Past exam of the mathematics course of the University of Cambridge / 2009 / iii / Paper 53 / 4

The relevant security model gives Eve the purifying system and access to the public transcript. A useful preliminary fact is that purity decouples a subsystem from its purification. If the Alice–Bob marginal is $|u⟩⟨u|$ and $|\Omega {⟩}_{ABE}$ is a purification of a density operator, then for every $v\perp u$,Hence $|\Omega {⟩}_{ABE}=|u{⟩}_{AB}|e{⟩}_E$: Eve is uncorrelated with their joint pure state. A Bell pair then supplies a uniform shared secret bit when both parties measure in the computational basis. Pure product states have no shared random correlations, while a mixed state must be assessed with its purifying information included. The classifications below use the usual quantum key distribution setting with an authenticated public classical channel; no full security proof is required.

A secure key can be produced, at one ideal secret bit per copy. The shared Bell state is pure, so the preceding factorization shows that Eve's purifying system is independent of it. Measuring both qubits in the computational basis gives matching outcomes $00$ or $11$, each with probability $1/2$. Neither party announces these key outcomes. Eve's state is the same for both possibilities, so each copy supplies a shared uniform private bit.

The normalized ray produces a secure key; the literal printed vector is not normalized. The squared norm of the coefficients in the PDF is $8/9+1/81=73/81$. Thus the physical pure state on that ray has normalized coefficients $6\sqrt{2}/\sqrt{73}$ and $1/\sqrt{73}$. This is a genuine entangled state with two nonzero Schmidt coefficients, and Eve is independent of it by purity decouples a subsystem from its purification.

For an explicit way to obtain uniform key bits, Alice applies a two-outcome local measurement in quantum mechanics with Kraus operatorsTheir squared products sum to the identity. The successful unnormalized state is $(|00⟩+|11⟩)/\sqrt{73}$, soAlice announces only success or failure. Success leaves an exact Bell pair, yielding one uniform secret bit; failure leaves $|00⟩$ and is discarded. With many copies the successful fraction is positive. Alternatively, direct computational basis measurements give a shared biased bit with probabilities $72/73$ and $1/73$, from which privacy amplification can extract uniform secret bits. The coefficient $1/9$ has not been silently replaced by $1/3$.

No secure key can be produced from this state alone. Factoring the printed amplitudes gives the normalized product stateEve is uncorrelated with the joint pure state, but Alice and Bob also have no correlations with each other: local outcome probabilities factor. They may generate independent private random bits locally, but local operations and classical communication cannot make those bits shared and secret using only public messages. A product state supplies no shared secret resource.

No secure key can be produced. The off-diagonal terms in the two Bell state projectors cancel, giving the separable quantum stateA possible purification of a density operator is $(|00{⟩}_{AB}|0{⟩}_E+|11{⟩}_{AB}|1{⟩}_E)/\sqrt{2}$. Eve measures her register in the computational basis and learns whether Alice and Bob have $00$ or $11$. Their apparently shared random bit is therefore completely known to Eve. Conditioned on her record the Alice–Bob state is a known product state; public discussion and local private randomness cannot create a shared secret unknown to that record. The state has no distillable secret key in the stated purification model.

A secure key can be produced, at one ideal secret bit per copy. Denote Alice's additional flag qubit by $F$. Alice can measure $F$ in the computational basis and, when its outcome is $1$, apply the Pauli Z gate to her half of the shared pair. The two flag outcomes each have probability $1/2$, and $Z_A|{\Phi }^{-}⟩=|{\Phi }^{+}⟩$; either branch therefore supplies the same pure Bell pair.

Equivalently, Alice applies the local controlled unitaryThis local flag correction of a Bell-state phase mixture changes the full density matrix intoThe corrected pair is pure, so every purification factors between $AB$ and $FE$. Eve may know the flag without knowing the key bit obtained from $AB$. Alice need not disclose the flag, but even disclosing it does not compromise the corrected pure Bell pair. Tracing out the flag before correction would give the nonprivate mixture in the preceding case; retaining Alice's local side information is essential.

Insecure as a proposed test-and-purify protocol: the basis string and check positions are announced before receipt. Eve can intercept and store the travelling qubits until the announcement. For each data position with basis bit $b_j$, she measures the stored qubit in the basis $\{H^{b_j}|0⟩,H^{b_j}|1⟩\}$. If the outcome is $z_j$, the Alice–Bob pair becomesand Eve knows $z_j$. She forwards that qubit, and forwards every publicly identified check qubit untouched. After Bob's Hadamard gate decoding, every data pair is the known product state $|z_j{z}_j⟩$, while the unmodified check pairs remain perfect. Thus the check bit error rate is zero even though Eve knows all raw data bits. This is premature basis announcement in quantum key distribution.

The retained data are a separable quantum state with a classical label held by Eve; LOCC cannot turn them into private Bell pairs. Consequently the listed check does not justify the claimed success of the subsequent entanglement purification. A sound purification procedure that independently detects the missing entanglement must fail or abort on this attack. If Step 9 were instead read as an independently guaranteed production of private, nearly perfect Bell pairs, their subsequent key would of course be private; the flaw is that this protocol's test cannot establish that guarantee. Naming an EPP does not repair the information leak or the invalid sampling test.

Impossible to implement as written: Bob is never given the basis string. Step 7 requires him to know which incoming qubits were acted on by a Hadamard gate, but the announcement contains only the check positions. Since $H^{-1}=H$, knowing that a transformation is its own inverse does not identify which qubits need it.

Bob cannot recover the missing information from the qubits alone. For each encoded Bell pair, his reduced density matrix isfor either $b=0$ or $b=1$. His entire received register has the same density matrix $I/2^{2n}$ for every string $b$, so every local measurement in quantum mechanics has statistics independent of $b$. Nor can one fixed unitary undo both possibilities: preserving $|{\Phi }^{+}⟩$ requires that unitary to be proportional to $I$, whereas decoding $(I\otimes H)|{\Phi }^{+}⟩$ requires it to be proportional to $H$. Supplying the missing basis announcement after receipt would repair the protocol and make it the third one, but that communication is absent from the printed sequence.

Secure in the intended ideal setting, with a sound entanglement-purification procedure. Bob confirms receipt before Alice reveals either the random basis string or the randomly chosen check positions. Eve must therefore release the travelling qubits before knowing which basis to use and which positions to protect from disturbance. Bob can then decode because $H^2=I$.

The random check sample tests the same ensemble of encoded transmissions as the retained data. Random computational basis and Hadamard basis encodings make the test sensitive to complementary disturbances; Eve cannot use the targeted zero-error attack available in Protocol 1. For example, measuring every intercepted qubit in one fixed one of these two bases uses the wrong basis half the time, and then disagrees with Alice half the time, producing a bit error rate of $1/4$. A sound entanglement purification protocol uses the tested error bounds, corrects both relevant types of error, and aborts if the noise is too high; secrecy is not claimed for every possible attack without an abort option.

When the protocol succeeds in producing nearly perfect Bell pairs, purity decouples a subsystem from its purification explains why they are nearly independent of Eve, and matching computational basis measurements produce an approximately uniform shared secret key. The disclosed check outcomes are discarded rather than included in that key. This is the standard entanglement-based quantum key distribution ordering: receipt first, basis and sample disclosure second, testing and purification next, and private measurements last.