## 1 Introduction  
Quantum Theory allows us to have new cryptographic protocols of which we can prove security. Those protocols are secure against adversaries with unlimited power.1 One of those protocols is the Quantum Key Distribution (QKD) protocol which is named BB84 after its inventors [PERSON] and [PERSON] [1]. In this protocol, two users (conventionally named [PERSON] and [PERSON]) wish to set up a common random key, using a quantum channel and a classical (insecure) authenticated channel. Their adversary (named [PERSON]) is trying to eavesdrop on both of those channels in order to have as much information as possible about the agreed key. The goal of [PERSON] and [PERSON] is to use a protocol that can be proven secure, potentially even unconditionally secure, against powerful eavesdropping. In this paper we discuss the security of the BB84 protocol against the _collective attacks_[2; 3; 4], that form a subclass of the joint attacks (which are the most powerful theoretic attacks). This subclass is conjectured2 to contain the strongest joint attacks and therefore, to be as informative to [PERSON] as the joint attack [2; 3]. In addition, analyzing the collective attack is much simpler than analyzing the joint attack. Thus, analyzing the collective attack might be highly relevant for practical setups of QKD where proving security is still a hard task. Footnote 2: See discussion in Section 4. We improve the analysis done in [4] to the BB84 scheme against all collective attacks. The analysis shown in [4] bounds the information in a non-optimal way which adds a factor of \(2^{r}2^{m}\) to the information bound, where \(r\) is the amount of error-correction bits revealed during the protocol, and \(m\) is the final-key length. Our proof uses methods that are used in [5] for the joint attack, in order to achieve an optimized bound for the collective attack. Let \(\mathscr{H}_{2}\) be the 2-dimensional Hilbert space with standard (or computational) basis \(|0^{0}\rangle,|1^{0}\rangle\). Let \(|0^{1}\rangle=\frac{1}{\sqrt{2}}[|0^{0}\rangle+|1^{0}\rangle]\) and \(|1^{1}\rangle=\frac{1}{\sqrt{2}}[|0^{0}\rangle-|1^{0}\rangle]\); it is clear that \(|0^{1}\rangle\), \(|1^{1}\rangle\) is an orthonormal basis; it is called the Hadamard basis. The unitary map \(H\) such that \(H|0^{0}\rangle=|0^{1}\rangle\) and \(H|1^{0}\rangle=|1^{1}\rangle\) is called the Hadamard transform. Due to linearity, \(H|0^{1}\rangle=\frac{1}{\sqrt{2}}[H|0^{0}\rangle+H|1^{0}\rangle]=|0^{0}\rangle\) and similarly, \(H|1^{1}\rangle=|1^{0}\rangle\) i.e. \(H\cdot H=I\) (the identity). Those bases are used for measurements in the BB84 scheme; measuring a state represented as the density matrix \(\rho\) in the \(b\) basis returns output \(0\) with probability \(\langle 0^{b}|\rho|0^{b}\rangle\) and \(1\) with probability \(\langle 1^{b}|\rho|1^{b}\rangle\). Thus if the state \(|0^{b}\rangle\) (or \(|1^{b}\rangle\)) is measured in the \(b\) basis, it results with output \(0\) (1) with certainty. Yet, when \(|0^{b}\rangle\) or \(|1^{b}\rangle\) is measured in the \(\overline{b}=1-b\) basis, the output is random, i.e. \(0\) with probability \(1/2\) and \(1\) with probability \(1/2\). This is the principle underlying the BB84 quantum key distribution protocol [1]. [PERSON] sends [PERSON] qubits (2-dimensional systems), each qubit in one of the four state \(|i^{b}\rangle\) with \(i,b\in\{0,1\}\). In order to send a bitstring \(\mathbf{i}=i_{1}\ldots i_{t}\) to [PERSON], [PERSON] first draws randomly a bitstring \(\mathbf{b}=b_{1}\ldots b_{t}\) and then sends the state \(|\mathbf{i}^{\mathbf{b}}\rangle=|i_{1}^{b_{1}}\rangle\ldots|i_{t}^{b_{t}} \rangle=H^{\mathbf{b}}|\mathbf{i}\rangle\) where \(H^{\mathbf{b}}=H^{b_{1}}\otimes\ldots\otimes H^{b_{t}}\) and \(|\mathbf{i}\rangle=|i_{1}\ldots i_{t}\rangle\), with \(H^{0}=I\) and \(H^{1}=H\). In the conventional setting, [PERSON] measures each qubit in one of those two bases, and whenever they used the same basis they obtain the same bit \(i\).