[@qkd1; @qkd2; @qkd3]. There is, however, a big gap between the theory [@qkd_t1; @qkd_t2] and the practice [@exp1; @exp2; @exp3; @exp4; @exp5] of QKD, and the security of QKD implementations is seriously threatened by quantum hacking [@hack4; @hack5; @hack6; @hack7; @hack9]. To solve this problem, the ultimate solution is device-independent (DI)-QKD [@diQKD1; @diQKD2; @diQKD5; @diQKD6], whose security is essentially based on a loophole-free Bell test [@bell1; @bell2]. Although no experimental implementation of DI-QKD has been realised yet, the recent demonstrations of loophole-free Bell tests [@belltest1; @belltest2; @belltest3; @belltest4; @belltest5] might bring DI-QKD closer to experimental realisation.

![Schematic representation of a memory attack against a DI-QKD system [@mem_attack]. In the $i$-th QKD run, Alice and Bob’s QKD modules, QKD$_{\rm A}$ and QKD$_{\rm B}$, use a quantum channel to produce a raw key, $k'_{{\rm A}i}$ and $k'_{{\rm B}i}$, as well as certain protocol information, $p_{\rm A{\it i}, info}$ and $p_{\rm B{\it i}, info}$, respectively. The content of $p_{\rm A{\it i},info}$ and $p_{\rm B{\it i},info}$ depends on the particular QKD protocol implemented. For instance, in the standard decoy-state BB84 scheme [@decoy1; @decoy2; @decoy3], $p_{\rm A,info}$ contains the basis and the decoy setting information per emitted signal, while $p_{\rm B,info}$ contains Bob’s measurement basis 