Quantum key exchange skepticism/confusion I was hoping somebody could explain some issues I have with quantum key exchange that I don't quite understand. I've read bits and pieces about BB84 but I'm sure my questions probably apply to other schemes also. My understanding of quantum key exchange is the following (please correct me if I'm wrong):


Alice creates a random bit string and for each bit, selects a random filter (say x or +). 
she encodes these choices as a polarized photon and sends over the quantum channel to Bob 
Bob guesses which filter to use, if he guesses correctly (assuming no Eve messing around for the moment), he'll get the bit Alice intended. If he guesses the wrong filter, it's 50% chance he gets the bit Alice intended 
Alice and Bob exchange what filters Bob should have used; they ignore the bits where Bob used the wrong filter
Alice and Bob then pick a sample of their bits and find out if there are any discrepancies, if there are a lot, they try the key exchange again. If there aren't that many, they proceed to do parity checks to agree on the exact right key, then then use the leftover hash lemma to make sure Eve doesn't know anything much


Please correct me if I'm wrong with the above.
My questions are the following: 


What's to guarantee authentication or message integrity (particularly when Alice and Bob are exchanging which filters were correct and so on)?
If Alice and Bob only count the bits where they have the same filter, then isn't it 50/50 whether or not Eve guesses the correct filter also? So can't Eve see about half the key without Alice or Bob even knowing!?
What proportion of discrepancies is too much and why?
We always assume Eve is passively observing, can't she do more than that (like change the polarization to whatever she likes and so on)?
How does the leftover hash lemma actually work?


Apologies if any of the above are stupid questions but I'm very confused with this protocol. 1) and 2) are particularly important to me because they seem like major, major problems I can't seem to understand and I can't find a good article that really explains it properly so an explanation from here would be great.

Many thanks for any help with any question.
Let’s take your questions in order. Note that I’m a physicist working in quantum cryptography, so my opinion on this might be biased
1. What about authentication ?
The classical channel between Alice and Bob has to be authenticated in order for the protocol to work. Formally, this is a pre-requisite for quantum key distribution (QKD), and is not part of the protocol.
In practice, we often uses information theoretically secure schemes (see this answer for pointers), which consume secret keys. The point is to generate key through QKD faster than the authentication consume it, making the whole system a key expansion system.
2. Wait ! Can’t Eve guess half of the basis (filters) without being detected ?
No ! That’s the whole point. Eve does indeed know half of the key, but she’s detected by Alice and Bob. Eve choice and Bob’s choice are independent, so, Eve will have chosen the wrong filter for half of the photons kept by Alice and Bob, and this wrong filter choice would change the photon polarization, inducing errors in Alice and Bob strings (in this case $\tfrac12\times\tfrac12=25\%$ error.) detected in step 5. of your description of the protocol. This lead us to the next question .
3. What is the maximal error rate ? And why ?
An exact answer to this question is still a research subject, and is obviously protocol dependent, but the same ideas (with different numbers) are essentially valid for all protocols.
The attack you proposed is known as an intercept-resend attack, describing an attack where Eve measures the photons and resends something to Bob depending on her measurement. It is proved that there is no way for Alice and Bob to extract a secret key when such an attack occurs, which corresponds to 25% error rate for BB84 protocol. However, this is only an upper bound on the tolerable error rate, and this attack has no reason to be optimal.
To find a lower bound, one uses different techniques to optimize over the sets of attacks, which also depend on the exact way the final key is extracted (after error correction and privacy amplification, in order to use the lefover hash lemma). A commonly used lower bound is $e=11\%$ which corresponds to a case where Eve gather as much mutual information on Alice's string as Bob, but some research papers have some way to tolerate a higher error rate.
4. We always assume Eve is passively oberving ...
NO ! The whole point of QKD is that she cannot passively observe ! Heisenberg uncertainty principle ensures that any observation is active and disturbs the system. Usually, we assume Eve can do anything, but the tricky part is to properly define “anything”, and optimize over this set.
5. How does the leftover hash lemma actually work
I’m a physicist, and I will not give you a theoretical answer on this. You can read the publications of Renato Renner to have a rigorous analysis of this lemma in the presence of a quantum adversary.
On a practical point, Alice and Bob use error correcting codes (ECC) to correct the errors in order to have the same key. Doing that, they leak some information to Eve (at most the number $c$ of exchanged ECC bits, $c≥h(e)$ for BB84). This leakage is added to amount of information which has leaked during the photon exchange, and which can be evaluated from the error rate $e$ (at most $h(e)$ for BB84). Alice and Bob pass their key through a universal hash function, with an output small enough ($&lt;1-c-h(e)$) to ensure the leftover hash lemma applies.
Bonus question (from the comments) : is QKD relevant ?
I’m an academic, and I find it interesting from a fundamental point of view. It clearly changes the way physicist think about quantum mechanics, and is relevant in this aspects.
Whether it will soon be relevant to use QKD now in an industrial setting is a question of engineering, economics, future prediction and beliefs on what the NSA actually does ...
QKD is more difficult to implement than classical cryptography, because it needs specific hardware and has a limited range. However, it is indeed possible today to make QKD systems working over 200km, and small networks exist across a few cities. Some people work to make it practical and cheaper, and they may succeed.
In my opinion, the only reasonable application of QKD today is on securing expensive data which should stay secret for more than a decade (i.e. on an horizon where technological evolution is difficult to predict). The two properties which make QKD useful in this case are :

Its security relies on something completely independent than classical cryptography and it is easy to combine the two such that both have to be broken in order to break the scheme.
In order to break an imperfect implementation of quantum cryptography (aka quantum hacking), one need to break it at the moment where the photon exchange take place. You cannot record the messages in the hope that a weakness in the protocol will later be  found.