L OS S ITIOS N ATURALES S AGRADOS EN EL PNUMA

The preparation of the signal states of Alice and Bob is cast in a source-replacement scheme on each side, which we will refer to as the two-party source-replacement. The source states

Beam splitter

| ± α�

| ± α�

+

-

Figure 7.2: Implementation of the optimal joint USD between correlated and anti- correlated states ρ+ and ρ− for the symmetric case α = β. The input states on the systems A and B are combined at a balanced beamsplitter. The output states on the systems + and _{− are measured by threshold detectors. If the detector in the output port} +/_{− fires, the input state was ρ}+/− and the result of the USD is γ = “ + /− ”. If none of the detectors fires, the outcome is inconclusive, γ = “?”.

Table 7.1: The measurement outcomes of the optimal joint unambiguous state discrimina- tion between the states ρ+ and ρ−.

p(+) p(₋₎ p(?) |α, αi 1_{− e}−2|α|2 0 e−2|α|2 |α, −αi 0 1_{− e}−2|α|2 e−2|α|2 | − α, αi 0 1_{− e}−2|α|2 e−2|α|2 | − α, −αi 1 − e−2|α|2 0 e−2|α|2

in the two-party source-replacement scheme are the entangled states |ΦiAA0 =

1 √

2(|0i|αi + |1i| − αi), (7.15)

|ΦiBB0 =

1 √

2(|0i|βi + |1i| − βi), (7.16)

respectively. The systems A and B are 2-dimensional qubit spaces with a canonical basis {|0i, |1i}. The systems A0_{and B}0_{carry the signal states. The two-party source-replacement} scheme is shown in Fig. 7.1.

Alice and Bob send the systems A0 and B0 of the source states to the node. The node then performs the joint quantum operation and the announcement γ, which effectively creates entanglement between Alice and Bob, and is commonly referred to as entanglement swapping. The entanglement between Alice and Bob is formally captured by introducing a bipartite quantum state ργ_AB on the systems A and B for each announcement γ. The dimensions of the systems A and B depend on the number of signal states. In particular, for the MDI-B92 protocol, the dimension is two. The total state held by Alice and Bob including the classical announcements is described by a convex combination

ρABC = X

γ

p(γ)ργ_{AB⊗ |γihγ|}C. (7.17)

where the classical system C holds a description of the announcement γ, and p(γ) is the probability that the announcement γ was made by the node. The classical system C is public and accessible to all parties, including Eve.

In the two-party source-replacement scheme the reduced state ρAB = trCρABC is a fixed quantity and equal to the reduced state of the source

ρAB = trA0_B0{|ΦihΦ|_AA0 ⊗ |ΦihΦ|_BB0} = ρ_A⊗ ρ_B. (7.18)

In the canonical basis_{{|00i, |01i, |10i, |11i} the density matrix ρ}AB is given by

ρAB = 1 4     1 B0 A0 A0B0 B0 1 A0B0 A0 A0 A0B0 1 B0 A0B0 A0 B0 1     (7.19)

Alice and Bob perform measurements MK = {FKx} for K ∈ {A, B} with POVM elements F_K0 = _{|0ih0| and FK}1 = _{|1ih1| on the systems A and B, followed by the classical} postprocessing of their data.

Instead of specifying the postprocessing on the classical data after the measurement, we can equivalently describe it on the quantum level before the measurement.

Postprocessing on the quantum level:

• If γ = “ + ”, Alice and Bob do nothing to ρ+ AB.

• If γ = “ − ”, Bob applies the Pauli operator σX (bit flip operator) to his part of ρ−AB, and Alice does nothing.

• If γ = “?”, Alice and Bob do nothing to ρ? AB. This postprocessing is described by the quantum map

Vγ[ργ_AB] := 1 ⊗ Vγ ργ_AB 1 ⊗ Vγ† := σ γ

AB. (7.20)

where the Vγ are unitary transformations on Bob’s system B defined by

V+ =12, (7.21)

V− = σX, (7.22)

V? =12. (7.23)

Finally, Alice and Bob measure each_Vγ[ργAB] with respect to the POVMs MK ={FKx} for K _{∈ {A, B}. If γ = “?”, they discard the data point. Otherwise, from the probability} distribution of the measurement outcomes p±(x, y) = tr{FAx⊗F

y B V±[ρ

±

AB]}, they determine the average error rate

Q± = p±(0, 1) + p±(1, 0) (7.24)

in each data subset γ = “_{± ”. They perform parameter estimation based on the average} error rates and a known probability p(“?”) in order to constrain the form of the density operators ρABC. The set of density operators ρABC compatible with the observations are defined as follows:

Definition 23 The set Γ contains all density operators ρABC, which are compatible with 1. The density operator ρAB = ρA⊗ ρB.

2. The averaged error rates Q±. 3. The probability p(“?”).

Eve’s control over the node and the channel is described by giving her the power to gen- erate the density operators ργ_AB at her will, of which she holds the purification _|Ψγ_iABE. Therefore, each ρABC ∈ Γ corresponds to a possible eavesdropping attack.

Remark: we fix the value of p(“?”) in the parameter estimation, but not the values of p(“ + ”) and p(“_{−”). This allows us later to prove that the optimal attack has a symmetry} with respect to the “ + ” and “_{− ” terms.}

7.4.2

Key rate optimization problem

We assume that Alice and Bob choose to extract the key from each _V[ρ±_AB] individually. Consequently, the key rate is given by

r = ¯Iobs− max ρABC∈Γ

¯

χtot(ρABC), (7.25)

where the maximum is taken over the set Γ of states ρABC established in the parameter estimation. The mutual information, Iobs, depends only on observations, while the total Holevo quantity, ¯ χtot(ρABC) = X γ=± p(γ) χ(_Vγ[ργAB], MA), (7.26)

depends on the choice of ρABC.