have $n$ pairs of QKD modules, and up to $t<n$ of them could be corrupted. Alice’s (Bob’s) $i$-th QKD module is supposed to generate a raw key $k'_{{\rm A}i}$ ($k'_{{\rm B}i}$) and the protocol information $p_{\rm A{\it i},info}$ ($p_{\rm B{\it i},info}$), with $i=1,\ldots,n$. Also, they have one classical post-processing unit each, which is assumed to be honest. The goal is to distill an $\epsilon$-secure key, $k_{\rm A}$ and $k_{\rm B}$. This can be achieved by using [*Protocol*]{} $1$. See the main text for further details.[]{data-label="fig3"}](fig_protocol1){width="0.95\columnwidth"}

A possible solution to this scenario is rather simple. It is given by [*Protocol*]{} $1$ below, which consists of three main steps.\
[*Protocol $1$*]{}:

1.  [*Generation of raw keys and protocol information*]{}: Each pair QKD$_{{\rm A}i}$ and QKD$_{{\rm B}i}$ outputs, respectively, the bit strings $k'_{{\rm A}i}$ and $p_{\rm A{\it i},info}$, and $k'_{{\rm B}i}$ and $p_{\rm B{\it i},info}$, or the symbol $\perp_i$ to indicate abort, for all $i=1,\ldots,n$.

2.  [*Generation of an $\epsilon_{\rm cor}$-correct key*]{}: The units CP$_{\rm A}$ and CP$_{\rm B}$ use the key distillation procedure prescribed by the QKD protocol to generate an $(\epsilon/n)$-secure key, $k''_{{\rm A}i}$ and $k''_{{\rm B}i}$, from each raw key pair $k'_{{\rm A}i}$ and $k'_{{\rm B}i}$, or they generate the 