You are an expert at summarizing long articles. Proceed to summarize the following text: 
quantum key distribution is the art of distilling a secret key between two distant parties , alice and bob , who have access to an untrusted quantum channel @xcite . in this scenario , one typically assumes that the equipment in alice and bob s labs can be trusted , and moreover , that its behavior is accurately described by a given theoretical model . unfortunately , this often turns out to be a very strong assumption which is not justified in practice @xcite . in particular , many loopholes can be exploited by an eavesdropper to get around the usual security proofs : for instance , the state preparation might be imperfect @xcite , or the eavesdropper might perform a blinding attack to take control of the detectors at a distance @xcite .    one way around such problems consists in exhaustively listing all the potential mismatches between the theoretical model and the real implementation and taking care of each one of them individually . however , this approach is dubious as it is impossible to be sure that all loopholes have really been addressed . another , more promising , approach is inspired by the recent framework of device - independent quantum information processing  @xcite . here , the idea is that if alice and bob are able to experimentally violate a bell inequality  @xcite , it means that their data exhibit intrinsic randomness as well as secrecy  @xcite , independently of the internal operation of the devices  @xcite . in the recent years , this framework has been used to prove the security of device - independent key distribution @xcite , to certify randomness expansion @xcite , self - testing of quantum computers @xcite and states  @xcite , and guarantee the presence of entanglement @xcite .    in the present work , we focus on the cryptographic task of key distribution , which has been the subject of many very recent developments . until recently , security proofs were restricted to scenarios where alice and bob have access to a pair of memoryless devices or @xmath0 independent pairs of devices , thus ensuring that the measurements inside their own labs were causally disconnected  @xcite or commuting  @xcite . this is reminiscent of the notion of collective attacks in standard qkd , where some independence assumption is required . ideally , one would like a protocol where only one device is required per party , and for which no assumption is needed for the device . this is indeed the motivation for doing device - independent cryptography in the first place . recent works have been able to get rid of this assumption . in ref . @xcite , the authors introduced a protocol based on the chained bell inequality @xcite and established its security against arbitrary adversaries . the protocol , however , only produces a single secret bit and does not tolerate any noise . in ref . @xcite , the authors proved a strong converse of tsirelson s optimality result for the clauser - horne - shimony - holt ( chsh ) game , based on the chsh inequality  @xcite : the only way using quantum resources to win the game as predicted by tsirelson s bound is to use a strategy close to the optimal one for independent and identically distributed states , that is , applying the optimal measurements on copies of a two - qubit maximally entangled state . this theorem provides a security proof for diqkd based on the chsh inequality . unfortunately , the security proof does not resistant any constant amount of noise . while this work was completed , vazirani and vidick gave a universally composable security proof of diqkd against arbitrary attacks @xcite . their protocol , based again on the chsh inequality , is both reasonably efficient ( the key length scales linearly with the number of measurements ) and tolerant to a constant fraction of noise . a drawback , however , is that the maximum amount of noise tolerated is of the order of @xmath1 , significantly lower than the bounds obtained for protocols using @xmath0 pairs of devices .    in the present paper , we present a security proof that ( i ) works for only two devices , that is , does not require commuting measurements or memoryless devices , ( ii ) can be applied to generic diqkd protocols based on arbitrary bell inequalities , ( iii ) has the same efficiency and tolerance to noise than previous proofs using memoryless devices . all these nice properties , however , come at the price of assuming that the adversary only holds classical information . while this may seem a strong requirement , it can be easily enforced in any realistic implementation by delaying the reconciliation process , since the best existing quantum memories have very short coherence times  @xcite . another advantage of our general framework is that it can also provide security beyond quantum theory , that is , against eavesdroppers that are only limited by the no - signalling principle . the outline of the paper is the following . we first give a brief reminder of the relation between non locality , that is , violation of a bell inequality , and randomness . we then describe the quantum key distribution protocol and present its secret key rate . we prove the security of the protocol under the assumption that the eavesdropper does not have access to a long - term quantum memory . we conclude by briefly comparing our results with the existing security proofs , and discussing some rather natural follow - up questions . in the following , we consider a bipartite scenario where alice and bob input random variables @xmath2 and @xmath3 in their respective devices and obtain classical outputs @xmath4 and @xmath5 , respectively . we denote @xmath6 the sizes of the alphabets of @xmath7 , respectively . moreover , we denote by @xmath8 the probability of getting the specific results @xmath9 when the inputs are @xmath10 , and @xmath11 the vector with components @xmath8 . a bell inequality can be written as @xmath12 : = \sum_{a , b , x , y } \beta ( a , b , x , y)\ , p(a , b|x , y ) \leq i_\mathrm{cl}\ , \ ] ] where @xmath13 is the classical upper - bound . to any such bell inequality , one can associate a bound on the randomness of the output @xmath4 given the input @xmath14 through a function @xmath15 such that @xmath16)\quad \mbox { for all } a\in\lambda_a\ .\ ] ] such a function can be computed using the techniques given in  @xcite , as explained in  @xcite . without loss of generality , this function can be assumed to be monotonically non - increasing and such that @xmath17 is convex .    for simplicity , we consider the case where there exist an input - independent bound , i.e. a function @xmath18 such that @xmath19 for all @xmath20 . examples of bell inequalities satisfying this property are : the chsh inequality @xcite , the chained inequality @xcite , and the collins - gisin - linden - massar - popescu ( cglmp ) inequality @xcite . our results , however , can easily be generalised to cover the case of input - dependent bounds . the diqkd protocol that we consider in this paper is very general in the sense that it is compatible with arbitrary bell inequalities , in particular with the various examples of bell inequalities mentioned above . our protocol consists of four steps : measurements , estimation of the bell violation , error correction and privacy amplification . we note @xmath0 the number of times each device is used during the protocol .    1 .   * measurements . * alice and bob respectively generate the random variables @xmath21 with distribution @xmath22 for @xmath23 . if @xmath24 then alice measures round @xmath25 with input @xmath26 obtaining outcome @xmath27 . if @xmath28 then alice generates @xmath29 with uniform distribution @xmath30 and measures round @xmath25 with input @xmath29 obtaining outcome @xmath27 bob does the analog with @xmath31 , input @xmath32 , and outcome @xmath33 . in other words , events where @xmath34 are used to establish a raw key , while events where @xmath35 are used to test the bell inequality and guarantee that a secret key can indeed be extracted from the raw key . * estimation . * alice and bob publish @xmath36 for all @xmath25 , and discard the data corresponding to the rounds with @xmath37 . the data corresponding to the @xmath38 post - selected rounds @xmath39 with @xmath40 is relabeled with the index @xmath41 keeping the time order . the data corresponding to the rounds of the set @xmath42 is also published and used to estimate the bell - inequality violation . more specifically , alice and bob can use the public data to compute the following quantity : @xmath43 the data of the rounds not in @xmath44 constitutes the raw key of alice @xmath45 and bob @xmath46 . * error correction . * alice and bob publish @xmath47 bits in order to correct bobs errors @xmath48 . for sufficiently large @xmath47 , all errors are corrected @xmath49 with high probability . note that some of the published bits are used to estimate how many more bits need to be publish for a successful error correction . for large @xmath0 , publishing @xmath50 bits is enough . for more details about the functioning of error correction , we refer to @xcite . * privacy amplification . * alice generates and publishes a two - universal  @xcite random function @xmath51 which maps @xmath52 to an @xmath53-bit string @xmath54 . the number @xmath53 depends on the published information as @xmath55 where @xmath56 is the largest integer not bigger than @xmath57 . alice and bob then compute @xmath58 , obtaining two copies of the secret key . note that if the adversary holds a quantum memory , but can not keep it for an arbitrary long time , the honest parties should implement the protocol in two steps : ( i ) they receive the quantum systems from the source and perform the measurements , ( ii ) some time @xmath59 later they perform the rest of the protocol involving the public communication for the estimation , error correction , and privacy amplification . we show security under the assumption that the adversary can not keep a quantum memory for a time @xmath59 . according to current and near - future technology , this assumption can be enforced by taking @xmath59 of the order of a few minutes  @xcite . to prove security , we will not make any assumption on the behaviour of the devices of alice and bob , except that they do not broadcast information about the inputs and outputs towards the adversary ( a condition without which there is no hope of ever establishing any secret ) . modulo this requirement , we can even assume for simplicity that the devices have been built by the adversary . the eavesdropper could in particular hold quantum systems that are entangled with the systems in the users devices . however , our proof of security only holds under the condition that the eavesdropper can not store this quantum information past the measurement step of the protocol . after this step , she should thus perform a measurement @xmath60 on his quantum system , which would give him some classical information @xmath61 about the behaviour of alice s and bob s devices . but since until this point no public communication has been exchanged between alice and bob , we can as well assume that the eavesdropper has performed his measurement before the users received their devices from the source . the fact that our proof of security holds independently of the behaviour of the devices , then implies that it holds independently of the prior classical information @xmath61 that eve holds on the devices , and we can thus forget @xmath61 in the following .    at the end of the protocol , alice holds the secret key @xmath62 , and eve holds the information published in the estimation step @xmath63 $ ] , in the error correction step @xmath64 , and in the privacy amplification step @xmath51 . note that here we consider the worst case , where all the messages published within the error - correction step are a function @xmath65 of alices raw key @xmath52 . let @xmath66 be the probability distribution for these random variables . we say that @xmath62 is an ideal secret key if it is uniformly distributed and uncorrelated with all the rest : @xmath67 note that since @xmath44 and @xmath68 are functions of @xmath69 , so is @xmath53 . it is unrealistic to expect that a protocol can generate an ideal secret key . instead , what we demand is that the distribution generated by the above protocol is indistinguishable from an ideal secret key . it is known that the optimal success probability when discriminating the two distributions is @xcite @xmath70 the main result of this work ( see the theorem below ) is to shows that @xmath71 where @xmath57 is a constant and @xmath72 . for large @xmath0 , the success probability ( [ main result ] ) tends to 1/2 , which makes the optimal discriminating strategy not better than a random guess . let us now discuss the efficiency of the protocol in the asymptotic limit where @xmath0 tends to infinity . for large @xmath0 one expects , @xmath73 with high probability . this gives an asymptotic secret key rate of @xmath74 this is the same rate as the one given in @xcite for memoryless devices but with security against full quantum adversaries .    in the case of the chsh inequality , @xmath75 , we define @xmath76 and @xmath77 such that @xmath78)$ ] holds against an adversary limited by quantum theory and @xmath79)$ ] holds against an adversary limited by the no - signalling principle . the specific values of these functions was derived in @xcite : @xmath80 in fig . [ key ] , we plot the asymptotic secret key rate as a function of the visibility of the state @xmath81 shared by alice and bob . _ vs _ noise @xmath82 for the chsh protocol and a state @xmath81 , where @xmath83 is maximally entangled . the upper curve corresponds to a quantum adversary while the lower one considers an adversary only limited by the no - signalling principle . ] we now proceed with a detailed security proof for the protocol described above . before we present and prove our main result which is an explicit bound on @xmath84 , we need three technical lemmas . let us introduce a more compact notation @xmath85 for @xmath86 . variables with super - index @xmath87 represent the chain of variables associated to time steps equal or earlier than @xmath87 , that is @xmath88 . recall that the information made public in the estimation step is @xmath89 $ ] and that the raw key is @xmath90 . let @xmath91 and note that @xmath92 and @xmath93 . * lemma 1 . * the no - signaling constraints imposed by the causal structure of the protocol imply @xmath94 \right)\ , \ ] ] for all @xmath95 , where @xmath96 : = \frac{1}{m } \sum_{i=1}^m       i\ ! \left [ p(a_i , b_i|x_i , y_i , t^{i-1},z^{i-1 } ) \right]\ .\ ] ] note that above , in @xmath97 , the symbols @xmath98 are upper - case while @xmath99 are lower - case , meaning that @xmath97 is the vector with components @xmath100 for all values of @xmath101 but fixed @xmath99 . _ this proof is based on an argument introduced in  @xcite . a useful observation is that bound  ( [ tau i ] ) implies @xmath102)\quad \mbox { for all } a , b , x , y\ .\ ] ] the following chain of equalities and inequalities follows from : bayes rule , no - signaling to the future , bounds  ( [ tau i ] ) and  ( [ extra ] ) , and the concavity of the function @xmath103 . @xmath104 \right ) \\ & \leq &      \tau^{m}\ ! \left ( \bar i [ t^m , z^{m } ] \right)\end{aligned}\]]@xmath105    * lemma 2 . * the numbers @xmath106 , @xmath68 , @xmath107 are functions of the random variable @xmath108 , and satisfy @xmath109 where @xmath72 . ( here a comment is in order . actually , @xmath107 is not only a function of @xmath108 but also depends on the global probability distribution @xmath110 . but we think of this distribution as given , fixed and unknown . this dependence prevents the straight generalization of the results in this paper to a quantum adversary . ) _ the function @xmath111 satisfies @xmath112 \ = \      \frac{i_{\rm est } [ t^m , z^m]\ , |{\cal e}|}{\pr\{u=1|u = v\}}\ , \ ] ] and @xmath113 =      i[p(a_i , b_i|x_i , y_i , t^{i-1 } , z^{i-1})]\ , \ ] ] for all @xmath87 . consider the sequence of functions of @xmath114 defined by @xmath115\ , \ ] ] for @xmath116 . the fact that @xmath117 = \alpha_{l-1 } ( t^{l-1 } , z^{l-1})\ ] ] implies that the sequence of random variables @xmath118 is a martingale  @xcite with respect to the sequence @xmath119 . also , using the fact that @xmath120 and @xmath121 \geq q^2 $ ] , the differences @xmath122 are bounded for all values of @xmath114 . constraints ( [ martingale ] ) and ( [ bound dif ] ) constitute the premises for azumas inequality  @xcite @xmath123 for any @xmath124 . using ( [ eta xi ] ) , ( [ new ] ) and ( [ martingale ] ) we obtain @xmath125 & = &      \frac{1}{m } \sum_{i=1}^m      i\ ! \left [ p(a_i , b_i|x_i , y_i , z^{i-1 } , t^{i-1 } ) \right ] \\ & = &      \frac{1}{m } \left (      \sum_{i=1}^{m } \eta[t_i , z_i ] - \alpha_{m } ( t^{m } , z^m )      \right ) \\ & = &      \frac{1}{m } \left (      \frac{|{\cal e}|\ , i_{\rm est}}{\pr\{u=1|u = v\ } }      -   \alpha_{m } ( t^{m } , z^m ) \right)\ , \end{aligned}\ ] ] and setting @xmath126 gives ( [ l2 ] ) . @xmath127    * lemma 3 . * there is a good event @xmath128 with probability @xmath129 such that @xmath130 for all @xmath69 such that @xmath131 . _ this proof uses a trick introduced in  @xcite . the values of @xmath114 in the set @xmath132 are the good ones , since alice and bob correctly lower - bound @xmath133 ( and hence @xmath53 ) from the values @xmath106 and @xmath134 determined in the estimation step . in the condition defining @xmath135 above , every symbol is a constant except for latexmath:[$\bar i ,    @xmath114 . note that @xmath107 also depends on the global distribution @xmath137 , which prevents the generalization of this results to the case of quantum adversary . fortunately , according to lemma 2 , the probability of @xmath135 is large @xmath138 note the abuse of notation @xmath139 . define the set @xmath140 and note that @xmath141 . using this and @xmath142 we obtain @xmath143 . recall @xmath144 and note that @xmath145 and @xmath146 . define the set @xmath147 and note that @xmath148 where we have used @xmath149 . the good event mentioned in the statement of this lemma is @xmath150@xmath151 , and has probability @xmath152 , as in ( [ g ] ) . we assume @xmath153 , since it is a premise of the lemma . if @xmath154 then @xmath155 . hence , the non - trivial case happens for @xmath156 , which we assume in what follows . using bayes rule , the definition of @xmath157 and @xmath158 , lemma 1 , and ( [ g1 ] ) , we obtain @xmath159 \right ) \\ & \leq &      2\ , ( \lambda_a \lambda_b)^{2|{\cal e}|}\ , \tau^m \!\ ! \left (      \frac{|{\cal e}|\ , i_{\rm est}(g , z^m)}{m\pr\{u=1|u = v\ } }      -n^{-1/8 } \right)\ , \end{aligned}\ ] ] which shows the lemma . @xmath105    * theorem . * the distance between the secret key generated by the protocol and an ideal key is @xmath160    _ proof . _ using definitions ( [ n_k ] ) and ( [ pguess ] ) , lemma 3 , and @xmath161 , we obtain : @xmath162 the symbol @xmath163 denotes the knowledge of @xmath52 with respect to @xmath164 ( see appendix ) when the statistics is conditioned on the events @xmath165 and @xmath128 . next , we use the identity @xmath166 with the event @xmath128 introduced in lemma 3 . noticing that @xmath167 is a function of @xmath168 , using ( [ hg ] ) , the triangular inequality , and lemma 4 , we see that @xmath169 which concludes the proof . in this work , we provide a novel security proof for diqkd . contrary to most of the existing proofs , it applies to the situation in which alice and bob generate the raw key using two devices . in particular , it does not need to assume that the devices are memoryless or , equivalently , that each raw - key symbol is generated using a different device . while there exist other recent proofs that also work without this assumption , they tolerate zero  @xcite or rather small amounts of noise  @xcite . another important feature of our proof is that it can also be applied to non - signalling supra - quantum eavesdroppers . all these advantages come at the price of making an extra assumption on eve : she does not have access to a long - term quantum memory and , therefore , effectively she can not store quantum information . while this may at first be considered a strong assumption ( and is actually not needed in new security proofs for diqkd  @xcite ) , it is a very realistic assumption taking into account current technology . the natural open question is to understand how the assumption on the memory can be removed within the framework presented here , or how the other proofs  @xcite could be improved to tolerate realistic noise rates . in the case of no - signalling eavesdroppers , there is some evidence suggesting that the fact that eve can store information and delay her measurement prevents any form of privacy amplification between the honest parties  @xcite . however , the recent results of  @xcite imply that privacy amplification is indeed possible against quantum eavesdroppers . a good understanding of privacy amplification in the device - independent quantum scenario is probably the missing ingredient to get robust and practical fully device - independent security proofs . we acknowledge useful discussion with serge massar . this work is supported by the erc sg percent , by the eu projects q - essence and qcs , by the chist - era diqip project , by the spanish fis2010 - 14830 projects , by the snf through the national centre of competence in research `` quantum science and technology '' , by catalunyacaixa , by the interuniversity attraction poles photonics@be programme ( belgian science policy ) , by the brussels - capital region through a bb2b grant , and from the frs - fnrs under project diqip . a random function @xmath170 is two - universal  @xcite if @xmath171 for all @xmath172 with @xmath173 . the following is a simple extension of the main result in  @xcite . * lemma 4 . * let @xmath174 be two ( possibly correlated ) random variables where @xmath52 takes values in the set @xmath175 , and let @xmath170 be a two - universal random function  @xcite . the random variable @xmath54 satisfies @xmath176 where @xmath177                                            the two main approaches for quantum memories are based on ensemble of atoms or on crystals . to our knowledge , the best existing quantum memories with ensemble of atoms have coherence times of the order of 100 milliseconds , a. g. radnaev _ et al . _ , nature phys . * 6 * , 894 ( 2010 ) . moving to crystals , coherence times of the order of a few seconds have been reported for classical light , see j.  j. longdell , e. fraval , m.  j. sellars and n.  b. manson , phys . 95 , 063601 ( 2005 ) . while in principle the method should be scalable to light at the quantum level , this has not been demonstrated yet . of course , improvements on these coherence times may be expected in the foreseeable future , however there is no evidence that these improvements will be significant . s. pironio , a. acn , s. massar , a. boyer de la giroday , d.  n. matsukevich , p. maunz , s. olmschenk , d. hayes , l. luo , t.  a. manning and c. monroe , _ random numbers certified by bell s theorem _ nature * 464 * 1021 ( 2010 ) . f. magniez , d. mayers , m. mosca and h. ollivier , _ self - testing of quantum circuits _ , proceedings of 33rd international colloquium on automata , languages and programming , volume 4051 , series lecture notes in computer science , 72 ( 2006 ) . m. navascus , s. pironio and a. acn , _ bounding the set of quantum correlations _ _ phys lett . _ * 98 * 010401 ( 2007 ) ; _ a convergent hierarchy of semidefinite programs characterizing the set of quantum correlations _ , new j. phys . * 11 * , 045021 ( 2009 ) . r. arnon - friedman , e. hnggi and a. ta - shma , _ towards the impossibility of non - signalling privacy amplification from time - like ordering constraints _ , arxiv:1205.3736 ; r. arnon - friedman and a. ta - shma , _ on the limits of privacy amplification against non - signalling memory attacks _ , arxiv:1211.1125 .
device - independent quantum key distribution ( diqkd ) is a formalism that supersedes traditional quantum key distribution , as its security does not rely on any detailed modelling of the internal working of the devices . 
 this strong form of security is possible only using devices producing correlations that violate a bell inequality . 
 full security proofs of diqkd have been recently reported , but they tolerate zero or small amounts of noise and are restricted to protocols based on specific bell inequalities . here , we provide a security proof of diqkd that is both more efficient and noise resistant , and also more general as it applies to protocols based on arbitrary bell inequalities and can be adapted to cover supra - quantum eavesdroppers limited by the no - signalling principle only . 
 it requires , however , the extra assumption that the adversary does not have a long - term quantum memory , a condition that is not a limitation at present since the best existing quantum memories have very short coherence times .