## 2 BB84, SARG04 and ack-QKD
ack-QKD uses the four sets of non-orthogonal states \(S_{(+,+)}=\{\left|+_{X}\right\rangle,\left|+_{Z}\right\rangle\}\), \(S_{(+,-)}=\{\left|+_{X}\right\rangle,\left|-_{Z}\right\rangle\}\), \(S_{(-,+)}=\{\left|-_{X}\right\rangle,\left|+_{Z}\right\rangle\}\) and \(S_{(-,-)}=\{\left|-_{X}\right\rangle,\left|-_{Z}\right\rangle\}\). However, in the ack-QKD protocol, [PERSON] never reveals the set she used, \(S_{(+,+)},S_{(+,-)},S_{(-,+)}\) or \(S_{(-,-)}\). For example, suppose [PERSON] chooses the set \(S_{(+,+)}=\{\left|+_{X}\right\rangle,\left|+_{Z}\right\rangle\}\). Instead of sending one of the two states, say \(\left|+_{X}\right\rangle\) and announcing publicly the sifting instance, \(S_{(+,+)}\), she actually sends the two states, \(\left|+_{X}\right\rangle\) and \(\left|+_{Z}\right\rangle\). Then, [PERSON] measures them using the same basis, \(X\) or \(Z\), one by one, as the two states arrive consecutively. If [PERSON] has measured with the \(X\) basis, he certainly has obtained \(\left|+_{X}\right\rangle\) (after he measured the first state), but he can obtain \(\left|+_{X}\right\rangle\) or \(\left|-_{X}\right\rangle\) in the second measurement, with a 0.5 probability each outcome. If [PERSON] got \(\{\left|+_{X}\right\rangle,\left|-_{X}\right\rangle\}\) after the two measurements, the result is ambiguous for him, and it must discarded. In contrast, if he obtained \(\{\left|+_{X}\right\rangle,\left|+_{X}\right\rangle\}\), the result is unambiguous, and he adds a bit, 1, to his key. In order to allow [PERSON] to recover the same bit, [PERSON] announces the basis measurement, \(X\), and the matching condition according to the following rule: \((2M)\) if the two detection events gives a click on the same detector, it includes the cases \(\{\left|+_{X}\right\rangle,\left|+_{X}\right\rangle\},\{\left|-_{X}\right\rangle,\left|-_{X}\right\rangle\},\{\left|+_{Z}\right\rangle,\left|+_{Z}\right\rangle \},\{\left|-_{Z}\right\rangle\}\), or \((2 nM)\) if the detection events gives a click on the opposite detectors, e.g., \(\{\left|+_{X}\right\rangle,\left|-_{X}\right\rangle\},\{\left|-_{X}\right\rangle,\left|+_{X}\right\rangle\},\)\(\{\left|+_{Z}\right\rangle,\left|-_{Z}\right\rangle\},\{\left|-_{Z}\right\rangle,\left|+_{Z}\right\rangle\}\). [PERSON] gets the secret bit, because the \(\{\left|+_{X}\right\rangle,\left|+_{Z}\right\rangle\}\) states she sent, the \(X\) basis and the \((2M)\) measurement result, allow her to infer that [PERSON] certainly got \(\{+_{X},+_{X}\}\) (consider the cases depicted in Table 1). On the other hand, if [PERSON] has measured the two states, \(\left|+_{X}\right\rangle\) and \(\left|+_{Z}\right\rangle\), with the \(Z\) basis, then he would obtain one of the two possible outcomes: \((2M)=\{\left|+_{Z}\right\rangle,\left|+_{Z}\right\rangle\}\) or \((2 nM)=\{\left|-_{Z}\right\rangle,\left|+_{Z}\right\rangle\}\). In the first case, he announces publicly the \(Z\) basis and the \((2M)\) result; then, [PERSON] and [PERSON] add a zero to the key. In the second case, [PERSON] announces the \(Z\) basis and the \((2 nM)\) result, but he discards the outcome. In the ack-QKD protocol, the \((2M)\) outcomes are useful to distill secret bits; but, the \((2 nM)\) are ambiguous, and those measurement results must be discarded.