## 2 Background  
The detailed description of the stages for the typical QKD protocol can be found in reviews, see, e.g., [1; 2]. Here, we focus on the four stages that are the most significant for our study:  
1. The quantum states are sent via a quantum channel from [PERSON] to [PERSON], with [PERSON] performing an appropriate measurement. Then, the legitimate users utilize a classical authenticated channel to perform key sifting and/or basis reconciliation. After this procedure, [PERSON] and [PERSON] have correlated but not yet coinciding classical bit sequences also correlated with [PERSON]. 2. The legitimate users estimate the intervention of [PERSON] and the information available to her based on the data observed at the receiver's side. The most significant parameter is quantum bit error rate (QBER), but other parameters including the visibility, attenuation, or gain of different classes of states can be utilized as well [9; 10; 11]. The aforementioned estimate can be performed by disclosing a part of the signals, which is then removed from the key as it is not secret any more. 3. The legitimate users perform error correction, which provides them with coinciding keys correlated with [PERSON]. Classical error correction codes [12] or the Cascade method [13] may be used. The legitimate users take into account that some secret data are disclosed during error correction. The disclosed data actually specify the set of codewords used by [PERSON], e.g., for linear codes, the syndrome specifies that \"a string of [PERSON] is the one that produces the following syndrome\", while the check matrix of the linear code may be fixed for many communication sessions. The Cascade method uses the interactive exchange of parity bits, which also specify the set of possible bit sequences used by [PERSON]. 4. Finally, the privacy amplification stage follows. This results in a shorter key with very low correlation with the eavesdropper. The length of the final key depends on the data observed by the legitimate users and, correspondingly, their estimate of [PERSON]'s and their own information. In addition, the security proof, i.e., the proof of the statement that the key obtained with this formula is secure according to the security parameter (see, e.g., [14; 15]), is the main theoretical element for the QKD protocol. The classical or quantum data available to the participants after each of these stages can be described by a quantum states in the joint Hilbert space of Alice-Bob-Eve, with classical states of [PERSON] and Bob being diagonal density matrices in some fixed basis. The total state depends on the attack performed by the eavesdropper. All the eavesdropping attacks on QKD protocols can be categorized into three nesting groups. The most general type of attack entails conducting a joint unitary transformation with ancilla on an arbitrary number of signal quantum states and subsequent collective measurement of the ancillary system. This sequence of actions conducted by an eavesdropper is called a coherent attack. If the eavesdropper is limited to conducting an individual unitary transformation with an ancilla of every signal state followed by a collective measurement of all the ancillary systems, then their intervention can be attributed to a narrower class of col lective attacks. Finally, each attack including only individual unitary transformations and individual measurements of ancillary systems belongs to the subset of individual attacks. Full security analysis of any QKD protocol, i.e., proving its unconditional security, requires considering [PERSON] to be able to perform any action allowed by the laws of quantum physics, i.e., operating in the set of coherent attacks.