Past exam of the mathematics course of the University of Cambridge / 2009 / iii / Paper 53 / 4 / B / Protocol 1 / Solution

Insecure as a proposed test-and-purify protocol: the basis string and check positions are announced before receipt. Eve can intercept and store the travelling qubits until the announcement. For each data position with basis bit $b_j$, she measures the stored qubit in the basis $\{H^{b_j}|0⟩,H^{b_j}|1⟩\}$. If the outcome is $z_j$, the Alice–Bob pair becomesand Eve knows $z_j$. She forwards that qubit, and forwards every publicly identified check qubit untouched. After Bob's Hadamard gate decoding, every data pair is the known product state $|z_j{z}_j⟩$, while the unmodified check pairs remain perfect. Thus the check bit error rate is zero even though Eve knows all raw data bits. This is premature basis announcement in quantum key distribution.

The retained data are a separable quantum state with a classical label held by Eve; LOCC cannot turn them into private Bell pairs. Consequently the listed check does not justify the claimed success of the subsequent entanglement purification. A sound purification procedure that independently detects the missing entanglement must fail or abort on this attack. If Step 9 were instead read as an independently guaranteed production of private, nearly perfect Bell pairs, their subsequent key would of course be private; the flaw is that this protocol's test cannot establish that guarantee. Naming an EPP does not repair the information leak or the invalid sampling test.