## 3 A Detector-Blinding Attack on the BB84 with Passive Base Selection  
In the receiving station (Bob), which was broken in Ref. [4], the random selection of bases is performed passively with the help of a non-polarizing beam splitter (BS), as shown in Figure 2. Note that the sender ([PERSON]) needs an equivalent of two random bits to generate the qubit state (namely, to choose one out of four possible qubit states), while Bob needs an equivalent of one bit of entropy per received qubit to randomly choose its measurement basis (one out of two possible bases), which mandates that each station must have a private random number generator or something equivalent. In the Bob setup, show, in Figure 2, the random selection of the receiving base is achieved through the use of the beam splitter (BS). A detector blinding attack (DBA) on this setup works as follows. [PERSON] cuts the quantum channel between Alice and Bob (e.g., an optic fiber or aerial link) and simultaneously blinds all four detectors in Bob by shining a strong, pulsed, circularly polarized light of a high enough intensity, as explained in Ref. [4]. Each detector in Bob receives one-quarter of the incident power of the blinding light. The pulses are powerful and frequent enough (~70 kHz repetition rate; 8 mW during a pulse) to keep the detectors thermally blinded at all times during the qubit exchange. According to Ref. [4], this blinding strategy generates a four-fold coincidence among all detectors upon each blinding pulse. Figure 2: A receiver for the BB84 protocol with a passive random number generator; the measurement basis is selected randomly via the first polarization-insensitive beam splitter (BS). Each base consists of a polarizing beam splitter (PBS) and two detectors. The (45\({}^{\circ}\), 135\({}^{\circ}\)) base is realized by placing a properly rotated half-wave plate (HWP) in front of it. In a blind state, detectors are sensitive only to strong pulses of light brighter than some threshold power \(P_{thr}\), superimposed on top of the blinding light: so-called \"fake states\". For example, [PERSON] can shoot a pulse polarized at 45\({}^{\circ}\) and of a power just over \(2P_{thr}\). Half of the power would end up in the 45\({}^{\circ}\) detector, making it click. The 135\({}^{\circ}\) detector will receive negligible power while the detectors in the other base will receive slightly more than \(\frac{1}{2}P_{thr}\) each; thus, none of the other detectors will click. Note that the success of the attack is not very sensitive to the pulse power as it can be anywhere between just above \(2P_{thr}\) and just below \(4P_{thr}\), leaving quite a wide range for the attack to work on all four detectors which, for other security reasons, should have well-matched specifications anyway. [PERSON] measures [PERSON]'s qubit in a randomly selected base (either (0\({}^{\circ}\), 90\({}^{\circ}\)) or (45\({}^{\circ}\), 135\({}^{\circ}\))), using a receiving station which is a close copy of [PERSON]. Note that [PERSON] receives [PERSON]'s qubits using the close copy of [PERSON] and using the same protocol as [PERSON]. After the measurement, [PERSON] sends [PERSON] a fake state matching her measurement, effectively copying her measurement result to [PERSON], who then measures the same as [PERSON]. Finally, [PERSON] passively listens to the classical channel between [PERSON] and [PERSON] and copies their activities the next two classical phases, namely, information reconciliation and the privacy amplification, in order to arrive to exactly the same \"secret\" key. Note that the attack does not introduce any extra bit error rate (BER). Since blinded detectors do not produce dark counts, a prudent [PERSON] may send [PERSON] random fake-noise pulses targeting each detector separately (at individual dark count rates), thus not taking chances in case [PERSON] is monitoring the dark count rates of the detectors. Note that by [PERSON]'s principle of cryptography [23], [PERSON] knows the dark count rates of [PERSON]'s detectors.