= Solution
\b[Insecure as a proposed test-and-purify protocol: the basis string and check positions are announced before receipt.] Eve can intercept and store the travelling qubits until the announcement. For each data position with basis bit $b_j$, she measures the stored qubit in the basis $\{H^{b_j}|0\rangle,H^{b_j}|1\rangle\}$. If the outcome is $z_j$, the Alice–Bob pair becomes
$$
|z_j\rangle_A\otimes H^{b_j}|z_j\rangle_B,
$$
and Eve knows $z_j$. She forwards that qubit, and forwards every publicly identified check qubit untouched. After Bob's <Hadamard gate> decoding, every data pair is the known <product state> $|z_jz_j\rangle$, while the unmodified check pairs remain perfect. Thus the check <bit error rate> is zero even though Eve knows all raw data bits. This is <premature basis announcement in quantum key distribution>.
The retained data are a <separable quantum state> with a classical label held by Eve; <LOCC> cannot turn them into private <Bell pairs>. Consequently the listed check does not justify the claimed success of the subsequent <entanglement purification>. A sound purification procedure that independently detects the missing entanglement must fail or abort on this attack. If Step 9 were instead read as an independently guaranteed production of private, nearly perfect <Bell pairs>, their subsequent key would of course be private; the flaw is that this protocol's test cannot establish that guarantee. Naming an EPP does not repair the information leak or the invalid sampling test.
Back to article page
