# Quantum cryptographic resource distillation and entanglement

Minjin Choi  Department of Mathematics and Research Institute for Basic
Sciences, Kyung Hee University, Seoul 02447, Korea  Soojoon Lee  Department of
Mathematics and Research Institute for Basic Sciences, Kyung Hee University,
Seoul 02447, Korea

###### Abstract

We look into multipartite quantum states on which quantum cryptographic
protocols including quantum key distribution and quantum secret sharing can be
perfectly performed, and define the quantum cryptographic resource distillable
rate as the asymptotic rate at which such multipartite state can be distilled
from a given multipartite state. Investigating several relations between
entanglement and the rate, we show that there exists a multipartite bound
entangled state whose quantum cryptographic resource distillable rate is
strictly positive, that is, there exists a multipartite entangled state which
is not distillable, but can be useful for quantum cryptography such as quantum
key distribution and quantum secret sharing.

###### pacs:

03.67.Dd

##  I Introduction

Entanglement is one of the most significant resources for quantum
cryptography. In particular, it has been well known that any pure entangled
state can be useful in performing quantum cryptographic protocols, such as
quantum key distribution Ekert (1991) and quantum secret sharing Hillery et
al. (1999). However, it has also been known that there exist mixed states,
called the private states Horodecki et al. (2005); Horodecki and Augusiak
(2006); Horodecki et al. (2009) or the (genuine) secret sharing states Chi et
al. (2008); Choi and Lee (2021), which can distill perfectly secure key bits
or secret bits for secret sharing just by measurement. We here call such mixed
states the quantum cryptographic resource (QCR) states. Hence, it can be seen
that a QCR state is not only considered as a generalized version of the
private state or the genuine secret sharing state, but is also regarded as a
resource unit in a quantum cryptographic theory, while a pure maximally
entangled state plays a role of a resource unit in entanglement theory.

We consider a general form of the QCR states with one dealer party. In other
words, the QCR state that we here deal with is a multipartite quantum state,
and a private state on the parties can be obtained from the state by local
quantum operations and classical communication (LOCC) so that perfectly secure
key distribution is feasible between the dealer party and any player party of
the state. In addition, complete secret sharing on any number of divided
parties together with the dealer party of the QCR state is also possible,
although dishonest players cooperating with any exterior eavesdropper exist.
Thus, players can select one quantum cryptographic protocol among various
kinds of ones with the dealer on the same QCR state, as they want.

As in any resource theories including entanglement theory, it is both natural
and important to take into account the quantity representing how much amount
of QCR can be extracted from a given state, which we call the QCR distillable
rate of the state. We remark that since the simplest QCR state is a maximally
entangled state, the QCR distillable rate in entanglement theory is nothing
but the distillable entanglement Bennett et al. (1996a), and since the private
state is also a simple form of the QCR state, the QCR distillable rate in
quantum key distribution is equal to the distillable key rate Horodecki et al.
(2005, 2009); Chi et al. (2007). Hence, in this paper, we discover the
properties of the QCR distillable rate, and compare the QCR distillable rate
with the distillable entanglement and the distillable key rate.

We say that a multipartite state is QCR distillable if its QCR distillable
rate is strictly positive. Then it is clear that a QCR distillable state is
entangled, since if a multipartite state has a separable bipartite split, then
perfectly secure key distribution is impossible between the split, and hence
the state is not QCR distillable. However, it does not seem to be true that
all entangled states are QCR distillable, because its simplest case is not
true, that is, there exists a bipartite bound entangled state with positive
secret key distillable rate Horodecki et al. (2005, 2009); Chi et al. (2007).

In this paper, we first present necessary and sufficient conditions for the
QCR state with a dealer party, and definition of the QCR state, and then show
that a given multipartite quantum state is a QCR state if and only if the
conditions on the state hold. We also define the QCR distillable rate of a
given multipartite state in a mathematical way, and present some properties on
the QCR distillable rate. Finally, by providing the method to construct a QCR
state with larger number of parties from several QCR states, we prove the
existence of multipartite bound entangled but QCR distillable states.

This paper is organized as follows. In Sec. II, we first define the QCR state,
and justify the definition. After showing the several properties of the QCR
states, we also present the mathematical definition of the QCR distillable
rate of a given state in Sec. III, and investigate some relations between the
QCR distillable rate and other distillable rates such as the entanglement
distillable rate and secret key distillable rate. We finally show that there
exists a multipartite QCR distillable state without any distillable
entanglement.

##  II QCR states

Assume that there are one dealer and $N$ players who participate in a quantum
cryptographic protocol, and let $D=\bar{D}\widetilde{D}$ be the dealer’s
quantum system with two subsystems $\bar{D}$ of $d$ dimension and
$\widetilde{D}$ of arbitrary dimension in the protocol. Similarly, for each
$1\leq i\leq N$, let $A_{i}=\bar{A}_{i}\widetilde{A}_{i}$ be the $i$-th
player’s quantum system with subsystems $\bar{A}_{i}$ of $d$ dimension and
$\widetilde{A}_{i}$ of arbitrary dimension. Throughout this paper, we denote
$\bar{A}_{1}\cdots\bar{A}_{N}$ and $\widetilde{A}_{1}\cdots\widetilde{A}_{N}$
by $\mathbf{\bar{A}}$ and $\widetilde{\mathbf{A}}$, respectively, and denote
$\mathbf{\bar{A}}\widetilde{\mathbf{A}}$ by $\mathbf{A}$. The systems
$\bar{\mathbf{A}}$ and $\mathbf{\widetilde{A}}$ are called the information
part and the shield part, respectively.

In order to perform the quantum cryptographic protocol, the dealer’s and
players’ information should satisfy the following cryptographic conditions:

  1. (i)

The probability distributions of the dealer’s and all players’ information
must be unbiased and perfectly correlated.

  2. (ii)

An eavesdropper and dishonest players cannot get any information about the
dealer’s information.

  3. (iii)

The dealer and any subset of players can perform the same protocol with
smaller number of parties after properly applying LOCC.

When $N=1$, if the dealer and the player share the private states Horodecki et
al. (2005); Horodecki and Augusiak (2006); Horodecki et al. (2009), or when
$N\geq 2$, if the dealer and the players share the genuine secret sharing
states Choi and Lee (2021), then the above three conditions are surely
satisfied. However, since any player can be a dealer in the private states and
the (genuine) secret sharing states, considering the case where the dealer is
predetermined is more general than those in the private states and the
(genuine) secret sharing states, Thus, we introduce the class of quantum
states suitable for the case where the dealer is determined in advance.

######  Definition 1.

$\Upsilon_{D\mathbf{A}}$ is called a QCR state if for any bipartite split
$\\{\mathbf{P}_{1},\mathbf{P}_{2}\\}$ of the players with $\mathbf{P}_{1}$
consisting of at least one player and
$\mathbf{A}=\mathbf{P}_{1}\mathbf{P}_{2}$, the given state
$\Upsilon_{D\mathbf{A}}$ can be written as

$\displaystyle\frac{1}{d^{N}}\sum_{iI_{1}I_{2},jJ_{1}J_{2}\in\mathfrak{S}_{N}^{0}}\ket{iI_{1}I_{2}}_{\bar{D}\mathbf{\bar{P}}_{1}\mathbf{\bar{P}}_{2}}\bra{jJ_{1}J_{2}}\otimes\left(U_{\widetilde{D}\mathbf{\widetilde{P}}_{1}}^{iI_{1}}V^{{I}_{2}}_{\widetilde{D}\mathbf{\widetilde{A}}}\right)\sigma_{\widetilde{D}\mathbf{\widetilde{A}}}\left(U_{\widetilde{D}\mathbf{\widetilde{P}}_{1}}^{jJ_{1}}V^{J_{2}}_{\widetilde{D}\mathbf{\widetilde{A}}}\right)^{\dagger},$
(1)

where

$\mathfrak{S}_{N}^{t}\equiv\left\\{jJ=jj_{1}j_{2}\cdots
j_{N}\in\mathbb{Z}_{d}^{N+1}:j+\sum_{k=1}^{N}j_{k}\equiv t\pmod{d}\right\\},$
(2)

$\bar{D}\mathbf{\bar{P}}_{1}\mathbf{\bar{P}}_{2}=\bar{D}\mathbf{\bar{A}}$ and
$\widetilde{D}\mathbf{\widetilde{A}}$ are the information part and the shield
part of the QCR state $\Upsilon_{D\mathbf{A}}$, respectively,
$\sigma_{\widetilde{D}\mathbf{\widetilde{A}}}$ is an arbitrary state, and the
$\left\\{U_{\widetilde{D}\mathbf{\widetilde{P}}_{1}}^{iI_{1}}\right\\}$ and
$\left\\{V^{{I}_{2}}_{\widetilde{D}\mathbf{\widetilde{A}}}\right\\}$ are
unitary operators on the systems $\widetilde{D}\mathbf{\widetilde{P}}_{1}$ and
$\widetilde{D}\mathbf{\widetilde{A}}$, respectively.

For instance, let
$\ket{\Upsilon}_{\bar{D}\bar{A}\bar{B}\widetilde{D}\widetilde{A}\widetilde{B}}$
be the following state.

$\displaystyle\ket{\Upsilon}_{\bar{D}\bar{A}\bar{B}\widetilde{D}\widetilde{A}\widetilde{B}}=\frac{1}{2}$
$\displaystyle(\ket{000}_{\bar{D}\bar{A}\bar{B}}\ket{000}_{\widetilde{D}\widetilde{A}\widetilde{B}}+\ket{011}_{\bar{D}\bar{A}\bar{B}}\ket{100}_{\widetilde{D}\widetilde{A}\widetilde{B}}+\ket{101}_{\bar{D}\bar{A}\bar{B}}\ket{100}_{\widetilde{D}\widetilde{A}\widetilde{B}}+\ket{110}_{\bar{D}\bar{A}\bar{B}}\ket{000}_{\widetilde{D}\widetilde{A}\widetilde{B}}).$
(3)

Then we can readily check that the state
$\Upsilon_{\bar{D}\bar{A}\bar{B}\widetilde{D}\widetilde{A}\widetilde{B}}=\ket{\Upsilon}\bra{\Upsilon}$
is a QCR state, but not a genuine secret sharing state in Reference Choi and
Lee (2021). Furthermore, when $N=1$, the QCR state
$\Upsilon_{\bar{D}\bar{A}\widetilde{D}\widetilde{A}}$ in Definition 1 can be
written as

$\frac{1}{d}\sum_{i,j\in\mathbb{Z}_{d}}\ket{i,-i}_{\bar{D}\bar{A}}\bra{j,-j}\otimes\left(U^{i}_{\widetilde{D}\widetilde{A}}\right)\sigma_{\widetilde{D}\widetilde{A}}\left(U^{j}_{\widetilde{D}\widetilde{A}}\right)^{\dagger},$
(4)

which is essentially equivalent to a private state, and all genuine secret
sharing states in Reference Choi and Lee (2021) are QCR states. Hence, the QCR
state can be regarded as a generalization of the private states and the
genuine secret sharing states with respect to quantum cryptography.

######  Theorem 1.

Suppose that a dealer and $N$ players share a quantum state
$\rho_{D\mathbf{A}}$. The dealer and players can obtain information satisfying
the above cryptographic conditions (i) and (ii) after they measure their
information parts in the computational basis if and only if the state
$\rho_{D\mathbf{A}}$ is a QCR state.

######  Theorem 2.

Assume that a dealer $D$ and $N$ players $\mathbf{A}$ share an $(N+1)$-party
QCR state. For any bipartite split $\\{\mathbf{P}_{1},\mathbf{P}_{2}\\}$ of
the players $\mathbf{A}=\mathbf{P}_{1}\mathbf{P}_{2}$ with
$\left|\mathbf{P}_{1}\right|=M\geq 1$, if players $\mathbf{P}_{2}$ measure
their information parts and correctly announce the measurement outcomes, then
$D\mathbf{P}_{1}$ can share an $(M+1)$-party QCR state after the dealer
applies a proper unitary operation on the dealer’s part.

Theorem 2 tells us that from a given QCR state, a QCR state on any smaller
number of players and the dealer as well as a private state between any player
and the dealer can be shared by LOCC, as seen in the Figure 1. In other words,
Theorem 2 implies that any QCR state satisfies the cryptographic condition
(iii).

Figure 1:  As in Theorem 2, from the $\Upsilon_{D\mathbf{A}}$, a private state
$\Upsilon_{DA_{k}}$ or a QCR state $\Upsilon_{D\mathbf{A}^{\prime}}$ with
smaller number of parties can be obtained by LOCC, where
$\mathbf{A}^{\prime}=A_{i_{1}}A_{i_{2}}\cdots A_{i_{m}}$.

######  Theorem 3.

Assume that there are two QCR states $\Upsilon_{D_{A}\mathbf{A}}$ and
$\Upsilon_{D_{B}\mathbf{B}}$, where both $D_{A}$ and $D_{B}$ are the dealer’s
parties, and $\mathbf{A}=A_{1}\cdots A_{N}$ and $\mathbf{B}=B_{1}\cdots B_{M}$
are two different sets of players. Then the dealer and all players share a QCR
state $\Upsilon_{D\mathbf{AB}}$ via the dealer’s proper local operations,
where $D=D_{A}D_{B}$.

Figure 2:  Constructing a QCR state with larger number of parties from two QCR
states $\Upsilon_{D_{A}\mathbf{A}}$ and $\Upsilon_{D_{B}\mathbf{B}}$ in
Theorem 3.

By Theorem 3, we can see that a larger QCR state can be obtained from two
different QCR states with the same dealer party as seen in the Figure 2.
Furthermore, we note that the private state is considered as a QCR state with
one dealer and one player. Hence, by mathematical induction, we have the
following corollary.

######  Corollary 4.

Suppose that each of $N$ players shares a private state with one dealer. Then
they can have an $(N+1)$-party QCR state by applying the dealer’s proper local
operations.

##  III QCR distillable rate and bound entangled states

Before defining the QCR distillable rate, we look at the distillable
entanglement and the distillable key rate. Let $\Phi^{m}_{AB}$ and
$\gamma^{m}_{ABA^{\prime}B^{\prime}}$ be denoted by the maximally entangled
state with $m=\log\dim(A)=\log\dim(B)$ and the private state with
$m=\log\dim(A)=\log\dim(B)$, respectively, where $\dim(\cdot)$ is the
dimension of the system. The distillable entanglement $E_{\mathrm{D}}$ is
defined as the rate at which maximally entangled states can be distilled under
LOCC Bennett et al. (1996b), that is,

$E_{\mathrm{D}}\left(\rho_{AB}\right)=\lim_{\delta\rightarrow
0}\lim_{n\rightarrow\infty}\sup_{\Lambda_{{A}:{B}}}\left\\{E:\|\Lambda\left(\rho_{AB}^{\otimes
n}\right)-\Phi_{AB}^{nE}\|_{1}\leq\delta\right\\},$ (5)

where $\Lambda_{{A}:{B}}$ is an LOCC protocol between Alice and Bob.
Similarly, the distillable key rate $K_{\mathrm{D}}$ is defined as the rate at
which private states can be distilled under LOCCHorodecki et al. (2005, 2009),
that is,

$K_{\mathrm{D}}\left(\rho_{AB}\right)=\lim_{\delta\rightarrow
0}\lim_{n\rightarrow\infty}\sup_{\Lambda_{{A}:{B}}}\left\\{K:\big{\|}\Lambda\left(\rho_{AB}^{\otimes
n}\right)-\gamma_{AB}^{nK}\big{\|}_{1}\leq\delta\right\\}.$ (6)

Since we can define the QCR distillable rate for any state in a similar way to
the above definitions, from the definition, we can know how many copies of the
given state are required to asymptotically distill a QCR state through LOCC.
The QCR distillable rate $CR_{\mathrm{D}}$ of a given multipartite quantum
state $\rho_{D\mathbf{A}}$ is defined as

$CR_{\mathrm{D}}\left(\rho_{D\mathbf{A}}\right)=\lim_{\delta\rightarrow
0}\lim_{n\rightarrow\infty}\sup_{\Lambda}\left\\{K:\big{\|}\Lambda\left(\rho_{D\mathbf{A}}^{\otimes
n}\right)-\Upsilon_{D\mathbf{A}}^{nK}\big{\|}_{1}\leq\delta\right\\},$ (7)

where $\Lambda$ is the dealer’s and all players’ LOCC operation, and
$\Upsilon_{D\mathbf{A}}^{m}$ denotes a QCR state whose information part
$\bar{D}\bar{A}_{1}\bar{A}_{2}\cdots\bar{A}_{N}$ satisfies
$m=\log\dim(\bar{D})=\log\dim(\bar{A}_{i})$ for all $i$.

Let us now investigate the connection between the distillable key rate and the
QCR distillable rate. It follows from Theorem 2 that

$CR_{\mathrm{D}}\left(\rho_{D\mathbf{A}}\right)\leq
K^{D\mathbf{P}_{1}:\mathbf{P}_{2}}_{\mathrm{D}}\left(\rho_{D\mathbf{A}}\right)$
(8)

for any bipartite split $\\{\mathbf{P}_{1},\mathbf{P}_{2}\\}$ of the players
$\mathbf{A}=\mathbf{P}_{1}\mathbf{P}_{2}$. In addition, by Theorem 3, we have
the following theorem.

######  Theorem 5.

Let $\mathbf{A}=A_{1}\cdots A_{N}$ and $\mathbf{B}=B_{1}\cdots B_{M}$ be two
different sets of players, and let $D_{A}$ and $D_{B}$ be the dealer’s
parties. For given two states $\rho_{D_{A}\mathbf{A}}$ and
${\rho}_{D_{B}\mathbf{B}}$,

$CR_{\mathrm{D}}\left(\rho_{D_{A}\mathbf{A}}\otimes\rho_{D_{B}\mathbf{B}}\right)\geq\mathrm{min}\\{CR_{\mathrm{D}}\left(\rho_{D_{A}\mathbf{A}}\right),CR_{\mathrm{D}}\left(\rho_{D_{B}\mathbf{B}}\right)\\}.$
(9)

Hence, the following corollary clearly comes from Theorem 5 and Corollary 4.

######  Corollary 6.

For each $i=1,2,\ldots,N$, let $\rho_{D_{i}A_{i}}$ be the quantum state shared
by the dealer $D_{i}$ and the $i$-th player $A_{i}$. Then the following
inequality holds.

$CR_{\mathrm{D}}\left(\bigotimes^{N}_{i=1}\rho_{D_{i}A_{i}}\right)\geq\mathrm{min}_{i}\left\\{K_{\mathrm{D}}(\rho_{D_{i}A_{i}})\right\\}.$
(10)

Corollary 6 implies that if each $\rho_{D_{i}A_{i}}$ has a positive
distillable key rate, then $\bigotimes^{N}_{i=1}\rho_{D_{i}A_{i}}$ has a
positive QCR distillable rate. We note that if each $\rho_{D_{i}A_{i}}$ is a
bipartite state with positive partial transposition (PPT), then
$\bigotimes^{N}_{i=1}\rho_{D_{i}A_{i}}$ is also an $(N+1)$-partite state with
PPT, since it is a PPT state with respect to any bipartite split of
$D\mathbf{A}$ with one dealer $D=D_{1}D_{2}\cdots D_{N}$ and $N$ players
$\mathbf{A}=A_{1}A_{2}\cdots A_{N}$. Hence, we can readily construct
multipartite PPT bound entangled states with positive QCR distillable rate
from bipartite PPT bound entangled states with positive distillable key rate,
which are presented in References Chi et al. (2007); Horodecki et al. (2009).
Therefore, we can finally present our theorem showing the existence of such
states as follows.

######  Theorem 7.

For any natural number $N\geq 2$, there exists an $(N+1)$-partite bound
entangled state $\rho_{D\mathbf{A}}$ with
$CR_{\mathrm{D}}\left(\rho_{D\mathbf{A}}\right)>0$.

##  IV Discussion

We have defined the QCR state with a dealer party, and have shown that a given
multipartite quantum state is a QCR state if and only if the two cryptographic
conditions on the state hold. We have also defined the QCR distillable rate of
a given multipartite state, and have presented several important properties on
the QCR distillable rate. In the sequel, we have presented how to construct a
QCR distillable state with larger number of parties from several QCR
distillable states. Moreover, we have proved that there exist multipartite
bound entangled states which are QCR distillable. This result implies that
there exists a multipartite quantum state on which a dealer and players can
perform one of several kinds of quantum cryptographic protocols to some
extent, and from which they cannot distill any bipartite nor multipartite
entanglement by LOCC. Hence, we can conclude that any bipartite or
multipartite distillable entanglement is not necessarily required for quantum
cryptography.

The QCR states that we have dealt with in this paper have one specific dealer
party. Thus several kinds of perfectly secure classical communication feasible
on the quantum state can be performed between the dealer party and any number
of players. Therefore, the QCR state can be considered as a resource unit in
quantum cryptographic theory, and hence we could construct the quantum
cryptographic network consisting of the QCR states instead of the bipartite
maximally entangled states or the private states.

###### Acknowledgements.

This research was supported by the National Research Foundation of Korea (NRF)
grant funded by the Ministry of Science and ICT (MSIT) (Grants No.
NRF-2019R1A2C1006337 and No. NRF-2020M3E4A1079678). S.L. acknowledges support
from the MSIT, Korea, under the Information Technology Research Center support
program (Grant No. IITP-2021-2018-0-01402) supervised by the Institute for
Information and Communications Technology Planning and Evaluation, and the
Quantum Information Science and Technologies program of the NRF funded by the
MSIT (Grant No. 2020M3H3A1105796).

##  Appendix A Proof of Theorem 1

This proof is almost the same as that of the theorem related to the genuine
secret sharing state in Reference Choi and Lee (2021). The details are as
follows.

Let us consider the state

$\ket{\Gamma_{\rho}}_{\bar{D}\mathbf{\bar{A}}\widetilde{D}\mathbf{\widetilde{A}}E}=\sum_{I\in\mathbb{Z}_{d}^{N+1}}\sqrt{p_{I}}\ket{I}_{\bar{D}\mathbf{\bar{A}}}\ket{\psi_{I}}_{\widetilde{D}\mathbf{\widetilde{A}}E},$
(11)

which is a purification of $\rho_{D\mathbf{A}}$. Assume that the dealer and
players can have cryptographic information that satisfies the cryptographic
condition (i) by measuring the information part of $\rho_{D\mathbf{A}}$. Then
we have $p_{I}=1/d^{N}$ for $I\in\mathfrak{S}_{N+1}^{0}$ and $p_{I}=0$ for
$I\notin\mathfrak{S}_{N+1}^{0}$.

Regarding the condition (ii), we first take account of the worst case that all
players except one player, say $A_{k}$, are dishonest. Then the subsystem
$\mathbf{\bar{A}}^{\prime}=\bar{A}_{1}\cdots\bar{A}_{k-1}\bar{A}_{k+1}\cdots\bar{A}_{N}$
is the information part of the dishonest players.

Let $i$ be the dealer’s measurement outcome. Then the eavesdropper and
dishonest players’ state after measurement becomes

$\gamma_{\mathbf{\bar{A}^{\prime}}\widetilde{D}\mathbf{\widetilde{A}}E}^{(i)}=\frac{1}{d^{N-1}}\sum_{i_{k}\in\mathbb{Z}_{d}}\sum_{\xi,\xi^{\prime}\in\mathfrak{S}_{N-1}^{-i-i_{k}}}\ket{\xi}_{\mathbf{\bar{A}^{\prime}}}\bra{\xi^{\prime}}\otimes{\rm{tr}}_{\widetilde{D}\widetilde{A}_{k}}\ket{\psi_{i,i_{k},\xi}}_{\widetilde{D}\mathbf{\widetilde{A}}E}\bra{\psi_{i,i_{k},\xi^{\prime}}}$
(12)

if reordering the systems. From the cryptographic condition (ii), we have
$\gamma_{\mathbf{\bar{A}^{\prime}}\widetilde{D}\mathbf{\widetilde{A}}E}^{(i)}=\gamma_{\mathbf{\bar{A}^{\prime}}\widetilde{D}\mathbf{\widetilde{A}}E}^{(i^{\prime})}$
for any $i,i^{\prime}\in\mathbb{Z}_{d}$. It follows from the Hughston-Jozsa-
Wootters theorem Hughston et al. (1993) that for
$i,i_{k},i^{\prime},i_{k}^{\prime}\in\mathbb{Z}_{d}$ with
$i+i_{k}=i^{\prime}+i_{k}^{\prime}\pmod{d}$, there is a unitary operator
$U_{\widetilde{D}\widetilde{A}_{k}}^{i,i_{k}\to i^{\prime},i_{k}^{\prime}}$ on
the system $\widetilde{D}\widetilde{A}_{k}$ such that

$U_{\widetilde{D}\widetilde{A}_{k}}^{i,i_{k}\to
i^{\prime},i_{k}^{\prime}}\ket{\psi_{i,i_{k},\xi}}_{\widetilde{D}\mathbf{\widetilde{A}}E}=\ket{\psi_{i^{\prime},i_{k}^{\prime},\xi}}_{\widetilde{D}\mathbf{\widetilde{A}}E}$
(13)

for all $\xi\in\mathfrak{S}_{N-1}^{-i-i_{k}}$.

Let $\\{\mathbf{P}_{1},\mathbf{P}_{2}\\}$ be an arbitrary bipartite split of
the players with $\mathbf{P}_{1}$ consisting of at least one player and
$\mathbf{A}=\mathbf{P}_{1}\mathbf{P}_{2}$. Without loss of generality, we may
assume that $\mathbf{P}_{1}=A_{1}\cdots{A}_{M}$ and
$\mathbf{P}_{2}={A}_{M+1}\cdots{A}_{N}$. Then by Eq. (13), it can be shown
that if $iI_{1}I_{2}=ii_{1}\cdots i_{M}i_{M+1}\cdots
i_{N}\in\mathfrak{S}_{N+1}^{0}$, then

$\ket{\psi_{00\cdots
0}}_{\mathbf{A^{\prime}}E}=U_{\widetilde{D}\widetilde{A}_{N}}^{j_{N-1},i_{N}}\cdots
U_{\widetilde{D}\widetilde{A}_{2}}^{j_{1},i_{2}}U_{\widetilde{D}\widetilde{A}_{1}}^{i,i_{1}}\ket{\psi_{ii_{1}i_{2}\cdots
i_{N}}}_{\mathbf{A^{\prime}}E},$ (14)

where
$U_{\widetilde{D}\widetilde{A}_{k}}^{i,j}=U_{\widetilde{D}\widetilde{A}_{k}}^{i,j\rightarrow
i+j,0}$ and $j_{t}\equiv i+i_{1}+\cdots+i_{t}\pmod{d}$. Let
${\rm{tr}}_{\widetilde{D}\mathbf{\widetilde{A}}}\left(\ket{\psi_{00\cdots
0}}\bra{\psi_{00\cdots
0}}\right)=\sum_{x}\lambda_{x}\ket{\eta_{x}}_{E}\bra{\eta_{x}}$ be its
spectral decomposition. Then we have

$\ket{\psi_{iI_{1}I_{2}}}_{\widetilde{D}\mathbf{\widetilde{A}}E}=\sum_{x}\sqrt{\lambda_{x}}U_{\widetilde{D}\mathbf{\widetilde{P}}_{1}}^{iI_{1}}V_{\widetilde{D}\mathbf{\widetilde{A}}}^{I_{2}}\ket{\phi_{x}}_{\widetilde{D}\mathbf{\widetilde{A}}}\ket{\eta_{x}}_{E}$
(15)

for some unitary operators
$U_{\widetilde{D}\mathbf{\widetilde{P}}_{1}}^{iI_{1}}$,
$V_{\widetilde{D}\mathbf{\widetilde{A}}}^{I_{2}}$ and orthonormal set
$\\{\ket{\phi_{x}}\\}$ for the system $\widetilde{D}\mathbf{\widetilde{A}}$.
Therefore, $\rho_{D\mathbf{A}}$ is of the form in Eq. (1).

Conversely, assume that $\rho_{D\mathbf{A}}$ has the form in Eq. (1). Then it
can be readily shown that players have cryptographic information that obeys
the cryptographic condition (i) after measuring their information parts in the
computational basis.

We now show that players’ cryptographic information satisfies the condition
(ii). Suppose that $\\{\mathbf{P}_{1},\mathbf{P}_{2}\\}$ is a bipartite split
of the players $\mathbf{A}=\mathbf{P}_{1}\mathbf{P}_{2}$ with $\mathbf{P}_{1}$
consisting of at least one player and $\mathbf{P}_{2}$ representing $K$
dishonest players. Let
$\sigma_{\widetilde{D}\mathbf{\widetilde{A}}}=\sum_{x}\kappa_{x}\ket{\mu_{x}}_{\widetilde{D}\mathbf{\widetilde{A}}}\bra{\mu_{x}}$
be a spectral decomposition of $\sigma_{\widetilde{D}\mathbf{\widetilde{A}}}$,
and let

$\ket{\varphi_{iI_{1}I_{2}}}_{\widetilde{D}\mathbf{\widetilde{A}}E}=\sum_{x}\sqrt{\kappa_{x}}U_{\widetilde{D}\mathbf{\widetilde{P}}_{1}}^{iI_{1}}V_{\widetilde{D}\mathbf{\widetilde{A}}}^{I_{2}}\ket{\mu_{x}}_{\widetilde{D}\mathbf{\widetilde{A}}}\ket{\nu_{x}}_{E},$
(16)

where $\left\\{\ket{\nu_{x}}\right\\}$ forms an orthonormal set for the
eavesdropper’s system $E$. Then the state

$\ket{\Upsilon}_{D\mathbf{P_{1}}\mathbf{P_{2}}E}=\frac{1}{\sqrt{d^{N}}}\sum_{iI_{1}I_{2}\in\mathfrak{S}_{N+1}^{0}}\ket{iI_{1}}_{\bar{D}\mathbf{\bar{P}_{1}}}\ket{I_{2}}_{\mathbf{\bar{P}_{2}}}\ket{\varphi_{iI_{1}I_{2}}}_{\widetilde{D}\mathbf{\widetilde{A}}E}$
(17)

is a purification of $\rho_{D\mathbf{A}}$. If the dealer has the measurement
outcome $i$ after measuring the dealer’s information part in the computational
basis, then the quantum state of dishonest players and eavesdropper after the
measurement becomes

$\Upsilon_{\mathbf{P}_{2}E}^{(i)}=\frac{1}{d^{K}}\sum_{\alpha\in\mathbb{Z}_{d}}\sum_{I_{2},J_{2}\in\mathfrak{S}_{K}^{-\alpha}}\ket{I_{2}}_{\mathbf{\bar{P}}_{2}}\bra{J_{2}}\otimes\mathrm{tr}_{\widetilde{D}\mathbf{\widetilde{P}}_{1}}\ket{\varphi_{I_{2}}}_{\widetilde{D}\mathbf{\widetilde{P}}E}\bra{\varphi_{J_{2}}},$
(18)

where
$\ket{\varphi_{I_{2}}}_{\widetilde{D}\mathbf{\widetilde{P}}E}=\sum_{x}\sqrt{\kappa_{x}}V_{\widetilde{D}\mathbf{\widetilde{P}}}^{I_{2}}\ket{\xi_{x}}_{\widetilde{D}\mathbf{\widetilde{P}}}\ket{e_{x}}_{E}.$
Since $\Upsilon_{\mathbf{P}_{2}E}^{(i)}=\Upsilon_{\mathbf{P}_{2}E}^{(j)}$ for
any $i,j\in\mathbb{Z}_{d}$, dishonest players and eavesdropper cannot get any
information about the dealer’s cryptographic information.

##  Appendix B Proof of Theorem 2

The proof of Theorem 2 is also similar to that of the theorem associated with
the genuine secret sharing states in Reference Choi and Lee (2021). However,
we here present its simple proof compared to that in Reference Choi and Lee
(2021) as follows.

Without loss of generality, we may assume that
$\mathbf{P}_{1}={A}_{1}\cdots{A}_{M}$ and
$\mathbf{P}_{2}={A}_{M+1}\cdots{A}_{N}$. Let $\Upsilon_{D\mathbf{A}}$ be an
$(N+1)$-party QCR state shared by a dealer and $N$ players. Since
$\Upsilon_{D\mathbf{A}}$ has the form in Eq. (1), if let
$I_{2}\in\mathfrak{S}_{N-M}^{\beta}$ be the measurement outcomes for some
$\beta$ when players $\mathbf{P}_{2}$ measure their information parts in the
computational basis, then the resulting state of the dealer $D$ and the
players $\mathbf{P}_{1}$ after the measurement becomes

$\Upsilon_{D\mathbf{P}_{1}}^{(I_{2})}=\frac{1}{d^{M}}\sum_{iI_{1},jJ_{1}\in\mathfrak{S}_{M+1}^{-\beta}}\ket{iI_{1}}_{\bar{D}\mathbf{\bar{P}}_{1}}\bra{jJ_{1}}\otimes
U_{\widetilde{D}\mathbf{\widetilde{P}}_{1}}^{iI_{1}}\tilde{\sigma}_{\widetilde{D}\mathbf{\widetilde{P}}_{1}}\left(U_{\widetilde{D}\mathbf{\widetilde{P}}_{1}}^{jJ_{1}}\right)^{\dagger},$
(19)

where
$\tilde{\sigma}_{\widetilde{D}\mathbf{\widetilde{P}}_{1}}=\mathrm{tr}_{\mathbf{\widetilde{P}}_{2}}\tilde{V}_{\widetilde{D}\mathbf{\widetilde{A}}}^{I_{2}}\sigma_{\widetilde{D}\mathbf{\widetilde{A}}}\left(\tilde{V}_{\widetilde{D}\mathbf{\widetilde{A}}}^{I_{2}}\right)^{\dagger}$.

We note that unitary operators on the shield part of the state
$\Upsilon_{D\mathbf{A}}$ can be expressed as in Eq. (14), and it can be easily
shown that
$W_{\bar{D}}\Upsilon_{D\mathbf{P}_{1}}^{(I_{2})}W_{\bar{D}}^{\dagger}$ is an
$(M+1)$-party QCR state, where $W=\sum_{i=0}^{d-1}\ket{i+\beta}\bra{i}$.
Therefore, if the players $\mathbf{P}_{2}$ announces the value $\beta$, then
the dealer $D$ and the players $\mathbf{P}_{1}$ can share the $(M+1)$-party
QCR state after applying the unitary operator $W$ on the dealer’s information
part.

##  Appendix C Proof of Theorem 3

Let

$\ket{\Upsilon}_{D_{A}\mathbf{A}E_{A}}=\frac{1}{\sqrt{d^{N}}}\sum_{iI\in\mathfrak{S}_{N+1}^{0}}\ket{iI}_{\bar{D}_{A}\bar{\mathbf{A}}}\otimes\ket{\psi_{iI}}_{\widetilde{D}_{A}\mathbf{\widetilde{A}}E_{A}}$
(20)

be a purification of the QCR state $\Upsilon_{D_{A}\mathbf{A}}$, and let

$\ket{\Upsilon}_{D_{B}\mathbf{B}E_{B}}=\frac{1}{\sqrt{d^{M}}}\sum_{jJ\in\mathfrak{S}_{M+1}^{0}}\ket{jJ}_{\bar{D}_{B}\bar{\mathbf{B}}}\otimes\ket{\phi_{jJ}}_{\widetilde{D}_{B}\mathbf{\widetilde{B}}E_{B}}$
(21)

be a purification of the QCR state $\Upsilon_{D_{B}\mathbf{B}}$. For
$I=i_{1}i_{2}\cdots i_{L}\in\mathbb{Z}_{d}^{L}$, let $|I|$ be defined as
$|I|=i_{1}+\cdots+i_{L}$. Then the states
$\ket{\Upsilon}_{D_{A}\mathbf{A}E_{A}}$ and
$\ket{\Upsilon}_{D_{B}\mathbf{B}E_{B}}$ in Eqs. (20) and (21) can be rewritten
as

$\ket{\Upsilon}_{D_{A}\mathbf{A}E_{A}}=\frac{1}{\sqrt{d^{N}}}\sum_{I\in\mathbb{Z}_{d}^{N}}\ket{-|I|,I}_{\bar{D}_{A}\bar{\mathbf{A}}}\otimes\ket{\psi_{-|I|,I}}_{\widetilde{D}_{A}\mathbf{\widetilde{A}}E_{A}}$
(22)

and

$\ket{\Upsilon}_{D_{B}\mathbf{B}E_{B}}=\frac{1}{\sqrt{d^{M}}}\sum_{J\in\mathbb{Z}_{d}^{M}}\ket{-|J|,J}_{\bar{D}_{B}\bar{\mathbf{B}}}\otimes\ket{\phi_{-|J|,J}}_{\widetilde{D}_{B}\mathbf{\widetilde{B}}E_{B}}$
(23)

respectively.

Let $cX$ be the unitary operator defined as

$cX=\sum_{j,k=0}^{d-1}\ket{j+k,k}\bra{j,k}.$ (24)

If the dealer applies the unitary operator $cX_{\bar{D}_{A}\bar{D}_{B}}$ on
the system $\bar{D}_{A}\bar{D}_{B}$ in the state
$\ket{\Upsilon}_{D_{A}\mathbf{A}E_{A}}\otimes\ket{\Upsilon}_{D_{B}\mathbf{B}E_{B}}$,
then after properly rearranging the order of the systems, the state becomes

$\displaystyle\frac{1}{\sqrt{d^{N+M}}}\sum_{I\in\mathbb{Z}_{d}^{N}}\sum_{J\in\mathbb{Z}_{d}^{M}}$
$\displaystyle\ket{-|I|-|J|,I,J}_{\bar{D}_{A}{\mathbf{\bar{A}}}{\mathbf{\bar{B}}}}\otimes\ket{-|J|}_{\bar{D}_{B}}\otimes\ket{\psi_{-|I|,I}}_{\widetilde{D}_{A}\mathbf{\widetilde{A}}E_{A}}\otimes\ket{\phi_{-|J|,J}}_{\widetilde{D}_{B}\mathbf{\widetilde{B}}E_{B}}.$
(25)

We remark that if the dealer and all players measure their information part
$\bar{D}_{A}{\mathbf{\bar{A}}}{\mathbf{\bar{B}}}$ in the computational basis,
then they have cryptographic information that satisfies the cryptographic
condition (i). In order to show that the cryptographic information obeys the
cryptographic condition (ii), we consider the worst case as in the proof of
Theorem 1.

Let us assume that the dealer measures the information part $\bar{D}_{A}$, and
let $i$ be the dealer’s measurement outcome. By tracing out the system
$\bar{D}_{A}\bar{D}_{B}\widetilde{D}_{A}\widetilde{D}_{B}$ of the resulting
state, we have

$\displaystyle\frac{1}{d^{N+M-1}}\sum_{\alpha\in\mathbb{Z}_{d}}\sum_{I,I^{\prime}\in\mathfrak{S}_{N}^{\alpha}}\sum_{J,J^{\prime}\in\mathfrak{S}_{M}^{-\alpha-i}}$
$\displaystyle\ket{I,J}_{\bar{\mathbf{A}}\bar{\mathbf{B}}}\bra{I^{\prime},J^{\prime}}\otimes\mathrm{tr}_{\widetilde{D}_{A}}\ket{\psi_{-\alpha,I}}_{\widetilde{D}_{A}\mathbf{\widetilde{A}}E_{A}}\bra{\psi_{-\alpha,I^{\prime}}}\otimes\mathrm{tr}_{\widetilde{D}_{B}}\ket{\phi_{\alpha+i,J}}_{\widetilde{D}_{B}\mathbf{\widetilde{B}}E_{B}}\bra{\phi_{\alpha+i,J^{\prime}}}.$
(26)

Let us now consider the situation where all players except the dealer and one
player are dishonest as the worst case. Without loss of generality, we may
assume that the honest player is $A_{1}$, by symmetry. When $N\geq 2$, after
tracing out the system $A_{1}$, the dishonest players and eavesdropper’s state
becomes

$\displaystyle\frac{1}{d^{N+M-1}}\sum_{\alpha,\beta\in\mathbb{Z}_{d}}\sum_{\hat{I},\hat{I}^{\prime}\in\mathfrak{S}_{N-1}^{\alpha-\beta}}\sum_{J,J^{\prime}\in\mathfrak{S}_{M}^{-\alpha-i}}$
$\displaystyle\ket{\hat{I}}_{\hat{\mathbf{A}}}\bra{\hat{I}^{\prime}}\otimes\ket{J}_{\bar{\mathbf{B}}}\bra{J^{\prime}}$
$\displaystyle\otimes\mathrm{tr}_{\widetilde{D}_{A}\widetilde{A}_{1}}\ket{\psi_{-\alpha,\beta,\hat{I}}}_{\widetilde{D}_{A}\mathbf{\widetilde{A}}E_{A}}\bra{\psi_{-\alpha,\beta,\hat{I}^{\prime}}}\otimes\mathrm{tr}_{\widetilde{D}_{B}}\ket{\phi_{\alpha+i,J}}_{\widetilde{D}_{B}\mathbf{\widetilde{B}}E_{B}}\bra{\phi_{\alpha+i,J^{\prime}}},$
(27)

where $\hat{I}=i_{2}\cdots i_{L}\in\mathbb{Z}_{d}^{L-1}$ for
$I=i_{1}i_{2}\cdots i_{L}\in\mathbb{Z}_{d}^{L}$ and
$\hat{\mathbf{A}}=\bar{A}_{2}\cdots\bar{A}_{L}$ for
$\bar{\mathbf{A}}=\bar{A}_{1}\bar{A}_{2}\cdots\bar{A}_{L}$. Since
$\Upsilon_{D_{A}\mathbf{A}}$ is a QCR state,

$\mathrm{tr}_{\widetilde{D}_{A}\widetilde{A}_{1}}\ket{\psi_{-\alpha,\beta,\hat{I}}}_{\widetilde{D}_{A}\mathbf{\widetilde{A}}E_{A}}\bra{\psi_{-\alpha,\beta,\hat{I}^{\prime}}}=\mathrm{tr}_{\widetilde{D}_{A}\widetilde{A}_{1}}\ket{\psi_{0,\beta-\alpha,\hat{I}}}_{\widetilde{D}_{A}\mathbf{\widetilde{A}}E_{A}}\bra{\psi_{0,\beta-\alpha,\hat{I}^{\prime}}}$
(28)

for any $\alpha,\beta\in\mathbb{Z}_{d}$ and
$\hat{I},\hat{I}^{\prime}\in\mathfrak{S}_{N-1}^{\alpha-\beta}$. Hence, the
state in Eq. (27) can be rewritten as

$\displaystyle\frac{1}{d^{N+M-1}}\sum_{s,t\in\mathbb{Z}_{d}}\sum_{\hat{I},\hat{I}^{\prime}\in\mathfrak{S}_{N-1}^{s}}\sum_{J,J^{\prime}\in\mathfrak{S}_{M}^{t}}$
$\displaystyle\ket{\hat{I}}_{\hat{\mathbf{A}}}\bra{\hat{I}^{\prime}}\otimes\ket{J}_{\bar{\mathbf{B}}}\bra{J^{\prime}}$
$\displaystyle\otimes\mathrm{tr}_{\widetilde{D}_{A}\widetilde{A}_{1}}\ket{\psi_{0,-s,\hat{I}}}_{\widetilde{D}_{A}\mathbf{\widetilde{A}}E_{A}}\bra{\psi_{0,-s,\hat{I}^{\prime}}}\otimes\mathrm{tr}_{\widetilde{D}_{B}}\ket{\phi_{-t,J}}_{\widetilde{D}_{B}\mathbf{\widetilde{B}}E_{B}}\bra{\phi_{-t,J^{\prime}}}.$
(29)

We can here see that the state in Eq. (29) is independent on the dealer’s
measurement outcome $i$. In other words, the dealer’s cryptographic
information is perfectly secure against the dishonest players and any exterior
eavesdropper, which implies that the dealer’s and all players’ cryptographic
information satisfies the cryptographic condition (ii).

Now assume that $N=1$, that is, $\mathbf{A}=A_{1}$. Then the state of the
dishonest players $\mathbf{B}$ and eavesdropper $E_{A}E_{B}$ after the
dealer’s measurement is

$\displaystyle\frac{1}{d^{M}}\sum_{\alpha\in\mathbb{Z}_{d}}\sum_{J,J^{\prime}\in\mathfrak{S}_{M}^{-\alpha-i}}$
$\displaystyle\ket{J}_{\bar{\mathbf{B}}}\bra{J^{\prime}}\otimes\mathrm{tr}_{\widetilde{D}_{A}\widetilde{\mathbf{A}}}\ket{\psi_{-\alpha,\alpha}}_{\widetilde{D}_{A}\mathbf{\widetilde{A}}E_{A}}\bra{\psi_{-\alpha,\alpha}}\otimes\mathrm{tr}_{\widetilde{D}_{B}}\ket{\phi_{\alpha+i,J}}_{\widetilde{D}_{B}\mathbf{\widetilde{B}}E_{B}}\bra{\phi_{\alpha+i,J^{\prime}}},$
(30)

where the dealer’s measurement outcome is $i$. Since

$\mathrm{tr}_{\widetilde{D}_{A}\widetilde{\mathbf{A}}}\ket{\psi_{-\alpha,\alpha}}_{\widetilde{D}_{A}\mathbf{\widetilde{A}}E_{A}}\bra{\psi_{-\alpha,\alpha}}=\mathrm{tr}_{\widetilde{D}_{A}\widetilde{\mathbf{A}}}\ket{\psi_{0,0}}_{\widetilde{D}_{A}\mathbf{\widetilde{A}}E_{A}}\bra{\psi_{0,0}}$
(31)

for all $\alpha\in\mathbb{Z}_{d}$, the state in Eq. (30) does not depend on
the measurement outcome $i$, and hence the cryptographic information is
perfectly secure against the dishonest players and any exterior eavesdropper.

Let $\ket{\Upsilon}_{D\mathbf{AB}E}$ be the pure state in Eq. (25), which is
the resulting state after the dealer applies the unitary operator
$cX_{\bar{D}_{A}\bar{D}_{B}}$ on the system $\bar{D}_{A}\bar{D}_{B}$ in the
state
$\ket{\Upsilon}_{D_{A}\mathbf{A}E_{A}}\otimes\ket{\Upsilon}_{D_{B}\mathbf{B}E_{B}}$,
where $D=D_{A}D_{B}$ and $E=E_{A}E_{B}$. Then, for any cases, the
cryptographic information from the state $\ket{\Upsilon}_{D\mathbf{AB}E}$
obeys the cryptographic conditions (i) and (ii). Therefore, the state
$cX_{\bar{D}_{A}\bar{D}_{B}}\left(\Upsilon_{D_{A}\mathbf{A}}\otimes\Upsilon_{D_{B}\mathbf{B}}\right)cX^{\dagger}_{\bar{D}_{A}\bar{D}_{B}}$
is an $(N+M+1)$-party QCR state by Theorem 1, since the state is equal to
$\mathrm{tr}_{E}\ket{\Upsilon}_{D\mathbf{AB}E}\bra{\Upsilon}$.

##  Appendix D Proof of Theorem 5

We first note that the set of all LOCC operations $\Lambda_{D\mathbf{AB}}$ on
the dealer $D=D_{A}D_{B}$ and all players $\mathbf{AB}$ contains LOCC
operations of the form
$\Lambda_{D_{A}\mathbf{A}}\otimes{\Lambda}_{D_{B}\mathbf{B}}$. Hence,
$CR_{\mathrm{D}}\left(\rho_{D_{A}\mathbf{A}}\otimes{\rho}_{D_{B}\mathbf{B}}\right)$
is lower bounded by

$\lim_{\delta\rightarrow
0}\lim_{n\rightarrow\infty}\sup_{U_{D}}\sup_{\Lambda_{D_{A}\mathbf{A}},{\Lambda}_{D_{B}\mathbf{B}}}\left\\{K:\Big{\|}U_{D}\left(\Lambda_{D_{A}\mathbf{A}}\left(\rho^{\otimes
n}_{D_{A}\mathbf{A}}\right)\otimes{\Lambda}_{D_{B}\mathbf{B}}\left({\rho}_{D_{B}\mathbf{B}}^{\otimes
n}\right)\right)U^{\dagger}_{D}-\Upsilon_{D\mathbf{AB}}^{nK}\Big{\|}_{1}\leq\delta\right\\},$
(32)

where $U_{D}$’s are unitary operators acting on the system $D$. In addition,
as seen in the proof of Theorem 3, there exists a unitary operator
$\bar{U}_{D}$ such that

$\bar{U}_{D}\left(\Upsilon^{nK}_{D_{A}\mathbf{A}}\otimes{\Upsilon}^{nK}_{D_{B}\mathbf{B}}\right)\bar{U}^{\dagger}_{D}=\Upsilon^{nK}_{D\mathbf{AB}}.$
(33)

Then it follows from Eq. (33) that

$\Big{\|}\bar{U}_{D}\left(\Lambda_{D_{A}\mathbf{A}}\left(\rho^{\otimes
n}_{D_{A}\mathbf{A}}\right)\otimes{\Lambda}_{D_{B}\mathbf{B}}\left({\rho}_{D_{B}\mathbf{B}}^{\otimes
n}\right)\right)\bar{U}^{\dagger}_{D}-\Upsilon_{D\mathbf{AB}}^{nK}\Big{\|}_{1}=\Big{\|}\Lambda_{D_{A}\mathbf{A}}\left(\rho^{\otimes
n}_{D_{A}\mathbf{A}}\right)\otimes{\Lambda}_{D_{B}\mathbf{B}}\left({\rho}_{D_{B}\mathbf{B}}^{\otimes
n}\right)-\Upsilon^{nK}_{D_{A}\mathbf{A}}\otimes{\Upsilon}^{nK}_{D_{B}\mathbf{B}}\Big{\|}_{1}.$
(34)

By the telescoping property of the trace distance Wilde (2011, 2017), that is,

$\|\sigma_{1}\otimes\sigma_{2}-\tau_{1}\otimes\tau_{2}\|_{1}\leq\|\sigma_{1}-\tau_{1}\|_{1}+\|\sigma_{2}-\tau_{2}\|_{1},$
(35)

we can see that the lower bound on
$CR_{\mathrm{D}}\left(\rho_{D_{A}\mathbf{A}}\otimes{\rho}_{D_{B}\mathbf{B}}\right)$
in Eq. (32) is also lower bounded by

$\lim_{\delta\rightarrow
0}\lim_{n\rightarrow\infty}\sup_{\Lambda_{D_{A}\mathbf{A}},\Lambda_{D_{B}\mathbf{B}}}\left\\{K:\Big{\|}\Lambda_{D_{A}\mathbf{A}}\left(\rho^{\otimes
n}_{D_{A}\mathbf{A}}\right)-\Upsilon^{nK}_{D_{A}\mathbf{A}}\Big{\|}_{1}\leq\frac{\delta}{2},\Big{\|}{\Lambda}_{D_{B}\mathbf{B}}\left({\rho}_{D_{B}\mathbf{B}}^{\otimes
n}\right)-{\Upsilon}^{nK}_{D_{B}\mathbf{B}}\Big{\|}_{1}\leq\frac{\delta}{2}\right\\},$
(36)

which is greater than or equal to both
$CR_{\mathrm{D}}\left(\rho_{D_{A}\mathbf{A}}\right)$ and
$CR_{\mathrm{D}}\left(\rho_{D_{B}\mathbf{B}}\right)$. This completes the
proof, that is,

$CR_{\mathrm{D}}\left(\rho_{D_{A}\mathbf{A}}\otimes\rho_{D_{B}\mathbf{B}}\right)\geq\mathrm{min}\\{CR_{\mathrm{D}}\left(\rho_{D_{A}\mathbf{A}}\right),CR_{\mathrm{D}}\left(\rho_{D_{B}\mathbf{B}}\right)\\}.$
(37)

## References

  * Ekert (1991) A. K. Ekert, Phys. Rev. Lett. 67, 661 (1991).
  * Hillery et al. (1999) M. Hillery, V. Bužek, and A. Berthiaume, Phys. Rev. A 59, 1829 (1999).
  * Horodecki et al. (2005) K. Horodecki, M. Horodecki, P. Horodecki, and J. Oppenheim, Phys. Rev. Lett. 94, 160502 (2005).
  * Horodecki and Augusiak (2006) P. Horodecki and R. Augusiak, Phys. Rev. A 74, 010302 (2006).
  * Horodecki et al. (2009) K. Horodecki, M. Horodecki, P. Horodecki, and J. Oppenheim, IEEE Trans. Inf. Theory 55, 1898 (2009).
  * Chi et al. (2008) D. P. Chi, J. W. Choi, J. S. Kim, T. Kim, and S. Lee, Phy. Rev. A 78, 012351 (2008).
  * Choi and Lee (2021) M. Choi and S. Lee, Quantum Inf. Process. 20, 47 (2021).
  * Bennett et al. (1996a) C. H. Bennett, D. P. DiVincenzo, J. A. Smolin, and W. K. Wootters, Phys. Rev. A 54, 3824 (1996a).
  * Chi et al. (2007) D. P. Chi, J. W. Choi, J. S. Kim, T. Kim, and S. Lee, Phys. Rev. A 78, 012351 (2007).
  * Bennett et al. (1996b) C. H. Bennett, G. Brassard, S. Popescu, B. Schumacher, J. A. Smolin, and W. K. Wootters, Phys. Rev. Lett. 76, 722 (1996b).
  * Hughston et al. (1993) L. P. Hughston, R. Jozsa, and W. K. Wootters, Phys. Rev. A 183, 14 (1993).
  * Wilde (2011) M. M. Wilde, _From Classical to Quantum Shannon Theory_ (2011), arXiv:1106.1445.
  * Wilde (2017) M. M. Wilde, _Quantum Information Theory_ (Cambridge University Press, 2017).