unrealistic to consider that each of Alice and Bob could possess a few QKD modules and classical post-processing units, each of them purchased from a different vendor. Now, provided that the majority of the vendors are honest and careful in the manufacturing of their devices, it might not be entirely unreasonable to assume that at least one pair of QKD modules is honest and the number of malicious/flawed classical post-processing units is strictly less than one third of the total number of them. With these assumptions in place, we can then apply techniques in conventional multiparty secure computation to prove security in different QKD scenarios with malicious devices. Importantly, if we disregard the cost of authenticating the classical communications, our protocols are optimal with respect to the resulting secret key rate. Moreover, the operations involved are based on simple functions in linear algebra such as bit-wise XOR and multiplication of matrices. So, they are conceptually simple and easy to implement.

QKD with malicious devices {#mainresults}
==========================

Let us start by describing the general scenario that we consider in more detail. It is illustrated in Fig. \[fig\_gen\](a). Alice and Bob have $n$ pairs of QKD modules, and, in addition, say Alice 