Then, in a second step, the CP units distill a supposedly $(\epsilon/n)$-secure key from each raw key received and concatenate the resulting keys to form a longer key bit string. Finally, in the third step, the CP units apply privacy amplification to remove the information that could be known to Eve due to the presence of corrupted QKD modules. Importantly, if the CP units are untrusted, all these steps are performed in a distributed setting by acting on data shares produced by a VSS scheme.

Next we evaluate three different scenarios of practical interest in this context. For concreteness, in these examples we use the VSS scheme introduced in [@maurer_smpc] and described in Appendix \[tool\].

QKD with malicious QKD modules and honest classical post-processing units {#ups}
-------------------------------------------------------------------------

We begin by analysing the situation where Alice and Bob have $n$ pairs of QKD modules and up to $t<n$ of them could be corrupted, and each of Alice and Bob has one classical post-processing unit which is assumed to be honest. This scenario is illustrated in Fig. \[fig3\] and corresponds to the case $s=r=1$ and $t'=t''=0$ in Fig. \[fig\_gen\](a).

![QKD with malicious QKD modules and honest classical post-processing units. Alice and Bob 