= Solution
{c}
Encode $0$ by phase zero and $1$ by phase $\pi$. Alice and Bob choose their bits independently and keep their choices private. Bob announces the trial numbers with a D0 click over an authenticated public channel. For each retained trial, <6/c> guarantees that their bits agree. In the ideal symmetric setup, the two equal-phase cases $00$ and $11$ give the same click probability, so announcing success does not itself reveal which shared bit was used.
The matching-phase cases occur with <probability> $1/2$, and a matching case succeeds with <probability> $1/16$. Therefore
$$
\boxed{P(\text{retained trial})=\frac1{32},\qquad
\mathbb E[K_{\rm raw}]=\frac N{32}.}
$$
For independent ideal trials, the raw-key length has a <binomial distribution> with <standard deviation> $\sqrt{31N}/32$. These are bits before sacrificing test positions or performing <privacy amplification>.
A missing click does \b[not] certify unequal phases: the same phases also fail to click with <probability> $15/16$. With uniform choices,
$$
P(\phi_A=\phi_B\mid\text{no click})=\frac{15}{31},\qquad
P(\phi_A\ne\phi_B\mid\text{no click})=\frac{16}{31}.
$$
Thus a no-click trial supplies neither a known equal bit nor a known complemented bit. This is why it cannot be retained by the direct error-free sifting rule. The source's “cannot use” should be understood in this sense: the events are not statistically independent, so an absolute claim that they contain no information would be false.
To obtain a secret final key, reveal and discard a random subset of retained bits to test the observed error rate, then apply reconciliation and <privacy amplification> as required by a security analysis of the actual implementation. Resolving which time path a <photon> took removes the accepted histories' <quantum coherence> and can turn destructive <interference> into false D0 clicks, providing a simple disturbance test. Equal-phase click correlations alone are not a proof of security against every attack, particularly in the presence of losses and device imperfections. The supplied ideal model fixes the sifted rate $N/32$; it does not fix a positive secure final length without an adversary model and observed parameters.
Back to article page
