In Quantum Key Distribution, the distributed key is produced by Privacy Amplification (also known as key distillation). An ID Quantique whitepaper introduces it with a
Rudimentary Privacy Amplification Protocol
Let us consider a two-bit key shared by the emitter and the receiver and let us assume that it is 01. Let us further assume that the eavesdropper knows the first bit of the key but not the second one: 0?.
The simplest privacy amplification protocol consists in calculating the sum, without carry, of the two bits and to use the resulting bit as the final key. The legitimate users obtain 0 + 1 = 1. The eavesdropper does not know the second bit. For him, this operation could be either 0 + 0 = 0 or 0 + 1 = 1. He has no way to decide which one is the correct one. Consequently, he does not have any knowledge on the final key. There is a cost. This privacy amplification protocol shortens the key by 50%. In practice, more efficient protocols have obviously been developed.
Updated formal definition: In this question, Privacy Amplification aims at deterministically producing as much as possible nearly secret uniformly random and independent bits, rigorously bounding the advantage any distinguisher may give, when given as input
- $n$ partially secret bits, having been significantly and individually probed or/and influenced by an adversary, so that the remaining secret entropy is $\ge s\,n$ bit for some known $s\ll1$ (say $s=1/4$ );
- and optionally, some extra public uniformly random bits, assumed independent including of the partially secret bits;
- and optionally, as few as possible extra secret uniformly random bits, assumed independent including of the partially secret and extra public bits.
The classical cryptographer could use a hash and ignore the optional extras, but that relies on unproven mathematical hypothesis, that Quantum Cryptography aims at replacing with physical hypothesis. What provable methods does Information Theory bring to the rescue? Can we do without the optional extras?
Full disclosure: I'm trying to plug a hole at B.2 there.
Note: Extra public bits are used in Chi-Hang Fred Fung, Xiongfeng Ma, H. F. Chau Practical issues in quantum-key-distribution postprocessing (in Phys. Rev. A, 2010). Extra secret bits are a figment of my imagination.