The Exercise

In the protocol of Bennett and Brassard, BB84, Alice sends Bob a qubit prepared in one of four states. Each state carries two bits: a data bit $a$ , and a basis bit $b$ that says whether $a$ is written in the computational basis $\{|0\rangle, |1\rangle\}$ or in the basis $\{|+\rangle, |-\rangle\}$ of eigenvectors of the Pauli operator $X$ . Suppose an eavesdropper, Eve, could take the qubit in transit and tell with certainty which of the four states it is. Show that she could then learn Alice’s data bit and send Bob a qubit in exactly the state Alice prepared.^✦

A Quantum System

A quantum system $S$ is given by its state space, a finite dimensional complex Hilbert space.^✦ A pure state $|\phi\rangle$ of $S$ is a vector of unit norm in the state space of $S$ ; we write $\mathcal{P}(S)$ for the set of pure states of $S$ .^✦

The qubit $Q$ is the quantum system whose state space is $\mathbb{C}^2$ .^✦ For a bit $i$ , the basis state $|i\rangle$ of $Q$ is the pure state whose vector is the column of $\mathbb{C}^2$ with $1$ in position $i$ and $0$ in the other, so that $|0\rangle = (1, 0)$ and $|1\rangle = (0, 1)$ .^✦ The eigenvectors of $X$ with eigenvalues $\pm 1$ are the pure states $|\pm\rangle = \frac{1}{\sqrt{2}} \begin{pmatrix} 1 \\ \pm 1 \end{pmatrix} = \frac{|0\rangle \pm |1\rangle}{\sqrt{2}}.$ (1)

The BB84 States

Alice’s state $|\psi_{ab}\rangle$ , which carries the data bit $a$ in the basis named by the basis bit $b$ , is the pure state of $Q$ given by $|\psi_{00}\rangle = |0\rangle, \qquad |\psi_{10}\rangle = |1\rangle, \qquad |\psi_{01}\rangle = |+\rangle, \qquad |\psi_{11}\rangle = |-\rangle.$ (2)^✦ Labelled by the pair of bits, the four states form a family of pure states of $Q$ , the BB84 family: $(a, b) \longmapsto |\psi_{ab}\rangle \in \mathcal{P}(Q).$ (3)^✦

Eve’s Attack

Let $S$ be a quantum system and $|\psi_i\rangle$ , for $i$ in a set of labels $I$ , a family of pure states of $S$ , the signal states. A state distinguisher $D$ for the family is a map from the pure states of $S$ to the labels, Eve’s classical readout of which signal was sent, that returns the right label on every signal state: $D \colon \mathcal{P}(S) \to I, \qquad D(|\psi_i\rangle) = i \quad \text{for every } i \in I.$ (4)^✦ For the BB84 family, $S = Q$ , the labels are $I = \{0, 1\} \times \{0, 1\}$ with $i = (a, b)$ , and a readout is a pair of bits whose first entry is the data bit.

The intercept and resend attack of a distinguisher $D$ is the map $\mathcal{I}_D$ on the pure states of $S$ that sends the state $|\phi\rangle$ Eve intercepts to the signal state labelled by her readout of it, the state she passes on to Bob: $\mathcal{I}_D(|\phi\rangle) = |\psi_j\rangle, \qquad j = D(|\phi\rangle).$ (5)^✦

The Claim

Theorem 1. Let $D$ be a state distinguisher for a family of signal states $|\psi_i\rangle$ of a quantum system $S$ . Then Eve’s readout recovers the label $i$ of the transmitted signal state: $D(|\psi_i\rangle) = i.$ (6)^✦ Her attack sends the signal state labelled $i$ to itself: $\mathcal{I}_D(|\psi_i\rangle) = |\psi_i\rangle.$ (7)^✦ For a state distinguisher $D$ of the BB84 family and any bits $a$ and $b$ , the first entry of Eve’s readout of $|\psi_{ab}\rangle$ , its data bit, is $a$ , and Bob receives $|\psi_{ab}\rangle$ : $D(|\psi_{ab}\rangle)_1 = a, \qquad \mathcal{I}_D(|\psi_{ab}\rangle) = |\psi_{ab}\rangle.$ (8)^✦

What Is Checked

The claim is stated over a state distinguisher $D$ for a family of pure states of a quantum system (4), the intercept and resend attack $\mathcal{I}_D$ it defines (5), and, for BB84, the four states (2) of the qubit in their signal family (3).