at least one of them is corrupted. Also, we conservatively assume that corrupted devices do not have to necessarily follow the prescriptions of the protocol but their behaviour is fully controlled by Eve, who could also access all their internal information. We refer the reader to Appendix \[gen\_sec\] for the security analysis of QKD against a general mixed adversary structure [@fitzi].

The goal is to generate a composable $\epsilon$-secure key, $k_{\rm A}$ and $k_{\rm B}$. That is, $k_{\rm A}$ and $k_{\rm B}$ should be identical except for a minuscule probability $\epsilon_{\rm cor}$, and say $k_{\rm A}$ should be completely random and decoupled from Eve except for a minuscule probability $\epsilon_{\rm sec}$, with $\epsilon_{\rm cor}+\epsilon_{\rm sec}\leq\epsilon$ [@comp1; @comp2]. Importantly, since now some QKD modules and classical post-processing units could be corrupted, the secrecy condition also implies that $k_{\rm A}$ and $k_{\rm B}$ must be independent of any information held by the corrupted devices [*after*]{} the execution of the protocol. Otherwise, such corrupted devices could directly leak $k_{\rm A}$ and $k_{\rm B}$ to Eve. Obviously, at the end of the day, some parties might need to have access to the final key, and thus one necessarily must assume that such parties are 