$k_{\rm B{\it j}, key}$ to obtain $s_{{\rm A}j}=M_{\rm EC}k_{\rm A{\it j}, key}$ and $s_{{\rm B}j}=M_{\rm EC}k_{\rm B{\it j}, key}$, respectively, for all $j$. Next, Alice sends $s_{{\rm A}j}$ to Bob who obtains $s_{\rm A}=\oplus_{j=1}^qs_{{\rm A}j}$ and $s_{\rm B}=\oplus_{j=1}^qs_{{\rm B}j}$. This is so because $\oplus_{j=1}^qs_{{\rm A}j}=\oplus_{j=1}^qM_{\rm EC}k_{\rm A{\it j}, key}=M_{\rm EC}\oplus_{j=1}^qk_{\rm A{\it j}, key}=M_{\rm EC}k_{\rm A, key}=s_{\rm A}$, and a similar argument applies to $s_{\rm B}$. Finally, if $s_{\rm A}\neq{}s_{\rm B}$ Bob corrects $k_{\rm B, key}$ by acting on its shares $k_{\rm B{\it j}, key}$. This is so because to flip certain bits in $k_{\rm B, key}$ is equivalent to flip the corresponding bits in one of its shares $k_{\rm B{\it j}, key}$. That is, the error correction step in QKD can be easily performed in a distributed setting by acting only on shares of $k_{\rm A, key}$ and $k_{\rm B, key}$. The same argument applies as well to the other classical post-processing techniques in QKD, as all of them involve only linear operations.

To defeat corrupted QKD modules, on the other hand, we use privacy amplification techniques. Suppose, for instance, that each pair of QKD modules, QKD$_{{\rm A}i}$ and QKD$_{{\rm B}i}$, output a raw key, $k'_{{\rm A}i}$ and $k'_{{\rm B}i}$. 