Past exam of the mathematics course of the University of Cambridge / 2009 / iii / Paper 53 / 4 / B

Insecure as a proposed test-and-purify protocol: the basis string and check positions are announced before receipt. Eve can intercept and store the travelling qubits until the announcement. For each data position with basis bit $b_j$, she measures the stored qubit in the basis $\{H^{b_j}|0⟩,H^{b_j}|1⟩\}$. If the outcome is $z_j$, the Alice–Bob pair becomesand Eve knows $z_j$. She forwards that qubit, and forwards every publicly identified check qubit untouched. After Bob's Hadamard gate decoding, every data pair is the known product state $|z_j{z}_j⟩$, while the unmodified check pairs remain perfect. Thus the check bit error rate is zero even though Eve knows all raw data bits. This is premature basis announcement in quantum key distribution.

The retained data are a separable quantum state with a classical label held by Eve; LOCC cannot turn them into private Bell pairs. Consequently the listed check does not justify the claimed success of the subsequent entanglement purification. A sound purification procedure that independently detects the missing entanglement must fail or abort on this attack. If Step 9 were instead read as an independently guaranteed production of private, nearly perfect Bell pairs, their subsequent key would of course be private; the flaw is that this protocol's test cannot establish that guarantee. Naming an EPP does not repair the information leak or the invalid sampling test.

Impossible to implement as written: Bob is never given the basis string. Step 7 requires him to know which incoming qubits were acted on by a Hadamard gate, but the announcement contains only the check positions. Since $H^{-1}=H$, knowing that a transformation is its own inverse does not identify which qubits need it.

Bob cannot recover the missing information from the qubits alone. For each encoded Bell pair, his reduced density matrix isfor either $b=0$ or $b=1$. His entire received register has the same density matrix $I/2^{2n}$ for every string $b$, so every local measurement in quantum mechanics has statistics independent of $b$. Nor can one fixed unitary undo both possibilities: preserving $|{\Phi }^{+}⟩$ requires that unitary to be proportional to $I$, whereas decoding $(I\otimes H)|{\Phi }^{+}⟩$ requires it to be proportional to $H$. Supplying the missing basis announcement after receipt would repair the protocol and make it the third one, but that communication is absent from the printed sequence.

Secure in the intended ideal setting, with a sound entanglement-purification procedure. Bob confirms receipt before Alice reveals either the random basis string or the randomly chosen check positions. Eve must therefore release the travelling qubits before knowing which basis to use and which positions to protect from disturbance. Bob can then decode because $H^2=I$.

The random check sample tests the same ensemble of encoded transmissions as the retained data. Random computational basis and Hadamard basis encodings make the test sensitive to complementary disturbances; Eve cannot use the targeted zero-error attack available in Protocol 1. For example, measuring every intercepted qubit in one fixed one of these two bases uses the wrong basis half the time, and then disagrees with Alice half the time, producing a bit error rate of $1/4$. A sound entanglement purification protocol uses the tested error bounds, corrects both relevant types of error, and aborts if the noise is too high; secrecy is not claimed for every possible attack without an abort option.

When the protocol succeeds in producing nearly perfect Bell pairs, purity decouples a subsystem from its purification explains why they are nearly independent of Eve, and matching computational basis measurements produce an approximately uniform shared secret key. The disclosed check outcomes are discarded rather than included in that key. This is the standard entanglement-based quantum key distribution ordering: receipt first, basis and sample disclosure second, testing and purification next, and private measurements last.