aborts and its raw data could in principle be transformed into a secure key we have, by definition, that the maximum [*total*]{} final key length is at most $n\times{}N$ bits. Also, we know that up to $t\times{}N$ bits of such key could be compromised by the $t$ pairs of corrupted QKD modules. That is, the maximum secure key length is at most $(n-t)\times{}N$ bits. Moreover, as discussed above, if some pairs of QKD modules abort we must necessarily assume the worst-case scenario where they are honest. This is so because through her interaction with the quantum signals in the channel, Eve could always force honest QKD modules to abort by simply increasing the resulting QBER or phase error rate. That is, in the scenario considered it is not possible to distill a key length greater than $(M-t)\times{}N$ bits.

QKD with honest QKD modules and malicious classical post-processing units {#ups2}
-------------------------------------------------------------------------

We now consider the situation where Alice and Bob have one trusted QKD module each, and Alice (Bob) has $s$ ($r$) classical post-processing units CP$_{{\rm A}i}$ (CP$_{{\rm B}i'}$), with $i=1,\ldots,s$ ($i'=1,\ldots,r$), and up to $t'<s/3$ ($t''<r/3$) of them could be corrupted. This scenario is illustrated in Fig. \[fig2\] and corresponds 