g the block 1/4/, Bob uses a random-bit generator to produce a sequence A' = of N = (4 + A), n bits length. Conventionally, Bob chooses that if a' = 0, the qubit measurement basis is Z, and if a'k = 1 it is X. The outcome of Bob's eigenvalue measurement is a random-bit sequence B = (b1, b2, ...) of length N = (4 + A)n. Here, I shall use the convention according to which the eigenvalue +1 corresponds to bk = 0 and -1 corresponds to bk = 1.21 Bob's different measurement outcomes (eigenvalues and cbits bk as functions of cbits ak, a') are summarized in Table 25.9. We first observe from the table that if the "right" bases for Bob to measure /Vo) and 1/1/1 are Z and X, respectively, the outcome is deterministic, since in either cases Bob certainly obtains bk = 0, corresponding to ak = ak. Therefore, contrary to the BB84 protocol, the information about which are the "right" bases is surely not to be publicly exchanged! Consider now the use of the "wrong" bases, which correspond to the cases ak=1 - ak. We observe from the table that Bob's measurements randomly yield the cbits bk = 0 or bk = 1 with equal chances. Thus, it is a matter of Bob communicating his cbit sequence B = (b1, b2, bN) to Alice over a public channel, while keeping = secret. Only the bit pairs ak, a'k yielding bk = 1 are retained by Alice and Bob. Clearly, such public knowledge does not tell Eve anything about the values of Ak, a = 1 - Ak, which have equal chances of being 0 or 1. This operation yields two common subsets of A, A" with at least 2n valid bits (Bob needs to complement his own bits, according to ak = 1 - ak = Ak, SO that his subset matches Alice's). The 21 The opposite convention, introduced earlier, is applicable to the B92 protocol if Alice chooses instead 1/20) = |1). 25.12 The EPR protocol Table 25.9 Outcomes of Bob's measurements (eigenvalues and cbits) according to Alice's qubits and Bob's measurement basis Z, X. Alice 1/20) = |0) (V/1) = l+) |0) = |0) Z|+) = |0) or |1), 50% chances Eigenvalue +1, bk = 0 bk=0,1 X|0) = |0) or |1), 50%