Randomness extraction via a quantum

1 Randomness extraction via a quantum generalization of the conditional collision entropy Yodai Watanabe, Member, IEEE arxiv:1703.1036v3 [cs.it 4 Dec 018 Abstract Randomness extraction against side information is the art of distilling from a given source a key which is almost uniform conditioned on the side information. This paper provides randomness extraction against quantum side information whose extractable key length is given by a quantum generalization of the collision entropy smoothed and conditioned differently from the existing ones. ased on the fact that the collision entropy is not subadditive, its optimization respect to additional side information is introduced, and is shown to be asymptotically optimal. The lower bound derived there for general states is expressed as the difference between two unconditional entropies and its evaluation reduces to the eigenvalue problem of two states, the entire state and the marginal state of side information. Index Terms Randomness extraction; Quantum collision entropy; Extractable key length I. INTRODUCTION Consider a random variable X and a quantum state ρ correlated to X. The task of randomness extraction from source X against side information ρ is to distill an almost random key S from X. Here the randomness of S is measured by the trace distance between the composite systemss, ρ) and U, ρ), where U is a random variable uniformly distributed and independent of ρ. A major application of randomness extraction is privacy amplification [1, [13, whose task is to transform a partially secure key into a highly secure key in the presence of an adversary side information. It has been shown that a two-universal hash function [3 can be used to provide randomness extraction against quantum side information, in which the extractable key length is lowerbounded by a quantum generalization of the conditional minentropy [1. The extractable key length can also be given by a quantum generalization of the conditional collision entropy conditional Rényi entropy of order ) [1, [13. It should be stated that the collision entropy is lower-bounded by the min-entropy and so gives a better extractable key length than the min-entropy, while the min-entropy has several useful properties such as the monotonicity under quantum operations. The way to consider a tighter bound on the length of an extractable almost random key is to generalize entropies by the smoothing. In fact, the existing extractable key lengths have been described by smooth entropies, most of which are defined as the maximization of entropies respect to quantum states in a small ball see e.g. [10, [1, [13, [15, [17). More precisely, let H A and H be finitedimensional Hilbert spaces, and SH) and S H) denote the This work was supported in part by JSPS Grants-in-Aid for Young Scientists ) No. 170001 and Scientific Research C) No. 15K0000. The author is Department of Computer Science and Engineering, University of Aizu, Aizuwakamatsu, Fukushima 9658580, Japan e-mail: yodai a u aizu ac jp). sets of normalized and sub-normalized quantum states on a Hilbert space H, respectively; then, for example, the smooth min-entropy H ǫ min A ) ρ of system A conditioned on system of a state ρ S H A H ) is defined by H ǫ mina ) ρ = max ρ ǫ ρ) H mina ) ρ, H min A ) ρ = max σ SH ) sup I A σ ρ}, where I A denotes the identity operator on H A, and ǫ ρ) = ρ S H) Cρ,ρ ) ǫ } for ǫ > 0 and ρ SH) Cρ,ρ ) = 1 F ρ,ρ ) and Fρ,ρ ) = Tr ρ ρ. The hypothesis relative entropy [16, [18 is not based on this smoothing, but is conditioned in the same way as above, i.e. an operator of the form I A σ is introduced and the entropy is maximized respect to σ. This paper introduces a quantum generalization R ǫ of the collision entropy smoothed and conditioned differently from the existing ones Definition 1). ased on the fact that the collision entropy is not subadditive, its optimization R ǫ respect to additional side information, which automatically satisfies the strong subadditivity and so the data processing inequality Proposition ), is also introduced Definition 1). These generalized collision entropies R ǫ and R ǫ are shown to give a lower bound on the maximal key length in randomness extraction against quantum side information Theorem 3). Moreover, a lower bound on R ǫ for general states is derived Theorem 6) and used to show the asymptotic optimality of R ǫ Corollary 7). The general lower bound on R ǫ is expressed as the difference between two unconditional entropies and its evaluation reduces to the eigenvalue problem of two states, the entire state and the marginal state of side information. II. PRELIMINARIES Let H be a Hilbert space. For an Hermitian operator X on H spectral decomposition X = i ie i, let X 0} denote the projection on H given by X 0} = E i. i: i 0 The projections X > 0}, X 0} and X < 0} are defined analogously. Let A and be positive operators on H. The trace distance d 1 A,) and the relative entropy DA ) between A and are defined as d 1 A,) = 1 Tr[A )A > 0} A < 0}), DA ) = Tr[Alog A log ),

respectively, where log denotes the logarithm to base. The von Neumann entropy of A is defined as SA) = TrAlog A. For an operator X > 0, let X denote the normalization of X; that is, X = X/Tr[X. It then follows from SA ) log ranka = log ranka and DA ) 0 that SA) Tr[A log ranka log Tr[A ), 1) DA ) Tr[A log Tr[A log Tr[ ). ) More generally, it can be shown that inequality 1) holds for A 0 and inequality ) holds for A, 0 such that suppa supp, by using the convention0log 0 = 0, which can be justified by taking the limit, lim ǫ +0 ǫlog ǫ = 0. Let f be an operator convex function on an interval J R. Let X i } i be a set of operators on H their spectrum in J, and C i } i be a set of operators on H such that i C i C i = I, where I is the identity operator on H. Then Jensen s operator inequality for f, X i } i and C i } i is given by ) f C i X ic i C i fx i)c i 3) i i see e.g. [, [8). Let X and S be finite sets and G be a family of functions from X to S. Let G be a random variable uniformly distributed over G. Then G is called two-universal, and G is called a twouniversal hash function [3, if Pr[Gx 0 ) = Gx 1 ) 1 4) S for every distinct x 0,x 1 X. For example, the family of all functions from X to S is two-universal. A more useful twouniversal family is that of all linear functions from 0,1} n to 0,1} m. More efficient families, which can be described using On + m) bits and have a polynomial-time evaluating algorithms, are discussed in [3, [0. Let X be a random variable on a finite set X and ρ be a quantum state on a Hilbert space H. In considering the composite system X,ρ ), it may help to introduce a Hilbert space H X an orthonormal basis x } x X and define the classical-quantum state ρ X by ρ X = x p x x x ρ x, where p x = Pr[X = x for x X, and ρ x denotes the quantum state ρ conditioned on X = x. Let ρ X be a classical-quantum state as above. Then the distance dx ) ρ from uniform of system X given system can be defined as dx ) ρ = d 1 ρ X,σ X ) σ X = 1 d X I X ρ, where d X = X is the dimension of X and I X is the identity operator on X. Instead of the trace distance, another distance measure may be used to define the distance from uniform. For example, the relative entropy can be used to define the distance from uniform of the form DX ) ρ = Dρ X σ X ). Here, quantum Pinsker s inequality d 1 ρ,σ) ) Dρ σ) see [11) gives dx )ρ ) DX )ρ, which ensures that an upper bound on DX ) ρ also gives an upper bound ondx ) ρ. Therefore, in this paper, we will use DX ) ρ, instead of dx ) ρ, as the measure of the distance from uniform. III. RANDOMNESS EXTRACTION First, we introduce a quantum generalization of the smoothed) conditional collision entropy and its optimization respect to additional side information. Definition 1. Let H A and H be Hilbert spaces, and ρ A be a quantum state on H A H. For ǫ 0, the information spectrum collision entropy 1 R ǫ A ) ρ of system A conditioned on system of a state ρ is given by R ǫ A ) ρ = sup Tr [ Λ ρ 0} ρ 1 ǫ }, Λ = Tr A [ ρ A. Moreover, for ǫ 0, the information spectrum collision entropy R ǫ A ) ρ of system A conditioned on system of a state ρ optimal side information is given by R ǫ A ) ρ = sup H C,ρ AC:Tr C[ρ AC=ρ A R ǫ A C) ρ, where the supremum ranges over all Hilbert spaces H C and quantum states ρ AC on H A H H C such that Tr C [ρ AC = ρ A. In contrast to the conditional von Neumann entropy SA ) ρ = Sρ A ) Sρ ), R ǫ A ) ρ can increase when additional side information is provided; that is, R ǫ A C) ρ > R ǫ A ) ρ is possible such side information for the classical collision entropy is called spoiling knowledge [1). On the other hand, Rǫ A ) ρ is optimized respect to additional side information, and so satisfies the following data processing inequality. Proposition. Let H A, H and H be Hilbert spaces, and ρ A be a quantum state on H A H. Let F be a trace preserving completely positive map from system to system. Then R ǫ A ) ρ R ǫ A ) Fρ). Proof. The definitions of R ǫ and R ǫ at once give that R ǫ A ) ρ is invariant under the adjoint action of an isometry on system and R ǫ is strongly subadditive. Moreover, the Stinespring dilation theorem see [14) ensures that there exist 1 This name of R ǫ follows that of the information spectrum relative entropy D ǫ sρ σ) = supr Tr[ρρ R σ} ǫ}, which can be considered as an entropic version of the quantum information spectrum, D and D see [16).

3 a Hilbert space H E and an isometry U : H H H E such that Fρ ) = Tr E [ Uρ U for any ρ SH ). Therefore, if we suppose that R ǫ A ) ρ = R ǫ A C) ρ for ρ AC SH A H H C ) such that Tr C [ρ AC = ρ A, then R ǫ A ) ρ = R ǫ A C) ρ = R ǫ A EC) UρU This completes the proof. R ǫ A ) Fρ). We are now ready to state a main theorem. Note that the monotonicity of the relative entropy enables to replace R ǫ A ) ρ in this theorem by R ǫ A ) ρ. Theorem 3. Let X and S be finite sets, and X be a random variable on X. Let H be a Hilbert space, and ρ X be a classical-quantum state on H X H. Let G be a random variable, independent of ρ X, uniformly distributed over a two-universal family of hash functions from X to S. Then ) DS G) ρsg ǫlog d S +η0 ǫ)+ δ +ǫ+ǫ1/ ln for ǫ 0, where η 0 is a function on [0, ) given by ǫlog ǫ for 0 ǫ 1/, η 0 ǫ) = 1/ for ǫ > 1/, and we have introduced S = GX), d = rankρ and δ = S RǫX )ρ. In this theorem, ρ SG is given by ρ SG = p s g s s 1 G g g ρ s g p s g = x g 1 s) s S,g G p x and ρ s g = 1 p s g and DS G) ρsg can be written as x g 1 s) DS G) ρsg = Dρ SG σ SG ) σ SG = 1 S I S 1 G I G ρ. Proof. Direct calculation shows that DS G) ρsg = g,s p x ρ x, 5) 6) p g Tr [ ρ sg log ρ sg Tr [ ρ log ρ +log S 7) p g = 1/ G, where we have defined ρ sg = p x ρ x. 8) x g 1 s) Since the real function log is operator convex on 0, ) see e.g. [), we can estimate the first term of the right-hand side of 7) by applying Jensen s operator inequality as follows. Let f = log and introduce the operators X sg and C sg by writing X sg = ρ sg +γi and C sg = p g ρ sg ) 1/ Pˆρ 1/ for γ > 0, where we have defined ˆρ = Pρ P and P = Λ r ρ 0 } for r < R ǫ X ) ρ. It readily follows that X sg > 0 and C sg C sg = P ρ, where P ρ denotes the projection onto the range of ˆρ. Furthermore, let us define the operators X + and C + by so that X + = I and C + = I P ρ, fx + ) = 0 and C sgc sg +C +C + = I. Then by Jensen s operator inequality 3), ) f C sg X sgc sg +C + X +C + C sg fx sg)c sg. Here, C sgx sg C sg is an operator on the range Rˆρ ) of ˆρ, while C + X +C + is an operator on its orthogonal complement Rˆρ ). It thus follows that ) ˆρ 1/ f C sg X sgc sg ˆρ 1/ ˆρ 1/ C sg fx sg)c sgˆρ 1/, which, in the limit γ +0, leads to p g Pρ 1/ ) sg log ρ sg ρ 1/ sg P ˆρ 1/ log ) 9) p gˆρ 1/ Pρ sgpˆρ 1/ ˆρ 1/. To estimate the right-hand side of 9), let us estimate the sum p gpρ sgp. Substitution of 8) into this sum gives p g Pρ sg P = p g p x p x pgx)=gx ))Pρ x ρ x P. g,x,x Here, we divide the sum of the right-hand side into two parts so that one part consists of the terms x = x and the other part consists of the remaining terms. It follows from the definition of P that the former part can be bounded as g,x,x :x=x p g p x p x pgx)=gx ))Pρ x ρ x P = PΛ P r Pρ P. y using 4), the latter part can also be bounded as p g p x p x pgx)=gx ))Pρ x ρ x P g,x,x :x x = p x p x Pρ x ρ x P p g pgx)=gx )) x,x :x x g 1 p x p x Pρ x ρ x P S x,x :x x 1 S Pρ P.

4 The above two inequalities at once give p g Pρ sg P 1 S 1+δ r)pρ P 10) δ r = S r. Note here that log ρ sg 0 and ρ sg ρ 1/ sg Pρ 1/ sg, and so p g Tr [ ρ sg log ρ sg p g Tr [ ρ 1/ sg Pρ 1/ sg log ρ sg. g,s Therefore, by taking the trace of both sides of 9) and then using 10) and Tr[ˆρ 1, we obtain DS G) ρsg 1 Tr[ˆρ )log S +log 1+δ r )+, = Tr [ˆρ log ˆρ 1/ Pρ Pˆρ 1/ ) Tr[ρ log ρ. Furthermore, by using Tr[ˆρ 1 ǫ and log 1 + x) x/ln for x 0, this inequality can be simplified to DS G) ρsg ǫlog S + δ r +. 11) ln It remains to estimate. Let us write in the form = 1 +, where 1 = Tr [ˆρ 1/ log ˆρ Pρ ) Pˆρ 1/ Tr[ˆρ log ˆρ, = Tr[ˆρ log ˆρ Tr[ρ log ρ. First, we estimate the first part 1. Let S = ˆρ and T =. Since ˆρ 1/ Pρ Pˆρ 1/ T S = ˆρ 1/ Pρ I P)ρ Pˆρ 1/ 0, and hence supps suppt, inequality ) can be applied to yield 1 = DS T) Tr[Slog Tr[T Tr[S. It is now convenient to define φ = Tr[T S, which can be written as 1/ φ = Tr [ˆρ Pρ I P)ρ Pˆρ 1/ = Tr [ I P)ρ 1/ ρ1/ Pˆρ 1 Pρ. Hence by Schwarz s inequality, φ Tr [ I P)ρ I P) Tr [ ρ Pˆρ 1 Pρ ) 1/. y use of Tr[I P)ρ ǫ and Tr [ ρ Pˆρ 1 Pρ = Tr[T = Tr[S+φ, this inequality can be simplified to φ ǫ 1/ Tr[S+φ ) 1/, which, together Tr[S = Tr[ˆρ 1, gives φ ǫ+ ǫ +4ǫTr[S ) 1/ Therefore 1 Tr[Slog Tr[S+φ Tr[S ǫ+ ǫ+ǫ 1/) = ǫ+ǫ 1/. ǫ+ǫ1/. 1) ln Next, we estimate the second part. Let κ P ρ ) = Pρ P +I P)ρ I P). Since ρ and κ P ρ ) are density operators, Dρ κ P ρ )) 0, and hence Sρ )+Sˆρ )+SI P)ρ I P)) 0. From this and 1), = Sˆρ )+Sρ ) SI P)ρ I P)) ǫlog d+η 0 ǫ), 13) where d = rankρ and η 0 is a monotone increasing function on [0, ) defined by 6). Now, the required inequality 5) follows from 11), 1) and 13) taking the limit r R ǫ X ) ρ 0. This completes the proof. Let ld ǫ X ) denote the maximal length of randomness of distance ǫ from uniform respect to the relative entropy D), extractable from system X given system. It then follows from this theorem that l ǫ DX ) R ǫ X )+log δ 14) ǫ ) = ǫlog d X +η0 ǫ)+ δ +ǫ+ǫ1/ 15) ln where we have used S X ). LetX be a finite set. For any set of quantum states ρ x } x X onh, one can construct a set of pure statesρ x } x X onh such that there exists a trace preserving completely positive map F : satisfying Fρ x) = ρ x for all x X [4. Therefore, for the case where d = rankρ is high, e.g. infinite, we may substitute RX ) Fρ) by RX ) ρ ρ X = x p x x x ρ x, where RX ) ρ RX ) Fρ) and rankρ X. Here, the latter inequality is an advantage but the former is a disadvantage of this reduction.) In randomness extraction against classical side information Y, the distance from uniform can be upper-bounded as DS G) ρsg ǫlog S + δ/ln if G and Y are independent [1, and as DS G) ρsg ǫlog S + δ +ǫ ln if Y may depend on G [19. It should be stated that, in quantum key distribution, adversary s measurement can wait until the choice of hash functions is announced, and so adversary s information Y may depend on the choice G). Here, we note that for a purely classical state ρ XY, RX Y) ρ becomes R ǫ X Y) = sup Pr[Y y RX Y = y) } 1 ǫ }, where RX Y = y) = log x Pr[X = x Y = y. Since R ǫ X Y) coincides the smoothed) conditional collision entropy given by [1, [19, R ǫ A ) ρ can be considered as its quantum generalization. Hence it may be of interest to compare the results of these works. It can be seen that the upper bound given in this work see 5)) is larger than that given in [19 see above) by ǫlog d/ǫ)+ǫ 1/ /ln, which is Oǫ 1/ ) as ǫ +0. This inequality is a special case of Fannes inequality [6.

5 IV. ASYMPTOTIC OPTIMALITY We first introduce two information spectrum entropies which asymptotically approach the von Neumann entropy. Definition 4. Let ρ A be a quantum state on a Hilbert space H A. Then, for ǫ 0, the information spectrum sup-entropy S ǫ A) ρ and inf-entropy S ǫ A) ρ of system A of a state ρ are given by [ S ǫ A) ρ = inf Tr ρ } ρ 1 ǫ }, [ S ǫ A) ρ =sup Tr ρ } ρ 1 ǫ }, respectively. Proposition 5. Let ρ A be a quantum state on a Hilbert space H A of finite dimension d A. Then, for γ > 0, S ǫ A n ) ρ n n SA) ρ +γ ), S ǫ A n ) ρ n n SA) ρ γ ), ǫ = 1+n) da ndρa,γ) and ǫ = 1+n) da ndρa,γ), 16) Dρ,γ) = Dρ,γ) = for ρ SH) and γ > 0. inf Dσ ρ), σ SH):ρσ=σρ,Sσ)+Dσ ρ)>sρ)+γ inf Dσ ρ), σ SH):ρσ=σρ,Sσ)+Dσ ρ)<sρ) γ Proof. Note that S ǫ A) ρ and S ǫ A) ρ can be described by the probability distribution induced by the eigenvalues of ρ A. Hence, the proposition is a direct consequence of Sanov s theorem see e.g. [5), which gives that, in our notation, Tr [ ρ n nµ < ρ n < nν } 1+n) d ndρ;µ,ν) Dρ;µ,ν) = inf Dσ ρ) σ SH):ρσ=σρ,ν<Sσ)+Dσ ρ)<µ for ρ SH), where H is a Hilbert space of finite dimension d. Next, we give a general lower bound on R ǫ in terms of the two information spectrum entropies introduced above, and then show the asymptotic optimality of R ǫ. Since each information spectrum entropy is determined by the eigenvalues of a quantum state, the evaluation of the lower bound reduces to the eigenvalue problem of two quantum states ρ A and ρ A. Theorem 6. Let H A and H be Hilbert spaces, and ρ A be a quantum state on H A H. Then, for ǫ,ǫ > 0, R ǫ A ) ρ S ǫ A) ρ S ǫ ) ρ +log 1 ǫ 1/ ) ǫ = ǫ 1/ +ǫ+ǫ. Proof. Let H C be a two-dimensional Hilbert space an orthonormal basis 0, 1 }. For ǫ > 0, define a quantum state ρ AC on H A H H C by ρ AC = ρ A 1 1 +ρ A ρ A ) 0 0, ρ A = ρ A ρa µ } µ = S ǫ A)ρ. It is clear from this definition that Tr C [ρ AC = ρ A and ρ A µ ρ A. Also, it follows from the definition of S ǫ that Tr[ ρ A 1 ǫ. 17) Moreover, for ǫ > 0, define ˆρ and ˇρ by ˆρ = ρ ρ }, ˇρ = ρ } ρ ρ }, = Sǫ)ρ and ρ = Tr A [ ρ A. It then follows from ρ ρ and 17) that and so for č = 1 ǫ 1/, Hence, ˇρ ˆρ and Tr [ˆρ ˇρ ǫ, Tr [ˆρ ˇρ < č } Tr [ˆρ ˇρ < čˆρ } = Tr [ˆρ ǫ 1/ˆρ < ˆρ ˇρ } < Tr [ ǫ 1/ˆρ ˇρ ) ǫ 1/. Tr [ˆρ ˇρ č } > Tr [ˆρ ǫ 1/. Here, on noting that ˇρ commutes ρ }, let us introduce the projection P on H H C defined by P = ρ }ˇρ č } 1 1. It can be seen from this definition that Tr [ ρ C P > Tr [ˆρ ǫ 1/ Tr [ ρ ρ Moreover, since and 1 ǫ ǫ 1/ ǫ. PΛ C P = PTr A [ ρ A 1 1 P µpρ C P Pρ CP Pρ C Pρ C P = Pˇρ 1 1 )P čpρ C P, it follows that PΛ C r ρ C )P 0 for r S ǫ A) ρ S ǫ ) ρ + log č. Hence, P Λ C r ρ C 0} and so for R ǫ A ) ρ R ǫ A C) ρ S ǫ A) ρ S ǫ ) ρ +log 1 ǫ 1/ ) ǫ = ǫ 1/ +ǫ+ǫ.

6 This completes the proof. Corollary 7. Let H A and H be Hilbert spaces of finite dimensions d A and d, respectively, and ρ A be a quantum state on H A H. Then, 1 lim n n R ǫ A ) ρ SA ) ρ for ǫ converging to 0 as n. Proof. It follows from Theorem 6 and Proposition 5 that R ǫ A n n ) ρ n n SA ) ρ γ ) +log 1 ǫ 1/ ) ǫ = ǫ 1/ +ǫ+ǫ, where ǫ and ǫ are given by 16). Now, suppose that ρ, σ and γ satisfy the condition in the definition of D or D. Then γ < Sρ) Sσ) ±Dσ ρ) d 1 ρ,σ)dimh d 1 ρ,σ)log d 1 ρ,σ)±dσ ρ) Dσ ρ) 1 δ δ > 0, for sufficiently small Dσ ρ), where the second inequality follows from Fannes inequality [6 and the third one from quantum Pinsker s inequality andlim x +0 x δ log x = 0 for δ > 0. Therefore, we can take γ = n eγ, ǫ = 1+n) dad neǫ, ǫ = 1+n) d neǫ for e γ and e ǫ such that e γ,e ǫ > 0 and e γ +e ǫ < 1, from which the corollary follows. For a classical-quantum state ρ X on H X H, it follows from inequality 14) that ǫ R ǫ X ) ld ǫ X ) log δ Hmin X ) ρ log δ see e.g. [16 for the second inequality), and so the asymptotic equipartition property of the min-entropy see e.g. [15) and the above corollary yield that 1 lim n n R ǫ X n n ) ρ n = SX ) ρ for ǫ converging to 0 as n. V. CONCLUDING REMARKS It follows from Theorem 3 and the monotonicity of the relative entropy that R ǫ gives the length of extractable randomness distance ǫ from uniform, where ǫ is given by 15). For fixed ǫ, the maximal length l ǫ d 1 of extractable randomness has an asymptotic expansion an optimal second-order term, 1 n lǫ d 1 X n n ) ) VX )ρ logn = SX ) ρ + Φ 1 ǫ )+O, n n where VA ) ρ = Tr[ρ A logρ A logi A ρ ) and Φ denotes the cumulative distribution function of the standard normal distribution see [16). Hence, it is of interest to examine how close 1 n R ǫ is to the above optimum, in particular when the classical large deviation theory giving an optimal secondorder asymptotics [9 is applied instead of Sanov s theorem. Moreover, it should be stated that in many applications such as those in cryptography, ǫ should converge to 0 faster than any polynomial n c for sufficiently large n > n c. However, the optimality of the above expansion, which is shown by use of erry-essen theorem see e.g. [7), is lost for such ǫ; in fact, the lower bound on l ǫ d 1 diverges to for ǫ converging faster than 1/ n. Therefore, it is also of interest to examine the possibility of further improvement in the second-order asymptotics for ǫ converging sufficiently fast. ACKNOWLEDGEMENT The author is grateful to reviewers for their helpful comments. REFERENCES [1 C. ennett, G. rassard, C. Crepeau, and U. Maurer, Generalized privacy amplification, IEEE Trans. Inform. Theory, vol. 41, no. 6, pp. 1915 193, Nov 1995. [ R. hatia, Matrix Analysis. erlin: Springer, 1997. [3 J. L. Carter and M. N. Wegman, Universal classes of hash functions, J. Comput. System Sci., vol. 18, pp. 143 154, 1979. [4 A. Chefles, R. Jozsa, and A. Winter, On the existence of physical transformations between sets of quantum states, International Journal of Quantum Information, vol., no. 1, pp. 11 1, 004. [5 T. M. Cover and J. A. Thomas, Elements of Information Theory, nd ed. Wiley, 006. [6 M. Fannes, A continuity property of the entropy density for spin lattice systems, Communications in Mathematical Physics, vol. 31, no. 4, pp. 91 94, Dec 1973. [7 W. Feller, An Introduction to Probability Theory and Its Applications, nd ed. New York: Wiley, 1971, vol.. [8 F. Hansen and G. K. Pedersen, Jensen s operator inequality, ull. London Math. Soc., vol. 35, pp. 553 564, 003. [9 M. Hayashi, Second-order asymptotics in fixed-length source coding and intrinsic randomness, IEEE Transactions on Information Theory, vol. 54, no. 10, pp. 4619 4637, Oct 008. [10, Quantum security analysis via smoothing of renyi entropy of order, in Proceedings of the 7th Conference on Theory of Quantum Computation, Communication, and Cryptography, ser. Lecture Notes in Computer Science, K. Iwama, Ed. erlin: Springer, 013, vol. 758, pp. 18 140. [11 M. Ohya and D. Petz, Quantum Entropy and Its Use. erlin: Springer, 1993. [1 R. Renner, Security of quantum key distribution, Ph.D. dissertation, ETH Zurich, 005. [13 R. Renner and R. König, Universally composable privacy amplification against quantum adversaries, in Proceedings of Theory of Cryptography Conference, ser. Lecture Notes in Computer Science, J. Kilian, Ed. erlin: Springer, 005, vol. 3378, pp. 407 45. [14 W. F. Stinespring, Positive functions on c -algebras, Proceedings of the American Mathematical Society, vol. 6, no., pp. 11 16, 1955. [15 M. Tomamichel, R. Colbeck, and R. Renner, A fully quantum asymptotic equipartition property, IEEE Trans. Inform. Theory, vol. 55, no. 1, pp. 5840 5847, Dec 009. [16 M. Tomamichel and M. Hayashi, A hierarchy of information quantities for finite block length analysis of quantum tasks, IEEE Transactions on Information Theory, vol. 59, no. 11, pp. 7693 7710, Nov 013. [17 M. Tomamichel, C. Schaffner, A. Smith, and R. Renner, Leftover hashing against quantum side information, IEEE Trans. Inform. Theory, vol. 57, no. 8, pp. 554 5535, Aug 011. [18 L. Wang and R. Renner, One-shot classical-quantum capacity and hypothesis testing, Phys. Rev. Lett., vol. 108, p. 00501, 01. [19 Y. Watanabe, Privacy amplification for quantum key distribution, J. Phys. A: Math. Theor., vol. 40, pp. F99 F104, 007. [0 M. N. Wegman and J. L. Carter, New hash functions and their use in authentication and set equality, J. Comput. System Sci., vol., pp. 65 79, 1981.