Past exam of the mathematics course of the University of Cambridge / 2009 / iii / Paper 53 / 4 / A / 5

A secure key can be produced, at one ideal secret bit per copy. Denote Alice's additional flag qubit by $F$. Alice can measure $F$ in the computational basis and, when its outcome is $1$, apply the Pauli Z gate to her half of the shared pair. The two flag outcomes each have probability $1/2$, and $Z_A|{\Phi }^{-}⟩=|{\Phi }^{+}⟩$; either branch therefore supplies the same pure Bell pair.

Equivalently, Alice applies the local controlled unitaryThis local flag correction of a Bell-state phase mixture changes the full density matrix intoThe corrected pair is pure, so every purification factors between $AB$ and $FE$. Eve may know the flag without knowing the key bit obtained from $AB$. Alice need not disclose the flag, but even disclosing it does not compromise the corrected pure Bell pair. Tracing out the flag before correction would give the nonprivate mixture in the preceding case; retaining Alice's local side information is essential.