to the case $n=1$ and $t=0$ in Fig. \[fig\_gen\](a).

![QKD with honest QKD modules and malicious classical post-processing units. Alice and Bob have one trusted QKD module each, QKD$_{\rm A}$ and QKD$_{\rm B}$, which generate, respectively, the raw key $k'_{\rm A}$ and $k'_{\rm B}$ and the protocol information $p_{\rm A,info}$ and $p_{\rm B,info}$. Also, Alice (Bob) has $s$ ($r$) classical post-processing units CP$_{{\rm A}i}$ (CP$_{{\rm B}i'}$) with $i=1,\ldots,s$ ($i'=1,\ldots,r$), and up to $t'<s/3$ ($t''<r/3$) of these units could be corrupted. The goal is to produce shares of an $\epsilon$-secure key, $k_{\rm A}$ and $k_{\rm B}$, from which the final key could be reconstructed. This can be achieved by using [*Protocol*]{} $2$. See the main text and Appendix \[app\_P2\] for further details. In the figure, $k'_{{\rm A}ij}$ ($k'_{{\rm B}i'j}$) denotes the $j$-th share of $k'_{\rm A}$ ($k'_{\rm B}$) which QKD$_{\rm A}$ (QKD$_{\rm B}$) sends to CP$_{{\rm A}i}$ (CP$_{{\rm B}i'}$), and $k_{{\rm A}ij}$ ($k_{{\rm B}ij}$) identifies the $j$-th share of $k_{\rm A}$ ($k_{\rm B}$) that is produced by CP$_{{\rm A}i}$ (CP$_{{\rm B}i'}$). Since QKD$_{\rm A}$ (QKD$_{\rm B}$) is honest, note that the shares $k'_{{\rm A}ij}$ ($k'_{{\rm B}ij}$) are equal for all $i$.[]{data-label="fig2"}](fig_protocol2){width="0.95\columnwidth"}

Since now the units CP$_{{\rm A}i}$ and CP$_{{\rm B}i'}$ could 