1. Worked problem §
For 2,000 detected signals and independent fair bases, what is the expected sifted size?
Hint 1
Compute the matching probability.
Worked solution
The probability is 1/2, so the expectation is 1,000; an individual run fluctuates.
Quantum Cryptography · Chapter 02
BB84: Preparing and Measuring
How do incompatible bases expose a simple interception attack?
In this chapter · 3 sections
Reading guide · preparation and approach
Starting point: Chapter 1 of this course.
Anchor example: A six-signal BB84 transcript with separate test and key positions.
Method: Trace the protocol, calculate an example, and identify the security assumptions.
Watch for: A simple attack calculation is not a general security proof.
This lesson includes explanations, worked examples, and problems with solutions. Advanced results whose proofs are outside the chapter are identified explicitly.
Chapter 1 fixed what a key must be: uniform, independent of Eve, and authenticated. This chapter introduces the simplest protocol that might deliver such a key. BB84 encodes each bit in one of two incompatible bases, so that an eavesdropper who measures must sometimes guess wrong and must sometimes disturb what she passes on. We follow one block from signal to sifted string, ask what tampering would look like in the error statistics, and then turn a finite sample of errors into an abort rule. Each step states what it establishes and where a security proof still has to take over.
2.1 Preparation, measurement, and sifting
Before any security claim can be discussed, the protocol itself must be unambiguous: who prepares what, when messages are sent, and which bits end up in which bin. This section builds that accounting.
2.1.1 Trace the protocol
Alice and Bob share no secret beyond a short authentication key. They proceed in five phases.
Preparation. Alice samples independent uniform bits \(a_1,\dots,a_n\) and independent uniform bases \(\theta_1,\dots,\theta_n\). She sends signal \(i\) prepared in basis \(\theta_i\) encoding \(a_i\).
Measurement. Bob chooses an independent uniform basis \(\phi_i\) for each arriving signal, measures, and records the outcome \(b_i\). He notes which signals actually arrived; loss is a fact of the channel, not an error.
Sifting. Only after all detections are recorded do they announce their bases over the authenticated classical channel. They keep positions with \(\theta_i=\phi_i\) and discard the rest. Discarded positions carry no key material, and their outcomes are irrelevant in the ideal model. Announcing bases earlier, however, would let Eve measure in the right basis and resend, so the delay is a security requirement rather than a convenience.
The announcement gives nothing away about the ideal signal. Averaged over its two bit values, each basis state is \(I/2\), so the basis label carries no information about the bit (Section 1.2.2). That conclusion is about the ideal qubit only. A real source that leaks timing, spectrum, or intensity can label its own preparations through a side channel, which is why device assumptions are treated separately in Chapter 5 (Section 5.3).
Parameter estimation. From the sifted positions they reveal a randomly selected subset and compare values. This measures the error rate Eve's interference would have caused. The revealed positions are removed from the key: they are public.
Post-processing. The remaining raw bits are reconciled, verified, and compressed into a shorter key. Chapters 3 and 4 show why the compression is necessary and how much is affordable.
Worked example
Alice uses bases Z X Z X with bits 0 1 1 0, and Bob uses Z Z Z X on an ideal channel. Which bits survive sifting?
Solution and reasoning
Compare basis by basis: position 1 is Z/Z, 2 is X/Z, 3 is Z/Z, 4 is X/X. Positions 1, 3, and 4 match, so the sifted string is \(010\) for both parties. Position 2 is discarded regardless of Bob's outcome; his recorded value there is never used and never announced.
2.1.2 Specify the registers and the order of announcements
A protocol description that lists operations without their order leaves a security-critical ambiguity, so it pays to write the rounds as a formula. Alice's preparation is \(H^{\theta_i}|a_i\rangle\), where \(H^{0}=I\) and \(H^{1}=H\). Bob applies \(H^{\phi_i}\) and measures Z. In an ideal detected round his recorded bit has probability
\[P(b_i\mid a_i,\theta_i,\phi_i)=|\langle b_i|H^{\phi_i}H^{\theta_i}|a_i\rangle|^2,\]which evaluates to
\[P(b_i\mid a_i,\theta_i,\phi_i)=\begin{cases}\delta_{a_i b_i},&\theta_i=\phi_i,\\1/2,&\theta_i\ne\phi_i.\end{cases}\]Both equal-basis cases collapse to \(H^2=I\). In the unequal cases the matrix entries of \(H\) all have magnitude \(1/\sqrt2\), so the squared amplitude is \(1/2\) whatever the inputs. One expression therefore explains deterministic agreement and uniformly random disagreement without attributing pre-existing values to both observables at once. That last point is what no-cloning and complementarity rule out (Section 1.2.1).
The order can be written as six commitments that the protocol fixes in advance:
- Agreement on the source model, block sizes, test rule, error budgets, and authenticated identities.
- Private choice of bits and bases, transmission, and recorded detections—all before any basis is revealed.
- Authenticated announcement of detections and bases, from which the sifted positions follow.
- Selection and revelation of test data under the fixed rule, parameter estimation, and abort if the bound fails.
- Reconciliation of retained raw bits and verification of agreement, with all leakage recorded.
- Extraction with an independent seed, hashing to the approved length, and a reported key or a reported abort.
Worked example
Check the Born rule for the four basis pairs with \(a_i=0\). Which cases are deterministic, and what does each equal-basis case rely on?
Solution and reasoning
With \(\theta_i=\phi_i=0\) both gates are identity, giving \(|\langle0|0\rangle|^2=1\) and \(|\langle1|0\rangle|^2=0\). With \(\theta_i=\phi_i=1\) both gates are \(H\), so \(H^2=I\) and the same two values return; the intermediate state is \(|+\rangle\) for the first case and \(|-\rangle\) for the second, but the answer is deterministic either way. With \(\theta_i=0,\phi_i=1\), \(\langle b|H|0\rangle\) has magnitude \(1/\sqrt2\) for both \(b\); with \(\theta_i=1,\phi_i=0\), \(\langle b|H|+\rangle\) likewise. The equal-basis determinism comes from \(H\) being its own inverse, not from the state carrying a definite value in both bases.
2.1.3 Follow one block without confusing its denominators
Most confusions in first QKD calculations come from mixing four different counts. A single ideal block makes them concrete.
| Position | Alice bit | Alice basis | Bob basis | Bob bit | Use |
|---|---|---|---|---|---|
| 1 | 0 | Z | Z | 0 | Raw key |
| 2 | 1 | X | Z | 0 | Discard |
| 3 | 1 | Z | Z | 1 | Public test |
| 4 | 0 | X | X | 0 | Raw key |
| 5 | 1 | X | X | 1 | Public test |
| 6 | 0 | Z | X | 1 | Discard |
Six emitted signals, six detections, four sifted positions, two revealed tests, and only two unrevealed raw bits. Note what the arithmetic does not say. The raw bits are not automatically secret: reconciliation leaks, the extractor costs a further fraction, and the security margin must be subtracted. A six-signal block illustrates the bookkeeping; it cannot support a key of useful length.
Basis weights change the ledger. For independent choices with Z probabilities \(p_A,p_B\), the matching probability is \(p_Ap_B+(1-p_A)(1-p_B)\). If only Z matches supply key and X matches supply tests, the key-candidate and test probabilities are \(p_Ap_B\) and \((1-p_A)(1-p_B)\), which at \(p_A=p_B=0.9\) are 0.81 and 0.01.
That trade is not free. Raising the apparent key efficiency shrinks the complementary-basis sample used to estimate Eve's disturbance, and a smaller sample widens every confidence interval. Efficient BB84 variants exist precisely to manage this trade; naively maximizing matching bases is not the same as maximizing the final key.
Worked example
Using the table above, compute the sifted fraction of emitted signals, the revealed fraction of sifted positions, and the raw fraction of sifted positions. Which of these is a QBER denominator?
Solution and reasoning
Sifted fraction \(=4/6\approx0.67\); revealed fraction \(=2/4=0.5\); raw fraction \(=2/4=0.5\). Only the sifted positions form the sample space for the error rate: errors are counted over sifted rounds only, because mismatched bases produce random outcomes by construction and would otherwise inflate the estimate. Mixing the denominators is the most common arithmetic error in a first finite-block calculation.
2.2 Intercept and resend
If Eve measures a signal, she must send something onward, and what she sends carries the imprint of her measurement. This section quantifies that imprint for the simplest attacks and shows why the aggregate error rate alone is an incomplete description.
2.2.1 Condition on the sifted positions
Take the most direct attack: Eve measures every signal in a uniformly random BB84 basis and resends the state she inferred. Then condition on the positions Alice and Bob kept, since those are the only ones that enter the error rate.
For a sifted position, Alice and Bob used the same basis. Eve's chosen basis either matches theirs, with probability \(1/2\), or does not. The two cases exhaust the possibilities:
| Eve's basis | Probability | State she resends | Bob errs with probability |
|---|---|---|---|
| Matches Alice | 1/2 | The correct basis state | 0 |
| Differs | 1/2 | A state unbiased in Alice's basis | 1/2 |
Adding the two branches gives
\[q=\underbrace{\tfrac12\cdot0}_{\text{basis matches}}+\underbrace{\tfrac12\cdot\tfrac12}_{\text{basis differs}}=\tfrac14.\]So full random-basis interception leaves a 25% sifted QBER in the ideal model. Two cautions belong with that number. First, it is an attack demonstration, not a bound on Eve's information for arbitrary attacks; a determined adversary can be far more subtle than measure-and-resend. Second, the absence of such an error does not prove Eve is absent, because a channel can also be noisy for honest physical reasons. The protocol responds to statistics, not to intentions.
Worked example
If Eve intercepts a fraction \(f=0.2\) of otherwise ideal signals, resending in a random basis, what is the expected sifted QBER?
Solution and reasoning
Untouched positions contribute nothing. Attacked positions contribute \(1/4\) each, so \(q=f/4=0.05\). The relation is linear in \(f\) because the attack acts independently on each signal. Note what five percent does not mean: it does not certify that Eve holds a particular amount of information, only that this attack is consistent with the observed rate.
2.2.2 Compare three attacks on the same protocol
The same protocol faces attacks with quite different signatures. Three are worth separating; the full random-basis attack of Section 2.2.1 is the \(f=1\) member of the second.
Z-only measurement. Eve measures every signal in Z. Alice and Bob's Z-sifted bits remain correct and Eve knows them; X-sifted bits carry error probability \(1/2\), because her Z measurement destroys the X coherence (the mechanism derived in Section 1.2.3). With equally many Z and X sifted rounds the aggregate is \(1/2\cdot0+1/2\cdot1/2=1/4\). She holds one bit on every Z-sifted position and none on any X-sifted position, so her average is \(1/2\) bit per sifted bit in this attack.
Random-basis interception of a fraction \(f\). For an intercepted sifted bit, Eve's basis matches Alice's with probability \(1/2\). After the announcement she knows the bit exactly on that half and has no information on the other half, so her information is \(f/2\) bits per sifted bit while Bob's error rate is \(f/4\). The relation \(I(A{:}E)=2q\) describes this classical attack; it is not an upper bound on every quantum adversary.
Replacement by independent random states. Eve discards each signal and sends a fresh random BB84 state. Bob's sifted bit is then independent of Alice's, so the QBER is \(1/2\), and because she chose the replacement herself it carries no information about Alice's bit. No key can be recovered from the raw strings, and no further resource is needed to notice: the test fails outright. Destroying availability is much easier than learning an accepted key, which is why availability is budgeted separately (Section 1.3.1).
| Attack | QBER on Z-sifted | QBER on X-sifted | Aggregate, equal mix | Aggregate, 90% Z | Eve's information |
|---|---|---|---|---|---|
| Z-only measurement | 0 | 1/2 | 0.25 | 0.05 | 0.5 bit |
| Random basis, all signals | 1/4 | 1/4 | 0.25 | 0.25 | 0.5 bit |
| Random basis, fraction \(f\) | \(f/4\) | \(f/4\) | \(f/4\) | \(f/4\) | \(f/2\) bit |
| Replace with random states | 1/2 | 1/2 | 0.5 | 0.5 | 0 |
The first two rows are the reason a single aggregate number is not enough. At an equal basis mix they are numerically identical, yet one leaves Z bits untouched and corrupts X bits entirely while the other spreads damage evenly. Move to a 90% Z mix—a plausible optimization from Section 2.1.3—and they separate: 0.05 against 0.25. A security argument therefore cannot replace one basis's error rate by an average, and a protocol that reports only an aggregate is discarding information its own proof may need.
2.2.3 Derive the measure-and-resend disturbance for a tilted basis
The 25% figure came from a specific choice of Eve's measurement basis. Making her basis a variable shows that the aggregate is stable while the split between bases is not.
Let Eve use the real orthonormal basis
\[|e_0\rangle=\cos\theta\,|0\rangle+\sin\theta\,|1\rangle,\] \[|e_1\rangle=-\sin\theta\,|0\rangle+\cos\theta\,|1\rangle,\]which interpolates between Z at \(\theta=0\) and X at \(\theta=\pi/4\). For input \(|0\rangle\), her first outcome occurs with probability \(\cos^2\theta\) and is followed by Bob's wrong Z result with probability \(\sin^2\theta\); the second branch has the two factors reversed. Summing the two branches—their probabilities and their error rates are exchanged—gives
\[q_Z=2\cos^2\theta\sin^2\theta=\tfrac12\sin^2(2\theta),\] \[q_X=\tfrac12\cos^2(2\theta).\]The X expression follows by rotating the input basis by \(\pi/4\), which maps \(2\theta\mapsto2\theta+\pi/2\) and exchanges sine with cosine. Two consequences deserve to be read off the formulas rather than memorized.
First, the equally weighted mean is always
\[\tfrac12\left(\tfrac12\sin^2(2\theta)+\tfrac12\cos^2(2\theta)\right)=\tfrac14,\]so no tilt hides from a protocol that samples both bases. Second, the split is not constant: at \(\theta=\pi/8\) the two rates are equal at \(1/4\), while at \(\theta=\pi/12\) they are \(1/8\) and \(3/8\). At \(\theta=\pi/8\) her bit guess after the basis announcement succeeds with probability \(\cos^2(\pi/8)\), which is \((1+1/\sqrt2)/2\approx0.8536\). That exceeds the \(0.75\) available from random-basis measurement. That value coincides with the Helstrom probability of Section 1.2.2, but the two quantities answer different questions: there the optimization was over measurements of a signal whose basis was unknown, here Eve's basis is fixed and only her bit guess is scored.
One caution about replacing guessing probabilities with entropy. Although \(0.8536\) exceeds \(0.75\), guessing probability and mutual information are different functionals of the same joint distribution: two attacks can share a guessing probability while differing in how confident Eve is across individual outcomes. Security statements are written in terms of smooth min-entropy for exactly this reason (Section 4.2).
Worked derivation. With full independent random-basis interception, how many test bits are needed for the probability of observing no errors to be at most \(10^{-6}\)?
Solve the inequality
Each test bit is error-free with probability \(3/4\), independently, so \(m\) test bits show no error with probability \((3/4)^m\). Requiring \((3/4)^m\le10^{-6}\) gives \(m\ln(3/4)\le\ln(10^{-6})\). Both logarithms are negative, so dividing reverses the inequality: \(m\ge\ln(10^{-6})/\ln(3/4)\approx48.02\), hence 49 test bits. The independence assumption is doing real work here: it describes this particular attack, and it does not give a general 49-bit security theorem.
2.3 Sampling and aborting
A measured error rate is evidence, not a fact about the bits nobody looked at. This section converts evidence into a bound, inverts an exact finite-population model, and then separates what such a bound can certify from what it cannot.
2.3.1 Treat uncertainty as part of the protocol
The test sample must be chosen independently of the bit values, by a rule fixed before the run. Under that rule, the observed fraction is an estimate of the unrevealed error fraction, and the protocol needs an upper bound that fails only with small probability.
For independent Bernoulli trials with common mean \(q\), the one-sided Hoeffding bound states that
\[q\le\hat q+\sqrt{\frac{\ln(1/\varepsilon)}{2m}}\]except with probability at most \(\varepsilon\), where \(\hat q\) is the observed rate, \(m\) the sample size, and \(\ln\) the natural logarithm. Two features of this formula matter for design. The margin shrinks only as \(1/\sqrt m\), so quadrupling the sample halves it. Failure probability is much cheaper to buy: tightening \(\varepsilon\) from \(10^{-6}\) to \(10^{-8}\) costs either a 15% larger margin at fixed \(m\) or 33% more samples at fixed margin, because the dependence is logarithmic rather than a square root. And the bound concerns the statistic it estimates: it says nothing about errors of a different kind.
This classroom bound is not automatically the right finite-key theorem. Against coherent quantum attacks, and when sampling without replacement from a fixed block, the proof must name its population, its phase-error estimator, and the allocation of its failure budget. What the protocol can always do is abort: if the valid bound cannot support a positive key length, no key is produced, even when the observed rate looks small.
Worked example
For \(m=10{,}000\), \(\hat q=0.02\), and \(\varepsilon=10^{-6}\), compute the independent-trial upper bound and the margin's dependence on \(m\).
Solution and reasoning
The margin is
\[\sqrt{\frac{\ln(10^{6})}{20{,}000}}=\sqrt{\frac{13.8155}{20{,}000}}\approx0.02628,\]so \(q\le0.04628\). Doubling \(m\) shrinks the margin by \(\sqrt2\), to about 0.01858 and a bound of 0.03858; quadrupling \(m\) halves it. Note that the bound is about twice the observed rate here—at this sample size a 2% observation is genuinely weak evidence.
2.3.2 Invert an exact sampling model
Hoeffding treats trials as independent. A real protocol samples sifted positions without replacement from a fixed block, which admits an exact combinatorial treatment.
Suppose the block contains \(N\) sifted bits of which \(W\) are errors. The protocol reveals \(m\) positions chosen uniformly at random, so every \(m\)-subset is equally likely. Observing \(t\) errors means choosing \(t\) of the \(W\) wrong positions and \(m-t\) of the \(N-W\) correct ones, hence
\[P(T=t\mid W)=\frac{\binom Wt\binom{N-W}{m-t}}{\binom Nm}.\]This hypergeometric law answers a sharper question than the independent-trial illustration: given a finite population and random sampling, how surprising is this sample if many errors remain? Write \(F_W(t)=P(T\le t\mid W)\). Because \(F_W(t)\) decreases as \(W\) grows, an upper confidence bound
\[W_U(t)=\max\{W: F_W(t)>\varepsilon\}\]has the property that the true error count exceeds it with probability at most \(\varepsilon\). The remaining errors are \(W-t\), so the unseen error fraction is bounded by \((W_U(t)-t)/(N-m)\), clipped to the physical interval \([0,1]\).
Work through the numbers. For \(N=20\), \(m=5\), and no observed errors, the hypothesis \(W=10\) gives
\[P(T=0)=\frac{\binom{10}{5}}{\binom{20}{5}}=\frac{252}{15504}\approx0.01625,\]so a 5% one-sided test excludes it. At \(W=8\) the value is \(792/15504\approx0.05108\), and at \(W=9\) it is \(462/15504\approx0.02980\). The largest admissible count is therefore eight, leaving up to \(8/15\approx0.53\) unseen error fraction within this deliberately conservative procedure. Five clean observations are weak evidence, and the figure makes the reason visible: the curve is still above the threshold at eight errors.
Worked example
Repeat the inversion for \(N=10\), \(m=3\), \(t=0\). Find \(W_U\) and the bound on the unseen error fraction.
Solution and reasoning
With no observed errors the tail is \(P(T=0)=C(10-W,3)/C(10,3)\), and \(C(10,3)=120\). The values are \(35/120\approx0.2917\) at \(W=3\), \(10/120\approx0.0833\) at \(W=5\), \(4/120\approx0.0333\) at \(W=6\), and \(1/120\approx0.0083\) at \(W=7\). Since \(0.0833>0.05\) but \(0.0333<0.05\), \(W_U=5\), and the unseen fraction is bounded by \(5/7\approx0.714\). Three clean bits certify almost nothing—exactly the behaviour a protocol must not mistake for safety.
2.3.3 Identify what the sample does and does not certify
The derivation above assumes a well-defined classical error string and a uniformly sampled subset. It does not identify Z-key phase errors with observed X-test errors in a quantum protocol. That identification is a separate security-proof step: in entanglement-based proofs it concerns hypothetical complementary measurements and the symmetry of basis selection, and in optical implementations it also requires control of basis-dependent detection and preparation effects.
Reports go wrong when these layers are blended, so keep three quantities visibly separate.
| Quantity | Justified by | Certifies | Does not certify |
|---|---|---|---|
| Observed rate \(t/m\) | Counting revealed outcomes | The empirical error rate on the revealed bits | Anything about the unrevealed bits |
| Population bound \(W_U\) | The fixed sampling rule and an exact or Hoeffding tail | An upper bound on errors in the same-basis block, except with probability \(\varepsilon\) | A bound on complementary-basis errors |
| Phase-error or entropy bound | A quantum security proof (Chapter 3) | A bound on Eve's information, hence a key length | Correctness of the device model, or the absence of side channels |
The numerical laboratory reproduces the first two rows and exposes their assumptions; it does not silently substitute them for the third.
A design trade-off follows. Revealing more bits improves estimation but shrinks the candidate pool for extraction. Tightening \(\varepsilon\) increases the statistical margin and therefore the abort rate. Both choices have to be fixed before the block is analysed, or else justified by a proof that tolerates adaptation: trying thresholds until one passes is itself a selection procedure whose failure probability must be charged. Chapter 3 supplies the missing layer—how a classical error rate becomes a statement about phase errors and Eve's information—and Chapter 4 turns that statement into a key length.
Laboratory task. Run python3 education/cryptography/examples/bb84_lab.py --signals 20000 --attack 0.2 --seed 7. Record the emitted, sifted, tested, and unrevealed counts, and compare the test QBER with 0.05. Repeat with a second seed. Sampling variation should move the estimate; changing the seed must not move the expected attack formula.
Further reading
These sources supply the protocol, the security proofs whose results this chapter invokes, and the statistics behind the bounds.
- Bennett and Brassard, Quantum cryptography: public key distribution and coin tossing (1984; reprint 2014) — the original BB84 protocol and the sifting idea.
- Shor and Preskill, Simple proof of security of the BB84 quantum key distribution protocol (2000) — the entanglement-based route from bit and phase errors to a key rate.
- Mayers, Unconditional security in quantum cryptography (2001) — the first complete unconditional proof for BB84.
- Lo, Chau, and Ardehali, Efficient quantum key distribution scheme and proof of its unconditional security (2005) — why unequal basis weights can raise the key rate, the trade-off noted in Section 2.1.3.
- Scarani et al., The security of practical quantum key distribution (2009) — a review that separates protocol-level from device-level assumptions.
- Hoeffding, Probability inequalities for sums of bounded random variables (1963) — the bound used in Section 2.3.1, with its independence requirements.
- Tomamichel, Lim, Gisin, and Renner, Tight finite-key analysis for quantum cryptography (2012) — the finite-key accounting developed in Chapter 4.
Summary
- Sifting keeps matching bases; revealed test bits are public and cannot count as key.
- Full random-basis intercept–resend gives 25% sifted QBER, but the same aggregate can hide different basis-resolved statistics.
- A finite sample supports only a classical population bound, which a separate quantum theorem must turn into a phase-error and key-length statement.
Questions and worked problems
These exercises draw on the whole chapter. Attempt each question before opening a hint, explain your reasoning, then compare it with the worked solution.
2. Worked problem §
If both use Z with probability 0.9 independently, what fraction matches?
Hint 1
Include both Z and X matches.
Worked solution
0.9²+0.1²=0.82. A sufficient X sample is still needed to estimate complementary-basis errors.
3. Worked problem §
Under full intercept-resend, what is the chance ten independent test bits contain no error?
Hint 1
Each test passes with probability 3/4.
Worked solution
(3/4)¹⁰≈0.0563. This uses the independent attack model.
4. Worked problem §
Does zero observed error imply zero error in the remaining block?
Hint 1
Distinguish a sample from a population.
Worked solution
No. Finite samples can miss errors, so an upper confidence bound is needed.
5. Worked problem §
How does the deviation change if m is quadrupled?
Hint 1
Inspect the square root.
Worked solution
It is halved for fixed ε.
6. Worked problem §
Why discard revealed test bits?
Hint 1
Eve hears their values.
Worked solution
They are public and cannot be counted as fresh secret raw bits.
7. Worked problem §
Alice and Bob independently choose Z with probability 0.95 and use only Z matches for key. Out of one million ideal detected rounds, find expected Z-key candidates and X tests, and compare with probability 0.9.
Hint 1
Keep Z matches and X matches in separate bins.
Worked solution
At 0.95 the expectations are 0.95²×10⁶=902500 Z candidates and 0.05²×10⁶=2500 X tests. At 0.9 they are 810000 and 10000. The gain in candidate count accompanies a fourfold drop in test count, approximately doubling a square-root sampling margin. These are expectations, not guaranteed run counts.
8. Worked problem §
For Eve’s tilted measure-and-resend basis at θ=π/12, derive qZ, qX, and their equal-basis average. Would their average remain 25% if 90% of sifted rounds were Z rounds?
Hint 1
Use the two trigonometric error expressions and then apply the actual weights.
Worked solution
Here sin²(π/6)=1/4 and cos²(π/6)=3/4, so qZ=1/8 and qX=3/8. The equally weighted average is 1/4. With 90% Z weight it is 0.9/8+0.1×3/8=0.15. Aggregate QBER depends on the sifted basis mix; phase-error inference must preserve the basis-resolved statistics.
9. Worked problem §
With N=20, m=5, and t=0 errors, derive the 95% upper bound on total errors using the hypergeometric tail, and convert it to the unseen error fraction.
Hint 1
Compare W=8 and W=9, using the monotonicity of the no-error sample probability.
Worked solution
The probability is C(20−W,5)/C(20,5). For W=8 this equals 792/15504≈0.05108, above 0.05; for W=9 it equals 462/15504≈0.02980, below 0.05. Larger W have still smaller tails. Thus WU=8 and the remaining fraction is bounded by 8/15≈0.5333 by this procedure. No errors in a tiny sample still leaves a weak bound.
10. Extension §
Run the simulator at attack fractions 0, 0.2, and 1 using five fixed seeds. Explain which results are exact and which should fluctuate, and why its hidden raw QBER cannot be measured freely in a real run.
Hint 1
Distinguish ideal-model identities from finite-sample estimates.
Worked solution
With no channel noise and no attack, all sifted and raw bits agree exactly. For the other fractions, expected QBER is f/4 but sample and hidden raw QBER fluctuate across seeds. Sifted counts fluctuate around half the emitted count. Revealing raw comparisons in a real protocol would publish additional information and require discarding or accounting for those bits. A table of simulated rates validates this attack model, not a general secrecy claim.