# How Secure Are Two-Way Ping-Pong and LM05 QKD Protocols under a Man-in-the-Middle Attack?
## 3 Security of the Protocols
Fidelities are \(f_{0}=c_{00}^{2}\), \(f_{1}=c_{11}^{2}\), \(f_{+}=c_{++}^{2}\), and \(f_{-}=c_{--}^{2}\). \(f_{0}=f_{1}\) and \(f_{-}=f_{+}\) are assumed...  
[PERSON]'s qubit is in a mixed state \(\rho^{B}=(|0\rangle\langle 0|+|1\rangle\langle 1|)/2\). The joint state of the forward qubit and [PERSON]'s ancilla becomes \(\rho_{BA}^{BE}=U_{BE}(\rho^{B}\otimes|E\rangle\langle E|)U_{BE}\). [PERSON]'s encoded qubit together with [PERSON]'s ancillas is: \(\rho^{ABE}=\frac{1}{2}|0\rangle\langle 0|^{A}\otimes\rho_{BA}^{BE}+\frac{1}{2}|1 \rangle\langle 1|^{A}\otimes\Upsilon_{B}\rho_{BA}^{BE}\Upsilon_{B}\)... The asymptotic key generation rate is \(r=\lim_{m\to\infty}\frac{k(m)}{m}\), where \(m\) is the size of the raw key and \(k(m)\) is the number of the final key bits. [PERSON] sends [PERSON] EC information over a classical channel so that he can correct his raw key to match [PERSON]'s. * _[PERSON] does not induce any disturbance, so there is no EC._
* The final key is then derived by applying two-universal hashing to their common raw key as PA. The secure key rate \(r_{\text{PA}}\) for secret key generation is bounded by the conditional entropy of [PERSON] and [PERSON]'s key bits given the quantum information of [PERSON] about the key bits \(r_{\text{PA}}=S(\rho^{A}|\rho^{BE})=-tr\rho^{ABE}\log_{2}\rho^{ABE}+tr\rho^{ BE}\log_{1}\rho^{BE}=1-h(\xi)\), where \(\xi=c_{++}^{2}-c_{1}^{2}\), \(c_{1}=c_{01}=c_{10}\), and \(h(x)=-x\log_{2}x-(1-x)\log_{2}(1-x)\) is the binary Shannon entropy. In particular, if [PERSON] does not attack the forward qubits in the Bob-Alice channel, i.e., \(f_{0}=f_{1}=f_{+}=f_{-}=1\), one can find that \(r_{\text{PA}}(\xi)=1\). This states that [PERSON] cannot gain any information about [PERSON]'s key bits if she does not attack the travel qubit in the Bob-Alice channel first. Consider the case that [PERSON] measures each forward qubit in the Bob-Alice channel in the basis \(|0\rangle,|1\rangle\). [PERSON] and [PERSON] can verify that \(f_{0}=f_{1}=1\), and \(f_{+}=f_{-}=\frac{1}{2}\). In this case, we have \(r_{\text{PA}}(\xi)=0\). On the other hand, [PERSON] can also measure each forward qubit in the Bob-Alice channel in the basis \(|+\rangle,|-\rangle\), which gives \(f_{+}=f_{-}=1\) and \(f_{0}=f_{1}=\frac{1}{2}\), and thus \(r_{\text{PA}}(\xi)=0\). That is, [PERSON] can gain full information of [PERSON]'s key bits if she has exactly known the forward states before [PERSON]'s encoding operations. * _[PERSON] does not measure qubits (or ancillas). When she is in the line all the time, she just reads off_ **I** _and_ _iY_ _[PERSON] executed on her qubits and applies them to [PERSON]'s qubits she stored, i.e., she copies the whole key--both sides have the whole key. There is no privacy which can be amplified. That means we have \(r_{\text{PA}}=1\), not 0. This deserves a clarification. \(r_{\text{PA}}=\lim_{m\to\infty}\frac{k(m)}{m}=1\) states that the secret key is equivalent to the raw key in the infinite limit for both [PERSON] and [PERSON] and [PERSON], what corresponds to \(I_{AB}=I_{AE}(D_{Max-\text{CM}})=1\), for \(D_{Max-\text{CM}}=0.5\). So, \(k_{\text{PA}}(m)\) should not be used as a secret key, but that does not mean that we can infer \(k_{\text{PA}}(m)=0\). After PA both parties have the same \(r_{\text{PA}}=1\) and discarding \(k_{\text{PA}}(m)\) does not turn \(r_{\text{PA}}\) to zero. Discarding the key is based on [PERSON] and [PERSON]'s estimation from the CM, i.e., from outside of the MM space of calculation. The way of calculating \(k_{\text{PA}}(m)\) so as to include discarding of estimated bits both parties might possess should follow from an adequately elaborated PA procedure and its algorithms. A starting step should be a predefined \(D_{Max-\text{CM}}<0.5\) and its inclusion in the protocol via \(I_{MaxAE}=I_{AE}(D_{Max-\text{CM}})\).