data [@Renner; @Renner2]. As a result, Eve’s attack collapses into a collective attack, where each travelling system is probed by an independent ancilla. This means that Eve’s interaction can be represented by a two-system unitary $U_{ae}$ coupling system $a$ with an ancillary system $e $ prepared in a pure state [@Noteiso]. The output ancilla $E$ is then stored in a quantum memory which is coherently measured at the end of the protocol (see Fig. \[picU\]). In this attack, the maximum information which is stolen on $X$ or $Y$ cannot exceed the Holevo bound.

*Non-zero discord is necessary*.– Before analyzing the secret-key rates, we briefly clarify why discord is a necessary resource for QKD. Suppose that Alice prepares a quantum-classical state $\rho_{Aa}=%
\sum_{k}p_{k}\rho _{A}(k)\otimes|k\rangle_{a}\langle k|$ with $\{|k\rangle\}$ orthogonal, so that $D(A|a)=0$. Classical system $a$ is perfectly clonable by Eve. This implies that the three parties will share the state [@Add]$$\rho_{ABE}=\sum_{k}p_{k}\rho_{A}(k)\otimes|k\rangle_{B}\langle k|\otimes
|k\rangle_{E}\langle k|,$$ with Eve fully invisible, since her action is equivalent to an identity channel for Alice and Bob ($\rho_{AB}=\rho_{Aa}$).

Direct reconciliation fails since $\rho_{ABE}$ is symmetric under $B$-$E$ permutation, which means that Eve decodes Alice’s variable with the same accuracy of Bob. Reverse reconciliation also fails. Bob encodes $Y$ 