# How Secure Are Two-Way Ping-Pong and LM05 QKD Protocols under a Man-in-the-Middle Attack?
## 3 Security of the Protocols  
To reach the main point of the paper, let us first discuss the one-way asymmetric (aBB84) and symmetric (sBB84, i.e., standard BB84) protocols. A recent definition of aBB84 [25] reads: \"[PERSON] [asks her] entanglement-based source to [randomly] prepare quantum states in two bases, \(\mathbb{X}=\{|0\rangle,|1\rangle\}\) and \(\mathbb{Z}=\{(|0\rangle+|1\rangle)/\sqrt{2},(|0\rangle-|1\rangle)/\sqrt{2}\}\)... [PERSON] [randomly] measure[s] quantum systems in [these two] bases... The protocol is _asymmetric_ [meaning that] the number of bits measured in the two bases (\(n\) bits in the \(\mathbb{X}\) basis and \(k\) bits in the \(\mathbb{Z}\) basis) are not necessarily equal [26]...  
**Sifting:** [PERSON] and [PERSON] broadcast their basis choices over the classical channel... **Error correction:** (EC) A reconciliation scheme that broadcasts [chosen] bits of classical error correction data is applied. [PERSON] compute[s] an estimate \(\hat{\mathbf{Y}}\) of the raw key string \(\mathbf{Y}\). [PERSON]  
Figure 1: (**a**) [PERSON]’s attack [23] by which [PERSON] is able to deterministically (and undetectably in the message mode (MM)) copy every one of the Bell-state messages in the ping-pong (pp) protocol [7]; (**b**) [PERSON]’s attack ([24], p. 61, Figure 5.5) by which [PERSON] is able to deterministically (and undetectably in the MM) copy every message in the LM05 protocol; (**c**) common schematics of both attacks; the green dashed line shows the path of photons when [PERSON] is not in the line. computes universal\({}_{2}\) hash function of \(\mathbf{Y}\) [and] sends [it] to [PERSON]. If the hash[es] of \(\hat{\mathbf{Y}}\) and \(\mathbf{Y}\) disagree, the protocol aborts. **Privacy amplification:** (PA) [PERSON] extracts \(l\) bits of secret key \(\mathbf{S}\) from \(\mathbf{Y}\) using a random universal\({}_{2}\) hash function. The choice of function is communicated to [PERSON], who uses it to calculate \(\mathbf{S}\).\" ([25], p. 3) There are other similar definitions of aBB84 in the literature [26; 27; 28; 29; 30]. When \(n=k\), aBB84 turns into sBB84, i.e., it becomes identical to the original BB84. In what follows, when not explicitly stated otherwise, under BB84 we mean sBB84. What is essential for the standard aBB84 and sBB84, is that [PERSON] cannot avoid introducing disturbance (\(D\)). Specifically, when [PERSON] sends messages in \(\mathbb{X}\) and \(\mathbb{Z}\) bases, [PERSON] cannot avoid introducing \(D\). E.g., [PERSON] sends \(|1\rangle\) in \(\mathbb{X}\) basis, [PERSON] reads it as \((|0\rangle+|1\rangle)/\sqrt{2}\) in \(\mathbb{Z}\) basis and sends it to [PERSON] who, say in \(\mathbb{X}\) basis, reads it either as \(|0\rangle\) or as \(|1\rangle\). If the former, it will be discarded in the EC procedure, if the latter, it will be accepted as a valid message. As for [PERSON], no public information can enable her to find out what [PERSON] actually measured hence she loses information. However, [PERSON] and [PERSON] lose their information too, and as shown in Figure 2a in a BB84 protocol, when the level of disturbance approaches \(D_{\text{MM}}=0.11\) (the MM is the only mode of the standard BB84 protocol) the mutual information between [PERSON] and [PERSON] \(I_{AE}\) approaches the mutual information between [PERSON] and [PERSON] \(I_{AB}\) and they have to abort the protocol. Note that \(I_{AB}=1+D\log_{2}D+(1-D)\log_{2}(1-D)\) and \(I_{AE}=-D\log_{2}D-(1-D)\log_{2}(1-D)\)[31] and that, ideally, for \(D_{\text{MM}}<0.11\), EC can eliminate all errors induced by [PERSON] and that PA can remove all key bits [PERSON] might have collected, no matter how close to \(0.11\)\(D_{\text{MM}}\) is. This is so because both \(I_{AB}\) and \(I_{AE}\) are functions of \(D_{\text{MM}}\), i.e., functions of the disturbance in the message mode for which the mutual information in the very same message mode is calculated.