be malicious, we aim to generate shares of an $\epsilon$-secure key, $k_{\rm A}$ and $k_{\rm B}$. A possible solution to this scenario is given by [*Protocol*]{} $2$, which uses the VSS protocol introduced in [@maurer_smpc]. These protocols are described in Appendices \[tool\] and \[app\_P2\] respectively. Below we provide a sketch of [*Protocol*]{} $2$ where, for easy of presentation, we assume $r=s$. It consists of six main steps.\
Sketch of [*Protocol $2$*]{}:

1.  [*Generation and distribution of shares of raw keys and protocol information*]{}: QKD$_{\rm A}$ and QKD$_{\rm B}$ output, respectively, $k'_{\rm A}$ and $p_{\rm A,info}$, and $k'_{\rm B}$ and $p_{\rm B,info}$, or the abort symbol $\perp$. If the output is different from $\perp$, QKD$_{\rm A}$ sends $p_{\rm A,info}$ to all CP$_{{\rm A}i}$ and uses a VSS scheme to distribute shares of $k'_{\rm A}$ between the CP$_{{\rm A}i}$. Likewise, QKD$_{\rm B}$ does the same with $p_{\rm B,info}$, $k'_{\rm B}$ and the units CP$_{{\rm B}i'}$. Let $k'_{{\rm A}ij}$ ($k'_{{\rm B}i'j}$) be the $j$-th share of $k'_{\rm A}$ ($k'_{\rm B}$) received by CP$_{{\rm A}i}$ (CP$_{{\rm B}i'}$). Next, the CP$_{{\rm A}i}$ and CP$_{{\rm B}i'}$ send to each other $p_{\rm A,info}$ and $p_{\rm B,info}$.

2.  [*Sifting*]{}: Each CP$_{{\rm A}i}$ uses $p_{\rm A,info}$ and $p_{\rm B,info}$ 