format: text

text:
# A high energy determination of Yukawa couplings in SUSY models *footnote **footnote *Partially supported by EU contract HPRN-CT-2000-00149

## I Introduction

The possibility that virtual electroweak effects of Supersymmetric models at future lepton colliders can be described, for sufficiently large c.m. energies, by a logarithmic expansion of Sudakov type, has been examined in recent papers  in the simplest case of the MSSM. The first considered process has been that of final fermion pair production. This has been only treated at one-loop, computing for both massless  and massive  final states the SUSY Sudakov terms. One main conclusion is that these terms do exist and are all of ”subleading” SL (linear) kind. At one TeV, working in a relatively ”light” SUSY scenario, where the heaviest SUSY mass if of a few (two, three) hundred GeV, the numerical effects of SUSY Sudakov terms on the various observables are relatively small (a few percent at most), while at three TeV they become definitely large. The next step has been the analysis of final scalar (sfermion or Higgs) pair production for both massless and massive final states. This has been performed both at the one-loop level and at resummed subleading order accuracy . By comparison of the two calculations it can be concluded that, in the assumed ”light” SUSY scenario the two approximations are practically indistinguishable at one TeV, where their effect is, as in the fermion case, relatively small, but become drastically different (and both large, well beyond a relative ten percent) in the higher (two, three TeV) energy region. Within this approach one would thus conclude that at the LC extreme energies the MSSM can be safely treated, to subleading logarithmic order accuracy, at the one loop level for what concerns fermion, sfermion, scalar Higgs production.

This conclusion could be of immediate practical consequence. In fact, it has been remarked in Refs. that, for production of fermions and squarks of the third family and of charged Higgs bosons, the coefficients of the SL electroweak SUSY logarithms of Yukawa origin only depend on a common SUSY scale $`M_S`$, by definition the heaviest SUSY mass involved in the electroweak component of the process, and on the ratio of the two scalar vevs $`\mathrm{tan}\beta =\mathrm{v}_2/\mathrm{v}_1`$. To the extent that a subleading order approximation can be considered as a reliable description of the variation with energy of the observables of the process, i.e. that the missing terms of the expansion can be adequately described by a constant component, this has allowed to propose a determination of $`\mathrm{tan}\beta `$ based on a number of measurements of the observables at different energies (roughly, on measurements of their slopes), whose main features have been already illustrated in Refs.  in a qualitative way for fermion production and scalar production separately.

The aim of this note is that of proposing a more quantitative determination of $`\mathrm{tan}\beta `$ from a combined analysis of the slopes in energy of fermion, sfermion, charged Higgs production. This will be done working at the one-loop level, in an energy region around (below) 1 TeV. With this purpose, and to try to be reasonably self-consistent, we briefly recall the structure of the various Yukawa contributions in the production of pairs of fermions ($`t,b`$), sfermions ($`\stackrel{~}{t}_{L,R}`$, $`\stackrel{~}{b}_{L,R}`$) and charged Higgs in the MSSM. The complete expressions of the asymptotic contributions can be found in Refs., and we do not reproduce them here. Starting from them it is relatively straightforward to derive the quantities that are relevant for this note, which are given in the following list.

## II Complete List of Yukawa Effects in Cross Sections and Asymmetries

We parametrize the Yukawa effects in the physical observables that we are going to analyze and summarize them by giving a complete list.

Let us denote by $`𝒪_n`$, the various cross sections for production of sfermions ($`\stackrel{~}{t}_{L,R}`$, $`\stackrel{~}{b}_{L,R}`$), charged Higgs bosons $`H^\pm `$ and third generation fermions ($`t`$ and $`b`$). For top and bottom production we also include three basic asymmetry observables (unpolarized forward-backward asymmetry $`A_{FB}`$, Left-Right asymmetry for longitudinally polarized $`e^\pm `$ beams $`A_{LR}`$ and its forward-backward asymmetry $`A_{pol}`$). In the case of top production the average helicity $`H_t`$ as well as its forward-backward and Left-Right asymmetries $`H_{FB,t}`$ and $`H_{LR,t}`$ should be measurable by studying the leading top decay mode $`tWb`$. The definition of these observables, in particular of the asymmetries, is conventional and can be found in full details in Appendix B of .

For cross sections $`𝒪\sigma `$, we define the relative one loop SUSY effect as the ratio

$$ϵ_n(q^2)=\frac{𝒪_n(q^2)𝒪_n^{\mathrm{Born}+\mathrm{SM}}(q^2)}{𝒪_n^{\mathrm{Born}+\mathrm{SM}}(q^2)},$$
(1)
where “SM” denotes all the one loop terms that do not involve virtual SUSY partners (sfermions, gauginos and extra Higgs particles). For asymmetries, we consider instead the absolute SUSY effect defined as the difference

$$ϵ_n(q^2)=𝒪_n(q^2)𝒪_n^{\mathrm{Born}+\mathrm{SM}}(q^2).$$
(2)
At one loop, in the asymptotic regime, the shifts $`ϵ_n`$ can be parametrized as

$$ϵ(q^2)=\frac{\alpha }{4\pi }F(\mathrm{tan}\beta )\mathrm{ln}\frac{q^2}{M_S^2}+G+𝒪\left(\frac{M^2}{q^2}\right),$$
(3)
where, as we wrote, $`F`$ is a simple function of $`\mathrm{tan}\beta `$ only. Its explicit expression must be determined by performing a Sudakov (logarithmic) expansion of the one loop calculation. The detailed analysis can be found in  and here we collect the various results for convenience of the reader.

Sfermion cross sections

$`F(\sigma _{\stackrel{~}{t}_L})`$ $`=`$ $`{\displaystyle \frac{1}{M_W^2s_W^2}}\left(m_t^2\mathrm{cot}^2\beta +m_b^2\mathrm{tan}^2\beta \right),`$ (4)
$`F(\sigma _{\stackrel{~}{t}_R})`$ $`=`$ $`{\displaystyle \frac{2}{M_W^2s_W^2}}m_t^2\mathrm{cot}^2\beta ,`$ (5)
$`F(\sigma _{\stackrel{~}{b}_L})`$ $`=`$ $`F(\sigma _{\stackrel{~}{t}_L}),`$ (6)
$`F(\sigma _{\stackrel{~}{b}_R})`$ $`=`$ $`{\displaystyle \frac{2}{M_W^2s_W^2}}m_b^2\mathrm{tan}^2\beta `$ (7)
Charged Higgs cross section

$$F(\sigma _{H^\pm })=\frac{3}{M_W^2s_W^2}\left(m_t^2\mathrm{cot}^2\beta +m_b^2\mathrm{tan}^2\beta \right).$$
(8)
Fermion cross section

$`F(\sigma _t)`$ $`=`$ $`{\displaystyle \frac{1}{s_W^2M_W^2}}{\displaystyle \frac{1}{912s_W^2+88s_W^4}}\times `$ (10)
$`\left(3m_t^2(34s_W^2+56s_W^4)\mathrm{cot}^2\beta m_b^2(912s_W^2+8s_W^4)\mathrm{tan}^2\beta \right)`$
$`F(\sigma _b)`$ $`=`$ $`{\displaystyle \frac{1}{s_W^2M_W^2}}{\displaystyle \frac{1}{924s_W^2+40s_W^4}}\times `$ (12)
$`\left(m_t^2(924s_W^2+20s_W^4)\mathrm{cot}^2\beta 3m_b^2(38s_W^2+20s_W^4)\mathrm{tan}^2\beta \right)`$
Fermion cross section asymmetries

$`F(A_{FB,t})`$ $`=`$ $`{\displaystyle \frac{1}{M_W^2}}{\displaystyle \frac{72s_W^2(34s_W^24s_W^4)}{(912s_W^2+88s_W^4)^2}}(m_t^2\mathrm{cot}^2\beta m_b^2\mathrm{tan}^2\beta )`$ (13)
$`F(A_{LR,t})`$ $`=`$ $`{\displaystyle \frac{1}{M_W^2}}{\displaystyle \frac{384s_W^2(34s_W^2+s_W^4)}{(912s_W^2+88s_W^4)^2}}(m_t^2\mathrm{cot}^2\beta m_b^2\mathrm{tan}^2\beta )`$ (14)
$`F(A_{pol,t})`$ $`=`$ $`{\displaystyle \frac{1}{M_W^2}}{\displaystyle \frac{120s_W^2(912s_W^2+8s_W^4)}{(912s_W^2+88s_W^4)^2}}(m_t^2\mathrm{cot}^2\beta m_b^2\mathrm{tan}^2\beta )`$ (15)
$`F(A_{FB,b})`$ $`=`$ $`{\displaystyle \frac{1}{M_W^2}}{\displaystyle \frac{18s_W^2(38s_W^2)}{(924s_W^2+40s_W^4)^2}}(m_t^2\mathrm{cot}^2\beta m_b^2\mathrm{tan}^2\beta )`$ (16)
$`F(A_{LR,b})`$ $`=`$ $`{\displaystyle \frac{1}{M_W^2}}{\displaystyle \frac{96s_W^2(38s_W^2+5s_W^4)}{(924s_W^2+40s_W^4)^2}}(m_t^2\mathrm{cot}^2\beta m_b^2\mathrm{tan}^2\beta )`$ (17)
$`F(A_{pol,b})`$ $`=`$ $`{\displaystyle \frac{1}{M_W^2}}{\displaystyle \frac{30s_W^2(924s_W^2+20s_W^4)}{(924s_W^2+40s_W^4)^2}}(m_t^2\mathrm{cot}^2\beta m_b^2\mathrm{tan}^2\beta )`$ (18)
Fermion helicity and its asymmetries
It has been shown in  that the logarithmic parts of these observables are related to those of the cross section asymmetries as follows:

$`F(H_f)`$ $`=`$ $`{\displaystyle \frac{4}{3}}A_{pol,f}`$ (19)
$`F(H_{FB,f})`$ $`=`$ $`{\displaystyle \frac{3}{4}}A_{LR,f}`$ (20)
$`F(H_{LR,f})`$ $`=`$ $`{\displaystyle \frac{4}{3}}A_{FB,f}`$ (21)
## III Limits and Confidence Regions for tan $`\beta `$

The constant $`G`$ in Eq. (3) is a sub-subleading correction that does not increase with $`q^2`$ and depends on all mass ratios of virtual particles. The omitted terms in Eq. (3) vanish in the high energy limit .

To eliminate $`G`$ we assume that a set of $`N`$ independent measurements is available at c.m. energies $`\sqrt{q_1^2},\sqrt{q_2^2},\mathrm{},\sqrt{q_N^2}`$ and take the difference of each measurement with respect to the one at lowest energy. For each observable, the resulting quantities

$$\delta _i=ϵ(q_i^2)ϵ(q_1^2),$$
(22)
do not contain the constant term $`G`$ and take the simple form

$$\delta _i=F(\mathrm{tan}\beta ^{})\mathrm{ln}\frac{q_i^2}{q_1^2},$$
(23)
where $`\mathrm{tan}\beta ^{}`$ is the true unknown value that describes the experimental measurements.

We now turn to a description of a possible strategy for the determination of $`\mathrm{tan}\beta `$. It results from a non linear analysis of data that must deal with extreme situations where $`\mathrm{tan}\beta `$ is determined with a still reasonable but rather large relative error.

Let us label the various observables by the index $`n=1,\mathrm{},N_𝒪`$ and denote by $`\sigma _n(q^2)`$ the experimental error on $`ϵ_n(q^2)`$. For each set of explicit measurements $`\{\delta _n(q_i^2)\}`$, the best estimate for $`\mathrm{tan}\beta `$ is the value that minimizes the $`\chi ^2`$ sum

$$\chi ^2(\mathrm{tan}\beta )=\underset{i=1}{\overset{N}{}}\underset{n=1}{\overset{N_𝒪}{}}\frac{[F_n(\mathrm{tan}\beta )\mathrm{ln}\frac{q_{i+1}^2}{q_1^2}\delta _{n,i}]^2}{4\sigma _{n,i}^2},$$
(24)
where $`\delta _{n,i}\delta _n(q_i^2)`$ and $`\sigma _{n,i}\sigma _n(q_i^2)`$. The factor $`4`$ in the above formula follows from the fact that we assume a conservative error $`2\sigma _{n,i}`$ on the difference $`\delta _{n,i}`$. In other words, we describe the experimentally measured quantity $`\delta _{n,i}`$ in terms of a normal Gaussian random variable distributed around the theoretical value computed at $`\mathrm{tan}\beta ^{}`$

$$\delta _{n,i}=F_n(\mathrm{tan}\beta ^{})\mathrm{ln}\frac{q_{i+1}^2}{q_1^2}+2\sigma _{n,i}\xi _{n,i},$$
(25)
with probability density for the independent fluctuations $`\{\xi _{n,i}\}`$ given by

$$P(\{\xi _{n,i}\})=\underset{n,i}{}\frac{1}{\sqrt{2\pi }}e^{\frac{1}{2}\xi _{n,i}^2}.$$
(26)
In the following we shall simplify the analysis by taking a constant $`\sigma _{n,i}\sigma `$ with typical values around 1%. For each set of measurements we determine the optimal $`\mathrm{tan}\beta `$ that minimizes $`\chi ^2`$. It is a function of the actual measurements $`\{\xi _{n,i}\}`$ and the width of its probability distribution $`P(\mathrm{tan}\beta )`$ determines the limits that can be assigned to the estimate of the unknown $`\mathrm{tan}\beta ^{}`$.

The distribution $`P(\mathrm{tan}\beta )`$ cannot be computed analytically because of the highly non linear dependence of the MSSM effects on $`\mathrm{tan}\beta `$. However, it can be easily obtained by Monte Carlo sampling. With this aim, we generate a large set of independent realizations of the measurements $`\{\xi _{n,i}\}`$ and compute for each of them $`\mathrm{tan}\beta `$. The histogram of the obtained values is a numerical estimate of the true $`P(\mathrm{tan}\beta )`$.

In previous papers , we discussed a simplified approximate procedure and we determined the $`1\sigma `$ boundary on $`\mathrm{tan}\beta `$ by linearizing the dependence on $`\mathrm{tan}\beta `$ around the minimum of $`\chi ^2`$. The bound that we derived is thus

$$\delta \mathrm{tan}\beta =2\sigma \left(\underset{n=1}{\overset{N_𝒪}{}}F_n^{}(\mathrm{tan}\beta ^{})^2\right)^{1/2}\left(\underset{i}{}\mathrm{ln}^2\frac{q_{i+1}^2}{q_1^2}\right)^{1/2}.$$
(27)
This result can be trusted if the experimental accuracy $`\sigma `$ is small enough to determine a region around the minimum of $`\chi ^2`$ where deviations from linearity can be neglected. It gives anyhow a rough idea of the easy regions where a determination of $`\mathrm{tan}\beta `$ from virtual one loop MSSM effects is not difficult.

In a more realistic analysis, however, this approximation can be misleading and possibly too much optimistic, especially for values of $`\mathrm{tan}\beta `$ around $`15`$ where the linearized analysis predicts typical relative errors around $`50\%`$. For this reasons, we pursue in this paper the complete Monte Carlo analysis of the allowed range of $`\mathrm{tan}\beta `$.

## IV Numerical Analysis

We begin by considering the full set of 16 observables consisting in:

1. cross sections for sfermion production in the case of final $`\stackrel{~}{t}_L`$, $`\stackrel{~}{t}_R`$, $`\stackrel{~}{b}_L`$, $`\stackrel{~}{b}_L`$;
2. cross section for charged Higgs production;
3. cross sections and 3 asymmetries (forward-backward, longitudinal and polarized) for top, bottom production;
4. 3 top helicity distributions (again forward-backward, longitudinal and polarized).

We assume a set of $`N=10`$ measurements at energies between 600 GeV and 1 TeV with an aimed experimental precision equal to 1% for all observables at all energies. Within this ideal framework we have determined the probability distribution $`P(\mathrm{tan}\beta )`$ for $`5<\mathrm{tan}\beta ^{}<40`$. In Fig. (1) we show the associated histograms in the four cases $`\mathrm{tan}\beta ^{}=10,15,20,25`$. Even in the easiest case, $`\mathrm{tan}\beta ^{}=25`$, it is not possible to determine $`\mathrm{tan}\beta `$ in a reasonable way. There is always a rather pronounced peak at small $`\mathrm{tan}\beta `$ in the histogram and the distribution is rather broad without a second peak recognizable around the exact value.

To analyze in a quantitative way these results, we compute from each histogram the standard deviation of the estimated $`\mathrm{tan}\beta `$. If the distribution can be characterized in terms of a single dominant peak, then this is rough measure of its width. Of course, when the distribution is wide or when it is the sum of two large separated peaks, the standard deviation is a pessimistic estimate of the uncertainty on the parameter determination that can be improved by adding, for instance, some information excluding the regions corresponding to large (or small) values.

The determination of $`\mathrm{tan}\beta `$ is almost completely driven by the observables related to sfermions and charged Higgses production. In Fig. (2), we show the results obtained without observables related to top and bottom production. In Fig. (3), we show the results obtained with top, bottom and charged Higgs observables. The single measurement of charged Higgs cross section is not enough to determine $`\mathrm{tan}\beta `$ with this level of precision in the measures. Finally, in Fig. (4), we show the results obtained with sfermions and fermions observables. The single measurement of charged Higgs cross section is not enough to determine $`\mathrm{tan}\beta `$ with this level of precision in the measurements. The plot of the relative error as a function of $`\mathrm{tan}\beta `$ for the various sets of observables (including the full case) is collected in Fig. (5).

With these necessary remarks in mind, we can analyze the standard deviation of the parameter histograms and the result is shown in Fig. (5) (solid line). We see that for $`\mathrm{tan}\beta <20`$ a determination with a relative error smaller than $`50\%`$ is not possible.

If we consider still 10 measurements ranging from 600 GeV up to 1 TeV, but with a precision of $`0.5\%`$, then the scenario is quite better. In Fig. (6), we see that for $`\mathrm{tan}\beta ^{}>20`$, a well defined peak is visible in the rightmost part of the Figures roughly centered on the exact value. Fig. (10) (solid line) allows to conclude that the relative error is smaller than $`50\%`$ for $`\mathrm{tan}\beta ^{}>13`$ and smaller than $`25\%`$ for $`\mathrm{tan}\beta ^{}>25`$. Again, the role of the observables related to sparticle production is fundamental. In Fig. (7) we show what can be obtained without the information coming from top and bottom production. As one can see, there is small difference with respect to the previous two figures. Fig. (8) shows the results obtained with top, bottom and charged Higgs observables. Fig. (9) shows the results obtained with sfermions and fermions observables. Again, Fig. (10) collects the error as a function of $`\mathrm{tan}\beta `$ for the various considered cases.

As a final comment, we observe that a general feature of the histograms is the presence of a fake peak at small $`\mathrm{tan}\beta `$ as well at $`\mathrm{tan}\beta 6`$. The reason for this can be understood by analyzing what happens by exploiting in the analysis just the (dominant) charged Higgs cross section as discussed in Appendix A.

## V Conclusions

In a ”standard” SUSY model, all the gauge couplings are fixed and coincide with the corresponding SM ones. For the couplings of the Yukawa sector, much more freedom is allowed. In the MSSM, one such coupling is the ratio of the scalar vevs $`\mathrm{tan}\beta `$. We have shown in this Note that, in a light SUSY scenario, a determination of $`\mathrm{tan}\beta `$ based on measurements of the slope with energy of the combined set of observables of the three processes of fermion, sfermion, scalar charged Higgs production can lead to a determination of this parameter with a relative error of 20-30 % in a range of high values that would otherwise require difficult final state analyses of Higgs decays, see the proposals in .

The main point of our approach is, in our opinion, the fact that in this determination $`\mathrm{tan}\beta `$ is the only SUSY parameter to be measured: all the other parameters give vanishing contributions in the high energy limit. Isolating the various SUSY parameters to be studied is in fact, in our opinion, a basic feature of any realistic ”determination strategy”.

In addition to the previous conclusion, we would like to add an extra final comment. If a SUSY model were different from the considered MSSM, in particular if it had a different Higgs structure (for example more Higgs doublets), the Yukawa couplings would be, quite generally, different. But the features of the Sudakov structure would remain essentially unchanged. This would lead to the possibility of deriving, with minor changes in our approach, the components of the SUSY Yukawa sector that dominate the high energy behaviour in this model. In analogy with what was done at LEP1 for the ”prediction”, from an analysis of one-loop effects, of the value of the top mass, that remains in our opinion one of the biggest LEP1 achievements, a combined set of high precision measurements at future linear colliders physics could therefore produce a genuine determination of this fundamental SUSY parameter.

## A Analysis with the $`H^\pm `$ cross section alone

It is interesting to analyze the role of charged Higgs production in $`\mathrm{tan}\beta `$ determination when no additional observables are exploited. In fact, at the level of precision we are working, some problems arise. To see why, let us denote $`\mathrm{tan}\beta T`$ and write $`\chi ^2`$ explicitly:

$$\chi ^2(T)=\underset{i=1}{\overset{N}{}}\frac{[(F(T)F(T^{}))\mathrm{ln}\frac{q_{i+1}^2}{q_1^2}2\sigma \xi _i]^2}{4\sigma ^2},$$
(A1)
The function $`F(T)`$ is given by

$$F(T)=\frac{3\alpha }{4\pi M_W^2s_W^2}(m_t^2\mathrm{cot}^2\beta +m_b^2\mathrm{tan}^2\beta )$$
(A2)
If we denote $`L_i=\mathrm{log}\frac{q_{i+1}^2}{q_1^2}`$, the derivative of $`\chi ^2`$ vanish when

$$F^{}(T)=0T=\sqrt{m_t/m_b}6.2,$$
(A3)
and also at the solutions (if there are any) of

$$F(T)F(T^{})=2\sigma \frac{_iL_i\xi _i}{_iL_i^2},$$
(A4)
that we can write in a simpler way in terms of a new normalized gaussian random variable $`\stackrel{~}{\xi }`$:

$$\mathrm{\Delta }(T,T^{})=\stackrel{~}{\sigma }\stackrel{~}{\xi }$$
(A5)
where

$$\mathrm{\Delta }(T,T^{})F(T)F(T^{}),\stackrel{~}{\sigma }=\frac{2\sigma }{(_iL_i^2)^{1/2}}$$
(A6)
To discuss the solutions of Eq. (A5), we must consider the main features of $`\mathrm{\Delta }(T,T^{})`$ for a given (unknown) $`T^{}`$. It tends to $`\mathrm{}`$ for $`T0`$ or $`\mathrm{}`$ and vanishes at

$$T_1=T^{},T_2=\frac{m_t}{m_b}\frac{1}{T^{}}$$
(A7)
It is a convex function and attains its maximum value at $`T=\sqrt{m_t/m_b}`$ where

$$\mathrm{\Delta }_{max}(T^{})\mathrm{\Delta }(\sqrt{\frac{m_t}{m_b}},T^{})=\frac{3\alpha }{4\pi M_W^2s_W^2}\left(\frac{m_t}{T^{}}m_bT^{}\right)^2$$
(A8)
Each would-be measurement corresponds to a value of $`\stackrel{~}{\xi }`$ and to an associated random $`T(\stackrel{~}{\xi })`$ that is found by minimization of $`\chi ^2`$. It is easy to see that two possibilities can arise:

1. $`\stackrel{~}{\sigma }\stackrel{~}{\xi }\mathrm{\Delta }_{max}(T^{})`$: in this case, $`\chi ^2(T)`$ has a double well shape with a local maximum at $`T=\sqrt{m_t/m_b}`$ and two local minima around two points that are located around $`T_1`$ and $`T_2`$ and that tend toward them as $`\stackrel{~}{\sigma }0`$.
2. $`\stackrel{~}{\sigma }\stackrel{~}{\xi }>\mathrm{\Delta }_{max}(T^{})`$: in this case, $`\chi ^2(T)`$ is concave and has a global minimum at $`T=\sqrt{m_t/m_b}`$.

If the would-be measurements are randomly generated, cases (a) and (b) will occur with a relative frequency depending on $`\stackrel{~}{\sigma }`$. For small $`\sigma /\mathrm{\Delta }_{max}`$ the majority of cases will be (a) and we shall be able to identify two well defined peaks in the histogram of the reconstructed $`T`$. The first will be false and around $`T_2`$, the second will be true and around $`T_1=T^{}`$. Of course, if several measurements with independent dependencies on $`T`$ are combined, then it is possible to suppress the false peak.

If, on the other hand, $`\sigma /\mathrm{\Delta }_{max}`$ is not small, then we shall fall in case (b) with very high probability and the reconstruction process will simply accumulate artificially at $`T=\sqrt{m_t/m_b}`$ just because Eq. (A5) has no solutions.

To give numerical values, with 10 measurements at $`0.5\%`$ between 600 GeV and 1 TeV, we find that the condition $`\stackrel{~}{\sigma }<\mathrm{\Delta }_{max}`$ forbids the analysis of the region $`3<\mathrm{tan}\beta <13`$ and in practice some other observable must be added (in the previous analysis we chose production of top or bottom).


text:
# Security of the Bennett 1992 quantum-key distribution against individual attack over a realistic channel

## I Introduction

Quantum key distribution (QKD) is a way to share between the sender, Alice, and the receiver, Bob, a secret key whose information is not known to the eavesdropper, Eve. Since the first QKD protocol, called BB84 protocol, was introduced by Bennett and Brassard BB84 , several schemes for QKD have been proposed, such as Ekert protocol ekert , which is based on the nonlocality of quantum mechanics, B92 protocol B92 , which uses two nonorthogonal states, and so on imoto . In each protocol, since Eve cannot eavesdrop without disturbing quantum states, she will induce some errors or changes in the transmission rate. In ideal situations where imperfections such as transmission losses and dark counting of detectors do not exist, one can prove that the QKD protocols are secure even when Eve employs any kind of eavesdropping strategies including so-called collective attack or coherent attack, which is the most general attack where a single probe is entangled to the whole transmitted pulses. In practice, however, imperfections exist and if Eve gets rid of imperfections by using her unlimited technology (for example, she may replace the noisy channel to a noiseless channel), Eve can disturb quantum states to a certain degree and therefore she obtains some information about the secret key. Estimation of the amount of information extracted by Eve and construction of a secure secret key under such situations are not a trivial problem.

There are several works which deal with the security of realistic QKD. In BB841 ; BB842 ; BB843 ; simple ; inamori , it is proven that under some conditions the BB84 protocol is secure even when Eve employs coherent attack. The security proof in simple  reveals a tight connection to the entanglement purification protocol EPP  and quantum error correcting codes, especially Calderbank-Shor-Steane codes CSS . This proof can be also applied to BB84-type protocols such as the 6-state protocol six  where the basis information is exchanged over a public channel. The security against the individual attack, which is more restricted but more realistic, was also discussed for the BB84 protocol norbert2  and for the Ekert protocol waks .

On the other hand, we have not yet fully understood the security of the B92 protocol. The discussions so far concerned with the security against individual attack fuchs ; slu . In each paper, the single-photon polarization is used as a carrier of the quantum signals, and the transmission loss is not included. In fuchs , Fuchs and Peres have calculated the upper bound of Eve’s Shannon information gain averaged over all transmitted bits. Slutsky and co-authers have estimated the upper bound of Eve’s Renyi information gain in a B92 protocol as a function of the error rate when Alice and Bob discard errors slu . The B92 protocol, which uses only two states, is conceptually the simplest of all the protocols. In addition, the protocol includes a continuous parameter (the nonorthogonality between the two states) that can be chosen by the users, forming a striking contrast to the BB84-type protocols. Further understanding of the security of the B92 protocol is thus important not only for the practical applications but also for deeper understanding of the nature of quantum information.

In this paper, we estimate the security of the B92 protocol against individual attack over a realistic channel including noises and transmission losses. We assume, like in fuchs ; slu , that Alice encodes the bit values in two single-photon polarization states (the original B92 in B92  uses two nonorthogonal coherent states). We consider a modified protocol in which inconclusive measurement results are also used for the estimation of Eve’s information gain, in addition to the bit error rate used in the previous analyses. The problem is also regarded as one of the basic problems of quantum eavesdropping, namely, the maximum information leak to an adversary who are simulating the noisy quantum channel through which Alice transmits Bob a bit encoded on two quantum states.

We briefly describe how Alice and Bob can obtain the secret key whose information available to Eve is negligibly small. First, Alice prepares nonorthogonal single- photon polarization states $`|\mathrm{\hspace{0.17em}0}`$ and $`|\mathrm{\hspace{0.17em}1}`$, depending on the bit values of the raw key, and sends them to Bob. After propagating through the noisy channel or through eavesdropping by Eve, $`|\mathrm{\hspace{0.17em}0}`$ and $`|\mathrm{\hspace{0.17em}1}`$ generally become mixed states, $`\rho _0`$ and $`\rho _1`$, respectively. Secondly, Bob performs measurement whose outcomes are 0, 1 and “?”. The outcome “?” means an inconclusive result where Bob cannot determine which state Alice has sent. Thirdly, Alice and Bob discard inconclusive bits and they reconcile the errors in conclusive bits by an error correction protocol which is the technique of classical information theory to obtain the reconciled key. Finally, in order to eliminate Eve’s information about the reconciled key, Alice and Bob shorten their keys via a privacy amplification protocol privacy amp , which is also the technique of the classical information theory. How much they should shorten the reconciled key depends on how much information about the reconciled key Eve could have obtained. The last two procedures are done over a public channel. It is assumed that Eve can listen to the information exchanged over the public channel, but she cannot alter it. By means of these techniques, Alice and Bob can obtain the identical secret key, even under the imperfections and Eve’s interference.

In the above framework, it is important for Alice and Bob to estimate Eve’s information about the reconciled key properly. To estimate this information, we propose a slightly modified protocol. The difference between our protocol and the original protocol is that when Bob obtains an inconclusive result, Alice opens which state she has sent. Using this extra data, Bob performs data processing which is a kind of symmetrization of the states received by Bob. This makes our analysis simpler without underestimating Eve’s ability. We can estimate Eve’s information by using the symmetrized density matrices. Eve’s information gain is calculated as a function of a few parameters which characterize the symmetrized density matrices. Since Bob’s symmetrized density matrices can be fully characterized by the observed quantities and classical communication, the problem we have solved is equivalent to the problem of how much maximum information Eve can extract while she simulates the noisy channel. The answer to this problem has turned out to be more complex than expected; We found a counter-intuitive phenomenon where the maximum information gain is not monotone increasing as a function of the amount of noises when the angle between Alice’s two states is small. We also found that for a small noise rate, Eve can extract perfect information in the case where the angle of Alice’s two states is very small or very large, while she cannot extract perfect information for the intermediate angle. We give an explanation that is useful to understand these behavior intuitively.

We also performed an optimization of the angle between Alice’s two states that makes the rate of the final key gain as high as possible. We show that the optimized angle decreases as the amount of noises and the transmission losses increase. Unfortunately, the assumption of the polarization encoding makes the B92 protocol particularly weak against channel losses, so that the key gain is always smaller than in the BB84 protocol.

This paper is organized as follows. In Sec. II, we describe our assumption on the apparatus used by Alice and Bob, and the limitation on Eve’s strategy. Our slightly modified B92 protocol is proposed in Sec. III. Then, in Sec. IV, we consider Bob’s data processing for the symmetrization of the density matrices, and in Sec. V, we optimize Eve’s eavesdropping strategy and calculate Eve’s maximum information gain as a function of the parameters that reflect imperfections or Eve’s disturbance. In Sec. VI, we calculate the secret key gain as a function of these parameters. Finally Sec. VII is devoted to the summary and discussion.

## II Assumptions

In this section, we describe the assumptions on the abilities of the legitimate users (Alice and Bob) and the eavesdropper (Eve). We put these conditions throughout this paper.

First, we describe what Alice and Bob perform with ideal apparatus. The B92 protocol is originally considered to use two nonorthogonal coherent states. In this paper, however, we assume two nonorthogonal single-photon polarization states for the simplicity of analysis. We denote the Hilbert space for each pulse as $`H`$, which contains arbitrary photon number states, and the subspace that contains only one photon as $`H_1`$. The subspace $`H_1`$ is two-dimensional reflecting the polarization degree of freedom, and the states in $`H_1`$ are conveniently represented by the Bloch sphere. We define $`|\sigma _\phi `$ and $`|\overline{\sigma _\phi }`$ for $`\pi <\phi <\pi `$ as follows,

$`|\sigma _\phi `$ $``$ $`\mathrm{cos}{\displaystyle \frac{\phi }{2}}|z++\mathrm{sin}{\displaystyle \frac{\phi }{2}}|z,`$
$`|\overline{\sigma _\phi }`$ $``$ $`\mathrm{sin}{\displaystyle \frac{\phi }{2}}|z+\mathrm{cos}{\displaystyle \frac{\phi }{2}}|z\mathrm{for}\phi 0,`$
$`\mathrm{and}|\overline{\sigma _\phi }`$ $``$ $`\mathrm{sin}{\displaystyle \frac{\phi }{2}}|z++\mathrm{cos}{\displaystyle \frac{\phi }{2}}|z\mathrm{for}\phi <0,`$ (1)
where $`|z+`$ and $`|z`$ are the eigenstates of $`\sigma _z`$ ($`z`$ component of Pauli matrix) whose eigenvalues are $`+1`$ and $`1`$, respectively. $`\phi `$ is the angle between $`|\sigma _\phi `$ and $`|z+`$ on the $`xz`$ plane in the Bloch sphere.

We assume that Alice prepares the following states depending on the bit value,

$$|\mathrm{\hspace{0.17em}0}|\sigma _\alpha ^{}\mathrm{and}|\mathrm{\hspace{0.17em}1}|\sigma _\alpha ^{}(0\alpha ^{}\pi /2),$$
(2)
where the parameter $`\alpha ^{}`$ characterizes the nonorthogonality between the two states, such that

$$0|1=\mathrm{cos}\alpha ^{}.$$
(3)
When these states are sent to Bob through the noisy quantum channel, $`|\mathrm{\hspace{0.17em}0}`$ and $`|\mathrm{\hspace{0.17em}1}`$ generally become mixed states, $`\rho _0`$ and $`\rho _1`$, respectively. On these states, Bob measures the polarization on the basis $`\{|\sigma _\alpha ,|\overline{\sigma _\alpha }\}`$ or $`\{|\sigma _\alpha ,|\overline{\sigma _\alpha }\}`$, which is selected randomly. The whole measurement process is described by the following POVM sPOVM

$`F_0`$ $``$ $`{\displaystyle \frac{1}{2}}|\sigma _\alpha \sigma _\alpha |`$
$`F_{\overline{0}}`$ $``$ $`{\displaystyle \frac{1}{2}}|\overline{\sigma _\alpha }\overline{\sigma _\alpha }|`$
$`F_1`$ $``$ $`{\displaystyle \frac{1}{2}}|\sigma _\alpha \sigma _\alpha |`$
$`F_{\overline{1}}`$ $``$ $`{\displaystyle \frac{1}{2}}|\overline{\sigma _\alpha }\overline{\sigma _\alpha }|`$
$`F_\mathrm{V}`$ $``$ $`1F_0F_{\overline{0}}F_1F_{\overline{1}}`$ (4)
where “V” means the states which contain zero or more than one photon, where allowances are made for the effect of transmission losses. $`F_i`$ and $`F_{\overline{i}}`$ ($`i=0,1`$) are shown in Fig. 1 schematically using Bloch sphere. Here we allow general cases where $`\alpha `$ is not necessarily equal to $`\alpha ^{}`$. We call the events inconclusive where Bob’s outcome of the measurement is $`0`$ or $`1`$, and the events where Bob’s outcome is $`\overline{0}`$ or $`\overline{1}`$ conclusive.

In reality, the transmission line and Alice and Bob’s apparatus is not perfect (see Fig. 2). We assume one condition on the character of the imperfection, namely, the imperfection is equivalently represented as a noise source placed just after Alice’s ideal apparatus, and a noise source just before Bob’s ideal apparatus. Under this condition, Fig. 2 becomes Fig. 3. We need some care for this assumption. For example, if the noisy photon detectors PD1 and PD2 in Fig. 2 have different quantum efficiencies, we cannot transform this model into Fig. 3 directly. However, if Bob interchanges noisy PD 1 and noisy PD 2 at random, which effectively makes the efficiency of these detectors identical, we can transform Fig. 2 into Fig. 3, and the assumption can be met.

The benefit of the above assumption is that we can use a simpler model in which Alice and Bob’s apparatus is perfect, in the following sense. In Fig. 3, the region bounded by dash-dotted lines is under Eve’s control. Suppose that this region is extended up to the dotted lines. While this assumption may make the length of the final key shorter than the optimum one, at least we can avoid the risk of underestimating Eve’s ability. In this model, every imperfection is attributed to the property of the quantum channel, and the analysis is considerably simplified. This assumption has been also used in the previous works waks ; esti .

We assume that Eve’s eavesdropping is restricted to individual attack. The definition of individual attack is that eavesdropping is independently done for each pulse and there exists no correlation of events among pulses. In the most general individual attack, Eve prepares her auxiliary system (probe) E in an initial state $`|w_\mathrm{E}`$, interacts it with one pulse sent by Alice via a unitary operation $`U`$, and performs measurements on the probe E to obtain the bit information. We do not impose any restriction on Eve’s measurement on the probe. We do not treat more general attack, such as collective attack or coherent attack.

## III Protocol

In this section, we propose a protocol slightly modified from the original one, which makes it possible to identify the density matrices of the states received by Bob more tightly. The main idea is that Alice and Bob can identify the density matrices more precisely by monitoring more parameters. In our protocol, Alice and Bob monitor not only the error rate in conclusive bits, but also the statistics of inconclusive bits. This additional information makes it possible to identify the density matrices after a symmetrization which is described in Sec. IV.

Our modified protocol consists of the following steps.

1. Alice determines a bit value $`j=0`$ or $`j=1`$ randomly, and sends to Bob the single-photon polarization state $`|j`$ defined by Eq. (2).
2. Bob performs the measurement described by POVM $`\{F_\mu \}(\mu =0,1,\overline{0},\overline{1},\mathrm{V})`$ defined by Eq. (4).
3. If the measurement result was $`\mu =\overline{1}`$, Bob sets the received bit value as $`j^{}=0`$, and if $`\mu =\overline{0}`$, he sets $`j^{}=1`$. In both cases, Bob tells Alice over the public channel that the result was conclusive, and Alice adopts $`j`$ and Bob adopts $`j^{}`$ as a bit value of their raw keys, respectively. If the measurement result was $`\mu =0,1,`$ or $`\mathrm{V}`$, Bob opens the result $`\mu `$, and Alice opens the bit value $`j`$ in the cases $`\mu =0,1`$.
4. Alice and Bob repeat steps 1–3 $`n_{\mathrm{total}}`$ times and obtain their raw keys.
5. Error reconciliation: To make an identical key (the reconciled key) from their raw keys, Alice and Bob perform an error correction protocol. The reconciled key consists of “correct bits” which were found to be correct and “flipped bits” which were found to be incorrect and hence flipped in the error correction protocol. In order not to leak the additional information about the final key to Eve, a previously shared secret key is used to encrypt the communication over the public channel. A small length of the secret key is also used to make sure that the reconciled key is identical, using an authentication protocol authen .
6. Estimation of Eve’s information: After the public communication about the inconclusive events in step 3 and the error reconciliation in step 5, Bob knows Alice’s original bit values for the cases where Bob’s measurement results were $`\mu =0,1,\overline{0},\overline{1}`$. He can determine the number of events $`n_{j,\mu }`$ $`(\mu =0,1,\overline{0},\overline{1};j=0,1)`$ where Alice’s choice was $`j`$ and Bob’s result was $`\mu `$. Assuming that $`n_{\mathrm{total}}`$ is large, $`2n_{j,\mu }/n_{\mathrm{total}}`$ gives a good estimate of the quantity $`\mathrm{Tr}(F_\mu \rho _j)`$. Bob estimates the maximum information that can be leaked to Eve under the condition

$$\mathrm{Tr}(F_\mu \rho _j)=2n_{j,\mu }/n_{\mathrm{total}}.$$
(5)
The estimation of Eve’s information gain is separately made for the correct bits and for the flipped bits.
7. Privacy Amplification: To eliminate the information leaked to Eve, Alice and Bob produce a secure final key by shortening the correct bits and flipped bits of reconciled key according to the information gains estimated in step 6 via a privacy amplification protocol.

The most important part in the quantum key distribution through a noisy channel is the estimation of the leaked information done in step 6. The detailed procedures in the proposed protocol above were chosen so as to make the estimation easier. First, we use not only the error rate in conclusive bits but also the measurement results of inconclusive bits to fix the density operator of the state delivered to Bob more tightly. Secondly, the optimization of Eve’s measurement on her probe system is simplified by estimating Eve’s information about correct bits and flipped bits independently. For the correct bits, the state of Eve’s probe when the bit value of the final key is $`0`$ is a pure state $`C_0\overline{1}|U|\mathrm{\hspace{0.17em}0}|w_\mathrm{E}|\varphi _0_\mathrm{E}`$, and the state when the bit value is $`1`$ is $`C_1\overline{0}|U|\mathrm{\hspace{0.17em}1}|w_\mathrm{E}|\varphi _1_\mathrm{E}`$, where $`C_0`$ and $`C_1`$ are the constants for normalization.

In our estimation of Eve’s information gain on each correct bit, we use the information gain $`\mathrm{I}`$ defined through the collision probability $`P(i|\nu )^2`$ averaged over possible Eve’s outcomes $`\nu `$. Here $`P(i|\nu )`$ is the posteriori probability that Alice’s bit value is $`i`$ (the state of Eve’s probe was $`|\varphi _i_\mathrm{E}`$) under the condition that Eve has obtained outcome $`\nu `$. The explicit definition of the information gain $`\mathrm{I}`$ is

$`\mathrm{I}1\left[\mathrm{log}_2{\displaystyle \underset{\mathrm{i}=0,1}{}}{\displaystyle \underset{\nu }{}}\mathrm{P}(\nu )\mathrm{P}(\mathrm{i}|\nu )^2\right],`$ (6)
where $`P(\nu )`$ is the probability that Eve obtains outcome $`\nu `$. This measure is useful since it directly tells us how much we should shorten the key in the privacy amplification esti ; privacy amp . The quantity $`\mathrm{I}`$ is maximized by the Von Neumann measurement on the basis symmetrically arranged around the vectors $`|\varphi _0_\mathrm{E}`$ and $`|\varphi _1_\mathrm{E}`$ slu ; opt-measure , and thus we obtain the maximum information gain for each correct bit $`\mathrm{I}^{\mathrm{Gc}}`$ which can be written as

$`\mathrm{I}^{\mathrm{Gc}}=\mathrm{log}_2\left(2|Q|^2\right),`$ (7)
where

$$Q{}_{\mathrm{E}}{}^{}\varphi _0|\varphi _1_{\mathrm{E}}^{}=\frac{{}_{\mathrm{E}}{}^{}w|0|U^{}|\overline{1}\overline{0}|U|1|w_{\mathrm{E}}^{}}{\sqrt{|{}_{\mathrm{E}}{}^{}w|0|U^{}|\overline{1}|^2}\sqrt{|\overline{0}|U|1|w_\mathrm{E}|^2}}.$$
(8)
Note that the same measurement also maximizes the information gain measured with respect to Shannon entropy opt-measure , and its maximum value $`\mathrm{I}_\mathrm{S}^{\mathrm{Gc}}`$ is given by

$$\mathrm{I}_\mathrm{S}^{\mathrm{Gc}}=1h\left(\frac{1\sqrt{1|Q|^2}}{2}\right),$$
(9)
where $`h(x)`$ is the entropy function defined as $`h(x)x\mathrm{log}_2x(1x)\mathrm{log}_2(1x)`$.

The maximum information gain $`\mathrm{I}^{\mathrm{Gf}}`$ for each flipped bit can be obtained by merely changing the definition of $`Q`$ with $`Q^{}{}_{\mathrm{E}}{}^{}\varphi _0^{}|\varphi _1^{}_{\mathrm{E}}^{}`$, where $`|\varphi _0^{}_\mathrm{E}C_0^{}\overline{0}|\mathrm{U}|\mathrm{\hspace{0.17em}0}|w_\mathrm{E}`$ and $`|\varphi _1^{}_\mathrm{E}C_1^{}\overline{1}|\mathrm{U}|\mathrm{\hspace{0.17em}1}|w_\mathrm{E}`$. The problem of finding the maxima of $`\mathrm{I}^{\mathrm{Gc}}`$ and $`\mathrm{I}^{\mathrm{Gf}}`$ reduces to finding the minimum of $`|Q|`$ or $`|Q^{}|`$, which will be solved in Sec. V.

In our analysis, we assume, for simplicity, an unrealistic assumption that Eve can deal correct bits and flipped bits independently, which may overestimate the amount of the leaked information. If we try to deal these together, we need to optimize Eve’s measurement in four dimensional Hilbert space, and the optimization would be more complicated. We leave the tight estimation of the leaked information in such cases to future investigations.

We have to be careful about leaked information during the error reconciliation protocol. The redundant information used in step 5 contains the partial information of the secret key. So, in order to prevent this leakage of information, redundancy bits are encrypted by previously shared secret key. On the other hand, since we assume Eve employs individual attack, in other words the events for different pulses are independent, the public communication concerned with inconclusive results in step 4 does not leak any information about the conclusive results, and so we need not to encrypt this communication.

## IV Symmetrization of Eve’s strategy

In this section, we consider the symmetrization of Eve’s strategy which simplifies our analysis, but never underestimates Eve’s ability. The discussion can be similarly applied to the flipped bits.

The eavesdropping strategy of Eve, specified by the unitary operator $`U`$, gives the information gain about the correct bits of the final key that is determined through the quantity $`Q(U)`$ defined by Eq. (8). It also determines the density operators $`\rho _j`$ ($`j=0,1`$) of the states delivered to Bob as follows,

$$\rho _j=\mathrm{Tr}_\mathrm{E}[U|j|w_\mathrm{E}_\mathrm{E}w|j|U^{}].$$
(10)
On the other hand, these density matrices must satisfy Eq. (5). The problem to be solved is to find the minimum value of $`|Q|`$ under the constraint Eq. (5).

A standard way of symmetrization would be to replace the transformation $`U`$ to an operation with higher symmetry $`\stackrel{~}{U}`$, such that Eqs. (5) and (10) still hold, and $`|Q(U)||Q(\stackrel{~}{U})|`$ holds. Then, Eve’s information gain can be estimated by minimization of $`|Q|`$ over possible $`\stackrel{~}{U}`$ without fear of underestimation.

Instead of using such a standard scheme, here we invoke a transformation $`UU^\mathrm{s}`$ with $`|Q(U)||Q(U^\mathrm{s})|`$, but Eqs. (5) and (10) with $`U`$ replaced by $`U^\mathrm{s}`$ are not necessarily satisfied. The transformation $`UU^\mathrm{s}`$ is explained in Appendix A. The states that would be received by Bob when Eve performed $`U^\mathrm{s}`$ are given by

$$\rho _j^\mathrm{s}=\mathrm{Tr}_\mathrm{E}[U^\mathrm{s}|j|w_\mathrm{E}_\mathrm{E}w|j|(U^\mathrm{s})^{}].$$
(11)
Due to the symmetry of $`U^\mathrm{s}`$, these states are simply parametrized by $`\{\theta ,ϵ,T\}`$ as follows:

$`\rho _0^\mathrm{s}`$ $`=`$ $`T\left(1{\displaystyle \frac{ϵ}{2}}\right)|\sigma _{(\alpha +\theta )}\sigma _{(\alpha +\theta )}|`$
$`+`$ $`T{\displaystyle \frac{ϵ}{2}}|\overline{\sigma _{(\alpha +\theta )}}\overline{\sigma _{(\alpha +\theta )}}|+(1T)|\mathrm{vac}\mathrm{vac}|,`$
and

$`\rho _1^\mathrm{s}`$ $`=`$ $`T\left(1{\displaystyle \frac{ϵ}{2}}\right)|\sigma _{(\alpha +\theta )}\sigma _{(\alpha +\theta )}|`$ (13)
$`+`$ $`T{\displaystyle \frac{ϵ}{2}}|\overline{\sigma _{(\alpha +\theta )}}\overline{\sigma _{(\alpha +\theta )}}|+(1T)|\mathrm{vac}\mathrm{vac}|,`$
where $`|\mathrm{vac}`$ is the vacuum state. These density matrices are shown in Fig. 4. An important point is that the states $`\rho _j^\mathrm{s}`$ are related to $`\rho _j`$ as in Eqs. (79)–(83), and hence, the parameters $`\{\theta ,ϵ,T\}`$ should be related to the actually observed quantities as follows:

$`(1ϵ)\mathrm{cos}\theta =\mathrm{Tr}[(F_0F_{\overline{0}})\rho _0^\mathrm{s}]`$
$`={\displaystyle \frac{1}{2}}(\mathrm{Tr}[(F_0F_{\overline{0}})\rho _0]+\mathrm{Tr}[(F_1F_{\overline{1}})\rho _1])`$
$`=(n_{0,0}n_{0,\overline{0}}+n_{1,1}n_{1,\overline{1}})/n_{\mathrm{total}}`$ (14)
$`(1ϵ)\mathrm{cos}(\theta +2\alpha )=\mathrm{Tr}[(F_1F_{\overline{1}})\rho _0^\mathrm{s}]`$
$`={\displaystyle \frac{1}{2}}(\mathrm{Tr}[(F_1F_{\overline{1}})\rho _0]+\mathrm{Tr}[(F_0F_{\overline{0}})\rho _1])`$
$`=(n_{0,1}n_{0,\overline{1}}+n_{1,0}n_{1,\overline{0}})/n_{\mathrm{total}}`$ (15)
and

$`T=1\mathrm{Tr}[F_\mathrm{V}(\rho _0+\rho _1)/2]`$
$`={\displaystyle \underset{j=0,1}{}}{\displaystyle \underset{\mu =0,1,\overline{0},\overline{1}}{}}n_{j,\mu }/n_{\mathrm{total}}.`$ (16)
Eqs. (LABEL:den1)-(16) imply that the density operators $`\rho _0^\mathrm{s}`$ and $`\rho _1^\mathrm{s}`$ can be completely specified by Bob through the observed quantities.

The above argument is summarized as follows. Suppose that Eve conducted a strategy $`U`$ and Bob obtained the values of $`\{\theta ,ϵ,T\}`$ through the observed quatities and relations (14)-(16). The states $`\rho _j^\mathrm{s}`$ is determined by Eqs. (LABEL:den1) and (13). Then, there exists an attack with unitary operator $`U^\mathrm{s}`$ satisfying Eq.(11) and $`|Q(U)||Q(U^\mathrm{s})|`$. Hence, the minimum of $`|Q(U)|`$ can be safely estimated by the minimization of $`|Q(U^\mathrm{s})|`$ under the condition that $`U^\mathrm{s}`$ satisfies Eq.(11).

Let us further reduce the minimization problem in a convenient form. Using Schmidt decomposition, Eqs. (LABEL:den1) and (13) lead to the expressions of the total pure states

$`U^\mathrm{s}|\mathrm{\hspace{0.17em}0}|w_\mathrm{E}`$ $`=`$ $`\sqrt{T\left(1{\displaystyle \frac{ϵ}{2}}\right)}|\sigma _{(\alpha +\theta )}|a_1_\mathrm{E}`$ (17)
$`+`$ $`\sqrt{T{\displaystyle \frac{ϵ}{2}}}|\overline{\sigma _{(\alpha +\theta )}}|a_2_\mathrm{E}`$
$`+`$ $`\sqrt{1T}|\mathrm{vac}|a_\mathrm{v}_\mathrm{E},`$
and

$`U^\mathrm{s}|\mathrm{\hspace{0.17em}1}|w_\mathrm{E}`$ $`=`$ $`\sqrt{T\left(1{\displaystyle \frac{ϵ}{2}}\right)}|\sigma _{(\alpha +\theta )}|b_1_\mathrm{E}`$ (18)
$`+`$ $`\sqrt{T{\displaystyle \frac{ϵ}{2}}}|\overline{\sigma _{(\alpha +\theta )}}|b_2_\mathrm{E}`$
$`+`$ $`\sqrt{1T}|\mathrm{vac}|b_\mathrm{v}_\mathrm{E},`$
where $`|a_i_\mathrm{E}`$ and $`|b_i_\mathrm{E}(i=1,2)`$ are orthogonal to the space spanned by $`|a_\mathrm{v}_\mathrm{E}`$ and $`|b_\mathrm{v}_\mathrm{E}`$, since Eve knows the photon number in this strategy. $`|a_i_\mathrm{E}`$ and $`|b_i_\mathrm{E}(i=1,2)`$ satisfy

$${}_{\mathrm{E}}{}^{}a_i|a_j_{\mathrm{E}}^{}=\delta _{i,j},_\mathrm{E}b_i|b_j_\mathrm{E}=\delta _{i,j},$$
(19)
and hence connected by a unitary operator $`\widehat{\xi }`$, namely,

$$|b_i_\mathrm{E}=\widehat{\xi }|a_i_\mathrm{E}.$$
(20)
By applying the discussion in Appendix A, the unitary operator $`\widehat{\xi }`$ is a real orthogonal matrix in the basis $`\mathrm{W}`$, since $`U^\mathrm{s}`$, $`|\sigma _\phi `$, $`|\overline{\sigma _\phi }`$, $`|\mathrm{vac}`$, and $`|w`$ are invariant under $`Z_\mathrm{W}`$.

The condition for $`U^\mathrm{s}`$ to be unitary can be written as

$${}_{\mathrm{E}}{}^{}w|0|(U^\mathrm{s})^{}U^\mathrm{s}|\mathrm{\hspace{0.17em}1}|w_{\mathrm{E}}^{}=0|1,$$
(21)
which means

$$T\mathrm{Tr}\left[\widehat{B}\widehat{\xi }\right]+(1T)\mathrm{cos}\varphi =\mathrm{cos}\alpha ^{},$$
(22)
where

$`\mathrm{cos}\varphi `$ $`=`$ $`{}_{\mathrm{E}}{}^{}a_\mathrm{v}|b_\mathrm{v}_{\mathrm{E}}^{},`$ (23)
$`\widehat{B}`$ $`=`$ $`{\displaystyle \underset{i,j}{}}B_{ij}|a_i_\mathrm{E}_\mathrm{E}a_j|,`$ (24)
$`B_{11}`$ $`=`$ $`\left(1{\displaystyle \frac{ϵ}{2}}\right)\mathrm{cos}\left(\alpha +\theta \right),`$ (25)
$`B_{12}`$ $`=`$ $`B_{21}=\sqrt{\left(1{\displaystyle \frac{ϵ}{2}}\right){\displaystyle \frac{ϵ}{2}}}\mathrm{sin}\left(\alpha +\theta \right),`$ (26)
and

$`B_{22}={\displaystyle \frac{ϵ}{2}}\mathrm{cos}\left(\alpha +\theta \right).`$ (28)
Note that for arbitrary $`\varphi `$ and arbitrary real orthogonal matrix $`\widehat{\xi }`$ satisfying Eq. (22), there exists a corresponding unitary operator $`U^\mathrm{s}`$.

Using $`\widehat{\xi }`$ and Eq. (8), $`Q(U^\mathrm{s})`$ can be written as a function of $`\widehat{\xi }`$ as

$$Q(\widehat{\xi })=\mathrm{Tr}\left[\widehat{A}\widehat{\xi }\right]$$
(29)
where

$`\widehat{A}`$ $`=`$ $`{\displaystyle \underset{i,j}{}}A_{ij}|a_i_\mathrm{E}_\mathrm{E}a_j|,`$ (30)
$`A_{11}`$ $`=`$ $`{\displaystyle \frac{\left(2ϵ\right)\mathrm{sin}^2\left(\alpha +\frac{\theta }{2}\right)}{\left[1(1ϵ)\mathrm{cos}(2\alpha +\theta )\right]}},`$ (31)
$`A_{12}`$ $`=`$ $`A_{21}={\displaystyle \frac{\sqrt{ϵ\left(2ϵ\right)}\mathrm{sin}\left(2\alpha +\theta \right)}{2\left[1(1ϵ)\mathrm{cos}(2\alpha +\theta )\right]}},`$ (32)
and

$`A_{22}={\displaystyle \frac{ϵ\mathrm{cos}^2\left(\alpha +\frac{\theta }{2}\right)}{\left[1(1ϵ)\mathrm{cos}(2\alpha +\theta )\right]}}.`$ (33)
Therefore, the problem of finding the minimum of $`|Q(U)|`$ reduces to the problem of finding the minimum of $`|Q(\widehat{\xi })|`$ under the constraint

$$\left|T\mathrm{Tr}\left[\widehat{B}\widehat{\xi }\right]\mathrm{cos}\alpha ^{}\right|1T.$$
(34)
## V Optimization of Eve’s apparatus and her information gain

In this section, we determine the minimum of $`|Q(\widehat{\xi })|`$ under the constraint Eq. (34). It is convenient to introduce a function $`Q_{\mathrm{min}}(B)`$ which is defined as the minimum of $`|Q(\widehat{\xi })|`$ under the condition

$$B(\widehat{\xi })\mathrm{Tr}\left[\widehat{B}\widehat{\xi }\right]=B$$
(35)
for $`B_{\mathrm{max}}BB_{\mathrm{max}}`$, where $`B_{\mathrm{max}}`$ is the maximum of $`\mathrm{Tr}[\widehat{B}\widehat{\xi }]`$ over all $`\widehat{\xi }`$ for a given $`\widehat{B}`$. Since $`B_{11}B_{22}B_{12}^20`$, $`B_{\mathrm{max}}`$ is given by

$$B_{\mathrm{max}}^2=(B_{11}B_{22})^2+4B_{12}^2.$$
(36)
Note that the relations $`B(\widehat{\xi })=B(\widehat{\xi })`$ and $`|Q(\widehat{\xi })|=|Q(\widehat{\xi })|`$ imply that $`Q_{\mathrm{min}}(B)=Q_{\mathrm{min}}(B)`$. Several properties of $`Q_{\mathrm{min}}(B)`$ are derived from the fact that $`Q_{\mathrm{min}}(\mathrm{cos}\alpha ^{})`$ is equal to the minimum of $`|Q(\widehat{\xi })|`$ under the constraint Eq. (34) when $`T=1`$. Since Eve can freely determine the bit value $`j`$ when $`\mathrm{cos}\alpha ^{}=0`$, we have $`Q_{\mathrm{min}}(0)=0`$. Moreover, since Eve can always convert the initial states $`|j`$ to $`|j^{}`$ such that $`1^{}|0^{}\mathrm{cos}\alpha ^{}`$, $`Q_{\mathrm{min}}(B)`$ is a never-decreasing continuous function for $`B0`$. Therefore, $`Q_{\mathrm{min}}(B)=0`$ in a range $`|B|B_0`$, and $`Q_{\mathrm{min}}(B)>0`$ for $`B_0<|B|B_{\mathrm{max}}`$. The minimum of $`|Q(\widehat{\xi })|`$ under the constraint Eq. (34) is given by

$$\mathrm{min}|Q|=0\mathrm{when}\frac{\mathrm{cos}\alpha ^{}(1T)}{T}B_0$$
(37)
and

$`\mathrm{min}|Q|=Q_{\mathrm{min}}\left({\displaystyle \frac{\mathrm{cos}\alpha ^{}(1T)}{T}}\right)`$
$`\mathrm{when}{\displaystyle \frac{\mathrm{cos}\alpha ^{}(1T)}{T}}>B_0.`$ (38)
As we discuss the detail in Appendix B, in order to minimize $`|Q|`$, operator $`\widehat{\xi }`$ must satisfy

$$[(\nu \widehat{A}\lambda \widehat{B})^2,\widehat{\xi }]=0.$$
(39)
where $`\nu `$ and $`\lambda `$ are real parameters which satisfy \[$`(\nu ,\lambda )(0,0)`$\].

The form of operator $`\widehat{\xi }`$ satisfying this condition depends on the rank of $`\nu \widehat{A}\lambda \widehat{B}`$. For the moment, we assume that $`ϵ0`$. Since the rank of $`\widehat{A}`$ is $`1`$ and that of $`\widehat{B}`$ is $`2`$, the rank of $`\nu \widehat{A}\lambda \widehat{B}`$ is $`1`$ or $`2`$.

First, we consider the case where the rank of $`\nu \widehat{A}\lambda \widehat{B}`$ is $`2`$. Let $`H_0`$ be the subspace spanned by $`|a_1_\mathrm{E}`$ and $`|a_2_\mathrm{E}`$, which is the support of $`\nu \widehat{A}\lambda \widehat{B}`$, and $`H_0^{}`$ be the complementary space of $`H_0`$. Let $`\widehat{P}_{H_0}`$ and $`\widehat{P}_{H_0^{}}`$ be the projection operators to the corresponding subspaces. $`\widehat{P}_{H_0}[(\nu \widehat{A}\lambda \widehat{B})^2,\widehat{\xi }]\widehat{P}_{H_0}^{}=0`$ implies that $`\widehat{\xi }|a_1_\mathrm{E}H_0`$ and $`\widehat{\xi }|a_2_\mathrm{E}H_0`$. Hence the matrix form of $`\widehat{\xi }`$ in $`H_0`$ with respect to the basis $`\{|a_1_\mathrm{E},|a_2_\mathrm{E}\}`$ should be written as

$$\widehat{\xi }=\left(\begin{array}{cc}\mathrm{cos}\eta & \mathrm{sin}\eta \\ \mathrm{sin}\eta & \mathrm{cos}\eta \end{array}\right),$$
(40)
which we call Type 1, or

$$\widehat{\xi }=\left(\begin{array}{cc}\mathrm{cos}\eta & \mathrm{sin}\eta \\ \mathrm{sin}\eta & \mathrm{cos}\eta \end{array}\right),$$
(41)
which we call Type 2. With the help of Eq.(29), $`Q(\widehat{\xi })`$ and $`B(\widehat{\xi })`$ for Type 1 are given by functions of parameter $`\eta `$ as

$$Q^{(1)}(\eta )=(A_{11}A_{22})\mathrm{cos}\eta +2A_{12}\mathrm{sin}\eta $$
(42)
and from Eq.(35)

$$B^{(1)}(\eta )=(B_{11}B_{22})\mathrm{cos}\eta +2B_{12}\mathrm{sin}\eta ,$$
(43)
respectively. Similarly, for Type 2, we have

$$Q^{(2)}(\eta )=(A_{11}+A_{22})\mathrm{cos}\eta =\mathrm{cos}\eta $$
(44)
and

$`B^{(2)}(\eta )`$ $`=`$ $`(B_{11}+B_{22})\mathrm{cos}\eta `$ (45)
$`=`$ $`(1ϵ)\mathrm{cos}(\alpha +\theta )\mathrm{cos}\eta .`$
$`|Q^{(1)}|`$ and $`|Q^{(2)}|`$ are plotted in Fig. 5 by solid line and dot-dashed line respectively. Note that the choice of $`\widehat{\xi }`$

$`\widehat{\xi }|a_1_\mathrm{E}=\mathrm{cos}\eta |a_1_\mathrm{E}+\mathrm{sin}\eta |a_3_\mathrm{E}`$
$`\widehat{\xi }|a_2_\mathrm{E}=\mathrm{cos}\eta |a_2_\mathrm{E}\mathrm{sin}\eta |a_4_\mathrm{E}`$ (46)
where $`|a_3_\mathrm{E}`$ and $`|a_4_\mathrm{E}`$ are the states orthogonal to $`H_0`$ and $`{}_{\mathrm{E}}{}^{}a_3|a_4_{\mathrm{E}}^{}=0`$, yields the same dependence of $`Q`$ and $`B`$ on $`\eta `$ as Type 2. When $`|\mathrm{cos}\eta |1`$, this $`\widehat{\xi }`$ does not satisfy Eq. (39), which means that $`|Q^{(2)}(\widehat{\eta })|`$ cannot be the minimum of $`|Q(\widehat{\xi })|`$. When $`|\mathrm{cos}\eta |=1`$, $`|Q^{(2)}(\widehat{\eta })|`$ is unity from Eq.(29). Therefore, we can neglect $`|Q^{(2)}|`$ in determining $`Q_{\mathrm{min}}(B)`$.

Next, we consider the case when the rank of $`\nu \widehat{A}\lambda \widehat{B}`$ is $`1`$. Solving $`det(\nu \widehat{A}\lambda \widehat{B})=0`$ in $`H_0`$, we find that this case happens when $`\lambda =0`$ \[since det$`\widehat{A}=0`$ from Eqs. (31)-(33)\], or

$$\frac{\lambda }{\nu }=\frac{A_{11}B_{22}+A_{22}B_{11}2A_{12}B_{12}}{B_{11}B_{22}B_{12}^2}\kappa .$$
(47)
The support of $`\nu \widehat{A}\lambda \widehat{B}`$ is one-dimensional and let us write the corresponding pure state as $`|a_\mathrm{E}H_0`$. Let $`|a^{}_\mathrm{E}H_0`$ be the state orthogonal to $`|a_\mathrm{E}`$. Using the same way as the derivation of Eqs. (40) and (41), Eq. (39) implies that the matrix form of $`\widehat{\xi }`$ in $`H_0`$ with respect to the basis $`\{|a_\mathrm{E},|a^{}_\mathrm{E}\}`$ should generally be written as

$$\widehat{\xi }=\pm \left(\begin{array}{cc}1& 0\\ 0& \mathrm{cos}\eta \end{array}\right).$$
(48)
When $`\lambda =0`$, $`|Q(\widehat{\xi })|`$ is always unity (from Eq.(29)), and is not relevant for the present problem of finding the minimum of $`|Q(\widehat{\xi })|`$. The case $`\lambda =\kappa \nu `$ is relevant, and we call it Type 3. With the help of Eq.(29), $`Q(\widehat{\xi })`$ and $`B(\widehat{\xi })`$ for Type 3 are given by functions of parameter $`\eta `$ as

$`Q^{(3,\pm )}(\eta )`$ $`=`$ $`\pm [_\mathrm{E}a|\widehat{A}|a_\mathrm{E}+\mathrm{cos}\eta _\mathrm{E}a^{}|\widehat{A}|a^{}_\mathrm{E}]`$ (49)
$`=`$ $`\pm [\mathrm{Tr}(\widehat{A}\widehat{P}_a)(1\mathrm{cos}\eta )+\mathrm{cos}\eta ]`$
and from Eq.(35)

$`B^{(3,\pm )}(\eta )`$ $`=`$ $`\pm [_\mathrm{E}a|\widehat{B}|a_\mathrm{E}+\mathrm{cos}\eta _\mathrm{E}a^{}|\widehat{B}|a^{}_\mathrm{E}]`$ (50)
$`=`$ $`\pm [\mathrm{Tr}(\widehat{B}\widehat{P}_a)(1\mathrm{cos}\eta )+\mathrm{cos}\eta \mathrm{Tr}(\widehat{B})]`$
respectively, where

$$\widehat{P}_a|a_\mathrm{E}_\mathrm{E}a|=\frac{\widehat{A}\kappa \widehat{B}}{\mathrm{Tr}(\widehat{A}\kappa \widehat{B})}.$$
(51)
$`|Q^{(3,\pm )}|`$ is plotted in Fig. 5 by dotted line. In the figure, only $`|Q^{(3,)}|`$ is plotted since $`|Q^{(3,+)}|`$ does not exist.

Finally, we consider the case where $`ϵ=0`$. In this case, $`Q_{\mathrm{min}}(B)`$ can be directly found as

$$Q(B)=\frac{B}{\mathrm{cos}(\alpha +\theta )},$$
(52)
and $`B_0=0`$.

Now, since we have listed up all candidates for Eve’s optimum operation, we can obtain Eve’s maximum information gain by picking up the optimum one numerically. We show some examples of Eve’s information gain as a function of $`\alpha ^{}`$, $`\alpha `$, $`T`$, $`\theta `$, and $`ϵ`$ in Fig. 6 and Fig. 7. In these figures, we plot Eve’s maximum information gain as a function of $`ϵ`$. Since the parameter $`ϵ`$ corresponds to the noise or the error rate, it might be expected that Eve’s information gain increases when $`ϵ`$ gets larger. In Fig. 7, however, Eve’s information gain starts to decrease from the unity when the noise parameter $`ϵ`$ exceeds a value around $`0.13`$. In Fig. 8, the shaded region represents the region where Eve’s information gain is unity when (a) $`\alpha ^{}=\alpha =10^{}`$, and $`\theta =0^{}`$, and (b) $`\alpha ^{}=\alpha =45^{}`$ and $`\theta =0^{}`$. We can see again in Fig. 8 (b) the counter-intuitive behavior that the Eve’s information gain is lower in the region with larger $`ϵ`$.

In order to explain the counter-intuitive behavior in Fig. 7, let us consider the mutual information among the classical variables in Alice, Bob and Eve’s sites. Let $`A`$, $`B`$, and $`E`$ be the random variables describing Alice’s bit value (0 or 1), Bob’s measurement result ($`\overline{0}`$, $`\overline{1}`$, or inconclusive), and Eve’s classical data obtained from her attack, respectively. Let us consider the conditional mutual information $`\mathrm{I}(\mathrm{E};\mathrm{A},\mathrm{B}|\mathrm{c})H(A,B|\mathrm{c})H(A,B|E,\mathrm{c})`$, which is the mutual information between Eve and the joint system of Alice and Bob for conclusive bits. Here $`c`$ represents the condition that $`B=\overline{0}`$ or $`\overline{1}`$, meaning that Bob’s measurement result is conclusive. The function $`H(A,B|\mathrm{c})`$ represents the entropy of the joint system on condition that Bob obtains a conclusive result, and $`H(A,B|E,\mathrm{c})`$ stands for the conditional entropy of the joint system averaged over Eve’s variable $`E`$, namely, $`H(A,B|E,\mathrm{c})_y\mathrm{Prob}(E=y)H(A,B|E=y,\mathrm{c})`$. Using the basic properties of the entropy function, we can easily see that the following relation holds:

$$\mathrm{I}(\mathrm{E};\mathrm{A},\mathrm{B}|\mathrm{c})+\mathrm{I}(\mathrm{A};\mathrm{B}|\mathrm{c})=\mathrm{I}(\mathrm{A};\mathrm{B},\mathrm{E}|\mathrm{c})+\mathrm{I}(\mathrm{B};\mathrm{E}|\mathrm{c}).$$
(53)
The information $`\mathrm{I}(\mathrm{E};\mathrm{A},\mathrm{B}|\mathrm{c})`$ is, hence, bounded as follows:

$$\mathrm{I}(\mathrm{E};\mathrm{A},\mathrm{B}|\mathrm{c})\mathrm{I}(\mathrm{A};\mathrm{B},\mathrm{E}|\mathrm{c})+\mathrm{I}(\mathrm{B};\mathrm{E}|\mathrm{c}).$$
(54)
The term $`\mathrm{I}(\mathrm{A};\mathrm{B},\mathrm{E}|\mathrm{c})`$ in the right-hand side means how well the joint system of Bob and Eve can distinguish Alice’s states on condition that Bob obtains a conclusive result, and this term can be bounded from the fact that Alice’s states are nonorthogonal, as follows. With the help of the inequality

$$\mathrm{I}(\mathrm{A};\mathrm{B},\mathrm{E})P_{\mathrm{conc}}\mathrm{I}(\mathrm{A};\mathrm{B},\mathrm{E}|\mathrm{c})+(1P_{\mathrm{conc}})\mathrm{I}(\mathrm{A};\mathrm{B},\mathrm{E}|\mathrm{inc}),$$
(55)
where “$`\mathrm{inc}`$” means $`B=\mathrm{inconclusive}`$ and $`P_{\mathrm{conc}}`$ is the probability that Bob obtains the conclusive results. For $`\theta =0`$ and $`\alpha ^{}=\alpha `$, $`P_{\mathrm{conc}}`$ is given by

$$P_{\mathrm{conc}}=\frac{T}{4}\left[2(1ϵ)(\mathrm{cos}2\alpha +1)\right],$$
(56)
we can bound $`\mathrm{I}(\mathrm{A};\mathrm{B},\mathrm{E}|\mathrm{c})`$ as

$$\mathrm{I}(\mathrm{A};\mathrm{B},\mathrm{E}|\mathrm{c})\frac{\mathrm{I}(\mathrm{A};\mathrm{B},\mathrm{E})}{P_{\mathrm{conc}}}\frac{1h\left(\frac{1\sqrt{1\mathrm{cos}^2\alpha }}{2}\right)}{P_{\mathrm{conc}}}.$$
(57)
The second inequality in Eq. (57) comes from the optimum measurement on two nonorthognal pure states, which was mentioned in Sec. III.

The second term $`\mathrm{I}(\mathrm{B};\mathrm{E}|\mathrm{c})`$ in the right-hand side of Eq.(54) means how well Eve can control Bob’s measurement outcomes, $`B=\overline{0}`$ and $`B=\overline{1}`$. Since Bob’s POVM elements $`F_{\overline{0}}`$ and $`F_{\overline{1}}`$ are nonorthogonal, Eve cannot control Bob’s outcome as she please, and $`\mathrm{I}(\mathrm{B};\mathrm{E}|\mathrm{c})`$ generally decreases as $`\alpha `$ decreases. As we discuss the detail in Appendix C, $`\mathrm{I}(\mathrm{B};\mathrm{E}|\mathrm{c})`$ is bounded by

$`\mathrm{I}(\mathrm{B};\mathrm{E}|\mathrm{c})1`$ (58)
$``$ $`h\left({\displaystyle \frac{1}{2}}{\displaystyle \frac{\mathrm{sin}\alpha }{4(P_{\mathrm{conc}}/T)}}\sqrt{1\left({\displaystyle \frac{2(P_{\mathrm{conc}}/T)1}{\mathrm{cos}\alpha }}\right)^2}\right).`$
Combining Eqs. (54), (57), and (58), the mutual information $`\mathrm{I}(\mathrm{E};\mathrm{A},\mathrm{B}|\mathrm{c})`$ is bounded by

$`\mathrm{I}(\mathrm{E};\mathrm{A},\mathrm{B}|\mathrm{c}){\displaystyle \frac{1h\left(\frac{1\sqrt{1\mathrm{cos}^2\alpha }}{2}\right)}{P_{\mathrm{conc}}}}`$ (59)
$`+`$ $`1h\left({\displaystyle \frac{1}{2}}{\displaystyle \frac{\mathrm{sin}\alpha }{4(P_{\mathrm{conc}}/T)}}\sqrt{1\left({\displaystyle \frac{2(P_{\mathrm{conc}}/T)1}{\mathrm{cos}\alpha }}\right)^2}\right)`$
$``$ $`\nu `$
After the transmission of $`n`$ pulses from Alice to Bob, we expect $`n_{\mathrm{conc}}nP_{\mathrm{conc}}`$ conclusive events on average, and Eve’s information about Alice and Bob’s bits for these events is bounded by $`nP_{\mathrm{conc}}\nu `$. This quantity approaches zero when $`\alpha `$ goes to zero. On the other hand, Alice and Bob obtain $`n_{\mathrm{cor}}nP_{\mathrm{conc}}(1e)`$ correct bits, where $`e`$ is the bit error rate given by

$$e=\frac{ϵ}{2(1ϵ)\left(\mathrm{cos}2\alpha +1\right)},$$
(60)
for $`\theta =0`$ and $`\alpha ^{}=\alpha `$. The number of correct bits $`n_{\mathrm{cor}}`$ does not necessarily approach zero when $`\alpha `$ goes to zero. The information gain per one correct bit, $`\mathrm{I}_\mathrm{S}^{\mathrm{Gc}}`$, cannot exceed $`n_{\mathrm{conc}}\nu /n_{\mathrm{cor}}`$, namely,

$$\mathrm{I}_\mathrm{S}^{\mathrm{Gc}}\frac{\nu }{1e}\mathrm{I}_\mathrm{S}^{\mathrm{upper}}.$$
(61)
Since Shannon information gain $`\mathrm{I}_\mathrm{S}^{\mathrm{Gc}}`$ \[Eq. (9)\] and the information gain $`\mathrm{I}^{\mathrm{Gc}}`$ \[Eq. (7)\] are connected by only one parameter $`Q`$, we can bound $`\mathrm{I}^{\mathrm{Gc}}`$ through $`\mathrm{I}_\mathrm{S}^{\mathrm{upper}}`$. In Fig. 7, we plot this information bound by the dashed line. The dashed line decreases as $`ϵ`$ gets larger.

To summarize, the counter-intuitive behavior can be explained as follows. When $`\alpha `$ is small, Alice’s bit value cannot be guessed well from the outside since she encodes it into nonorthogonal states. Bob’s measurement results are also hard to guess since they come from nonorthogonal measurements. As a result, the mutual information between Alice and Bob, $`\mathrm{I}(\mathrm{A};\mathrm{B}|\mathrm{c})`$, and Eve’s information $`\mathrm{I}(\mathrm{E};\mathrm{A},\mathrm{B}|\mathrm{c})`$, are both upper-bounded by the quantity $`\nu `$, which approaches zero when $`\alpha `$ goes to zero. On the other hand, when $`ϵ`$ is large, the number of the conclusive bits is not small even when $`\alpha `$ is close to zero. This means that Alice’s bits and Bob’s bits for the conclusive bits are almost uncorrelated when $`\alpha `$ is close to zero. Then, Alice and Bob construct the correct bits by picking up the bits whose values accidentally coincide, through the encrypted communication over the classical channel. In this case, the correct bits are essentially generated in this encrypted transmission, and Eve’s information gain about them is very low. It is, however, not practical to perform quantum key distribution in this region, since Alice and Bob must use many bits of the initially shared secret key to determine the correct bits.

Figure 9 shows in gray the region where Eve’s information gain is unity in the parameter region $`\{\alpha ,ϵ\}`$ for $`T=1,\theta =0,\alpha ^{}=\alpha `$. The upper-left white region (small $`\alpha `$ and large $`ϵ`$) corresponds to the counter-intuitive behavior we have just discussed. The figure shows another interesting behavior for small $`ϵ`$; Eve’s information gain is unity only when $`\alpha `$ is small or large, and is not unity for intermediate values of $`\alpha `$. For $`T<1`$, the region for the full information gain for Eve has a similar shape to Fig. 9, but is wider because the transmission loss gives advantage to Eve. In order to understand this behavior at $`T=1`$, we consider the following specific individual attack that gives Eve the perfect information about the correct bits.

If Eve is sure that the state $`|1(=|\sigma _\alpha )`$ released by Alice always evolves to $`|0(=|\sigma _\alpha )`$ and then reaches Bob, Eve can be sure that the value of the conclusive bit surviving the error discarding procedure is 0. The simplest way to perform this attack is to rotate the system counter-clockwise by angle $`2\alpha `$ in the Bloch sphere (see Fig. 1). To keep the symmetry, for half of the cases Eve rotates the system by angle $`2\alpha `$. For the latter cases she can be sure that the value of the correct bit is $`1`$. In this attack, the averaged state $`\rho _1^\mathrm{s}`$ received by Bob when Alice has emitted $`|1`$ is given by $`\rho _1^\mathrm{s}=(|\sigma _\alpha \sigma _\alpha |+|\sigma _{2\alpha }\sigma _{2\alpha }|)/2=\mathrm{cos}^2\alpha |\sigma _\alpha \sigma _\alpha |+\mathrm{sin}^2\alpha |\overline{\sigma _\alpha }\overline{\sigma _\alpha }|`$. This attack is thus successful when $`ϵ=2\mathrm{sin}^2\alpha `$, which coincides with the upper boundary in Fig. 9.

The above “rotating” strategy can be improved by performing a weak measurement before the rotation, so that it can be used for smaller values of $`ϵ`$. The weak measurement with outcomes $`\{+,\}`$ is described by the POVM $`\{\widehat{A}_+,\widehat{A}_{}\}`$, where

$$\widehat{A}_+=(1q)|x+x+|+q|xx|$$
(62)
and

$$\widehat{A}_{}=q|x+x+|+(1q)|xx|.$$
(63)
The parameter $`q`$ $`(0q1/2)`$ represents the weakness of the measurement. If Alice has emitted $`|j`$ $`(j=0,1)`$, the outcome “$`+`$” and “$``$” occur with probability $`p_{j+}j|\widehat{A}_+|j`$ and $`P_jj|\widehat{A}_{}|j`$, respectively. When this weak (projection) measurement produced outcome “$`+`$”, the angle $`\beta `$ (in the Bloch sphere) between the postmeasurement states $`\sqrt{\widehat{A}_+}|0`$ and $`\sqrt{\widehat{A}_+}|1`$ is given by

$$\mathrm{cos}^2(\beta /2)=|0|\widehat{A}_+|1|^2/(p_{0+}p_{1+}).$$
(64)
The outcome “$``$” gives the same angle by the symmetry. The angle $`\beta `$ is monotone increasing from $`0`$ to $`2\alpha `$ as a function of $`q[0,1/2]`$.

After this measurement, Eve rotates the system depending on the outcome. For “$`+`$”, she rotates it so that $`\sqrt{\widehat{A}_+}|0`$ becomes $`|1`$. The state $`\sqrt{\widehat{A}_+}|1`$ moves to $`|\sigma _{\alpha +\beta }`$ in this rotation. When the outcome is “$``$”, she rotates it so that $`\sqrt{\widehat{A}_+}|1`$ becomes $`|0`$. In this attack, the averaged state $`\rho _1^\mathrm{s}`$ received by Bob when Alice has emitted $`|1`$ is given by $`\rho _1^\mathrm{s}=p_1|\sigma _\alpha \sigma _\alpha |+p_{1+}|\sigma _{\alpha +\beta }\sigma _{\alpha +\beta }|`$. This state can be written in the form $`(1ϵ/2)|\sigma _\alpha \sigma _\alpha |+(ϵ/2)|\overline{\sigma _\alpha }\overline{\sigma _\alpha }|`$ when

$$\mathrm{sin}\beta /\mathrm{sin}2\alpha =p_1/p_{1+}$$
(65)
holds. In such a case, the value of $`ϵ`$ is given by

$$ϵ=1\frac{\mathrm{sin}(2\alpha +\beta )}{\mathrm{sin}2\alpha +\mathrm{sin}\beta }.$$
(66)
The equation (65) has two solutions in $`q[0,1/2]`$, $`q=q_0(\alpha )`$ and $`q=1/2`$. The case of $`q=1/2`$ corresponds to the simple rotating strategy described before. The strategy corresponding to the other solution $`q=q_0(\alpha )`$ turns out to give the lower boundary in Fig. 9. The entire gray region in Fig. 9 is then covered by simply mixing the two strategies corresponding to $`q=q_0(\alpha )`$ and $`q=1/2`$.

The behavior for small $`ϵ`$ shown in Fig. 9 will now be understood as follows. When $`\alpha `$ is small, the simple rotating strategy with the small rotation angle $`2\alpha `$ causes only a small disturbance, and it can be used to obtain small $`ϵ`$. When $`\alpha `$ is large and the two states can be well distinguished, the improvement of the strategy by the measurement is quite effective to reduce $`ϵ`$. For intermediate values of $`\alpha `$, $`p_{0+}/p_{1+}`$ cannot be close to zero. Since $`p_{0+}=p_1`$, the angle $`\beta `$ cannot be close to zero either, due to the constraint (65). Consequently, as is implied by Eq. (66), even the improved strategy cannot reduce $`ϵ`$ close to zero.

## VI Secret Key Gain

In this section, we show the calculation of secret key gain and the optimum angle of Alice’s states to obtain optimum secret key gain. For simplicity, we assume that $`\alpha =\alpha ^{}`$ and $`\theta =0`$. The calculation for more general cases is straghtforward.

We define the secret key gain $`G`$ as the net growth of the secret key per one pulse. Alice and Bob can increase the length of the secure secret key in the region where $`G`$ is positive.

In the calculation of key gain, we assume the error correction protocol whose number of redundancy bits used to detect the errors of the raw key are equal to the Shannon limit, i.e., $`nh(e)`$, where $`n`$ is the length of the raw key, $`e`$ is the bit error rate of the raw key given by Eq. (60), and $`h(e)`$ is entropy function. We further assume that the privacy amplification privacy amp  is applied to the correct bits and to the flipped bits independently. Since Eve may not be allowed to adopt the strategy that is simultaneously optimum both for correct bits and flipped bits, this protocol may be overkill but never underestimates Eve’s ability.

For the privacy amplification of the correct bits, we use Eve’s information estimated via the method described in the previous sections. From these bits Alice and Bob obtain $`G_c^{\mathrm{new}}`$ bits per pulse of new secret key, which is written as

$$G_c^{\mathrm{new}}P_{\mathrm{conc}}(1e)(1\mathrm{I}^{\mathrm{Gc}})(s_c/n_{\mathrm{total}})$$
(67)
where $`P_{\mathrm{conc}}`$ is given by Eq. (56), $`n_{\mathrm{total}}`$ is the number of pulses emitted by Alice, and $`s_c`$ is the security parameter for correct bits. Eve’s information about the secret key obtained from the correct bits is less than $`2^{s_c}/\mathrm{ln}2`$ (bits).

For flipped bits, Alice and Bob obtain $`G_f^{\mathrm{new}}`$ bits per pulse of new secret key, which is written as

$$G_f^{\mathrm{new}}P_{\mathrm{conc}}e(1\mathrm{I}^{\mathrm{Gf}})(s_f/n_{\mathrm{total}}).$$
(68)
Eve has information less than $`2^{s_f}/\mathrm{ln}2`$ (bits) about the secret key from the flipped bits. The information gain for flipped bits $`\mathrm{I}^{\mathrm{Gf}}`$ can directly be obtained by replacing $`\theta `$ with $`2\alpha \theta `$ in the formula in Sec. IV.

Noting that the redundancy bits used in the error correction protocol are encrypted by consuming $`P_{\mathrm{conc}}h(e)`$ bits per pulse of the initially shared secret key, we obtain the expression of the secret key gain $`G`$ as follows,

$`G`$ $``$ $`G_c^{\mathrm{new}}+G_f^{\mathrm{new}}P_{\mathrm{conc}}h(e)`$ (69)
$`=`$ $`P_{\mathrm{conc}}\left[(1e)(1\mathrm{I}^{\mathrm{Gc}})+e(1\mathrm{I}^{\mathrm{Gf}})h(e)\right]`$
$``$ $`(s_c+s_f)/n_{\mathrm{total}}.`$
In the limit of long key, i.e., $`n_{\mathrm{total}}\mathrm{}`$, $`G`$ is reduced to

$$G=P_{\mathrm{conc}}\left[(1e)(1\mathrm{I}^{\mathrm{Gc}})+e(1\mathrm{I}^{\mathrm{Gf}})h(e)\right].$$
(70)
In B92 protocol, if $`\alpha ^{}(=\alpha )`$ is changed, the secret key gain will be changed. So, Alice and Bob should optimize this angle to obtain higher secret key gain. In Fig. 10, we optimize $`\alpha ^{}(=\alpha )`$ for fixed values of $`T`$ and $`ϵ`$ gene  to obtain high secret key gain, and plot the key gain and the optimized angle as a function of $`ϵ`$. The points “A” and “B” represent the cases when $`ϵ=0`$ and when the key gain vanishes, respectively. In the figure, as $`ϵ`$ increases, the optimum angle tends to be smaller, and the region where optimum angle $`\alpha ^{}=0`$ implies that our protocol does not work. In the figure, there is only a negligible contribution of flipped bits to the key gain.

To investigate the $`T`$ dependence on the optimum angle which are represented as “A” and “B”, we plot these angles as a function of $`T`$ in Fig. 11. For “A”, the key gain has a simple expression

$$G=\frac{T}{4}(1\mathrm{cos}2\alpha ^{})\left[1\mathrm{log}_2\left(2\left(\frac{\mathrm{cos}\alpha ^{}1+T}{T\mathrm{cos}\alpha ^{}}\right)^2\right)\right].$$
(71)
In Fig. 11, it is seen that as $`T`$ gets larger, the optimum angle tends to get larger. In Fig. 12, we plot $`ϵ`$ of “B” as a function of $`T`$. The region below the curve means the parameter region of $`\{T,ϵ\}`$ where a secure key can be produced in our protocol.

Finally, to compare the security of B92 with that of BB84 assuming an ideal single-photon source, we consider the dependence of $`G`$ as a function of distance between Alice and Bob, while imperfection factors such as dark counting of detectors and losses of optical fibers are fixed. For the purpose of this comparison, we consider the case where Bob uses photon counters which can discriminate no photon, single-photon, and higher number of photons. Let $`l`$, $`L_c`$, $`L_r`$, $`\nu `$, and $`\eta `$ be the length of transmission line (km), the channel loss (dB/km), the receiver loss (dB), the mean dark count per pulse (which is given by $`\nu =\tau _{\mathrm{res}}R_{\mathrm{dark}}`$ where $`R_{\mathrm{dark}}`$ is the dark counting rate and $`\tau _{\mathrm{res}}`$ is the resolution time of the detector and electronic circuitry), and the detection efficiency, respectively. In this case, $`T`$ is given by barnett

$$T=\mathrm{e}^\nu \eta \mathrm{\hspace{0.17em}10}^{(lL_c+L_r)/10}+\mathrm{e}^\nu \nu (110^{(lL_c+L_r)/10}),$$
(72)
where we assume that the dark counts are Poissonian events. From this equation and

$`\stackrel{~}{\rho }_i^\mathrm{s}`$ $`=`$ $`{\displaystyle \frac{\mathrm{e}^\nu \eta \mathrm{\hspace{0.17em}10}^{(lL_c+L_r)/10}}{T}}|ii|`$ (73)
$`+`$ $`{\displaystyle \frac{\mathrm{e}^\nu \nu (110^{(lL_c+L_r)/10})}{T}}{\displaystyle \frac{\text{1}}{2}}`$
$`=`$ $`(1ϵ)|ii|+{\displaystyle \frac{ϵ}{2}}\text{1},`$
$`ϵ`$ can be written as

$$ϵ=\frac{\mathrm{e}^\nu \nu (110^{(lL_c+L_r)/10})}{T}.$$
(74)
In Fig. 13, we plot $`\mathrm{log}_{10}G`$ as a function of distance $`l`$(km). In the figure, we put $`\alpha (\alpha ^{})=11`$(degree) which is almost optimum, and experimental data is taken from KTH KTH . For the secret key gain of BB84 protocol in the figures, we used the formula for the single-photon case in norbert2 ,

$`G`$ $`=`$ $`{\displaystyle \frac{T}{2}}[1\mathrm{log}_2(1+4e4e^2)+e\mathrm{log}_2e`$ (75)
$`+`$ $`(1e)\mathrm{log}_2(1e)],`$
where $`e=\nu /(2T)`$, assuming that the errors stem from the dark counting. In Fig. 13, it is seen that B92 protocol is far less efficient, which is mainly because a low transmission rate $`T`$ directly gives an advantage to Eve in the B92 scheme using photon polarization.

## VII Summary and Discussion

Throughout this paper, we have estimated Eve’s information gain $`\mathrm{I}^{\mathrm{Gc}}`$. But as Bennett et al. pointed out in Sec. VI of privacy amp , if eavesdropping is independently done for each pulse, privacy amplification using information gain based on the expected collision probability is overkill. In such case, it follows that it may be sufficient to estimate Eve’s information gain by Shannon entropy. In the case where Eve employs the symmetric von Neumann measurement, the proof in privacy amp  assures that Shannon entropy is enough for the estimation. Maximizing Eve’s information gain with respect to Shannon entropy is equivalent to the problem of minimizing $`|Q|^2`$, which is the same problem as the maximization of Eve’s information gain $`\mathrm{I}^{\mathrm{Gc}}`$. So, our method described in the previous sections can be directly applied to this problem. We plot an example of the secret key gain for some cases when we estimate Eve’s maximum information gain by Shannon entropy in Fig. 14. We see that the key gain is higher than the case where Eve’s information is estimated by $`\mathrm{I}^{\mathrm{Gc}}`$.

Another candidate which may make the key gain higher is error reconciliation protocols. There may be the case where error discarding protocols error discarding  are more efficient than the error correction protocol, because the redundancy bits consumed in a discarding protocol may be less, for Alice and Bob do not need to keep the discarded bits secret in the error discarding protocol. In the calculation of all figures in Sec. VI, we have checked that there is no contribution of the flipped bits to the secret key, which implies that the use of an error discarding protocol may be more efficient than that of an error correction protocol.

Since the density matrices which Alice emits are fixed as well as those which are received by Bob, the problem of our estimation of quantum key distribution over a realistic channel is reduced to the problem that how much information Eve can extract on the condition that both initial density matrices $`\rho _i`$ ($`i=0,1`$) and final density matrices $`\rho _i^{}`$ are fixed. In the realistic situation, however, since the number of pulses $`n_{\mathrm{total}}`$ which are emitted by Alice is finite, we cannot uniquely identify the final density matrices. In such a situation, by considering the standard deviation of Bob’s data, we can pick up the candidates of the final density matrices, and we can estimate Eve’s maximum information gain by comparing information gain for each candidates.

To summarize this paper, we derived a formula that estimates Eve’s maximum information when Alice and Bob perform B92 protocol using two nonorthogonal single-photon polarization states. We have assumed that Alice can emit a single photon and Eve employs individual attack. The problem is equivalent to ask how much information can be extracted while simulating a noisy channel through which Alice communicates with Bob by sending the two nonorthogonal states. The dependence of the maximum information on the noise parameter shows nontrivial behavior. It decreases as the noise increases in some parameter regions. For a small noise rate, Eve can extract perfect information in the case where the angle of Alice’s two states is very small or very large, while she cannot extract perfect information for intermediate angles. Using the formula, we plot the secret key gain as a function of various parameters reflecting intervention by Eve. We also investigated the optimum angle between the two states to obtain large secret key gain, and showed the region of the parameters where this key gain is positive. A comparison of our protocol with BB84 protocol shows that B92 protocol with single photon polarization is less efficient than BB84 protocol, which is mainly because a low transmission rate $`T`$ directly gives an advantage to Eve in the B92 scheme using photon polarization. This drawback may be compensated in the original B92 protocol using two nonorthogonal coherent light, or in the 4+2 protocol imoto  that uses the switching of the basis as in BB84 while retaining the nonorthgonality as a freely adjustable parameter. We leave the security problems of such protocols to future studies.

We have assumed throughout this paper that eavesdropping is independent for each pulse. Even within the independent quantum operation, Eve can obtain a correlation among her eavesdropping outcomes by choosing her strategy depending on the outcomes which have been already obtained. The estimation against such attack is important for the realistic purpose, but we also leave this problem for future studies, along with the security against collective attack or coherent attack.

###### Acknowledgements.

This work was partly supported by a Grant-in-Aid for Encouragement of Young Scientists (Grant No. 12740243) and a Grant-in-Aid for Scientific Research (B) (Grant No. 12440111) by Japan Society of the Promotion of Science.

## Appendix A Symmetrization of Eve’s strategy

In this appendix, we construct a symmetrized strategy $`U^\mathrm{s}`$, which possesses higher symmetry and the same power as the actual strategy $`U`$, namely, $`|Q(U^\mathrm{s})|=|Q(U)|`$. The problem of minimizing $`|Q|`$ over possible $`U`$ is then simplified to the minimization over possible $`U^\mathrm{s}`$. Similar discussion is seen in Appendix A of slu . In addition to the symmetry, this reduction makes the analysis simpler because the states delivered to Bob by the strategy $`U^\mathrm{s}`$ are completely specified by the observed quantities.

First, consider a strategy $`U^{}`$ in which Eve conducts an additional (nondestructive) measurement of the photon number just after the original strategy of $`U`$ satisfying Eqs. (5) and (10). After this measurement, if the outcome of this measurement is one photon, she sends the projected state to Bob, but if the outcome is no photon or more than one photon, she always sends the vacuum state $`|\mathrm{vac}`$. The states $`\rho _j^{}(j=0,1)`$ delivered to Bob in this strategy are given by

$$\rho _j^{}=P_1\rho _jP_1+(1T_j)|\mathrm{vac}\mathrm{vac}|,$$
(76)
where $`P_1`$ is the projection onto the subspace $`H_1`$ of one photon and

$$T_j1\mathrm{Tr}[F_\mathrm{V}\rho _j],$$
(77)
which is the probability that Bob detects a single-photon. Since $`\mathrm{Tr}(F_\mu \rho _j^{})=\mathrm{Tr}(F_\mu \rho _j)`$ $`(\mu =0,1,\overline{0},\overline{1};j=0,1)`$, the strategy $`U^{}`$ satisfies the condition Eq. (5), and the additional measurement only gives Eve extra information, $`|Q(U^{})||Q(U)|`$ holds. Hence, in finding the minimum of $`|Q(U)|`$ under the condition Eq. (5), we are allowed to assume the additional assumption that $`\rho _j`$ is equal to $`\rho _j^{}`$ and is written as

$$\rho _j=T_j\stackrel{~}{\rho }_j+(1T_j)|\mathrm{vac}\mathrm{vac}|,$$
(78)
where $`\stackrel{~}{\rho }_jP_1\rho _jP_1/T_j`$ is a normalized density operator in $`H_1`$.

Next, take a basis of the signal space $`H`$ that includes $`|z+`$, $`|z`$, and $`|\mathrm{vac}`$ as elements, and take a basis of Eve’s probe space that includes $`|w`$. The product states of the two bases form a basis of the combined system, and let us denote it as $`\mathrm{W}`$. Let $`Z_\mathrm{W}`$ be the transformation which replaces all the vector components and the elements of matrices in the basis $`\mathrm{W}`$ with their complex conjugates. Since the initial states $`|j|w_\mathrm{E}(j=0,1)`$ and Bob’s measurement $`\{F_\mu \}`$ are invariant under the transformation $`Z_\mathrm{W}`$, and the probabilities of events in quantum mechanics are given by moduli squared of vector inner products, the strategy given by the unitary operator $`Z_\mathrm{W}UZ_\mathrm{W}^1`$ gives the same amount of the information gain to Eve as the strategy $`U`$.

Similarly, let $`\sigma _z|z+z+||zz|`$ be the $`\pi `$ rotation around the $`z`$ axis in the Bloch sphere, and $`R`$ be the extension of $`\sigma _z`$ to the entire space ($`R(\sigma _zF_\mathrm{V})1_\mathrm{E}`$, where subscript E means Eve’s probe space). Since the changes in the initial states $`|j|w_\mathrm{E}(j=0,1)`$ and Bob’s measurement $`\{F_\mu \}`$ under the transformation $`R`$ is just the interchange of the bit values $`0`$ and $`1`$, the strategy given by the unitary operator $`RUR^1`$ gives the same amount of the information gain to Eve as the strategy $`U`$.

Since the four strategies $`U`$, $`Z_\mathrm{W}UZ_\mathrm{W}^1`$, $`RUR^1`$, and $`RZ_\mathrm{W}UZ_\mathrm{W}^1R^1`$ give the same amount of information gain, the strategy in which Eve randomly chooses one of the four unitary operations also gives the same amount of information gain. In other words, if we write the unitary operator corresponding to this randomized strategy as $`U^\mathrm{s}`$, then $`|Q(U^\mathrm{s})|=|Q(U)|`$ holds. The states $`\rho _0^\mathrm{s}`$ and $`\rho _1^\mathrm{s}`$ delivered to Bob in this strategy are given by

$`\rho _0^\mathrm{s}`$ $`=`$ $`{\displaystyle \frac{1}{4}}(\rho _0+Z_\mathrm{W}\rho _0Z_\mathrm{W}^1+R\rho _1R^1`$ (79)
$`+`$ $`Z_\mathrm{W}R\rho _1R^1Z_\mathrm{W}^1)`$
$`=`$ $`T\stackrel{~}{\rho }_0^\mathrm{s}+(1T)|\mathrm{vac}\mathrm{vac}|`$
and

$`\rho _1^\mathrm{s}`$ $`=`$ $`{\displaystyle \frac{1}{4}}(\rho _1+Z_\mathrm{W}\rho _1Z_\mathrm{W}^1+R\rho _0R^1`$ (80)
$`+`$ $`Z_\mathrm{W}R\rho _0R^1Z_\mathrm{W}^1)`$
$`=`$ $`T\stackrel{~}{\rho }_1^\mathrm{s}+(1T)|\mathrm{vac}\mathrm{vac}|,`$
where

$`\stackrel{~}{\rho }_0^\mathrm{s}`$ $`=`$ $`{\displaystyle \frac{1}{4T}}[T_0(\stackrel{~}{\rho }_0+Z_\mathrm{W}\stackrel{~}{\rho }_0Z_\mathrm{W}^1)+T_1(R\stackrel{~}{\rho }_1R^1`$ (81)
$`+`$ $`Z_\mathrm{W}R\stackrel{~}{\rho }_1R^1Z_\mathrm{W}^1)],`$
$$\stackrel{~}{\rho }_1^\mathrm{s}=\sigma _z\stackrel{~}{\rho }_0^\mathrm{s}\sigma _z,$$
(82)
and

$$T\frac{T_0+T_1}{2}=1\mathrm{Tr}[F_\mathrm{V}(\rho _0+\rho _1)/2].$$
(83)
From these expressions, we have

$$\mathrm{Tr}[\sigma _y\stackrel{~}{\rho _j}^\mathrm{s}]=0,$$
(84)
where $`\sigma _yi|zz+|i|z+z|`$. Eqs.(79) and (84) implies that $`\stackrel{~}{\rho }_j^\mathrm{s}`$ are written in the Bloch sphere as in Fig. 4. Taking the parameters $`\theta `$ and $`ϵ`$ as in Fig. 4 (the sign of $`\theta `$ is positive in the clockwise), $`\rho _j^\mathrm{s}`$ can be written in a diagonalized form as in Eqs. (LABEL:den1) and (13).

## Appendix B Optimization of Eve’s apparatus

In this appendix, we derive Eq. (39). In order to determine the function $`Q_{\mathrm{min}}(B)`$, we use Lagrange’s method of undetermined multipliers. $`B_0`$ is the maximum of $`B(\widehat{\xi })`$ under the condition that $`Q(\widehat{\xi })=0`$. Hence, if $`B(\widehat{\xi })=B_0`$ and $`Q(\widehat{\xi })=0`$, such $`\widehat{\xi }`$ satisfies

$$\delta (B(\widehat{\xi })\nu Q(\widehat{\xi }))=0$$
(85)
for any variation of $`\widehat{\xi }`$. $`Q_{\mathrm{min}}(B)`$ for $`B_0<BB_{\mathrm{max}}`$ is determined by minimizing $`Q^2(\widehat{\xi })`$ under the condition that $`B(\widehat{\xi })=B`$. Suppose that $`Q^2(\widehat{\xi })`$ takes its minimum at $`\widehat{\xi }`$ under the condition that $`B(\widehat{\xi })`$ is fixed. Then, at least one of the following conditions holds, namely,

$$\delta B(\widehat{\xi })=0$$
(86)
for any variation of $`\widehat{\xi }`$, or, there exists real $`\lambda ^{}`$ such that

$$\delta (Q^2(\widehat{\xi })\lambda ^{}B(\widehat{\xi }))=0$$
(87)
for any variation of $`\widehat{\xi }`$. Since $`Q(\widehat{\xi })0`$ in the considered region, the condition (87) is equivalent to

$$\delta (Q(\widehat{\xi })\lambda B(\widehat{\xi }))=0,$$
(88)
where $`\lambda \lambda ^{}/2Q`$. The three conditions (85), (86), and (88) can be cast into a common form, namely, there exist real $`\nu `$ and $`\lambda `$ \[$`(\nu ,\lambda )(0,0)`$\] such that

$$\delta (\nu Q(\widehat{\xi })\lambda B(\widehat{\xi }))=0$$
(89)
for any variation of $`\widehat{\xi }`$. In determining $`B_0`$ and $`Q_{\mathrm{min}}(B)`$, it is sufficient to consider only the operator $`\widehat{\xi }`$ satisfying the above condition.

Since $`\widehat{\xi }`$ is a real orthogonal matrix in the basis $`\mathrm{W}`$, any variation of $`\widehat{\xi }`$ can be written as $`\widehat{\xi }\widehat{\xi }(1+\widehat{N}\delta )`$, where $`\widehat{N}`$ is an arbitrary real antisymmetric matrix in $`\mathrm{W}`$ and $`\delta `$ is an infinitesimal real number. Then, the condition (89) means

$$\mathrm{Tr}\left[(\nu \widehat{A}\lambda \widehat{B})\widehat{\xi }\widehat{N}\right]=0$$
(90)
for any $`\widehat{N}`$ whose matrix form in $`\mathrm{W}`$ is real and antisymmetric. This condition is satisfied if and only if $`(\nu \widehat{A}\lambda \widehat{B})\widehat{\xi }`$ is a real symmetric matrix in $`\mathrm{W}`$. Since $`(\nu \widehat{A}\lambda \widehat{B})`$ is a real symmetric matrix and $`\widehat{\xi }`$ is a real orthogonal matrix in $`\mathrm{W}`$, we have

$$(\nu \widehat{A}\lambda \widehat{B})\widehat{\xi }=\widehat{\xi }^1(\nu \widehat{A}\lambda \widehat{B})$$
(91)
and hence

$$[(\nu \widehat{A}\lambda \widehat{B})^2,\widehat{\xi }]=0.$$
(92)
## Appendix C The upper bound of $`\mathrm{I}(\mathrm{B};\mathrm{E}|\mathrm{c})`$

In this appendix, we derive an upper bound of $`\mathrm{I}(\mathrm{B};\mathrm{E}|\mathrm{c})`$ in Eq. (58), assuming that Eve freely prepares quantum states and sends them to Bob. We only require that Eve should not change the values $`T`$ and $`P_{\mathrm{conc}}`$. Hence, Eve’s strategy is generally described as she sends a single photon with its polarization in the state $`\rho _\gamma `$ with probability $`P(\gamma )T`$, and she sends the vacuum with probability $`1T`$. The probability $`P(\gamma )`$ should satisfy

$$\underset{\gamma }{}P(\gamma )=1,$$
(93)
and $`\rho _\gamma `$ and $`P(\gamma )`$ should satisfy

$$\underset{\gamma }{}P(\gamma )P(\mathrm{c}|\gamma )=P_{\mathrm{conc}}/T.$$
(94)
Here $`P(\mathrm{c}|\gamma )`$ is the probability of obtaining conclusive results for the state $`\rho _\gamma `$, which is given by

$`P(\mathrm{c}|\gamma )`$ $`=`$ $`\mathrm{Tr}\left[(F_{\overline{0}}+F_{\overline{1}})\rho _\gamma \right]`$ (95)
$`=`$ $`\mathrm{Tr}\left[\left(\mathrm{cos}^2{\displaystyle \frac{\alpha }{2}}|z+z+|+\mathrm{sin}^2{\displaystyle \frac{\alpha }{2}}|zz|\right)\rho _\gamma \right]`$
$`=`$ $`{\displaystyle \frac{1}{2}}\left[1\mathrm{cos}\alpha \mathrm{Tr}(\sigma _z\rho _\gamma )\right].`$
The mutual information $`\mathrm{I}(\mathrm{B};\mathrm{E}|\mathrm{c})`$ can be written as

$`\mathrm{I}(\mathrm{B};\mathrm{E}|\mathrm{c})`$ $`=`$ $`H(B|\mathrm{c})H(B|E,\mathrm{c})`$ (96)
$``$ $`1\left({\displaystyle \frac{T}{P_{\mathrm{conc}}}}{\displaystyle \underset{\gamma }{}}P(\gamma )P(\mathrm{c}|\gamma )H(B|\gamma ,\mathrm{c})\right).`$
The entropy $`H(B|\gamma ,\mathrm{c})`$ is given by

$`H(B|\gamma ,\mathrm{c})`$ $`=`$ $`h\left({\displaystyle \frac{1}{2}}{\displaystyle \frac{|P(\overline{0}|\gamma ,\mathrm{c})P(\overline{1}|\gamma ,\mathrm{c})|}{2}}\right)`$ (97)
$`=`$ $`h\left({\displaystyle \frac{1}{2}}{\displaystyle \frac{\left|\mathrm{Tr}[(F_{\overline{0}}F_{\overline{1}})\rho _\gamma ]\right|}{2P(\mathrm{c}|\gamma )}}\right).`$
Using

$$F_{\overline{0}}F_{\overline{1}}=\frac{\mathrm{sin}\alpha }{2}\sigma _x$$
(98)
and the relation $`\mathrm{Tr}(\sigma _z\rho _\gamma )^2+\mathrm{Tr}(\sigma _x\rho _\gamma )^21`$, we obtain

$`H(B|\gamma ,\mathrm{c})`$ $``$ $`h\left({\displaystyle \frac{1}{2}}{\displaystyle \frac{\mathrm{sin}\alpha }{4P(\mathrm{c}|\gamma )}}\sqrt{1\left({\displaystyle \frac{12P(\mathrm{c}|\gamma )}{\mathrm{cos}\alpha }}\right)^2}\right)`$ (99)
$``$ $`g\left(P(\mathrm{c}|\gamma )\right),`$
Since the function $`xxg(x)`$ is convex (we have confirmed this numerically), $`\mathrm{I}(\mathrm{B};\mathrm{E}|\mathrm{c})`$ in Eq. (96) is maximum when $`P(\mathrm{c}|\gamma )=P_{\mathrm{conc}}/T`$ for all $`\gamma `$, and we obtain the result

$$\mathrm{I}(\mathrm{B};\mathrm{E}|\mathrm{c})1g\left(P_{\mathrm{conc}}/T\right),$$
(100)
which is Eq. (58).