x$- and the $z$-basis measurements by Alice and Bob.

\subsubsection{Reduction to the qubit-based E91 protocol with uncharacterized $X$ measurement}
The first crucial step is to reduce this evaluation of $\rho^{UVE}$ to the case where only (generalized) qubit detectors are used.
Borrowing the argument of Ref. \cite{PABGSV09}, we can actually assume, without loss of generality, that input pulses to Alice and Bob are all qubits, and that they measure them using the generalized $x$, $z$ measurements in qubit space, defined by\footnote{Throughout the paper, we represent the Pauli matrices in the $y$-basis. For details see \ref{app:Pauli_matrices}.}
\begin{equation}
X_{\alpha}^A=
\left(
\begin{array}{cc}
0&\alpha\\
\alpha^*&0
\end{array}
\right),
\quad
X_{\beta}^B=
\left(
\begin{array}{cc}
0&\beta\\
\beta^*&0
\end{array}
\right),
\quad
Z^A=Z^B=
\left(
\begin{array}{cc}
0&1\\
1&0
\end{array}
\right),
\label{eq:reduced_detector_matrix_1}
\end{equation}
with $\alpha,\beta$ being complex numbers satisfying $|\alpha|=|\beta|=1$.
Parameters $\alpha$ and $\beta$ are chosen arbitrary by Eve and may vary for different qubit pairs $i$.
Accordingly, we may assume that Alice's sifted-key measurement and the CHSH measurement are
\begin{eqnarray}
M_{\alpha,\beta}(c_A=z)&=&Z^A\otimes \mathbb I^B,
\label{eq:qubit_Z_measurement_defined}\\
M_{\alpha,\beta}({\rm CHSH})&=&\frac14(Z^{A}\otimes Z^{B}+Z^{A}\otimes X^B_\beta
+X^A_\alpha\otimes Z^{B}-X^A_\alpha\otimes X^B_\beta).
\label{eq:def_M_alpha_beta_qubit}
\end{eqnarray}
The details of this reduction to qubit spaces are presented in Lemma \ref{lmm:decomposition_to_qubits} and in \ref{app:proof_reduction_to_qubit_measurement}.
In short, it suffices to evaluate $H_{\min}(\rho^{UVE}|VE)$, supposing that Alice and Bob jointly perform qubit-pair measurements (\ref{eq:qubit_Z_measurement_defined}), (\ref{eq:def_M_alpha_beta_qubit}), with $\alpha,\beta$ chosen arbitrarily by Eve.

\subsubsection{Bipartite squash operation}
The second step is to eliminate uncontrollable parameters $\alpha$, $\beta$, chosen by Eve, by a security reduction using the squash operation.
As we will prove in Theorem \ref{thm:squash_operation} of Section \ref{sec:bipartite_squash_operation}, there exists a bipartite squash operation $F_{\alpha,\beta}$ satisfying
\begin{eqnarray*}
F^{\dagger}_{\alpha,\beta}(Z^A\otimes \mathbb I^B)&=&Z^A\otimes \mathbb I^B,\\
F^{\dagger}_{\alpha,\beta}\left(\mathbb I+(\sqrt2-1)X^A\otimes X^B\right)&\ge&2M_{\alpha,\beta}({\rm CHSH}),
\end{eqnarray*}
where $X^A$ and $X^B$ are the usual Pauli operators: $X^A=X^A_{-i}, X^B=X^B_{-i}$, with $i=\sqrt{-1}$ being the imaginary unit.
By using this $F_{\alpha,\beta}$, the evaluation of $H_{\min}(\rho^{UVE}|VE)$ with qubit-pair measurement operators being (\ref{eq:qubit_Z_measurement_defined}), (\ref{eq:def_M_alpha_beta_qubit}) is reduced to the analysis of the BB84 protocol using sifted-key measurement $Z^A\otimes \mathbb I^B$ and the phase error measurement $X^A\otimes X^B$.

As a result, the security of the device-independent E91 protocol
is reduced to that of the BB84 protocol, which has been fully analyzed in the existing literature, e.g., \cite{SP00,RennerPhD,HT12,TLGR12}.
These are the main ideas of our security proof.

\subsection{Description of the Ekert 1991 protocol}
We consider the following version of the E91 protocol.

\subsubsection{Assumptions}
We use two assumptions for the security proof in the subsequent sections.
The first assumption is that quantum mechanics is valid.
The second assumption is for detectors:
Recall that we only consider the type of protocol where Eve prepares the initial state first, and Alice and Bob measure it using $N$ detectors respectively, with $N$ denoting the number of raw key bits.
In this setting we assume that these $2N$ detectors are memoryless, or uncorrelated with each other.

The precise description of the second condition is as follows.
Let us use variable $P\in\{A,B\}$ to denote players Alice and Bob.
We assume that the Hilbert space representing player $P$'s incoming state is clustered as ${\cal H}^{P}={\cal H}^{P}_1\otimes\cdots\otimes {\cal H}^{P}_N$, and that detector $i\in\{1,\dots,N\}$ operates only in subspace ${\cal H}^{P}_i$.
In other words, we assume that the $i$-th detector of player $P$ takes the form
\begin{equation}
\mathbb I^P_{1}\otimes \cdots\otimes \mathbb I^P_{i-1}\otimes M^P_{i}\left(r|c\right)\otimes\mathbb I^P_{i+1}\otimes \cdots\otimes \mathbb I^P_{N},
\label{eq:condition_cluster}
\end{equation}
where $c$ denotes the basis choice, $r\in\{\pm 1\}$ the output, and $\mathbb I^P_{i}$ the identity operator of ${\cal H}^{P}_i$.
We emphasize here that $M^P_{i}$ with different $P$ or $i$ may be different from each other.
In what follows we consider the situation where this conditions is guaranteed somehow, e.g., by shielding or separating detectors from each other.

We also restrict ourselves to the case where each detector $M^P_{i}$ always outputs value $r\in\{\pm 1\}$, and there is no inconclusive events, i.e.,
\begin{equation}
M^P_{i}(+1|c)+M^P_{i}(-1|c)=\mathbb I_{i}^P\quad{\rm for}\quad\forall c.
\end{equation}
Note this is not a new physical assumption, since any $M^P_{i}$ can be transformed to this type, e.g., by making it a rule that player $P$ assigns a random number $\pm1$ to output $c$ when detector $i$ says inconclusive.

\subsubsection{Procedures of the protocol}

The actual E91 protocol proceeds as follows.

\begin{oframed}
\noindent {\bf E91 Protocol, or  Game 0 (G0):} The E91 protocol with memoryless uncharacterized detectors.
\begin{enumerate}
\item (Quantum communication) Eve generates $N:=\displaystyle{\frac{n}{1-\delta}{\left(\frac1{1-q}\right)^2}}$ photon pairs  and sends them to Alice and Bob, where $\delta>0$ and $q\le 1/2$.

\item (Basis choice)
\begin{enumerate}
\item (Choosing sample and sifted key pulse candidates) On each pulse $i\in\{1,\dots,N\}$, Alice labels $b_{A,i}\in\{{\rm smp},{\rm sif}\}$ (denoting sample or sifted key candidate)
with probabilities $1-q, q$.
Bob also labels $b_{B,i}\in\{{\rm smp},{\rm sif}\}$ in the same manner.
\item (Alice's basis choices)
Alice does the following for each $i$: If $b_{A,i}={\rm sif}$, let the basis $c_{A,i}=z$.
If $b_{A,i}={\rm smp}$, let $c_{A,i}=x,z$ with probability 1/2.
\item (Bob's basis choice) Bob does the following for each $i$: If $b_{B,i}={\rm sif}$, let the basis $c_{B,i}=z'$.
If $b_{B,i}={\rm smp}$, let $c_{A,i}=x,z$ with probability 1/2.
\end{enumerate}

\item (Quantum measurement) Alice and Bob measure pulses using operators $M^A_{i}\left(c_{A,i}\right)$ and $M^B_{i}\left(c_{B,i}\right)$.
The results are recorded as $(r_{A,i},r_{B,i})\in \{\pm1\}^2$.

\item (Determining whether continuing the protocol or not)
\begin{enumerate}
\item Selection of sample and sifted key pulses:
\begin{enumerate}
\item Alice and Bob announce all their labels $b_{A,i},b_{B,i}$ and basis choices $c_{A,i},c_{B,i}$ ($i=1,\dots,N$).
\item Alice randomly selects $l_{\rm smp}:=\displaystyle{n\left(\frac{q}{1-q}\right)^2}$ pulses (resp., $n$ pulses) satisfying $b_{A,i}=b_{B,i}={\rm smp}$ (resp., $b_{A,i}=b_{B,i}={\rm sif}$), and registers those $i$ as sample pulses $I_{\rm smp}\subset\{1,\dots,N\}$ (resp., $I_{\rm sif}\subset\{1,\dots,N\}$).
If it is found that there are less than enough pulses satisfying the conditions, the protocol is aborted.
\end{enumerate}
\item Verification of the CHSH inequality:
\begin{enumerate}
\item Alice reveals $\{r_{A,i}\, |\, i\in I_{\rm smp}\}$ to Bob.
\item
Bob calculates
\begin{equation}
S=\frac1{l_{\rm smp}}\sum_{i\in I_{\rm smp}}(-1)^{r_{A,i}+r_{B,i}+t\left(c_{A,i},c_{B,i}\right)}
\label{eq:S_defined}
\end{equation}
where
\begin{equation}
t(c_{A},c_{B}):=
\left\{
\begin{array}{lll}
1 &{\rm if}\ c_{A}=c_{B}=x,\\
0&{\rm otherwise}.
\end{array}
\right.
\label{eq:t_defined}
\end{equation}
\item If $S$ is less than a given predetermined threshold $S_0$, Bob announces that the protocol is aborted.
\end{enumerate}
\item Generation of the sifted key:

Alice lets her measurement results of sifted key pulses $I_{\rm sif}$ be sifted key $u$, and stores it in ${\cal H}^U$.
\end{enumerate}
\item (Alice's post-processing)
Alice calculates syndrome $v_{\rm syn}$ of her sifted key for error correction, and announces it to Bob.
We assume that the syndrome length $|v_{\rm syn}|$ satisfy $|v_{\rm syn}|\le l_{\rm syn}$.

Alice also selects a universal hash function $f_{\rm cor}$ randomly with output length $|f_{\rm cor}(\cdot)|=\lceil \log(1/\varepsilon_{\rm cor})\rceil$, and announces $f_{\rm cor}$ along with the hash value $f_{\rm cor}(u)$ of sifted key $u$.

Alice selects another universal hash function $f_{\rm pa}$ with output length $l$ randomly, calculates secret key $k=f_{\rm pa}(u)$, and stores it in ${\cal H}^K$.

\item (Bob's post-processing)

Bob measures his sifted key pulses in the $z'$ basis to obtain his sifted key, and obtains corrected key $u'$ by performing bit error correction using syndrome $v_{\rm syn}$.
Then he verifies its correctness by checking if the hash value $f_{\rm cor}(u')$ of Bob's sifted key equals $f_{\rm cor}(u)$ sent from Alice.
If they differ the protocol is aborted; otherwise he obtains secret key of $l$ bits by applying a privacy amplification on the sifted key.
\end{enumerate}
\end{oframed}

\subsubsection{Remarks on the protocol besides security}

In Steps 2 and 4(a), Alice and Bob choose sample and sifted key pulses randomly, and if they fail to assign enough numbers of pulses, the protocol is aborted.
This abortion due to pulse selections occurs probabilistically and independently of Eve's choice of the initial state $\rho^{ABE}$.
This probability can be bounded by using the Chernoff bound (see, e.g., \cite{Mitzenmacher}, Theorem 4.5) as
\begin{equation}
{\rm Pr}[{\rm abort\ in\ Step\ 4(a)}]\le 2e^{-(\delta q)^2/2}.
\end{equation}

Parameter $S$, calculated in Step 3 (b), corresponds to the average of outcomes of the CHSH measurements.
That is, according to constructions of Step 2 and 3, obtaining $S$ is equivalent to measuring each sample pulse $i\in I_{\rm smp}$ using
\begin{eqnarray*}
&&\frac14( M_i^{A}(z)\otimes M_i^{B}(z) +  M_i^{A}(z)\otimes M_i^{B}(x)\\
&&\quad + M_i^{A}(x)\otimes M_i^{B}(z) -  M_i^{A}(x)\otimes M_i^{B}(x))
\end{eqnarray*}
with the outcome $s_i$, and then calculating the average $S=(l_{\rm smp})^{-1}\sum_{i\in I_{\rm smp}}s_i$.
In what follows, we will often call $S$ the {\it CHSH parameter}.

The uses of hash value $f_{\rm cor}(u)$ in Steps 5 and 6 guarantees that this protocol is $\varepsilon_{\rm cor}$-correct (see, e.g., Ref. \cite{RennerPhD,TLGR12}).

\subsection{Security of the above protocol}

\begin{Thm}
\label{Thm:security_E91}
The E91 protocol above is $\varepsilon$-secure.
That is, let $\rho^{KVE}_{\rm E91}$ be the final state generated by the E91 Protocol (or Game 0) on the input of initial state $\rho^{ABE}$,
consisting of secret key $K$, public communication $V$, and Eve's sub-state in ${\cal H}^E$.
Then we have
\begin{equation}
d_1(\rho^{KVE}_{\rm E91}|VE)\le \varepsilon,
\end{equation}
when the secret key length $l$ is chosen to be
\begin{eqnarray}
l&=&n\left(1-h\left((1+\sqrt2)\left(\frac1{\sqrt2}-S_0\right)+\mu'\right)\right)\nonumber\\
&&\ \ -2l_{\rm smp}-l_{\rm syn}-\log_2\frac1{\varepsilon_{\rm cor}}-2\log_2\frac3{\varepsilon},
\end{eqnarray}
with $\delta S$ and $\mu$ defined by
\begin{eqnarray}
\mu'&=&\left(4\sqrt3(1+\sqrt2)+\sqrt{\frac{(n+l_{\rm smp})(l_{\rm smp}+1)}{nl_{\rm smp}}}\right)\sqrt{\frac{1}{l_{\rm smp}}\ln\frac6{\varepsilon}}\,.
\label{eq:parameter_mu_defined}
\end{eqnarray}
where $h(p)$ denotes the binary entropy: $h(p)=-p\log_2 p-(1-p)\log_2 (1-p)$.
\end{Thm}
This theorem can be obtained by using the leftover hashing lemma (Lemma \ref{lmm:leftoverhashing}), and letting $\varepsilon'=\varepsilon/3$ in the following lemma.
\begin{Lmm}
Let $\rho^{UVE}_{\rm E91}$ be the state generated as a result of Steps 1 through 4 of the E91 Protocol (or Game 0) on the input of initial state $\rho^{ABE}$, and $U$ be the random variable denoting the sifted key.
Then $\rho^{UVE}_{\rm E91}$ satisfies, for an arbitrary value of $0<\varepsilon'\le1$, we have
\label{lmm:H_min_E91}
\begin{eqnarray}
\lefteqn{H_{\rm min}^{\varepsilon'}(\rho^{UVE}_{\rm E91}|VE)}\nonumber\\
&\ge& n\left(1-h\left((1+\sqrt2)\left(\frac1{\sqrt2}-\left(S_0-\delta S\right)\right)+\mu\right)\right)\\
&&-2l_{\rm smp}-l_{\rm syn}-\log_2\frac1{\varepsilon_{\rm cor}},
\end{eqnarray}
where
\begin{eqnarray}
\delta S&=&\sqrt{\frac{48}{l_{\rm smp}} \ln \frac2{\varepsilon'}}\,,\\
\mu&=&\sqrt{\frac{n+l_{\rm smp}}{nl_{\rm smp}}\frac{l_{\rm smp}+1}{l_{\rm smp}}\ln\frac2{\varepsilon'}}\,.
\label{eq:parameter_mu_defined}
\end{eqnarray}
\end{Lmm}
The proof of this lemma is given in the next section.

\subsection{Key generation rate for the qubit-based implementation}
In the ideal implementation of Ekert 1991 protocol, the entanglement source always generates the Bell state
\begin{equation}
|\Psi^{+1}\rangle:=\frac1{\sqrt2}\left(|0_z\rangle^A|0_{z'}\rangle^B+|1_z\rangle^A|1_{z'}\rangle^B\right),
\end{equation}
which is then sent to Alice and Bob, and measured using (presumable) single photon detectors.
In this setting, it is customary to rotate Bob's $x,z$ bases by 45 degrees with respect to those of Alice's, such that $S$ attains its maximum value $2\sqrt2$ when channels are noiseless.
It is also customary to choose Bob's $z'$ basis to be aligned with Alice's $z$ basis, so that their sifted keys match in the noiseless case.
When channels are noisy, e.g, the depolarizing channels with error rate $p$, the average of $S$ is
\begin{equation}
S=\frac{1-2p}{\sqrt2}
\end{equation}
and the bit error rate $p_{\rm sif}$ of sifted key equals $p$.

\begin{Crl}
In the above setting using single photon detectors, the asymptotic key generation rate $R:=\lim_{n\to\infty}n/N$ satisfies
\begin{equation}
R
=1-h\left((2+\sqrt2)p\right)-f_{\rm ec}h(p),
\end{equation}
where $f_{\rm ec}$ is the efficiency of error correction, i.e., asymptotic syndrome length is $l_{\rm syn}=f_{\rm ec}h(p)$.
\end{Crl}
{\it Proof:} For example, by choosing probability $q$ of basis choices as $q=n^{-1/2+\epsilon}$, $\epsilon>0$, we have $\mu'\to 0$, $l_{\rm smp}/N\to 0$, $n/N\to 1$ for $n\to\infty$, and obtain the lemma.
\hspace{\fill}$\blacksquare$

Note that this rate $R$ is improved upon those in the previous literature on the device-independent E91 protocol \cite{HRW10, MPA11, BCK12, RUV13, VV14,VV14Erata}, except for the one assuming collective attacks \cite{PABGSV09} (see Figure \ref{fig:key_rate}).

\begin{figure}
\centering
\includegraphics[width=10.00cm, clip]{key_rate.eps}
\caption{(Color online) Asymptotic key generation rates $R$ versus quantum bit error rate $p$.
The bold black curve is our device-independent (DI) key generation rate for the E91 protocol using memoryless detectors.
The orange, red and blue curves are those obtained in Ref. \cite{PABGSV09} (DI against collective attacks), Ref. \cite{MPA11} (DI using memoryless detectors), and Refs. \cite{VV14,VV14Erata} (fully DI), respectively.
The gray curve is the rate of the usual device-{\it dependent} scenario using the Pauli measurements and one-way classical communications.
We let the bit error correction efficiency $f_{\rm ec}=1$ for all the cases.
Note that we achieve a higher rate throughout the domain than those under the same (red, \cite{MPA11}) or a severer (blue, \cite{VV14,VV14Erata}) scenarios.}
\label{fig:key_rate}
\end{figure}

\section{Proof of Lemma \ref{lmm:H_min_E91}}

The rest of this paper is devoted to the proof of Lemma \ref{lmm:H_min_E91}.
Our goal is to obtain a lower bound of $H_{\rm min}^\varepsilon(\rho^{UVE}_{\rm E91}|VE)$, with $\rho^{UVE}$ a sifted key state generated by Alice and Bob in Procotol 1, the E91 protocol.
As the direct analysis of such a practical system is usually cumbersome, we will use an indirect approach.
We convert the protocol to simpler procedures called {\it games}, which are defined as quantum operation which output a final state $\rho^{UVE}$ on the input of initial state $\rho^{ABE}$.
We use this terminology because some of the converted procedures can no longer be considered as a communication protocol; e.g., in Games $1,\dots,4$ below, a substitute player Charlie alone plays both of Alice's and Bob's parts, and there is no communication.

In the proof below, we start with the E91 protocol, also called Game 0, and repeat converting it to Games $1,2,\dots$, until we reach Game $n$, which is simple enough to analyze directly.
Games $i$ will also be abbreviated as G$i$ in what follows.
In order to be able to bound the minimum entropy $H_{\rm min}^{\varepsilon'}(\rho^{UVE}_{{\rm E91}}|VE)$ of Game $0$ by those of other games, we design the conversions such that the minimum entropy of  Game $i$ is not larger than that of the preceding game, Game $i-1$, possibly with a constant offset term $l_i\ge0$.

That is, we design conversions from Game $i-1$ to $i$ such that
\begin{equation}
\min_{\rho^{ABE}}H_{\rm min}^{\varepsilon'}(\rho^{UVE}_{{\rm G}i-1}|VE)\ge\min_{\rho^{ABE}} H_{\rm min}^{\varepsilon'}(\rho^{UVE}_{{\rm G}i}|VE)-l_{i},
\label{eq:trace_distance_between_transformed_protocols}
\end{equation}
is satisfied for all $1\le i\le n$.
Here $\rho^{UVE}_{{\rm G}i}$ denotes the sifted key state generated as the result of Game $i$, on the input of $\rho^{ABE}$, i.e., $\rho^{UVE}_{{\rm G}i}=\Pi_{{\rm G}i,{\rm sif}}(\rho^{ABE})$.
In this setting, it is immediate that the minimum entropy of the original protocol is bounded by that of Game $n$ as
\begin{eqnarray}
\min_{\rho^{ABE}}H_{\rm min}^{\varepsilon'}(\rho^{UVE}_{{\rm E91}}|VE)
&=&\min_{\rho^{ABE}}H_{\rm min}^{\varepsilon'}(\rho^{UVE}_{{\rm G}0}|VE)\nonumber\\
&\ge& \min_{\rho^{ABE}}H_{\rm min}^{\varepsilon'}(\rho^{UVE}_{{\rm G}n}|VE)-\sum_{i=1}^{n}l_i.
\label{eq:bound_on_protocol0}
\end{eqnarray}
Hence if a lower bound is obtained for the final Game $n$, then that of the E91 protocol follows automatically.
This type of situation is often described as `the security of the original protocol is {\it reduced} to that of Game $n$'.
We note that this approach using game transformations is not essentially new, and is implicit in the previous literature, such as \cite{RennerPhD,SP00}.

In our proof below, Game $0$ is the E91 protocol (Protocol 1), and we convert it to simpler Games $i$ ($i\ge1$) satisfying relation (\ref{eq:trace_distance_between_transformed_protocols}), until we reach Game 4, a security game of the BB84 protocol.

\subsection{Definition of the security game and the basic strategy of our proof}

As the first step, we define the following game.

\begin{oframed}
{\bf Game 1 (G1):} Security game of the E91 protocol.
\begin{enumerate}
\item (Input of the initial state)
Charlie receives from Eve an initial state $\rho^{ABE}\in{\cal H}^A\otimes{\cal H}^B\otimes {\cal H}^E$, with ${\cal H}^A$ and ${\cal H}^B$ each forming a space of $N':=n+l_{\rm smp}$ photon pulses.

\item (Selection of samples and measurement bases)
\begin{enumerate}
\item Charlie selects $l_{\rm smp}$ pulse pairs randomly, label them as sample pulses: $I_{\rm smp}\subset\{1,\dots,N'\}$,
and announces it to Eve.
\item For all sample pulses $i\in I_{\rm smp}$, Charlie selects basis pairs $(c_{A,i},c_{B,i})\in\{(z,z),(z,x),(x,z),(x,x)\}$, each with probability $1/4$.
\end{enumerate}

\item (CHSH test)
Charlie measures sample pulses $i\in I_{\rm smp}$ using operator $M^A_{i}\left(c_{A,i}\right)\otimes M^B_{i}\left(c_{B,i}\right)$.
The results are recorded as $(r_{A,i},r_{B,i})\in \{\pm1\}^2$.
Then he calculates the CHSH parameter $S$ using (\ref{eq:S_defined}) and (\ref{eq:t_defined}), and if it is less than $S_0$, he announces to Eve that the protocol is aborted.

\item (Measurement of the sifted key)
Charlie measures each sifted key pulse $i\in I_{\rm sif}=\bar{I}_{\rm smp}=\{1,\dots,N'\}\setminus I_{\rm smp}$, using $M^A_{i}(z)\otimes \mathbb I^{B}$, and obtains a sifted key $U$ of $n$ bits.
Then he outputs the resulting state $\rho^{UVE}$.
\end{enumerate}
\end{oframed}

This game varies from Protocol 1 in four points:
\begin{itemize}
\item[i)] Alice's and Bob's procedures are all performed by a single substitute player, Charlie.
\item[ii)] For pulses that are neither samples nor sifted key, basis choices and measurement results are omitted.
\item[iii)] Charlie does not measure Bob's sifted key pulses.
\item[iv)] Charlie does not reveal basis choices of sample pulses, syndrome $v_{\rm syn}$ and hash value $f_{\rm cor}(u)$ to Eve, and keeps them secret.
\end{itemize}
It is straightforward to see that the first three modifications do not affect the output state $\rho^{UVE}$, nor the minimum entropy $H_{\min}^{\varepsilon'}(\rho^{UVE}|VE)$.
On the other hand, the fourth modification can affect $\rho^{UVE}$, since it erases some information available to Eve through public communication $V$, which is related with sifted key $U$ as well as basis choice of sample pulses.
In order to compensate the effect on $H_{\min}^{\varepsilon'}(\rho^{UVE}|VE)$ due to this lack of information properly,
we borrow results of Ref. \cite{RennerPhD} and prove the following lemma.

\begin{Lmm}
\label{lmm:Hmin_security_game}
For an arbitrary initial state $\rho^{ABE}$, we have
\begin{eqnarray}
H_{\rm min}^{\varepsilon'}(\rho^{UVE}_{{\rm E91}}|VE)
\ge H_{\rm min}^{\varepsilon'}(\rho^{UVE}_{{\rm G1}}|VE)-2l_{\rm smp}-l_{\rm syn}-\log_2\frac1{\varepsilon_{\rm cor}}.
\end{eqnarray}
\end{Lmm}
Note that this is an example of inequality (\ref{eq:trace_distance_between_transformed_protocols}).
The proof of this lemma is given in \ref{app:proof_min_entropy_compensation}.

\subsection{Reduction to a qubit-based game}

By borrowing the argument of Ref. \cite{PABGSV09}, we may assume, without loss of generality, that input pulses of Alice and Bob are all qubits.
\begin{Lmm}[c.f., Ref. \cite{PABGSV09}, Lemma 1]
\label{lmm:decomposition_to_qubits}
It is not restrictive to suppose that Eve sends to Alice and Bob a mixture $\rho_{AB}=\sum_{\alpha,\beta}p_{\alpha,\beta}\rho_{\alpha,\beta}$ of two-qubit states, together with a classical ancilla (known to her) that carries the values $\alpha,\beta$, and determines which measurements $M^A_{\alpha}(c_A)$ and $M^B_\beta(c_B)$ are to be used on $\rho_{\alpha,\beta}$.
\end{Lmm}
A proof sketch of this Lemma is given in \ref{app:proof_reduction_to_qubit_measurement}.
For the complete proof, we ask the reader to see Ref. \cite{PABGSV09}, Section 2.4.

This lemma states that, there is no loss of security (i.e., $H_{\min}(\rho^{UVE}|VE)$ does not increase), even if we restrict ourselves to the case where Eve generates a two-qubit state, accompanied by random variables $\alpha,\beta$, which are then measured by  Alice and Bob using operators $M^A_{\alpha}(c_A)$, $M^B_\beta(c_B)$.
With a suitable choice of bases, $M^A_{\alpha}(c_A)$, $M^B_\beta(c_B)$ can be expressed as $Z^A$, $Z^B$, $X^A_{\alpha}$, $X^B_{\beta}$ given in Eqs. (\ref{eq:reduced_detector_matrix_1}), (\ref{eq:reduced_detector_matrix_3}),
with $\alpha, \beta$ being complex numbers satisfying $|\alpha|=|\beta|=1$.
Thus the security of Game 1 can be reduced to that of the following game,
\begin{oframed}
{\bf Game 2 (G2):} (Qubit-based security game of the E91 protocol with uncharacterized detectors)

Same as Game 1 except
\begin{enumerate}
\item (Input of the initial state)
\begin{enumerate}
\item Eve selects complex numbers $\alpha_i$, $\beta_i$ ($|\alpha_i|=|\beta_i|=1$) for $i\in\{1,\dots,N'\}$, and announces them to Charlie.
\item Eve generates a state $\rho^{ABE}\in{\cal H}^A\otimes{\cal H}^B\otimes {\cal H}^E$, with each of ${\cal H}^A$ and ${\cal H}^B$ consisting of $N'$ qubit spaces, and gives it to Charlie.
\end{enumerate}

\setcounter{enumi}{2}
\item (CHSH test)
Charlie measures all $i\in I_{\rm smp}$ projectively using operators $Z^A\otimes Z^B$, $Z^A\otimes X^{B}_{\beta_i}$, $X^A_{\alpha_i}\otimes Z^B$, $X^A_{\alpha_i}\otimes X^B_{\beta_i}$ according to basis choices $(c^A_{i}, c^B_{i})=(z,z), (z,x), (x,z), (x,x)$.
The results are recorded as $(r^A_{i},r^B_{i})\in \{\pm1\}^2$.
Then he calculates the CHSH parameter $S$ using (\ref{eq:S_defined}) and (\ref{eq:t_defined}), and if it is less than $S_0$, he announces to Eve that the protocol is aborted.

\item (Measurement of the sifted key)
Charlie measures each sifted key pulse $i\in I_{\rm sif}=\bar{I}_{\rm smp}=\{1,\dots,N'\}\setminus I_{\rm smp}$ by using $Z^{A}\otimes \mathbb I^{B}$, and obtains a sifted key $U$ of $n$ bits.
Then he outputs the resulting state $\rho^{UVE}$.
\end{enumerate}
\end{oframed}
\noindent and we have the following lemma.
\begin{Lmm}
\label{lmm:Hmin_qubit_based_game}
For an arbitrary initial state
\begin{equation}
\min_{\rho^{ABE}} H_{\rm min}^{\varepsilon'}(\rho^{UVE}_{{\rm G2}}|VE)\le \min_{\rho^{ABE}} H_{\rm min}^{\varepsilon'}(\rho^{UVE}_{{\rm G1}}|VE).
\end{equation}
\end{Lmm}

\subsection{Conversion to coherent CHSH measurements}

Unlike Alice and Bob in the actual E91 protocol, Charlie in Games 1 and 2 does not reveal basis choices of sample pulses to Eve.
Hence, performing projective measurements using operators $Z^A\otimes Z^B$, $Z^A\otimes X^B_{\beta}$, $X^A_{\alpha}\otimes Z^B$, $X^A_{\alpha}\otimes X^B_{\beta}$ in Step 4 in Game 2 (according to randomly chosen $c_{A},c_{B}\in\{x,z\}$) is equivalent to performing a measurement using a POVM
\begin{equation}
M_{\alpha,\beta}(\pm1|{\rm CHSH}):=\frac12\left(\mathbb I^A\otimes\mathbb I^B\pm M_{\alpha,\beta}({\rm CHSH})\right),
\label{eq:def_M_pm_measurement}
\end{equation}
where
\begin{eqnarray}
M_{\alpha,\beta}({\rm CHSH})&:=&\frac14(Z^{A}\otimes Z^{B}+Z^{A}\otimes X^B_{\beta}\\
&&+X^A_{\alpha}\otimes Z^{B}-X^A_{\alpha}\otimes X^B_{\beta}).\nonumber
\end{eqnarray}

It is straightforward to verify that $M_{\alpha,\beta}({\rm CHSH})$ can be diagonalized as
\begin{eqnarray}
M_{\alpha,\beta}({\rm CHSH})
=\sum_{a=\pm1}a\left(|\mu| |\Psi^a_\mu\rangle\langle \Psi^a_\mu|
+|\nu||\Phi^a_\nu\rangle\langle \Phi^a_\nu|\right)
\end{eqnarray}
where parameters $\mu,\nu$ are defined by
\begin{eqnarray}
\mu(\alpha,\beta)
&&=
\frac14(1+\alpha+\beta-\alpha\beta),
\label{eq:mu_defined}\\
\nu(\alpha,\beta)
&&=
\frac14(1+\alpha+\beta^*-\alpha\beta^*),
\label{eq:nu_defined}
\end{eqnarray}
and vectors $\{ |\Psi_\mu^{\pm1}\rangle, |\Phi_\nu^{\pm1}\rangle\}$ are the Bell states defined by
\begin{eqnarray}
|\Psi^{\pm1}_\mu\rangle&=&\frac1{\sqrt2}\left(|0_y\rangle^A|0_y\rangle^B\pm\frac{\mu}{|\mu|}|1_y\rangle^A|1_y\rangle^B\right),\\
|\Phi^{\pm1}_\nu\rangle&=&\frac1{\sqrt2}\left(|0_y\rangle^A|1_y\rangle^B\pm\frac{\nu}{|\nu|}|1_y\rangle^A|0_y\rangle^B\right).
\end{eqnarray}
Note here that parameters $|\mu|,|\nu|$ satisfy
\begin{equation}
|\mu|^2+|\nu|^2=\frac12.
\label{eq:mu_nu_relation}
\end{equation}
and thus $|\mu|, |\nu|\le\frac1{\sqrt2}$.

Note that POVM measurement $M_{\alpha,\beta}(\pm1|{\rm CHSH})$, defined by (\ref{eq:def_M_pm_measurement}), is equivalent to: a) performing projective measurement $M_{\alpha,\beta}({\rm CHSH})$ to obtain a result $\in \{\pm|\mu|, \pm|\nu|\}$, and then b) adding to it a noise factor $\in\{\pm1\pm|\mu|,\pm1\pm|\nu|\}$ chosen locally by Charlie by a certain probability distribution.
The projective measurement $M_{\alpha,\beta}({\rm CHSH})$ can further be decomposed as:
 a-1)  performing the Bell state measurement,
 and then a-2) outputting $\pm|\mu|$ when $|\Psi^{\pm1}\rangle$ are measured, and $\pm|\nu|$ when $|\Phi^{\pm1}\rangle$.

Hence, as a result, Game 2 can be rewritten in the following equivalent form:
\begin{oframed}
{\bf Game 2' (G2'):} Same as Game 2 except
\begin{enumerate}

\setcounter{enumi}{2}
\item (CHSH test by POVM $M_{\alpha,\beta}(\pm1|{\rm CHSH})$)
Charlie performs the Bell measurement on each sample pulse $i\in I_{\rm smp}$ using the basis $\{ |\Psi^{\pm1}_{\mu_i}\rangle, |\Phi^{\pm1}_{\nu_i}\rangle\}$.
If he measures $|\Psi^a_{\mu_i}\rangle$, he outputs $s_{i}=b$ with probability $\frac12(1+ab|\mu_i|)$, where $a,b\in\{\pm1\}$,
and if he measures $|\Phi^a_{\nu_i}\rangle$, he outputs $s_{i}=b$ with probability $\frac12(1+ab|\nu_i|)$.

If the average $S=(l_{\rm smp})^{-1}\sum_{i\in I_{\rm smp}}s_{i}$ is below the threshold value $S_0$, he announces that the protocol is aborted.
\end{enumerate}
\end{oframed}

In this game the noise factors $\{\pm1\pm|\mu_i|,\pm1\pm|\nu_i|\}$ occur independently for each pulse $i$ with a probability independent of Eve's attack, so their perturbation to the average $S$ converge to zero rapidly with sample pulse number $l_{\rm smp}=|I_{\rm smp}|\to\infty$.
Hence the average $S$ can be replaced with the average of measurement results $\{\pm|\mu_i|,\pm|\nu_i|\}$ obtained by measurement $M_{\alpha_i,\beta_i}({\rm CHSH})$ up to a negligible error probability.
That is, for a new game defined as follows:
\begin{oframed}
{\bf Game 3 (G3):} Same as Game 2 except
\begin{enumerate}
\setcounter{enumi}{2}
\item (CHSH test by projective measurements with $M_{\alpha,\beta}({\rm CHSH})$)
Charlie measures each sample pulse $i\in I_{\rm smp}$ projectively with the basis $\{ |\Psi^{\pm1}_{\mu_i}\rangle, |\Phi^{\pm1}_{\nu_i}\rangle\}$, and outputs $s_{i}\in\{\pm|\mu_i|, \pm|\nu_i|\}$ respectively.
If the average $S=(l_{\rm smp})^{-1}\sum_{i\in I_{\rm smp}}s_{i}$ is below the threshold $S_0-\delta S$, he announces that the protocol is aborted.
\end{enumerate}
\end{oframed}
\noindent we have the following lemma:
\begin{Lmm}
\label{lmm:Hmin_G2_to_G3}
\begin{eqnarray}
\min_{\rho^{ABE}} H_{\rm min}^{\varepsilon'}(\rho^{UVE}_{{\rm G2}}|VE)
&\ge&\min_{\rho^{ABE}} H_{\rm min}^{\varepsilon'/2}(\rho^{UVE}_{{\rm G3}}|VE)\\
\frac{\varepsilon'}{2}&=&\exp(-l_{\rm smp}(\delta S)^2/48).
\end{eqnarray}
\end{Lmm}
The proof is straightforward, and is given in \ref{sec:locally_generated_randomness}.

\subsection{Bipartite squash operation}
\label{sec:bipartite_squash_operation}

The CHSH test of Game 3 still depends on parameters $\alpha$ and $\beta$, chosen arbitrarily by Eve.
Our next step is to eliminate this $\alpha,\beta$-dependence by converting them to a measurement consisting only of the usual Pauli operators $X, Z$.
For this purpose, we introduce a bipartite squash operation, $F_{\alpha,\beta}$, corresponding to $M_{\alpha,\beta}({\rm CHSH})$.

\begin{Thm}
\label{thm:squash_operation}
For any $\alpha$,$\beta$ satisfying (\ref{eq:mu_nu_relation}), there exists a squash operation $F_{\alpha,\beta}$ satisfying
\begin{eqnarray}
F_{\alpha,\beta}^\dagger\left(Z^{A}\otimes \mathbb I^{B}\right)&=&Z^A\otimes \mathbb I^B.\label{eq:E91_squash_condition1}\\
F^{\dagger}_{\alpha,\beta}\left(\mathbb I+(\sqrt2-1)X^A\otimes X^B\right)&\ge&2M_{\alpha,\beta}({\rm CHSH}),
\label{eq:E91_squash_condition2}
\end{eqnarray}
\end{Thm}
The proof of this theorem is given in \ref{app:proof_theorem_bipartite_squash}.

Condition (\ref{eq:E91_squash_condition1}) guarantees that sifted key $U$ has the same probability distribution whether $F_{\alpha,\beta}$ is applied or not.
It is an equality between POVM elements, as used in the previous formalism of the 1-partite squash operation.
On the other hand, condition (\ref{eq:E91_squash_condition2}) deviates the previous formalism  in that it is a relation between observables, not POVMs, so we elaborate on it and justify its use below.

The CHSH test of Game 3 is equivalent to checking
\begin{equation}
\frac1{l_{\rm smp}}\sum_{i\in I_{\rm smp}}2M_{\alpha_i,\beta_i}({\rm CHSH})^{A_iB_i}\ge 2(S_0-\delta S),
\label{eq:Bell_test_Game3}
\end{equation}
Suppose now that Charlie performs the CHSH test using $F_{\alpha,\beta}^\dagger(\cdots)$ on the l.h.s. of (\ref{eq:E91_squash_condition2}), instead of $2M_{\alpha,\beta}({\rm CHSH})$ on the r.h.s., without changing the threshold $S_0-\delta S$.
Then the test condition (\ref{eq:Bell_test_Game3}) becomes changed to
\begin{equation}
\frac1{l_{\rm smp}}\sum_{i\in I_{\rm smp}}F^{\dagger}_{\alpha_i,\beta_i}\left(\mathbb I^{A_iB_i}+(\sqrt2-1)X^{A_i}\otimes X^{B_i}\right)\ge 2(S_0-\delta S).
\label{eq:Bell_test_Game4}
\end{equation}
It is easy to see that any input state $\rho^{USVE}$ that can pass the CHSH test (\ref{eq:Bell_test_Game3}) always passes the new test (\ref{eq:Bell_test_Game4}) because of (\ref{eq:E91_squash_condition2}).
In this case we say that the new test (\ref{eq:Bell_test_Game4}) is {\it weaker} than (\ref{eq:Bell_test_Game3}).

More generally, we say that the CHSH test using observable $M_1$ is stronger (weaker) than that using $M_2$, whenever $M_1\le M_2$ ($M_1\ge M_2$) and they share the same threshold value for $S$.
In this terminology, we can prove that a stronger CHSH test results in an equal or larger minimum entropy $H_{\min}(\rho^{UVE}|VE)$.
Recall that we assume memoryless detectors, and thus sifted key $U$ and sample bits $S$ belong to different vector spaces (different sectors of tensor product).
In this case the CHSH test works as a filter that transforms an input $\rho^{USVE}$ to the output $\rho^{UVE}$.
Hence if the same state $\rho^{USVE}$ is CHSH-tested using observables $M_1\le M_2$, the resulting states satisfy $\rho^{UVE}_1\le\rho^{UVE}_2$, which leads to $H_{\min}(\rho_1^{UVE}|VE)\ge H_{\min}(\rho_2^{UVE}|VE)$ due to the property of the minimum entropy.
A more rigorous argument is given in \ref{sec:improved_lemma}.

We advance our game transformation further by applying this argument to Game 3.
By replacing condition (\ref{eq:Bell_test_Game3}) of Game 3 with (\ref{eq:Bell_test_Game4}), we obtain the following game:\footnote{%
In Game 4, we divide $F^{\dagger}_{\alpha_i,\beta_i}\left(\mathbb I^{A_iB_i}+(\sqrt2-1)X^{A_i}\otimes X^{B_i}\right)$ of (\ref{eq:Bell_test_Game4}) into two steps: $F_{\alpha_i,\beta_i}$ in Step (i)(c) and the $X^{A_i}\otimes X^{B_i}$ measurement in Step (iii).
We made this division so that the transition from Game 4 to 5 in the next subsection becomes transparent.
Note that this division does not affect the argument of this subsection, since it preserves the relation between inputs $\rho^{ABE}$ and outputs $\rho^{UVE}$ of Game 4.}
\begin{oframed}
{\bf Game 4 (G4):} Same as Game 2 except
\begin{enumerate}
\item \label{game2doubleprimestep1}
(Input of the initial state)
\begin{enumerate}
\item Same as Game 2.
\item Same as Game 2.
\item Charlie applies squash operations $F_{\alpha_i,\beta_i}$ to qubit pairs $i\in\{1,\dots,N\}$ given by Eve
\end{enumerate}
\setcounter{enumi}{2}
\item (Phase error measurements by operator $X^A\otimes X^B$)
Charlie measures sample pulse $i\in I_{\rm smp}$ using operator $X^{A_i}\otimes X^{B_i}$ and obtains results $t_i=\pm1$.
He announces that the protocol is aborted whenever
\begin{equation}
\frac{1}{l_{\rm smp}}\sum_{i\in I_{\rm smp}}t_i
\ge \frac{S_0-\delta S-\frac12}{\frac1{\sqrt2}-\frac12}
\label{eq:game3''condition}
\end{equation}
\end{enumerate}
\end{oframed}
\noindent Due to (\ref{eq:E91_squash_condition2}), the CHSH test condition of this game, (\ref{eq:Bell_test_Game4}), is weaker than that of Game 3, (\ref{eq:Bell_test_Game3}).
Hence for the same input state $\rho^{USVE}$, the minimum entropies after the CHSH tests of each game satisfy $H_{\min}(\rho_{\rm G3}^{UVE}|VE)\ge H_{\min}(\rho_{\rm G4}^{UVE}|VE)$.
From this we obtain the following lemma:
\begin{Lmm}
\label{lmm:Hmin_G3_to_G4}
\begin{eqnarray}
\min_{\rho^{ABE}} H_{\rm min}^{\varepsilon'/2}(\rho^{UVE}_{{\rm G3}}|VE)
&\ge&\min_{\rho^{ABE}} H_{\rm min}^{\varepsilon'/2}(\rho^{UVE}_{{\rm G4}}|VE)
\end{eqnarray}
\end{Lmm}

Now the whole quantum operation performed by Charlie in Step (\ref{game2doubleprimestep1}) of Game 4 can be regarded as a bipartite squash operation.
Thus we can apply the same argument as in Section \ref{sec:one_partite_squash}, and reduce this game to the following one where there is no squash operation.
Also, by noting that the phase error rate of samples is given by $p=\frac12\left(1-{l_{\rm smp}}^{-1}\sum_{i\in I_{\rm smp}}t_i\right)$, we see that condition (\ref{eq:game3''condition}) is equivalent to $p\le (1+\sqrt2)\left(\frac1{\sqrt2}-\left(S_0-\delta S\right)\right)$.
Hence, for the following game,
\begin{oframed}
{\bf Game 5 (G5):} Same as Game 2 except
\begin{enumerate}

\item (Input of the initial state)
Eve generates a state $\rho^{ABE}\in{\cal H}^A\otimes{\cal H}^B\otimes {\cal H}^E$, with each of ${\cal H}^A$ and ${\cal H}^B$ consisting of $N'$ qubit spaces, and gives it to Charlie.

\setcounter{enumi}{2}
\item (Phase error measurement using $X\otimes X$) Charlie detects phase errors of sample pulses $i\in I_{\rm smp}$ using operator $X^A\otimes X^B$, and aborts the protocol whenever the phase error rate $p$ satisfies
\begin{equation}
p\le (1+\sqrt2)\left(\frac1{\sqrt2}-\left(S_0-\delta S\right)\right).
\end{equation}
\end{enumerate}
\end{oframed}
\noindent we obtain the following lemma.
\begin{Lmm}
\label{lmm:Hmin_bipartite_squash}
\begin{eqnarray}
\min_{\rho^{ABE}} H_{\rm min}^{\varepsilon'/2}(\rho^{UVE}_{{\rm G4}}|VE)
&\ge&\min_{\rho^{ABE}} H_{\rm min}^{\varepsilon'/2}(\rho^{UVE}_{{\rm G5}}|VE).
\end{eqnarray}
\end{Lmm}

\subsection{Calculation of the key generation rate}

Since Game 5 is equivalent to the BB84 protocol,
by applying the existing security proofs of the BB84 protocol \cite{SP00,RennerPhD,HT12,TLGR12}, we can bound $H_{\rm min}^{\varepsilon'/2}(\rho^{UVE}_{{\rm G5}}|E)$ from below.
For example, by using a simple formula derived in \cite{TLGR12} for the finite length case, we obtain the following lemma.
\begin{Lmm}
\label{lmm:key_rate_of_finite_sized_BB84}
The output of Game 5, $\rho^{UVE}_{\rm G5}$, satisfies
\begin{equation}
H_{\rm min}^{\varepsilon'/2}(\rho^{UVE}_{{\rm G4}}|VE)\ge n\left(1-h\left((1+\sqrt2)\left(\frac1{\sqrt2}-\left(S_0-\delta S\right)\right)+\mu\right)\right).
\end{equation}
\end{Lmm}

{\it Proof:}
We follow the gedankenexperiment approach used in the security proof of \cite{TLGR12}.
Suppose that Alice and Bob perform $x$ basis measurement on all the squashed qubits, and denote Alice's measurement result by $W$ and Bob's by $W'$.
Then their maximum entropy is bounded by the threshold $Q_{\rm tol}$ of phase error rate of sample bits as
\begin{eqnarray}
H_{\max}^{\varepsilon'/2}(W|W')&\le& nh(Q_{\rm tol}+\mu)\nonumber\\
&=&nh\left((1+\sqrt2)\left(\frac1{\sqrt2}-\left(S_0-\delta S\right)\right)+\mu\right)
\end{eqnarray}
with $\mu$ defined in (\ref{eq:parameter_mu_defined}).
Combining this inequality with the uncertainty relation for smooth entropies derived in \cite{TR11}
\begin{equation}
H_{\min}^{\varepsilon'/2}(U|VE)+H_{\max}^{\varepsilon'/2}(W|W')\ge n,
\end{equation}
we obtain the lemma.
Here we used the notation $H_{\min}^{\varepsilon'/2}(U|VE)=H_{\min}^{\varepsilon'/2}(\rho^{UVE}|VE)$.
\hspace{\fill}$\blacksquare$

\subsection{Proof of Lemma \ref{lmm:H_min_E91}}
By combining Lemmas \ref{lmm:Hmin_security_game}, \ref{lmm:Hmin_qubit_based_game}, \ref{lmm:Hmin_G2_to_G3} \ref{lmm:Hmin_G3_to_G4}, \ref{lmm:Hmin_bipartite_squash}, and \ref{lmm:key_rate_of_finite_sized_BB84}, we obtain Lemma \ref{lmm:H_min_E91}.

\section{Conclusion}

We proposed a generalization of the squash operations involving  multi-partite measurements, and demonstrated that it allows us to prove the security of a wider class of QKD systems than previously possible.
In particular, we applied our method to prove the device-independent security of the Ekert 1991 (E91) protocol, and improved the key generation rate.

Note that for the conventional formalism of the 1-partite squash operation, there are explicit counterexamples, such as the one given in Lemma \ref{lmm:no-go_theorem}.
Hence our result on the device-independent E91 protocol is a concrete evidence that our approach indeed allows one to apply the squash operation to a wider class of protocols or detectors than previously possible.

We do not yet know how wide it will eventually be. Neither do we see any explicit limitation.
In this sense, possible future directions would be to investigate whether the techniques developed here can be applied to the cases where detectors are not memoryless, and to where two way classical communications are used for post processing.
It is also interesting to reinterpret the existing security proofs of partially device-independent or device-dependent protocols (e.g., Refs. \cite{GM14,M13}) using our method, and to develop them further.

\

\noindent{\bf Acknowledgment}

The authors would like to thank Takuya Hirano for valuable comments.
This work was partially supported by the National Institute of Information and Communications Technology (NICT), Japan, and by ImPACT Program of Council for Science, Technology and Innovation (Cabinet Office, Government of Japan).

redpajama_set_name: RedPajamaArXiv


The Government is to examine the threat caused to British security by hackers after a new mobile phone virus was discovered.
Michael Fabricant, Conservative MP for Lichfield, plans to raise the issue in Parliament with Home Secretary David Blunkett.
The infectious worm known as Cabir which has been discovered in mobile phones is not regarded as threatening in itself.
Mr Fabricant said that this was the first-known discovery of a mobile-phone virus, but that it was not a serious virus.
He said: "More virulent forms of the Cabir virus could disrupt our national mobile telephony network rendering handsets useless," he said.
"The US Government have set up a cyber terrorism branch of the Department for Homeland Security while Tony Blair seems to have no concept of the dangers that face us.
"Most companies now depend on mobile phones. A malevolent hacker or terrorist organisation could cause chaos to the British economy and health sector if mobile phones or our public utilities such as electricity companies were hit by a terror attack.
"I call upon the Government to protect our economic infrastructure against terrorist attack. We must institute a minister with cross-departmental powers and with resources to help prevent our vulnerability turning into a national tragedy."
Mr Fabricant said he would be tabling a series of Commons questions to Mr Blunkett on this issue.


text:
Home Authors Posts by Christina Wolfgram
Christina Wolfgram
Christina Wolfgram studied at the University of Oxford and Uncle Sam's Driving School in Gaithersburg, Maryland before moving to Los Angeles to earn her Masters of Professional Writing from USC. She began covering car culture for Los Angeles as Lady Driver in 2013 and helped launch the L.A. Driver blog the following year. Christina's comedy work can be found on YouTube, FunnyorDie.com, and —once—in one of Russell Crowe's tweets.
There's No Way a Movie Version of Cats Can Live Up...
Christina Wolfgram - March 4, 2019
L.A.'s Hamilton Sing-Alongs Are the New Karaoke
7 Hybrid Fitness Regimens That Will Shake Up Your Winter Workouts
Christina Wolfgram - December 3, 2015
L.A. History
Doom and Board: Four Ghost Stories from L.A.'s Most Famous Haunted...
Christina Wolfgram - October 5, 2015
The (Hollywood) Hills Are Alive: The Sound of Music National Tour...
Christina Wolfgram - September 18, 2015
The IQ of Ford Consoles Is About to Sky-Rocket
Christina Wolfgram - December 30, 2014
Man Uses Magic to Get Out of Speeding Ticket
Here's the Best Excuse to Let Your Car Get Filthy
On His Car Show, Seinfeld Lets a Promising Female Comic Take...
Lessons for Rainy Driving, Inspired by Angelina Jolie


The adventure begins picking the passengers up from Joya Andina Airport or Hotel in Uyuni city and our first stop will be Train Cemetery to see ancient locomotives.
Next, Colchani Village, this is a town that makes its living processing salt.
Then, we are going to see huge piles and block of salt.
Later, we are going to visit Playa Blanca Ex Salt hotel which is exposed as a Museum.
Then, we will have our lunch in Fish Island or other place on the salt flat (we have an option to make a barbecue here).
Then, we will go to Incahuasi Island.
Then, we are going to have a trekking in this Island to see the giant cacti and from the top of this island and we will appreciate the spectacular view of the salt flat.
We will have time to take amazing pictures in the salt flat during the afternoon and we will stay in the salt flat to look for a great spot to wait for the sunset and take more pictures of amazing landscapes and their reflection in the white desert. Finally, Return to Uyuni and leave the passengers in their hotel to have dinner and rest.
Do not forget to bring the following items: warm clothes, gloves, wool socks, hat covering your ears and to protect you from the sun, towel, lips moisturizer, sun block, sun glasses, waterproof clothes in Rainy season (From January to March), extra drinking water and a lot of energy to have fun.
I am interested in UYUNI + SUNSET TOUR! PRIVATE TOUR - BO-UYU-06 how much does it cost?


Program ASM_Bin2Dec demonstrates how to use the binary representation for an operand using Intel syntax. It converts the hard-coded binary value to denary.
Program ASM_Bin2DecA demonstrates how to use the binary representation for an operand using AT&T syntax. It converts the hard-coded binary value to denary.


The Sierra is in a class of its own. Combining the lightweight strength of an aluminum frame with the warmth of a faux wood finish, the Sierra delivers the best of both worlds. The clean, progressive styling makes it a natural fit to update the look in many environments, while the plush comfort ensures guests always have the best experience.


Introducing the next addventure – Great Britain by bike!
It's really happening kids! In just less than TWO MONTHS I'll be setting off on my quest to pedal through Britain and I couldn't be more excited! On April 19th I'll be cycling away from Land's End in Cornwall and heading on a firm north-east bearing until I wind up 1,000 miles down the road in John O'Groats (a.k.a. the top of Scotland) a little less than three weeks later. If that's not exciting enough, I'll get to celebrate my birthday on the road, have my mother bake me a gigantic chocolate cake AND take a sleeper train at the end of it all!
LEJOG (handy abbreviation for "Land's End to John O'Groats", the start and end points of the journey) is the journey from the most south-westerly point in Great Britain to its most north-easterly point (somewhat disputed but nbd). For whatever reason, this has become an iconic route and has been completed in all manner of different ways and times. I will be using the classic "bicycle" as my preferred mode of transport with a time that allows for exploration/getting lost but without me having to stress too much about packing the miles in. The shortest possible route is 814 miles, but as I will be going for safer, more enjoyable minor roads and cycle paths, I expect my mileage to be well over 900 miles. Maybe even 1,000 miles so I can justify singing The Proclaimers very loudly the whole way.
Mostly just me and my trusty steed, Aida. Matthes will join for a few days because that's the kind of thing I like to get for my birthday.
April 2015! Trains and planes are all considerably cheaper when booked in advance so both my outbound and return train journeys and flights are booked already – there's no turning back now! Planned arrival in John O'Groats is May 8th, or at any rate, I have to be on the train back by then.
Adventure! What more reason do you need?!
Doing an end-to-end tour has been on my "Things to do before I die" list since my dad told me about the time he assisted some guys who were doing it on roller blades. At some point last year I realised that I simply didn't have any reason not to do it – working freelance, it's not too difficult for me to stop working for three weeks, having cycled across the north coast of Scotland and 800km from Salzburg to Budapest a few years ago, I already had most of the kit I would need for a few weeks of cycle touring and, with the exception of a few flights and train journeys, there were no other major costs in my way. So I resolved to tick two long-standing items off my bucket list in 2015 – LEJOG and a marathon (yes, that's happening too).
So that's it for the basics, you can expect to hear lots more about this over the next few months. It would be great to get in touch with anyone who has already completed LEJOG or anyone who is planning on doing it soon (maybe even around the same time?!). Anyone want to be cycling BFFs?!


text:
Carriera
Ricciardi esordì nella OHL con gli Ottawa 67's nella stagione 1990-91 (71 presenze e 13 gol). Nella stagione 1992-93 collezionò 61 presenze e 7 gol con i Johnstown Chiefs nella ECHL, passando poi nella IHL con gli Indianapolis Ice (135 presenze e 5 gol in 2 stagioni), successivamente con i Las Vegas Thunder (75 presenze e 4 gol in 1 stagione) e infine con i Manitoba Moose (81 presenze e 3 gol in 1 stagione). Nella stagione 1997-98 gioca nella DEL con gli ECR Revier Löwen (28 presenze in 1 stagione), poi con i Kassel Huskies (18 presenze), con i Kölner Haie (50 presenze e 4 gol in 1 stagione), con i Schwenninger Wild Wings (46 presenze e 2 gol in 1 stagione), con i Düsseldorfer EG (59 presenze e 1 gol in 1 stagione) ed infine con i Frankfurt Lions (58 presenze e 1 gol in 1 stagione).

Nel 2003 approdò in Italia, con la maglia dell'Hockey Club Bolzano dove totalizzò 40 presenze e 4 gol. Dopo una stagione passò all'Asiago Hockey. Nel 2006 approdò all'Hockey Club Alleghe con cui giocò anche le stagioni successive fino al ritiro.

Note

Collegamenti esterni

redpajama_set_name: RedPajamaWikipedia


A collection of 13 songs from Mary's critically acclaimed three independent releases. Plus two previously unreleased live recordings. Beautifully packaged with 24-page booklet featuring extensive notes and photos. Completely remastered.


In 1952, Department Commander Dr. Garland D. Murphy, Jr. of Arkansas, came to The American Legion with an offer to provide a valuable contribution if we could figure out some way his gift could be used solely for children. After much study and discussion, the idea of a foundation was adopted. Later that year, the National Executive Committee appointed a special committee to determine the feasibility of establishing such a proposed foundation.
Eventually, on October 15, 1953, the National Executive Committee approved the establishment of the Foundation and entered into a trust agreement with Dr. Murphy. Legal work was completed, and on July 9, 1954, the Foundation was duly incorporated under the laws of the State of Indiana. At that time, Dr. Murphy assigned to the Foundation deeds to fractional mineral rights on nearly 10,000 acres of land in the oil-rich Williston Basin in Montana and North Dakota.
In 1955, it gave its first three grants totaling $22,500 to three organizations. The Delinquency Control Institute, the National Association for Retarded Children, and the National Society for the Prevention of Blindness were the first three beneficiaries.
To date, over $6 million has been awarded to organizations to assist the children of this country from the American Legion Child Welfare Foundation, Inc.
Any nonprofit organization may contact the Executive Secretary of the American Legion Child Welfare Foundation, Inc., and request in writing a copy of our application.
Application submissions should be limited to the pre-printed form.
Project outline should include direct impact on children and specific benefits of project.
Budget figures are required for the project only.
References should be individuals with a working knowledge of project and capable of answering questions concerning grant application.
The Executive Secretary reviews all grant proposals. Those that meet the criteria for consideration proceed to members of the Board of Directors.
Each year in mid-October, the Board of Directors meets to consider grant requests.
Personal appearances before the Board of Directors for the purpose of promotion and/or clarifying a grant by the grant applicant or associates are prohibited.
All grant seekers will receive written notification of decisions.
For more information visit www.cwf-inc.org.


text:
Nick Roberts
Jul 29, 2020 1 min read Technology
The vagabond data scientist
Machine learning on the road
Available on: Spotify, Apple, or Google
Technology episode
Nic Bertagnolli is an itinerant data scientist who lives almost full-time from his van with his partner, Laura McNerney, a previous guest of this show. He's also mathematician, tinkerer, and, though he may not admit it, a futurist and philosopher. Outside of this, Nic enjoys mountain biking, rock climbing, and mountaineering. He's worked for the likes of 3M, a series of startups, and even Verily, a health research company in Alphabet, as he travels the world with little more than a laptop on his mission for adventure and high accuracy, precision, and recall.
I speak to him about the state of machine learning and his areas of research. We also discuss the evolving relationship between humans and machines, potential futures, and how to keep current in one of the most dynamic domains of human knowledge.
Jeremy Howard's Fast AI class: https://www.fast.ai/about/
The Morning Paper with Adrian Colyer: https://blog.acolyer.org/
Music: "Morpho Diana" by the Rachel K. Collier
Sign up for articles, podcasts, and videos about technology, adventure travel, and more.
Subscribe Email sent
A review of our year on the road
Takeaways from nomad life.
Climbing the Grand Teton
My first true mountaineering expedition
Admiral Pete "Viper" Pettigrew on killing MiGs, filming Top Gun
A chat with Viper about his exploits in the F-4 Phantom.
Meditations at age 30
Birthday reflections.
A few thoughts on Everest
Looking back at Krakauer's account of the disaster on Everest in 1996.
Nick Roberts © 2023