abort symbol $\perp_i$, for all $i=1,\ldots, n$. Afterward, CP$_{\rm A}$ (CP$_{\rm B}$) concatenates the $M\leq{}n$ keys $k''_{{\rm A}i}$ ($k''_{{\rm B}i}$) which are different from $\perp_i$ to form the bit string $k'_{\rm A}=[k''_{{\rm A}1},\ldots, k''_{{\rm A}M}]$ ($k'_{\rm B}=[k''_{{\rm B}1},\ldots, k''_{{\rm B}M}]$). Since the units CP$_{\rm A}$ and CP$_{\rm B}$ are trusted, $k''_{{\rm A}i}$ and $k''_{{\rm B}i}$ are for certain $(\epsilon_{\rm cor}/n)$-correct $\forall i$ and thus $k'_{\rm A}$ and $k'_{\rm B}$ are $\epsilon_{\rm cor}$-correct. The secrecy condition only holds if all $k''_{{\rm A}i}$ and $k''_{{\rm B}i}$ originate from raw keys output by honest QKD modules. For simplicity, we will suppose that the length of $k''_{{\rm A}i}$ and $k''_{{\rm B}i}$ is $N$ bits $\forall i$.

3.  [*Generation of an $\epsilon$-secure key*]{}: CP$_{\rm A}$ and CP$_{\rm B}$ apply a randomly selected universal$_2$ hash function to extract from $k'_{\rm A}$ and $k'_{\rm B}$ two shorter bit strings, $k_{\rm A}$ and $k_{\rm B}$, of length $(M-t)\times{}N$ bits. $k_{\rm A}$ and $k_{\rm B}$ are by definition $\epsilon_{\rm sec}$-secret, and thus, from step $2$, they are $\epsilon$-secure.

Note that in step $3$ of [*Protocol*]{} $1$ we consider the worst-case scenario where all $k''_{{\rm A}i}$ and $k''_{{\rm B}i}$ generated by corrupted QKD modules contribute to $k'_{\rm A}$ and $k'_{\rm 