Guillaume Aubrun

Ludovico Lami

Carlos Palazuelos

Martin Plávala

Entanglement and superposition are equivalent concepts in any physical theory

We prove that any two general probabilistic theories (GPTs) are entangleable, in the sense that their composite exhibits either entangled states or entangled measurements, if and only if they are both non-classical, meaning that neither of the state spaces is a simplex. This establishes the universal equivalence of the (local) superposition principle and the existence of global entanglement, valid in a fully theory-independent way. As an application of our techniques, we show that all nonclassical GPTs exhibit a strong form of incompatibility of states and measurements, and use this to construct a version of the BB84 protocol that works in any non-classical GPT.

Introduction.-When one looks back at the magnificent conceptual and philosophical revolution that quantum mechanics has sparked almost a century ago, two discoveries stand out as fraught with consequences, namely, the superposition principle and the existence of entanglement. The former entails that the behaviour of quantum systems cannot be described by classical probability theory, while the latter implies, via Bell's theorem [1,2], that the correlations exhibited by separate systems cannot be explained by means of local hidden variable models. These consequences of superposition and entanglement are predicted by the formalism of quantum mechanics, but they can be understood operationally, as simple statements concerning the frequencies of certain measurement outcomes. They can thus be regarded as theory-independent: any future 'ultimate' theory of Nature, which may overcome quantum mechanics, must nevertheless encompass them and explain those experiments.

What is instead theory-dependent, here, is the connection between these two notions. Namely, it is only within the formalism of quantum theory that we can understand entanglement as the superposition principle applied to different product vectors of a tensor product Hilbert space [3,4]. That the connection between two fundamental phenomena whose physical existence rests on solid experimental evidence can only be understood by means of the mathematical formalism pertaining to a specific framework is somewhat conceptually unsatisfying, and, what is more, makes our understanding of said connection less sound and more dependent on the current theoretical paradigm -which is, most likely, incomplete. And indeed, recently there have been several attempts to fill this gap and investigate the interplay between these two notions in an a priori fashion [5][6][7][8].

In this paper we complete this programme, showing that the connection between superposition principle and entanglement -and, moreover, a strong notion of in-Non-classicality / Superpositions Strong incompatibility (Theorem 3)

Entangleability BB84

FIG. 1: Our path to connect the notions of non-classicality/superpositions and entangleability via that of strong incompatibility, which is also key to implementing the BB84 protocol.

compatibility of measurements and states -can be understood in a fully theory-independent way, and thus promoting it from a mere accident of the mathematics underpinning quantum mechanics to a logical necessity. This connection is demonstrated in Figure 1, showing that strong incompatiblity as given by Theorem 3 connects non-classicality/superpositions with entangleability, at the same time allowing us to construct a version of the Bennett-Brassard 1984 (BB84) protocol [START_REF] Bennett | Proc. IEEE International Conference on Computers, Systems and Signal Processing[END_REF] in any non-classical theory.

In order to do this, we need a framework capable of encompassing all physical theories obeying minimal operational requirements, beyond standard quantum theory. The formalism of general probabilistic theories provides us with the widest possible arena to pursue such a programme [START_REF] Hartkämper | Foundations of Quantum Mechanics and Ordered Linear Spaces: Advanced Study Institute held in Marburg 1973[END_REF][START_REF] Ludwig | An Axiomatic Basis for Quantum Mechanics: Derivation of Hilbert space structure[END_REF][START_REF] Ludwig | [END_REF][13][14][15]. A brief introduction can be found below; for a more complete one, we refer the reader to Ref. [START_REF] Lami | Non-classical correlations in quantum mechanics and beyond[END_REF][START_REF] Müller | SciPost Physics Lecture Notes[END_REF][START_REF] Plávala | [END_REF]. Before explaining our result, we need to answer two questions.

(I) What does it mean that a certain state space ex-hibits superpositions? The answer we shall adopt is that such state space should be non-classical, i.e. it should not be described by a classical probability theory: that is, there should not be a finite set of 'elementary states' that are both (a) perfectly distinguishable by a measurement; and (b) such that any other state can be written as a statistical mixture of them. In mathematical terms, this is equivalent to saying that the state space is not shaped as a simplex, the multi-dimensional generalisation of the two-dimensional triangle and of the threedimensional tetrahedron. The connection we have made here between the existence of superpositions and the notion of non-classicality is a posteriori justified by Theorem 3 below, which illustrates it by drawing a striking parallel with quantum theory.

(II) What does it mean that two systems, i.e. two state spaces, exhibit entanglement? First, we need to distinguish between entanglement at the level of states and entanglement at the level of measurements. The former means that there are states on the bipartite system that cannot be written as a statistical mixture of uncorrelated (product) states. The latter, accordingly, means that there are bipartite effects that are not a positive linear combination of product effects.

General probabilistic theories.-In the most general sense, a physical theory is simply a set of rules that allow to deduce a probabilistic prediction of the outcome of an experiment given the detailed description of its preparation. From this abstract description one can deduce, via the so-called Ludwig's embedding theorem [START_REF] Ludwig | An Axiomatic Basis for Quantum Mechanics: Derivation of Hilbert space structure[END_REF][START_REF] Ludwig | [END_REF][START_REF] Lami | Non-classical correlations in quantum mechanics and beyond[END_REF], the mathematical formalism of general probabilistic theories (GPTs) that we will now describe [START_REF] Lami | Non-classical correlations in quantum mechanics and beyond[END_REF][START_REF] Müller | SciPost Physics Lecture Notes[END_REF][START_REF] Plávala | [END_REF].

The fundamental object needed to model an arbitrary physical system is its state space; mathematically, this will be represented as a generic convex and compact subset Ω of some finite-dimensional real vector space [START_REF]The assumption of finite dimension is a technical one. It is possible and in general desirable to drop it[END_REF]. Physically, a state ω ∈ Ω should be thought of as a description of a preparation procedure for the system under examination. The convexity of Ω reflects the fact that preparation procedures can be mixed stochastically: the ensemble {p i , ω i }, which corresponds to the physical procedure of drawing a random variable I and preparing the system in the state ω i , is represented within the formalism by the convex mixture i p i ω i .

It is often useful to include into the picture not only normalised but also un-normalised states. This can be done by imagining a situation as the one depicted in Figure 2. Namely, in an augmented vector space V we introduce a proper cone C, i.e. a set C ⊂ V that is closed under positive scalar multiplication, and moreover: (i) convex; (ii) salient, meaning that C∩(-C) = {0}; (iii) generating, in the sense that C -C = V ; and (iv) topologically closed. The state space Ω is then recovered as the section of C identified by the equation u = 1, where u ∈ V * is a 'normalising' functional, called the order unit, belonging

0 Ω C u = 1 V FIG. 2:
The basic ingredients of a GPT are a real finite-dimensional vector space V and a cone C. The order unit functional u defines a hyperplane u -1 (1), whose intersection with C identifies the state space Ω.

to the dual vector space V * and (v) strictly positive on C, i.e. such that u(x) > 0 for all x ∈ C with x = 0. We can summarise the above discussion by giving an abstract definition of a GPT as any triple (V, C, u), where V is any real finite-dimensional vector space, C ⊂ V is a proper cone inside it, and u ∈ V * is a strictly positive functional on C.

From the mathematical standpoint, the introduction of the (proper) cone C makes V an ordered vector space: for any two x, y ∈ V , we define the ordering by stipulating that x ≤ y if y -x ∈ C. Notably, this ordering is not total, i.e. it is possible that neither x ≤ y nor y ≤ x. The dual space V * inherits an ordering from V : for f, g ∈ V * , we write f ≤ g if f (ω) ≤ g(ω) for all ω ∈ Ω (equivalently, f (x) ≤ g(x) for all x ∈ C). The cone of positive functionals in V * , called the dual cone to C, is denoted with C * . Remarkably, for proper cones C we have the identity

C * * = C.
To complete our picture we need to discuss measurements alongside with states. The description of a physical measurement together with the identification of one of its possible outcomes will be represented mathematically by an effect. This is just a linear functional e ∈ V * ; the value e(ω) it takes on a state ω ∈ Ω, which must be comprised between 0 and 1, is interpreted as the probability that the corresponding outcome occurs when that state is measured. Employing the above notion of ordering on V * , we can compactly require that 0 ≤ e ≤ u. A fully-fledged measurement will then be a (finite) collection of effects (e i ) i∈I , where e i ∈ V * with e i ≥ 0 for all i. The normalisation condition for the outcome probabilities implies that i∈I e i = u. Now that we have a mathematical description of measurements, we could wonder whether such description is complete. Namely, given a collection of effects summing to u, can it be physically implemented as a measurement procedure? If that is the case, we will say that the system satisfies the no-restriction hypothesis [START_REF] Janotta | [END_REF]21]. We deem this a natural assumption, for the good reason that classical theories (Example 1) and quantum mechanics satisfy it. Thus, throughout this paper we will always include the no-restriction hypothesis in our theoretical framework.

The GPT formalism we have just sketched may appear rather abstract. To make it more concrete, let us discuss a very important case.

Example 1 (Classical theories as GPTs). In classical theory the cone C is generated by a set of linearly independent states. It then follows that the state space is a simplex and that every state is given as a unique convex combination of the generating states.

We can now give a precise mathematical meaning to the answer to question (I) in the Introduction. Within the formalism of GPTs, we identify the existence of abstract superpositions with the non-classicality of the theory, where we say that a GPT is non-classical if it is not of the form described in Example 1.

Bipartite systems.-In order to describe entanglement we need to introduce bipartite systems into the picture. Given two systems A, B modelled by GPTs

A = (V 1 , C 1 , u 1 ) and B = (V 2 , C 2 , u 2 )
, can we represent also the joint system AB as a GPT AB = (V 12 , C 12 , u 12 )? In this context, a natural assumption -which we shall adopt throughout the paper -is the so-called local tomography principle. In layman's terms, it states that the composite system should not contain more degrees of freedom than its parts. In more mathematical terms, we require that the statistics under product measurements determine any state of the bipartite system uniquely. With this assumption, one can prove the familiar tensor product rule [22,23]

V 12 = V 1 ⊗ V 2 , u 12 = u 1 ⊗ u 2 . (1)
Two operationally motivated constraints on the cone C 12 come from the fact that independent local actions, namely, state preparations and measurements, should be faithfully represented in the bipartite picture as well. More formally, (i) local (tensor product) states should also be valid bipartite states, and (ii) local (tensor product) effects should also be valid effects on the bipartite system. Introducing the minimal and the maximal tensor product of the cones C 1 and C 2 , defined by

C 1 ⊗ min C 2 . . = conv {x ⊗ y : x ∈ C 1 , y ∈ C 2 } , (2)
C 1 ⊗ max C 2 . . = C * 1 ⊗ min C * 2 * , (3)
where conv denotes the convex hull, we can rephrase (i) as

C 1 ⊗ min C 2 ⊆ C 12 and (ii) as C * 1 ⊗ min C * 2 ⊆ C * 12 .
By combining the former relation with the dual of the latter we obtain the two-fold bound

C 1 ⊗ min C 2 ⊆ C 12 ⊆ C 1 ⊗ max C 2 (4)
on the bipartite cone C 12 . (Note that by definition

C 1 ⊗ min C 2 ⊆ C 1 ⊗ max C 2 .
) We are now in the position to formalise the answer to question (II) in the Introduction: the existence of entanglement at the level of states or at the level of measurements is equivalent to one of the two inclusions in (4) being strict. In turn, this happens if and only if

C 1 ⊗ min C 2 = C 1 ⊗ max C 2 , (5)
i.e. if the minimal tensor product is a strict subset of the maximal tensor product. When this is the case we will say that the two GPTs A, B are entangleable. One interesting aspect of this definition of entangleability is that it does away with the need to specify the bipartite cone: whatever C 12 is chosen to be, (5) guarantees that the joint system will exhibit either entangled states or entangled measurements (or both).

Entangleability.-Our result on entangleability, whose (highly technical) proof can be found in [24], is as follows.

Theorem 2. Two GPTs A, B are entangleable if and only if they are both non-classical.

The above theorem pinpoints a profound and intrinsic connection between the notions of non-classicality and entanglement: the two concepts are two sides of the same coin, and not merely linked by a mathematical accident of the quantum mechanical formalism. Theorem 2 relies on two main assumptions: first, the no-restriction hypothesis, positing that every mathematically consistent effect is physically realisable; and second, the local tomography principle, which entails that combining two systems does not lead to the appearance of new degrees of freedom. These two assumptions are not only natural, because they are satisfied by both classical theories and quantum theory, but also necessary to avoid the mathematical trivialisation of the problem. In fact, by dropping the no-restriction hypothesis it is possible to enforce a minimal tensor product composition rule at the level of states and of measurements at the same time, eliminating entanglement somewhat artificially. On the other hand, without the local tomography principle the dimension of the linear span of C 12 is larger than that of the span of C 1 ⊗ min C 2 , directly implying the existence of entangled states [8, Proposition 2].

Note that one implication is easy:

if either A = (V 1 , C 1 , u 1 ) or B = (V 2 , C 2 , u 2 ) is classical, then it is not difficult to see that C 1 ⊗ min C 2 = C 1 ⊗ max C 2 ,
meaning that A and B are not entangleable [START_REF] Barker | Linear Multilinear Algebra[END_REF][START_REF] Barker | [END_REF]. The converse implication is the truly challenging one.

As it is formulated now, Theorem 2 is rather abstract, as it merely asserts the existence of entangled objects (either states or measurements) in certain composite theories; it tells us nothing about how that entanglement may be detected and harnessed, and what it may be useful for. To remedy this, in what follows we will show that our result in fact leads to the construction of a BB84 protocol [START_REF] Bennett | Proc. IEEE International Conference on Computers, Systems and Signal Processing[END_REF] that allows for secret key distribution over a public noiseless channel in any non-classical GPT.

Strong incompatibility.-We consider now a strengthened version of the well-known notion of incompatibility and prove that it is in fact fully equivalent to non-classicality (see Figure 1). Given a vector space V ordered by a cone C, two finite families of vectors x i ∈ C and y j ∈ C are said to be compatible if one can find z ij ∈ C, such that j z ij = x i and i z ij = y j for all i, j; they are said to be incompatible otherwise. Clearly, a necessary but in general not sufficient condition for compatibility is that i x i = j y j . If (V, C, u) forms a GPT, we can try to find incompatible vectors either in the primal space V, C or in the dual space V * , C * . This latter case is particularly important operationally, as two measurements are compatible if and only if they can be implemented jointly [27].

The connection between incompatibility and nonclassicality of GPTs has been explored thoroughly [7,[28][29][30][31][32][33][34][35]. For instance, it is known that a GPT is non-classical if and only if it admits two incompatible binary measurements [34]. Here we establish a modified and somewhat stronger version of this fact: Theorem 3. A proper cone C is non-classical if and only if there are non-zero vectors 0 = x 0 , x 1 , x + , x -∈ C and functionals f 0 , f 1 , f + , f -∈ C * such that:

(i) x 0 + x 1 = x + + x -and f 0 + f 1 = f + + f -; (ii) f 0 (x 1 ) = f 1 (x 0 ) = f + (x -) = f -(x + ) = 0; (iii) f i + f j is strictly positive, for all i ∈ {0, 1}, j ∈ {+, -}.
The proof of Theorem 3 can be found in the Supplemental Material [36]. At first sight it may not be clear what Theorem 3 has to do with the notion of incompatibility. However, the two families of vectors x 0 , x 1 ; x + , x -constructed there are in fact incompatible. To see this, assume that a decomposition (z ij ) ij ∈ C holds, so that

j z ij = x i and i z ij = x j . Then 0 = f 1 (x 0 ) = f 1 (z 0+ + z 0-) ≥ f 1 (z 0+ ) ≥ 0 and anal- ogously 0 = f -(x + ) = f -(z 0+ + z 1+ ) ≥ f -(z 0+ ) ≥ 0, so that f 1 (z 0+ ) = f -(z 0+ ) = 0. Since f 1 + f -
must be strictly positive and (f 1 + f -)(z 0+ ) = 0, it necessarily holds that z 0+ = 0. Repeating this reasoning we reach the absurd conclusion that z ij ≡ 0 for all i, j; hence, the vectors x 0 , x 1 ; x + , x -were indeed incompatible.

Note that Theorem 3 supports the idea of identifying superposition with non-classicality (as we have done) since one can draw a direct parallel between the two families of vectors x 0 , x 1 ; x + , x -and the vectors |0 , |1 ; |+ , |-representing states of a qubit, where |± = 1 √ 2 (|0 ±|1 ). The corresponding effects f 0 , f 1 ; f + , f -are then simply the projections onto the subspaces generated by the respective vectors. It is then clear that (ii) implies that we can treat x 0 , x 1 and x + , x -as operational generalization of two different orthonormal sets in quantum theory, while (i) implies that the linear hulls of these sets overlap. In this sense, one can also interpret the result of Theorem 3 as stating that any non-classical state space exhibits an operational form of quantum discord [37,38].

Theorem 3 allows us to provide a simple proof of Theorem 2 [36]. Indeed, given two non-classical GPTs A = (V 1 , C 1 , u 1 ) and B = (V 2 , C 2 , u 2 ), thanks to Theorem 3 we can construct an explicit tensor belonging to (5). In order to do this, we invoke Theorem 3 for the cone C 1 (resp., C 2 ) to construct vectors 0 = x 0 , x 1 ; x + , x -∈ C 1 and functionals f 0 , f 1 ; f + , f -∈ C * 1 (resp., vectors y 0 , y 1 ; y + , y -∈ C 2 and functionals g 0 , g 1 ; g + , g -∈ C * 2 ) satisfying conditions (i)-(iii). We then construct the state

C 1 ⊗ max C 2 but not to C 1 ⊗ min C 2 , thus demonstrating
ω = x 0 ⊗ y + -x + ⊗ y + + x + ⊗ y 0 + x 1 ⊗ y 1 . (6)
It turns out that

ω ∈ C 1 ⊗ max C 2 \ C 1 ⊗ min C 2 , (7)
thus implying (5), i.e. A, B are entangleable. The proof of ( 7) consists of two parts: first we show that ω ∈ C 1 ⊗ max C 2 , which is rather straightforward and follows from (i). To show that ω / ∈ C 1 ⊗ min C 2 we construct a Bell-like inequality of the Clauser-Horne-Shimony-Holt (CHSH) type [39] using the functionals f 0 , f 1 ; f + , f -and we prove that this inequality is violated. Note that since in general f 0 + f 1 = f + + f -= u, the aforementioned Bell inequality is not necessarily a Bell inequality in the underlying GPTs and the question whether any two nonclassical GPTs violate some Bell inequality is still open.

Application: BB84 protocol in GPTs.-As the main application of the theory developed here we show how to design a version of the BB84 protocol [START_REF] Bennett | Proc. IEEE International Conference on Computers, Systems and Signal Processing[END_REF] for secret key distribution over a public channel that works in any non-classical GPT. The motivation follows from the aforementioned parallel between the families of vectors x 0 , x 1 ; x + , x -and the vectors |0 , |1 ; |+ , |-. Since the later are used to construct the BB84 protocol in quantum theory, it is natural to ask whether the former allow us to do the same in any non-classical GPT.

The main idea is rather straightforward: let (V, C, u) be a non-classical GPT and let and let x 0 , x 1 ; x + , x -and f 0 , f 1 ; f + , f -be the vectors as given by Theorem 3. We can construct states ρ 0 , ρ 1 ; σ + , σ -∈ Ω such that p i ρ i = x i and q j σ j = x j for some p i , q j > 0. It then follows that p 0 ρ 0 + p 1 ρ 1 = q + σ + + q -σ -. By re-scaling if necessary, we can assume that p 0 + p 1 = q + + q -= 1 and similarly that f 0 + f 1 = f + + f -= . . ≤ u. Now, Alice tosses a fair coin; if heads, she prepares one of the states ρ 0 , ρ 1 (with a priori probabilities p 0 , p 1 ); if tails, one of the states σ + , σ -(with a priori probabilities q + , q -). Since p 0 ρ 0 +p 1 ρ 1 = q + σ + +q -σ -, an eavesdropper Eve cannot discern these two scenarios. Unlike in the quantum case, it is not guaranteed that Bob can perfectly discriminate the ensembles ρ 0 , ρ 1 or σ + , σ -; however, he will toss a fair coin too, and run an unambiguous state discrimination procedure using the measurements f 0 , f 1 , u -(if heads) or f + , f -, u -(if tails). This introduces an additional error, as the rounds where Bob obtains the outcome u -have to be discarded. Despite that, Alice and Bob can proceed in the usual way: they make the results of their coin tosses public and they remove the rounds for which either the choices of preparation and measurement were not the same or Bob obtained the outcome u -. In the remaining cases the choices of preparation and measurement correspond, and moreover Bob's outcome was not u -. Using Theorem 3(ii), we thus see that Bob has recovered with no error the key bit i. In this way Alice and Bob obtain a shared key. One of the significant differences with the quantum case is that this key is not automatically secret. In fact, the information revealed to Eve is correlated with the key bit. To remedy this, Alice and Bob can run the secret key distillation protocol proposed by Maurer [40] to extract a truly secure key. A detailed description of the protocol as well as proof that our version of it achieves a non-zero secret key generation rate can be found in the Supplemental Material [36].

Conclusions.-We have showed that the connection between superpositions, entanglement, and BB84 protocol is purely operational and exists in every non-classical GPT. The crucial aspect of our techniques is that they by-pass the Hilbert space structure that underlies quantum mechanics, but that is not included in other possible non-classical theories. This gives a counter-example to possible axiomatizations of quantum theory [41]: for example, it is known that existence of purifications [21,42], certain symmetries [43,44] or self-duality and spectrality [START_REF] Barnum | Strongly symmetric spectral convex bodies are Jordan algebra state spaces[END_REF] are enough to single-out quantum theory among other non-classical theories. Our results show that existence of superpositions, entanglement, and availability of BB84 protocol do not restrict the set of possible theories at all.

Our main method was to exploit the strong incompatibility inherent in every non-classical GPT. Strong incompatibility allowed us to construct the universal entangled tensor (6), but also a generalised version of the BB84 protocol that works in any non-classical operational theory. It is an open question whether one can derive other properties characterising non-classical GPTs, such as nobroadcasting [START_REF] Barnum | [END_REF], from strong incompatibility. It is also open whether the violations of Bell inequalities and steering exist in any non-classical GPT; we anticipate that some version of strong incompatibility may play an im-portant role in investigating this question.

Supplemental Material

I. PROOFS OF THEOREM 2 AND THEOREM 3

In this part of the supplemental material we prove Theorem 3 in the main text. Leveraging this latter result, we will present a direct proof of Theorem 2 that is under several aspects more intuitive and physically and operationally meaningful than that reported in [24]. However, we warn the reader that the demonstration of Theorem 3 is based on a key result from [24] whose highly technical proof will not be reproduced here.

Let us first recall some basic notions on convex cones. Here, all the vector spaces are assumed to be real and finite-dimensional; they are denoted with symbols such as V, V , and so on. A subset C of a vector space V is called a cone if it satisfies sx + ty ∈ C for every x, y ∈ C and s, t ∈ R + (R + stands for the half-line [0, ∞) of non-negative reals). The cone generated by a subset A ⊂ V will be denoted with cone(A).

A cone C ⊂ V is said to be generating if C -C = V (equivalently, if it spans V as a vector space). Also, C is called salient (or pointed ) if it does not contain a line, i.e. if C ∩ (-C) = {0}. Finally, C is proper if it is closed, salient and generating. We call convex body a compact convex subset of a vector space with a nonempty interior.

For a convex set K ⊂ V , we can consider the cone over K, which is the cone in V × R defined by

C(K) = cone(K × {1}) = {(x ; t) ∈ V × R + : x ∈ tK}.
If K is a convex body, then C(K) can be shown to be a proper cone. Let V be a vector space, and V * its dual space, i.e. the space of linear functionals on V . Given a cone C in V , we can construct its dual cone, defined as

C * = {f ∈ V * : f (x) ≥ 0 for every x ∈ C}.
The bipolar theorem states that if C is a closed cone then C = (C * ) * , up to the canonical identification of V with the bidual V * * .

Let C be a cone. An element x ∈ C is called an extreme ray generator if x = y + z, for y, z ∈ C, implies that y = αx for some α ∈ [0, 1]. If that is the case, the set {tx : t ∈ R + } is said to be an extreme ray of C. An element f ∈ V * is said to be strictly positive if f (x) > 0 for every x ∈ C with x = 0.

• • • • Qα S b

FIG. S1: A kite inside the blunt square

We need to define two particular planar convex shapes which will be crucial for us, see Figure S1. First, the blunt square is constructed as the unit square minus its corners, via the formula

S b . . = [-1, 1] 2 \ {-1, 1} 2 .
Also, we define a kite as

Q α = conv{(-1, α 0 ), (1, α 1 ), (α -, -1), (α + , 1)}, (S1)
where α = (α 0 , α 1 , α -, α + ) ∈ (-1, 1) 4 . Note that any kite is a subset of the blunt square.

Let C be a proper cone in a finite-dimensional vector space V . Borrowing the terminology from [24], we will say that C admits a kite-square sandwiching if one can find a kite Q α and two linear maps Ψ : R 3 → V , Φ :

V → R 3 with the property that Φ • Ψ = id, Ψ(C(Q α )) ⊂ C and moreover Φ(C) ⊂ C(S b ).
Then, a crucial result proved in [24] is the following.

Theorem S1. A proper cone C is non-classical if and only if it admits a kite-square sandwiching.

Remark S2. The argument from [24] gives an extra piece of information of which we will make use: the map Φ : V → R 3 involved in the kite-square sandwiching satisfies C ∩ ker Φ = {0}.

As we explain in the main text, the minimal and the maximal tensor product of the cones C 1 and C 2 are defined by

C 1 ⊗ min C 2 . . = conv {x ⊗ y : x ∈ C 1 , y ∈ C 2 } , (S2) C 1 ⊗ max C 2 . . = C * 1 ⊗ min C * 2 * . (S3) It is very easy to show that C 1 ⊗ min C 2 ⊆ C 1 ⊗ max C 2 .
The result on entangleability in the main text can be then stated in the following way.

Theorem 2. Let C 1 and C 2 be a proper cones. Then, they are both non-classical if and only if

C 1 ⊗ min C 2 = C 1 ⊗ max C 2 .
This result was proved in [24] and its proof crucially relies on Theorem S1, which appears as a purely mathematical result with no clear physical interpretation. Here, we will first show how Theorem 3 in the main text can be obtained from Theorem S1. Theorem 3. A proper cone C is non-classical if and only if there are non-zero vectors 0 = x 0 , x 1 , x + , x -∈ C and functionals f 0 , f 1 , f + , f -∈ C * such that:

(i) x 0 + x 1 = x + + x -and f 0 + f 1 = f + + f -; (ii) f 0 (x 1 ) = f 1 (x 0 ) = f + (x -) = f -(x + ) = 0;
(iii) f i + f j is strictly positive, for all i ∈ {0, 1}, j ∈ {+, -}.

Remark S3. It is easy to see that the previous items imply that f 0 + f 1 = f -+ f + is also strictly positive.

Proof. It follows from the comments right after Theorem 3 in the main text that if C is a classical cone, there cannot exist elements x i and functionals f i satisfying properties (i)-(iii): since if C is classical, all elements are compatible. Hence, we just need to prove the converse implication.

To this end, let us assume that C is non-classical. According to Theorem S1 there is a kite Q α and two linear maps Ψ : R 3 → V , Φ :

V → R 3 such that Φ • Ψ = id, Ψ(C(Q α )) ⊂ C and Φ(C) ⊂ C(S b ). Introduce now the extreme rays generators of C(Q α ) u 0 = (-1, α 0 , 1), u 1 = (1, α 1 , 1), u -= (α -, -1, 1), u + = (α + , 1, 1).
Since the diagonals of a kite intersect, there exist positive numbers λ 0 , λ 1 , λ -, λ + such that

λ 0 u 0 + λ 1 u 1 = λ -u -+ λ + u + .
Incidentally, those numbers can easily be expressed as elementary functions of the components of the vector α; we do not report those formulae as we shall not need them in the following. We continue by defining the vectors

x i . . = λ i Ψ(u i ) ∈ C, i ∈ {0, 1, -, +} ,
which by construction satisfy the identity

x 0 + x 1 = x -+ x + .
On the other hand, let us consider the linear forms T i : R 3 → R, i ∈ {0, 1, -, +}, defined as T 0 (x, y, z) . . = z -x, T 1 (x, y, z) . . = z + x, T -(x, y, z) . . = z -y, T + (x, y, z) . . = z + y.

Define also the linear forms

f i . . = T i • Φ : V → R, i = {0, 1, -, +} . Using that C(S b ) ⊂ (x, y, z) : z ≥ 0, (x, y) ∈ [-z, z] 2 ,
we see that T i ∈ C(S b ) * for every i ∈ {0, 1, -, +} and immediately infer that f i ∈ C * . Moreover, it follows from the very definition of the T i 's that

f 0 + f 1 = (T 0 + T 1 ) • Φ = (T -+ T + ) • Φ = f -+ f + .

This proves claim (i).

The identities in item (ii) follow easily by plugging the concrete form of the T i 's and u j 's in the equation

f i (x j ) = (T i • Φ)(λ j Ψ(u j )) = λ j T i (u j ),
where in the last equality we have used that Φ • Ψ = id. Finally, let us verify item (iii). Consider 0 = p ∈ C. Observe from Remark S2 that Φ(p) is a nonzero element in C(S b ); writing Φ(p) = (x, y, z) with z > 0 and (x, y) ∈ [-z, z] 2 \ {-z, z} 2 , we see that

(f 0 + f -)(p) = (T 0 + T -)(Φ(p)) = (T 0 + T -)(x, y, z) = 2z -x -y > 0.
The other cases can be analysed in an analogous fashion. This concludes the proof.

Let us finally show how Theorem 3 can be used to give a direct and operationally meaningful proof of Theorem 2.

Proof (Theorem 2). The fact that if either

C 1 or C 2 is a classical proper cone then C 1 ⊗ min C 2 = C 1 ⊗ max C
2 is a wellknown and easily verified fact (see for instance [47,Lemma 5]).

In order to prove the converse, let us assume that C 1 and C 2 are both non-classical. Then, according to Theorem 3 there are non-zero vectors 0 = x 0 , x 1 , x -, x + ∈ C 1 , 0 = y 0 , y 1 , y -, y + ∈ C 2 and functionals f

0 , f 1 , f -, f + ∈ C * 1 , g 0 , g 1 , g -, g + ∈ C * 2 satisfying items (i)-(iii). Let us construct the tensor ω . . = x 0 ⊗ y + -x + ⊗ y + + x + ⊗ y 0 + x 1 ⊗ y 1 . (S4) One can easily check that ω ∈ C 1 ⊗ max C 2 . Indeed, given ϕ 1 ∈ C * 1 and ϕ 2 ∈ C * 2 , setting a i . . = ϕ 1 (x i ) and b i . . = ϕ 2 (y i ) for i ∈ {0, 1, -, +} gives that (ϕ 1 ⊗ ϕ 2 )(ω) = a 0 b + -a + b + + a + b 0 + a 1 b 1 = a 0 b 0 + a 1 b 1 -(a + -a 0 )(b + -b 0 ) ≥ 0. (S5)
Now, since a i ≥ 0 and b i ≥ 0 for every i, using item (i) from Theorem 3 we obtain -a 0 ≤ a + -a 0 = a 1 -a -≤ a 1 and similarly for the b i 's. This implies that (a + -a 0 )(b + -b 0 ) ≤ max{a 0 b 0 , a 1 b 1 }, from which (S5) follows easily. In order to finish the proof we will show that ω / ∈ C 1 ⊗ min C 2 . To this end, let use define the linear functional

ϕ = 2(f 0 + f 1 ) ⊗ (g 0 + g 1 ) -(f 0 -f 1 ) ⊗ (g 0 -g 1 ) -(f 0 -f 1 ) ⊗ (g + -g -) (S6) -(f + -f -) ⊗ (g 0 -g 1 ) + (f + -f -) ⊗ (g + -g -).
The strategy for the rest of the proof is to show that ϕ is strictly positive on

C 1 ⊗ min C 2 while ϕ(ω) ≤ 0. Indeed, let ω 1 ∈ C 1 , ω 2 ∈ C 2 , and define c 1 . . = (f 0 + f 1 )(ω 1 ), c 2 . . = (g 0 + g 1 )(ω 2 ), d 1 . . = (f 0 -f 1 )(ω 1 ), d 2 . . = (g 0 -g 1 )(ω 2 ), e 1 . . = (f + -f -)(ω 2 ), e 2 . . = (g + -g -)(ω 2 ), we want to show that ϕ(ω 1 ⊗ ω 2 ) = 2c 1 c 2 -d 1 d 2 -d 1 e 2 -e 1 d 2 + e 1 e 2 > 0.
Now, according to Theorem 3 and Remark S3 right below it we know that c 1 = (f 0 + f 1 )(ω 1 ) = (f + + f -)(ω 1 ), c 2 = (g 0 + g 1 )(ω 2 ) = (g + + g -)(ω 2 ) are positive numbers; it then follows that di . . = d i /c i , ẽi . . = e i /c i , for i = 1, 2, are all numbers in [-1, 1]. Using item (iii) from Theorem 3, we see that ( d1 , ẽ1 ) and ( d2 , ẽ2 ) both belong to S b . Then, checking the inequality 2 -d1 d2 -d1 ẽ2 -ẽ1 d2 + ẽ1 ẽ2 > 0 amounts to a straightforward computation.

It finally remains to show that indeed ϕ(ω) ≤ 0.

Through a long series of elementary algebraic manipulations one can verify that

ϕ(ω) = 4 f 0 (x + ) -f + (x 0 ) g 0 (y + ) -g + (y 0 ) . (S7)
A SageMath script checking the above can be donwloaded at https://github.com/gaubrun/entangleability. If the right-hand side of Eq. (S7) is nonpositive, we are done. Otherwise, we could consider new elements ω and φ, defined as the previous ones by switching the role of (x 0 , x 1 , f 0 , f 1 ) and (x + , x -, f + , f -), keeping untouched y i and g i . These elements satisfy the same properties as ω and ϕ. Moreover, as one can observe from the right-hand side of (S7), we have φ(ω) = -ϕ(ω) ≤ 0.

II. BB84 PROTOCOL IN GPTS

In this section we use Theorem 3 to construct a version of the BB84 protocol that works in any non-classical GPT. For a given non-classical GPT (V, C, u), we can construct vectors 0 = x 0 , x 1 ; x + , x -∈ C and functionals f 0 , f 1 ; f + , f -∈ C * satisfying conditions (i)-(iii) of Theorem 3. Up to re-scaling, we can assume without loss of generality that u(x 0 + x 1 ) = 1, so that in fact x i = p i ρ i , x j = q j σ j for some states ρ i , σ j ∈ Ω . . = C ∩ u -1 (1), with p i , q j > 0 and also p 0 + p 1 = q + + q -= 1. Set ω . . = p 0 ρ 0 + p 1 ρ 1 = q + σ + + q -σ -. Again, up to multiplying everything by a factor we can assume that f 0 + f 1 = f + + f -= . . ≤ u, so that f i , f j are valid effects. Note that η . . = (ω) ≥ 1 2 (f 0 + f + )(ω) > 0 is a strictly positive constant. Now, consider the following protocol to generate a secret key via a public noiseless channel connecting Alice to Bob and capable of transmitting states of the GPT (V, C, u):

(1) Alice tosses N times a fair coin. For each head, she prepares either ρ 0 (with probability p 0 ) or ρ 1 (with probability p 1 ); for each tail, she prepares either σ + (with probability q + ) or σ -(with probability q -). She sends the states to Bob, in an orderly manner, using the channel N times.

(2) Bob tosses N times a fair coin. If the k th coin is a head (respectively, a tail), he performs the measurement (f 0 , f 1 , u -) (respectively, (f + , f -, u -)) on the k th state sent by Alice.

(3) Alice and Bob announce publicly the outcomes of their coins. They discard all rounds for which the outcomes of their coin tosses were different.

(4) Also, Bob declares for which rounds he obtained the third measurement outcome, corresponding to u -. Those rounds are also discarded.

(5) If Eve has not interfered and the transmission were noiseless (something that can always be tested by sacrificing a small number of random bits), Alice and Bob are left with around 1 2 N (ω) bits each. The bit strings held by Alice and Bob are equal, because the detection error probabilities are all zero, according to Theorem 3(ii).

The bits retained by Alice and Bob at the end of the above protocol are 'flagged' by the corresponding outcomes of the coin tosses, and those outcomes, known to Eve, tell her something about the probability distribution of Alice and Bob's bits. Also, the fact that these bits have not been discarded in step (4) skews the probability distribution of each bit as seen by Eve. For example, it is not difficult to verify that if the k th coin outcome was a head and the round has not been discarded, the probability that the encoded bit is i ∈ {0, 1} as seen by Eve is p i = pi (ρi) (ω) . Importantly, p i > 0, because if 0 = (ρ i ) = (f 0 + f 1 )(ρ i )) were to hold we would deduce that also 0 = (ρ i ) ≥ f j (ρ i ), so that f j (ρ i ) = 0; this would be in contradiction with the requirement that f i + g i be strictly positive (Theorem 3(iii)).

Acknowledgments.-GA was supported in part by ANR (France) under the grants StoQ (2014-CE25-0003) and ESQuisses (ANR-20-CE47-0014-01). LL acknowledges financial support from the European Research Council under the Starting Grant GQCOP (Grant no. 637352), from the Foundational Questions Institute under the grant FQXi-RFP-IPW-1907, and from the Alexander von Humboldt Foundation. CP is partially supported by Spanish MINECO through Grant No. MTM2017-88385-P, by the Comunidad de Madrid through grant QUITEMAD-CM P2018/TCS4342 and by SEV-2015-0554-16-3. MP acknowledges support from the Deutsche Forschungsgemeinschaft (DFG, German Research Foundation, project numbers 447948357 and 440958198), the Sino-German Center for Research Promotion (Project M-0294), the ERC (Consolidator Grant 683107/TempoQ), and from the Alexander von Humboldt Foundation.

We can model the overall situation by saying that Alice, Bob, and Eve hold n ≈ 1 2 N (ω) i.i.d. random variable triples (ZX, ZX, Z), where Z ∈ {0, 1} is the coin outcome and X the bit encoded by Alice, so that

where according to the above reasoning

In this situation, it is an easy corollary of the work of Maurer [40] that the secret key rate S(X : Y Z) Alice and Bob can achieve via public communication is given by [40, Theorems 2 and 3]

Although a fully-fledged proof of the security of the above protocol is beyond the scope of this work, (S10) indicates that our tweaked BB84 protocol achieves a non-zero secret key generation rate in every non-classical GPT.