= Solution
\b[A secure key can be produced, at one ideal secret bit per copy.] Denote Alice's additional flag qubit by $F$. Alice can measure $F$ in the <computational basis> and, when its outcome is $1$, apply the <Pauli Z gate> to her half of the shared pair. The two flag outcomes each have <probability> $1/2$, and $Z_A|\Phi^-\rangle=|\Phi^+\rangle$; either branch therefore supplies the same pure <Bell pair>.
Equivalently, Alice applies the local controlled unitary
$$
U=I_{AB}\otimes|0\rangle\langle0|_F+(Z_A\otimes I_B)\otimes|1\rangle\langle1|_F.
$$
This <local flag correction of a Bell-state phase mixture> changes the full <density matrix> into
$$
\boxed{|\Phi^+\rangle\langle\Phi^+|_{AB}\otimes I_F/2.}
$$
The corrected pair is pure, so every purification factors between $AB$ and $FE$. Eve may know the flag without knowing the key bit obtained from $AB$. Alice need not disclose the flag, but even disclosing it does not compromise the corrected pure <Bell pair>. Tracing out the flag before correction would give the nonprivate mixture in the preceding case; retaining Alice's local side information is essential.
Back to article page
