= Solution
This is an entanglement-based <quantum key distribution> scheme of the type proposed by <Artur K. Ekert>.<Quantum cryptography based on Bell's theorem by Artur K. Ekert>[1991 primary proposal: Bell correlations used to test a key-distribution channel]{ref} The measurements generate correlated random data; Alice does not choose a message by choosing their random outcomes.
After the measurements, Alice and Bob announce their basis choices over an authenticated public channel. They retain the pairs with equal axes, here $(\mathbf a_2,\mathbf b_1)$ and $(\mathbf a_3,\mathbf b_2)$, and Bob flips his outcome signs to match Alice's bits. They sacrifice a random subset for error estimation and use the appropriate other setting combinations to estimate $S$. In the ideal source the same-axis bits match after the flip and $S=-2\sqrt2$; the specified intercept-resend attack cannot reproduce that value.
A practical protocol includes information reconciliation, an accounting of information leaked publicly, and <privacy amplification>. It must abort when its statistical security conditions fail. Authentication is essential: a completely unauthenticated public channel permits a <man-in-the-middle attack>. A Bell-violation observation alone, without sampling, device and adversary assumptions and a finite-key analysis, is not a proof that Eve knows no key bits.
With a sufficiently uniform secret shared key $k$ of the required length, Alice can send $c=m\oplus k$ publicly using a <one-time pad>; Bob recovers $m=c\oplus k$. \b[The pad must be secret, as long as the protected message, and never reused.] A complete security proof makes the probability or distinguishing advantage of failure small under stated assumptions. The ideal exam correlations diagnose the stated attack; they do not provide an unconditional guarantee against every attack or implementation fault.
Back to article page
