## 3 Proof of security of BB84 against collective attacks
### Representing states for bitstrings  
Let \(\mathbf{s}\) be a fixed string of length \(2n\) with a 1 in positions \(j_{1},\ldots,j_{n}\) corresponding to the \(n\) information bits. As in Eq. (9), given the basis string \(\mathbf{b}^{\prime}=b^{\prime}_{1}\ldots b^{\prime}_{n}=b_{j_{1}}\ldots b_{j_{ n}}\) and \(\mathbf{x}=x_{1}\ldots x_{n}=i_{j_{1}}\ldots i_{j_{n}}\) we define the state \(|\psi_{\mathbf{x}}^{\mathbf{b}^{\prime}}\rangle=\bigotimes_{l=1}^{n}|\psi_{x_ {l}}^{b^{\prime}_{l}}\rangle\). Using (26), we write the state as  
\[|\psi_{\mathbf{x}}^{\mathbf{b}^{\prime}}\rangle=\bigotimes_{l=1}^{n}\left[ \cos(\alpha_{l})\,|0_{l}\rangle+(-1)^{x_{l}}\sin(\alpha_{l})\,|1_{l}\rangle \right], \tag{29}\]  
where \(|0_{l}\rangle\) and \(|1_{l}\rangle\) represent the vectors \(|0_{H}^{b^{\prime}_{l}}\rangle\) and \(|1_{H}^{b^{\prime}_{l}}\rangle\) corresponding to the attack \(U_{j_{l}}\) on the \(j_{l}\)-th qubit (the \(l\)-th information qubit). If for \(\mathbf{c}=c_{1}\ldots c_{n}\in\{0,1\}^{n}\) we define  
\[d_{\mathbf{c},l}=\begin{cases}\cos(\alpha_{l})&\text{ if }c_{l}=0\\ \sin(\alpha_{l})&\text{ if }c_{l}=1\end{cases}\hskip 56.905512 ptd_{ \mathbf{c}}=d_{\mathbf{c},1}\ldots d_{\mathbf{c},n}\]  
then  
\[|\psi_{\mathbf{x}}^{\mathbf{b}^{\prime}}\rangle=\sum_{\mathbf{c}\in\{0,1\}^{n }}d_{\mathbf{c}}(-1)^{\mathbf{x}\cdot\mathbf{c}}\,|\mathbf{c}\rangle \tag{30}\]  
where \(|\mathbf{c}\rangle\) stands for \(|(c_{1})_{1}\ldots(c_{n})_{n}\rangle\); for instance if \(\mathbf{c}=0100\) then \(|\mathbf{c}\rangle\) is \(|0_{1}\rangle|1_{2}\rangle|0_{3}\rangle|0_{4}\rangle\) with \(|0_{l}\rangle\) and \(|1_{l}\rangle\) as defined above, and \(d_{\mathbf{c}}=\cos(\alpha_{1})\sin(\alpha_{2})\cos(\alpha_{3})\cos(\alpha_{4})\). We notice that the factors of \(d_{\mathbf{c}}^{2}\) can be interpreted as probabilities, and from (24) we deduce  
\[d_{\mathbf{c},l}^{2}=\begin{cases}\cos^{2}(\alpha_{l})=q_{l}^{\overline{b^{ \prime}_{l}}}&\text{ if }c_{l}=0\\ \sin^{2}(\alpha_{l})=p_{l}^{\overline{b^{\prime}_{l}}}&\text{ if }c_{l}=1\end{cases}\]  
where \(p_{l}^{\overline{b^{\prime}_{l}}}\) is the probability of an error on the bit of index \(j_{l}\) (the \(l\)-th information bit) when encoded and measured in the conjuguate basis and \(q_{l}^{\overline{b^{\prime}_{l}}}=1-p_{l}^{\overline{b^{\prime}_{l}}}\) is the probability of no error on the same bit under the same conditions.  
Due to the above, \(d_{\mathbf{c}}^{2}\) is the probability of having exactly the error string \(\mathbf{c}\) on the bits \(i_{j}\) such that \(s_{j}=1\) when those bits are encoded and measured in the other basis. Since, according to the protocol, the bits such that \(s_{j}=1\) are the \"information bits\", we will say, by abuse of language, that this is the probability of error on information bits. If we represent by \(\mathbf{C}_{I}\) the random variable corresponding to the error in [PERSON]'s measurement of the information bits, and by \(\mathbf{B}_{I}\) the random variable giving the corresponding basis string chosen by [PERSON] then we can write, for \(\mathbf{c}\in\{0,1\}^{n}\), \(\mathbf{b}\in\{0,1\}^{2n}\) and \(\mathbf{s}\in\{0,1\}^{2n}\) such that \(|\mathbf{s}|=n\),  
\[d_{\mathbf{c}}^{2}=P[\mathbf{C}_{I}=\mathbf{c}\mid\mathbf{B}_{I}=\overline{ \mathbf{b}_{\mathbf{s}}},\mathbf{s}] \tag{31}\]  
where \(\overline{\mathbf{b}_{\mathbf{s}}}=\overline{\mathbf{b}}^{\prime}=\overline{ b_{1}^{\prime}}\ldots\overline{b_{n}^{\prime}}\). This probability is not conditional on the syndrome \(\boldsymbol{\xi}\); all possible errors are taken into account here, even with values of \(\mathbf{x}\) inconsistent with \(\boldsymbol{\xi}\).