Abort-aware real and ideal QKD outputs and security errors

Fix one adversarial strategy in a protocol from Finite authenticated key-distribution protocol. Write its final output blocks as ${\omega }_E^{\mathrm{\perp },t}$ on abort and ${\omega }_E^{a,b,t}$ on acceptance. Define the abort and accepted transcript-adversary substates by

${\rho }_{TE}^{\mathrm{a}\mathrm{b}\mathrm{o}\mathrm{r}\mathrm{t}}:={\sum }_{t\in \mathsf{T}}\mathrm{\mid }t⟩⟨t\mathrm{\mid }\otimes {\omega }_E^{\mathrm{\perp },t},{\rho }_{TE}^{\mathrm{a}\mathrm{c}\mathrm{c}}:={\sum }_{t\in \mathsf{T}}\mathrm{\mid }t⟩⟨t\mathrm{\mid }\otimes {\sum }_{a,b\in \mathsf{K}}{\omega }_E^{a,b,t}\mathrm{.}$

The accepted part of the full real state is ${\rho }_{ABTE}^{\mathrm{a}\mathrm{c}\mathrm{c}}:={\sum }_{a,b\in \mathsf{K},t\in \mathsf{T}}\mathrm{\mid }a,b,t⟩⟨a,b,t\mathrm{\mid }\otimes {\omega }_E^{a,b,t}$.

Their traces are $p_{\mathrm{a}\mathrm{b}\mathrm{o}\mathrm{r}\mathrm{t}}$ and $p_{\mathrm{a}\mathrm{c}\mathrm{c}}$, with $p_{\mathrm{a}\mathrm{b}\mathrm{o}\mathrm{r}\mathrm{t}}+p_{\mathrm{a}\mathrm{c}\mathrm{c}}=1$. If $p_{\mathrm{a}\mathrm{c}\mathrm{c}}>0$, put ${\rho }_{ABTE}^{\mathrm{\top }}:={\rho }_{ABTE}^{\mathrm{a}\mathrm{c}\mathrm{c}}\mathrm{/}{p}_{\mathrm{a}\mathrm{c}\mathrm{c}}$ and define the normalized accepted marginals directly from their classical blocks:

${\rho }_{ATE}^{\mathrm{\top }}:={\sum }_{a,t}\mathrm{\mid }a,t⟩⟨a,t\mathrm{\mid }\otimes \frac{1}{p_{\mathrm{a}\mathrm{c}\mathrm{c}}}{\sum }_b{\omega }_E^{a,b,t},{\rho }_{TE}^{\mathrm{\top }}:={\sum }_t\mathrm{\mid }t⟩⟨t\mathrm{\mid }\otimes \frac{1}{p_{\mathrm{a}\mathrm{c}\mathrm{c}}}{\sum }_{a,b}{\omega }_E^{a,b,t}\mathrm{.}$

For $m:=\mathrm{\mid }\mathsf{K}\mathrm{\mid }$, define the uniform key state ${\tau }_A:=m^{-1}{\sum }_{a\in \mathsf{K}}\mathrm{\mid }a⟩⟨a\mathrm{\mid }$ and the ideal uniform shared-key state ${\tau }_{AB}:=m^{-1}{\sum }_{a\in \mathsf{K}}\mathrm{\mid }a,a⟩⟨a,a\mathrm{\mid }$. The abort-aware ideal full output keeps the real abort branch and the accepted transcript-adversary marginal, but replaces the accepted keys with a uniform shared key independent of both:

${\rho }_{ABTE}^{\mathrm{i}\mathrm{d}\mathrm{e}\mathrm{a}\mathrm{l}}:={\sum }_t\mathrm{\mid }\mathrm{\perp },\mathrm{\perp },t⟩⟨\mathrm{\perp },\mathrm{\perp },t\mathrm{\mid }\otimes {\omega }_E^{\mathrm{\perp },t}+{\tau }_{AB}\otimes {\rho }_{TE}^{\mathrm{a}\mathrm{c}\mathrm{c}}\mathrm{.}$

Let ${\rho }_{ABTE}^{\mathrm{r}\mathrm{e}\mathrm{a}\mathrm{l}}$ be the normalized output from the protocol definition. The real-ideal trace-distance error is ${\delta }_{\mathrm{i}\mathrm{d}}:=D({\rho }_{ABTE}^{\mathrm{r}\mathrm{e}\mathrm{a}\mathrm{l}},{\rho }_{ABTE}^{\mathrm{i}\mathrm{d}\mathrm{e}\mathrm{a}\mathrm{l}})$, using Trace Distance. The correctness error is ${\epsilon }_{\mathrm{c}\mathrm{o}\mathrm{r}}:=\mathrm{Pr}[K_A\mathrm{\ne }{K}_B]={\sum }_{a\mathrm{\ne }b,t}\mathrm{tr}({\omega }_E^{a,b,t})$; the common abort output contributes no mismatch. The secrecy error is

${\epsilon }_{\mathrm{s}\mathrm{e}\mathrm{c}}:=\{\begin{array}{ll}{p}_{\mathrm{a}\mathrm{c}\mathrm{c}}D({\rho }_{ATE}^{\mathrm{\top }},{\tau }_A\otimes {\rho }_{TE}^{\mathrm{\top }}),& p_{\mathrm{a}\mathrm{c}\mathrm{c}}>0,\\ 0,& p_{\mathrm{a}\mathrm{c}\mathrm{c}}=0.\end{array}$

This is an unconditional convention: the normalized secrecy distance on acceptance is weighted by the acceptance probability. Errors in a protocol are uniform bounds on these strategy-specific quantities over all allowed adversarial strategies.