## 3 Proof of security of BB84 against collective attacks
### Calculating and bounding the trace norm for one bit: the Biham basis. We now wish to bound \(\frac{1}{2}\,\mathrm{tr}\,|\widetilde{\rho}_{0}-\widetilde{\rho}_{1}|\) according to the specific attack [PERSON] has performed. Taking advantage of the fact that \(V_{r^{\prime}}+V_{r^{\prime}}^{c}=\mathbf{F}_{2}^{n}\) and \(V_{r^{\prime}}\cap V_{r^{\prime}}^{c}=\{0\}\) (i.e. the sum is \"direct\"), equation (30)rewrites as  
\[|\psi_{\mathbf{x}}^{\mathbf{b}^{\prime}}\rangle=\sum_{v\in V_{r}^{c}}(-1)^{ \mathbf{x}\cdot v}\sum_{v^{\prime}\in V_{r}}(-1)^{\mathbf{x}\cdot v^{\prime}}d_{ v+v^{\prime}}|v+v^{\prime}\rangle. \tag{35}\]  
For each \(\boldsymbol{\xi}\in\{0,1\}^{r}\), let \(i_{\xi}\) be a fixed \(n\)-bit string such that \(i_{\xi}P_{C}^{T}=\boldsymbol{\xi}\). By definition of the syndrome, \(\boldsymbol{\xi}=\mathbf{x}P_{C}^{T}\) and thus \((\mathbf{x}-\boldsymbol{\xi})P_{C}^{T}=0\), i.e. \((\mathbf{x}-i_{\xi})\) is a code word of \(C\). Since every string \(v^{\prime}\) in the dual code \(C^{\perp}=V_{r}\) is orthogonal to every code word, we get that \(v^{\prime}(\mathbf{x}-i_{\xi})=0\) and thus \(v^{\prime}\mathbf{x}=v^{\prime}i_{\xi}\). It follows that  
\[|\psi_{\mathbf{x}}^{\mathbf{b}^{\prime}}\rangle=\sum_{v\in V_{r}^{c}}(-1)^{ \mathbf{x}\cdot v}\sum_{v^{\prime}\in V_{r}}(-1)^{i_{\xi}\cdot v^{\prime}}d_{ v+v^{\prime}}|v+v^{\prime}\rangle.\]  
If we define \(|\eta_{v}\rangle=\sum_{v^{\prime}\in V_{r}}(-1)^{i_{\xi}\cdot v^{\prime}}d_{ v+v^{\prime}}|v+v^{\prime}\rangle\), we conclude with  
\[|\psi_{\mathbf{x}}^{\mathbf{b}^{\prime}}\rangle=\sum_{v\in V_{r}^{c}}(-1)^{ \mathbf{x}\cdot v}|\eta_{v}\rangle. \tag{36}\]  
**Lemma 3**. : _The non normalized states \(|\eta_{v}\rangle\) for \(v\in V_{r}^{c}\) are orthogonal._  
Proof. : \[\langle\eta_{v_{1}}|\eta_{v_{2}}\rangle=\sum_{v_{1}^{\prime}\in V_{r}}(-1)^{i _{\xi}\cdot v_{1}^{\prime}}\overline{d_{v+v^{\prime}}}\langle v_{1}+v_{1}^{ \prime}|\sum_{v_{2}^{\prime}\in V_{r}}(-1)^{i_{\xi}\cdot v_{2}^{\prime}}d_{v_ {2}+v_{2}^{\prime}}|v_{2}+v_{2}^{\prime}\rangle.\]  
If \(\langle v_{1}+v_{1}^{\prime}|v_{2}+v_{2}^{\prime}\rangle\
eq 0\), then \(v_{1}+v_{1}^{\prime}=v_{2}+v_{2}^{\prime}\) which, by (27), implies \(v_{1}=v_{2}\) (and \(v_{1}^{\prime}=v_{2}^{\prime}\)). The \(|\eta_{v}\rangle\) thus provide an orthogonal (but not orthonormal) basis with which we can simply represent \(|\psi_{\mathbf{x}}^{\mathbf{b}^{\prime}}\rangle\), as shown in (36). Using (33) we get  
\[\widetilde{\rho}_{0}-\widetilde{\rho}_{1}=\frac{1}{2^{n-r-1}}\sum_{ \begin{subarray}{ c}\mathbf{x}\end{subarray} }\left|\psi_{\mathbf{x}}^{\mathbf{b}^{\prime}} \right\rangle\langle\psi_{\mathbf{x}}^{\mathbf{b}^{\prime}}|-\frac{1}{2^{n-r- 1}}\sum_{ \begin{subarray}{c}\mathbf{x}\end{subarray} }\left|\psi_{\mathbf{x}}^ {\mathbf{b}^{\prime}}\right\rangle\langle\psi_{\mathbf{x}}^{\mathbf{b}^{ \prime}}|-\frac{1}{2^{n-r-1}}\sum_{ \begin{subarray}{c}\mathbf{x}\end{subarray}  \end{subarray}}|\psi_{\mathbf{x}}^{\mathbf{b}^{\prime}}\rangle\langle\psi_{ \mathbf{x}}^{\mathbf{b}^{\prime}}|.\]  
The set of elements \(\{\mathbf{x}\mid\mathbf{x}P_{C}^{T}=\boldsymbol{\xi}\}\) is the code coset containing the string \(i_{\xi}\), namely, \(\{c+i_{\xi}\mid c\in C\}\), where for every different element \(c\), the string \(c+i_{\xi}\) represents a different possible \(\mathbf{x}\).