atrix X, according to: (25.23) Thus, measuring circularly polarized photons is equivalent to "observing" X, or equiv- alently, to operate in the measurement basis {l+), |-)}, or, for short, in the X basis. Assume, next, that we have no knowledge of the input photon states. For the mea- surement, we have the possibility of using either the X or the Z bases. What happens if we choose the wrong one (namely X for linearly polarized photons, and Z for cir- cularly polarized photons)? There are two ways to answer such a question. The first one is a classical answer. It has been established for a fact that circular polarization is the superposition of two orthogonal linear polarizations (oscillating in quadrature), and the reverse. Thus, a circularly polarized E-field incident on a PBS is decomposed into its two linear-polarization components. Likewise, a linearly polarized E-field incident on a QWP-PBS apparatus is first transformed by the QWP into a circularly polarized E-field, and then decomposed by the PBS into its two linear components. But this expla- nation is valid only for classical E-fields! Indeed, consider now the case of polarized single photons. A circularly polarized photon incident onto a PBS cannot be physi- cally split into two linearly polarized photons. Since the photon is associated with two linear-polarization states (oscillating in quadrature) it has to "choose" one or the other, and such a choice comes with a 50% probability, as in the photon-beam partitioning experiment described earlier. The same conclusion applies to the case of linearly polar- ized photons incident on a QWP-PBS apparatus. The key conclusion is that measuring photons with the wrong basis, i.e., circularly polarized photons with basis Z or linearly polarized photons with basis X, produces equiprobable, random outcomes. The different measurement possibilities are summarized in Table 25.7. Classical and quantum cryptography We now have all the necessary tools to describe the principle of quantum cryptogra- phy, or, more precisel