  We consider quantum key distribution in the device-independent scenario,
i.e., where the legitimate parties do not know (or trust) the exact
specification of their apparatus. We show how secure key distribution can be
realized against the most general attacks by a quantum adversary under the
condition that measurements on different subsystems by the honest parties
commute.
