attacks, i.e., system $P$ in Fig. \[PicD\] is controlled by Eve. In this case, the secret-key rates are given by$$K(\blacktriangleright)=I_{c}(A\rangle
B),~K(\blacktriangleleft)=I_{c}(B\rangle A),   \label{standard}$$ so that QKD is equivalent to entanglement distillation.

It is easy to check that quantum discord upperbounds these key rates. Applying Eq. (\[KWvar\]) to Eq. (\[standard\]), we obtain the cryptographic relations$$\begin{aligned}
K(\blacktriangleright) & =D(A|B)-E_{f}(A,E)\leq D(A|B),  \label{B1} \\
K(\blacktriangleleft) & =D(B|A)-E_{f}(B,E)\leq D(B|A).   \label{B2}\end{aligned}$$ The optimal forward rate $K(\blacktriangleright)$, where Alice’s variable must be inferred, equals the difference between the output discord $D(A|B)$, based on Bob’s detections, and the entanglement of formation $E_{f}(A,E)$ between Alice and Eve. Situation is reversed for the other rate $%
K(\blacktriangleleft )$. Note that quantum discord not only provides an upper bound to the key rates, but its aymmetric definition, $D(A|B)$ or $%
D(B|A)$, is closely connected with the reconciliation direction (direct $%
\blacktriangleright$ or reverse $\blacktriangleleft$).

*Ideal QKD protocols*.– In practical quantum cryptography, extra noise is always present, and we distinguish between device-dependent and device-independent QKD on the basis of Eve’s accessibility of the extra system $P$. In theoretical studies of quantum cryptography, it is however common to design and assess new protocols by assuming no-extra noise in Alice’s and Bob’s apparata (perfect 