write $\tilde{P}$ the distribution corresponding to the state $\mathcal{S}(\rho^{\otimes n})$. The following lemma from [@LG10b] (proven in Appendix \[proof-three-variables\] for completeness) shows that this function only depends on 3 variables, instead of $4n$ for the non-symmetrized scenario.

\[three-variables\] For $n \geq 2$, the symmetrized distribution $$\tilde{P}({\bf x}, {\bf y}) = \int_{K(n)} P(R{\bf x}, R{\bf y}) \mathrm{d} R,$$ where $\mathrm{d}R$ refers to the Haar measure on $K(n)$, only depends on $||{\bf x}||^2, ||{\bf  y}||^2, {\bf x} \cdot {\bf y}$.

Let us note $X_i = x_i^2, Y_i = y_i^2, Z_i = x_i y_i$ and $X^n = \sum_{i=1}^n X_i, Y^n = \sum_{i=1}^n Y_i, Z^n = \sum_{i=1}^n Z_i$. Because $\tilde{P}({\bf x}, {\bf y})$ only depends on $X^n=||{\bf x}||^2$, $Y^n=||{\bf  y}||^2$ and $Z^n={\bf x} \cdot {\bf y}$, it actually corresponds to the probability distribution $P_v$ of the vector $V^n=[X^n, Y^n, Z^n]$: $$\tilde{P}({\bf x}, {\bf y})  \mathrm{d}{\bf x} \mathrm{d}{\bf y} = P_v(V^n) \mathrm{d} V^n.$$

According to the central limit theorem, since the vectors $V_i$ are i.i.d. (which follows from the collective attack assumption), the distribution $P_v$ converges to a Gaussian distribution as $n$ tends to infinity, and one can use a multidimensional version of Berry-Esseen theorem to bound the distance between the two distributions. Noting $P_G$ 