 So my name is Veronica O'Fingere, I have not said before, and I come from the Universidad Autónoma de Barcelona, and I will be sharing the session today. And it is my pleasure to introduce you, Professor Stefano Pirandola from University of York, that he will... Okay, thank you, thank you. Okay, thank you very much for the introduction. Okay. So can you hear me? Yes, can you hear me? Oh, let's wait if you put that there. Okay, so let's... Okay, so this is, yeah, three lectures on quantum cybersecurity, and after me there will be eBrain, talk about, I mean, other two lectures, talk about experimental applications. Now, when I start fighting with this, I'll write that the best solution, probably. So I can hear, sorry for my voice, I'm a bit of cold. So I uploaded this document on the website of the school, and it's quite, I mean, it's actually the first part, actually, I mean, it's the first part and other parts of this review that you may find on the archive with a bunch of other people. It's called Advanced Synchronography. Now, this is just one to take, I mean, this document is just, I mean, a collection of three excerpts, three parts from this review. I wanted to pick three main themes. First of all, the basics of quantum distribution. This is called discrete variable protocols, like BB84 in particular, which is the most important, of course. And I want to give you some idea of why this is used, I mean, why this works, what type of security you have, how you prove security, I mean, easily, somehow, for in terms of very, I mean, against very wide, very general attacks. And then, okay, we'll move to, this is called continuous variable quantum key distribution, which is a more advanced formulation where you have like a more, well, the possibility to have higher rates, generally speaking, and also in terms of application, it might be a cheaper implementation than standard, discrete variable quantum key distribution. And then at the end, the third hour, if we survive, and I survive, we look at a single key capacities, so some very recent result on basically, what are the ultimate limits in private communications? So what is the best rate you can achieve in private quantum communications? But okay, so I'm not going through all the details of this document, I'm going to use mainly the blackboard, not the whiteboard, the blackboard, likely. And so I'm going to pick some, I mean, some of the most important topics here in this document. So first of all, I want to ask you, what is your knowledge on, in terms of, well, quantum formation and continuous variable quantum formation? So what about quantum formation? You already know more or less the basics, right? Resuance. Okay, that's good part of the audience. And what about continuous variable quantum formation or quantum optics? Okay, well, yes, so not bad. Okay, so let me start with the, some of you, I mean, of course, there are other lectures about this, but about continuous variable quantum formation and I guess also there's been something about this key variable quantum formation. So let me give you like very basic elements. So, okay, so let's talk about, well, qubits, okay? So, because I mean, this is very important for me. When I say this key variable, protocols, basically I mean, I mean that we are using systems that have this, basically a finite dimensional eberspace. So the degrees of freedom are very simple. It could be like a spin, okay, we just bidimensional eberspace or a q-dit, the dimensional eberspace or d-levels. In continuous variable, it somehow is considering continuous, okay, degrees of freedom. So, infinite dimensional eberspaces. So in that case, we are looking at stuff like, well, the electric field. So the value of the electric field or the components of the electric field, okay, can take like a, I mean, this is called quadratures of the electric field. They have like this kind of continuous spectra or eigenvalues. So in that case, you have much more, much larger eberspace, of course, an infinite dimensional eberspace. Okay, but let's talk about qubits, okay? So of course, what we are talking about, I mean, the first thing to know is about that. When I have like a qubit, okay, let's say a pure state, right? I mean, okay, I can define a computational basis. Okay, just zero one, okay? And then I can always write that, okay, something like this. So that's an arbitrary pure state, so arbitrary pure state of a qubit. So we can write something like, okay, like this. Okay, so now what is this representation? So it's basically you have corresponding geometry picture, which is the block sphere, okay? So you have like this, well, not giotto, but okay, this kind of block sphere. So that's the quito, okay? So that's part of the quito. So the north pole, basically you have zero, right? The south pole, you have one. So cat zero and cat one. So that's the origin, right? And then you can see that, okay, you can see that this guy here is the polar angle, okay? So you get the polar angle. And also, okay, you have to consider like, that you may have like here, projecting here, okay? You may have like another angle, okay? Along the equator if you want. So you have basically the azimuth, okay? Azimuthal angle, here. So you see if you're already here, so that, okay, so if theta is equal to zero, so basically cosine here is basically, we're just kicking up basically, yeah. That's cosine is one, and the sine here, we have here is an half, okay? It's just conventional, okay? You can also write with other half, but I mean that's the best way to represent this. So that's basically, it is one, and you get the north pole. If theta is equal to pi, you go the other way around, and you get the other cat one. And when you have like theta, which is, so if you got theta equal to zero, you got that state, and when it's pi, you got that state. Now this is the computational basis, okay? Which is also called the Z basis, right? Because these are the eigenvalues of basically, this operator here, which is the Z Pauli operator, okay? Or sigma, I mean that's several conventions, Z, sigma, Z, whatever. Okay, but now, okay, what's happening if I consider the equator, right? So the equator I have like here, what is called like the plus, right? And here I got the manos. Now these are given by, so it's like you take theta equal to pi half, so you got like there. And then you have two choices. You take phi equal to zero, or phi equal to pi, right? So you get there, or you got like there. So now I'm basically going along the equator, and here you get plus, and you get manos, right? And these are the eigenvalues. Sorry, the eigenstate, not the eigenstate of basically the X Pauli operator, okay? And then you can make other choices, like for instance, you may, well, you may consider special where you are here, and here, okay? So this is also sometime called the plus I, and manos I, right? And so basically this is achieved when you got the phase, which is pi, I mean this azimuth, which is pi half, or three half pi, okay? And then you got this and this, right? And this is basically the eigenvalue, the eigenstate of the Y operators, which is this, this Pauli here. Okay, now, so this actually, so why am I telling you about this? Because I mean, of course, it is really the very basic information you need to know, okay? So what is the deal here? The deal here is that, okay, each of this, so that's my Z basis, that's my X basis, okay? Coming from this operator there, right? This is my Y basis there, okay? So these basis are known to be mutually unbiased. So what does it mean mutually unbiased basis? Okay, it's like this. So mutually unbiased basis. Okay, so mutually unbiased basis basically means that, okay, if I give you like one or two eigenstates, okay, in one of those basis, and I try to measure it using a different basis, okay? So if I pick, for instance, I don't know, let's say plus, okay? So plus is about also, of course, can also be written like this, right? So that's my plus. Is this state here, okay? So for instance, if I pick this plus from the basis, which is X, okay? It's one of the two. And then I try to measure this in the Z basis, okay? I remember that that Z basis is the computational basis here, right? Okay? So what I get? I mean, it's like, I mean, it's easy to see, no? That I mean, if I compute this, right? That's equal to this, which is equal to one-half, okay? So what's going on? What's going on that if I pick away that state from one basis and I use another basis, another of these basis, the Pauli basis, because they are mutually unbiased, it means that I'm getting a completely random output, okay? So if I use these basis, I get zero with probability one-half and I got one with probability one-half. And this is actually the property of all these basis, okay? So whenever you pick one from, if I get, I mean, if I pick a minus, it would be the same. If I pick also, I mean, use the zero-one and I use the X basis to measure, that would be exactly the same. Well, that's a very important observation because it's really at the basis of why BBAT4 is working. So that is to keep in mind, okay? So if you have like a basis, so they get state of one basis and if I pick the wrong basis, so somehow if I pick X, I have like a completely random output. Of course, I mean, if I pick Z, I'm fine because I mean, if I pick Z and I get, I mean, if I pick the same basis, so if I prepare, if I have this and I measure this in the X basis, then it's fine. Can I get, I have a deterministic output? Okay, so that's important to remember. So M2M bias basis. These are used in BBAT4. I'm going to explain a little bit. The other notion which is very important is no cloning, okay? So no cloning is really, I mean, a very simple consequence of the linearity of quantum mechanics, okay? Because one say, okay, suppose I have like an input, which is from the Z basis, okay? So I get zero and one, okay? From the Z basis. Then suppose I can actually consider a machine which clones perfectly, okay? This states, so it creates something like this, okay? So my input is one of the two other states and at the output are two copies. Why I want to do that? Because, okay, my name is dropper, I'm on a channel and I'm getting some state. I want to create two copies. I want to send one copy to the legitimate user. I want to keep one copy for me because I want to withdraw the information, okay? So suppose this can be done, okay? But now the question is that, okay. Can I actually, can I actually do the same for this? So if I pick now a state from the X basis from which is a mutiland biased with respect to the other one, can I do this? So can I clone like this? Well, I mean, it's, clearly no, you can't, okay? So what you can see because you have this, right? So, I mean, you cannot do this, right? Because it's easy, you know, you just exploit the, well, this, I mean, the standard expression for the plus eigenstate, so you get, and then what you get, right? So because you have this transformation, the ballinarity, you go into something like this, right? But this is actually, I mean, just compact notation for this, okay? So that's the rule you establish for the Z basis, okay? So you apply the fact that, I mean, this is like a quantum mechanics linear, so you need to apply that to those eigenstates. So this is going to be cloned, it's going to be cloned, okay? Then you sum up them. I mean, you consider this kind of tensor product here individually for each of these terms, and of course, this is different from this, okay? Because that would be like something like, okay, one half, and then you get all the, no? You got all these pieces, that's different. Okay, so that's important. Of course, it's very fundamental in quantum cryptography because you want to use that. In fact, what is the most, I mean, the simplest way to use mutual embies basis and no cloning is before even, I mean, not historically, but conceptually, even before BBT-4, the simplest QKT protocol is basically the so-called B92. So it was proposed by Bennett in 92 as, and it's today probably the simplest. So what you want to have, you want to achieve, you want to achieve basically, you want to use two non-orthogonal states, okay? So as long as I'm using something which is not zero and one, okay, but something like, say, zero and plus, okay? Then I kind of, I mean, I'm kind of using two mutual embies basis and I'm kind of relying on the Neucloning Theorem, okay? So in the B92 protocol, it's not the same thing as this. So basically you pick like a zero and plus. So you have like a bit. So as I said, there is a standard called Alice and Alice is encoding zero, the bit zero into that state and the bit value one into that state, okay? So that's my encoding, classical encoding. Right. And then there is the channel, okay? Here is Bob who wants to basically detect these states and retrieve a zero one, okay? Now the problem is that here in the middle, there is Eve, this is his dropper, trying to attack these states, right? Now we know that because of the Neucloning, so if you use like a, so called a quantum cloning machine, that quantum cloning machine has a limited power. In the sense that if this quantum machine is working very well for zero, okay? So if the quantum machine is perfectly cloning zero, well, it's really bad in cloning plus and vice versa. So because of this non-orthogonality between these two states, that actual attack is now not perfect, okay? And this dropper only sometimes is able to get the input from Alice, okay? Okay, I'm not going to talk more about this BNNRT rule, but that's just the idea is that it is the simplest protocol basically exploiting which exploits the fact, okay? That the input signals, the two input states are non-orthogonal, okay? So if you want to belong, in particular there are between two motor and bias basis, okay? Because of this, this is not working perfectly and you can achieve security and you can achieve some kind of security threshold and so on. Now, this was just wanted to tell you about some basics idea, okay? Behind this QKD, this quantum cryptography model and in general behind QKD protocols. Now, let's look at VBAT4 in detail, okay? Where these concepts, especially this and the use of these two basis is fundamental. Okay, now, VBAT4 suffered with the description of the protocol, right? And I don't know if I can use actually my slides. Okay, okay, so that's the, that is actually, right. So you see here, this is how VBAT4 basically is working. So it's very, very, very condensed way. So you have Alice on one side and Alice, she wants basically to encode a bit of information, okay? Zero or one, it's something as in B92, okay? So she wants to send this bit to Bob in a right way but okay, what does, I mean, just doesn't use the Z basis. I mean, if you, she was using just the Z basis, right? This means that she was going to encode zero into that state and one into that state, okay? And if it only does that, we know this is not secure because I mean, if she sends these two, I mean, you can actually perfectly clone the input so if we can get the perfect copy, okay, and completely understand the input, right? So what she does is she randomly switches between the two bases, okay? So, okay, 50, I mean, 50% of the times, she does this, okay? The other 50%, she does the, she used the other bases, the X bases, okay? So, let's say that the first operation she does is just she randomly pick a number between zero and one, okay? And then after that, she does a second random operation. Okay, let's encode this number, this bit value, say zero, into either the Z basis or the X basis. So if she chooses the Z basis, then zero go into that cat zero. If she chooses the X basis, zero goes into the plus state, okay? So this extra layer of randomness, the switching between the two bases, which is clearly fundamental, okay? Because now the same bit zero that goes through the channel could be potentially encoding into non-orthogonal states, okay? And if his dropper doesn't know what somehow, what type of cloning she has to do. Do I clone the Z basis or I clone the X basis or, okay, she doesn't know, okay? And because of this, she cannot perfectly call or clone the input. Well, so that's the basic trick. But now what's going on for Bob? Of course, Bob needs to be in the conditions to understand, okay, what was the input. So at the end of the communication channel here, there's Bob, right? Now Bob needs to decode the input bit. Okay, now Bob knows that Alice has been randomly switching between Z and X, right? But it doesn't know, no, in each instance. And I suppose that basically it is a protocol like with many rounds, okay? So Alice is sending like a lot of signals. And each time she's switching between bases. So Bob doesn't know what bases were used. It has to basically switch randomly between X and Z, okay? So what's going on? So suppose that Alice has been using the Z basis, okay? Now if Bob is using the Z basis as well, right? Yes, he's able to perfectly retrieve the input, okay? Because it's going to measure in the current basis. And so it's going to get zero and one perfectly, okay? Without any errors. But if Bob has been using the, for that instance, Bob used the X basis, then it gets completely random. So for instance from zero, it can get here plus or minus. So one or two are against state of the basis. I mean with 50%, something like this, okay? Or the same. If one is coming here and he used the X basis, again he has a random output, okay? So the same, the basis is X. And if Bob is using the X basis, so the corresponding basis, so X with respect to X, so it's going to get plus, it's going to detect plus perfectly. So to the code zero, which is basically the label if you want. And it's going to detect miles perfectly. So it's going to do the code one again. Now again, I mean if instead it was using the Z basis, and for instance if he receives plus, here he would get zero, one, zero, one randomly, okay? So what they have to do then to eliminate these instances. The idea is that, okay, so there's this kind of randomness, okay? Going on. So the idea is that, okay, what about if at the end of the protocol, okay? Alice use a kind of public channel, okay? Classical channel, like a telephone or internet or whatever, which is somehow not, I mean, which is robust. So it's kind of, I mean something that, of course, the dropper cannot tamper with. So a classical channel, not a communication channel. Or when I talk about a communication channel in practice, I mean this communication, for instance, could be, sorry, I didn't mention this, but basically this communication could be like a Q, I mean a polarization qubit. So it could be like a photon with some polarization, like different polarization could be like a vertical horizontal for zero and one and diagonal and so on. So you have perfect mapping between these ideas and corresponding photonic implementations. This channel could be like a fiber, an optical fiber with some noise, okay? And you have to assume that the worst case scenario, that noise is due to a new dropper. And Bob here is at the end is applying some detection which could be like, well, photon detection generally, or I mean it's just clicking using like some kind of different meter and trying to polarize it with splitter. So you can use like optical, linear optics in general to understand, to make these decoding. So to implement the measurements into the Z or X basis. So all this has an optical implementation clearly. So what's going on here is that, okay, so they do this kind of process and at the end they say, okay, now let's reconciliate the basis. So this is a very important step in a protocol of this. And it's also called sifting, okay? So Alice is using another channel now, a classical channel, not the fiber, a classical channel, okay? Like a telephone, whatever, to say, hey, look Bob, I am using for this instance the Z basis. I'm using for this other instance the X basis and so on. And now Bob say, okay, reply, okay, in this instance I got the correct one. In this other instance I got, I used the incorrect one. So they can understand, run by run, if they were using the same basis or different basis. So this means that they can basically, they had to throw away half of the communication rounds where the basis were different. So Z X or X Z. And they're keeping half of the instances where they were basically using the same, X, X, Z, Z, okay? So this means that they have like, so this means that they have basically perfected the coding. So Bob is perfected the coding in half of the cases, is perfected the coding, the input. Okay, now you may imagine, okay, look, but this is actually, this kind of random switching, right? Could be done by this dropper as well, right? So this dropper, instead of using a quantum cooling machine, right? It could use, okay, let's apply, actually one of the most basic attacks, which is called interceptor send. So let's apply the same, the same idea, right? So here, let me use this one. Not the B92, it's, no, it's BBT4. Okay, BBT4, so probably it's better to use the white one. Right, okay, so remember, so this L is here, bit 01, okay? That's important, that's classical formation to be shared. Now, 50% of the time, she picked Z, that basis, and the 50% of the time, okay? She picked that basis, okay? So this is random switch, right? Now, this goes to the channel, right? And now, as I told you, there are two chances, okay? Bob is using Z, okay, that's fine. He's using X, well, no. They discard the distance. Now here, he choose Z, well, no. He use X, that's fine. And if they do this like this, this kind of decoding, Bob is doing this decoding, then it's fine. Now, what about if in the middle, there is dropper, no? That is actually the same, okay? So she could actually measure the input system in Z or X, no, randomly. So basically, she can apply the same decoding process of Bob. Of course, I mean, if she does that, well, there are two issues, okay? First of all, because of the not cloning, no? So she introduced a lot of noise in the communication line. And we quantify now exactly what is this noise. For that second observation, if she does that, she actually gets more information than Bob, okay? So basically, she is actually replacing Bob in the middle of the line. And then she's sending basically a lot of garbage back to Bob. So actually, this interceptor sent attack is a very strong attack in the sense that Eve is actually getting all the information, more than Bob, okay? Now we see more precisely about that. But the catch, I mean, the other point is that it's very noisy. So, and as Bob, they have the chance to measure the noise on the communication line. And if the noise is at that level, okay? So it's quite high. So they say, okay, that's too noisy. So probably Eve is doing interceptor send. And we had to discard, I mean, to abort the protocol, right? So, this is an important point on the standard QKD in quantum photography. It's not that the noise in the channel, I mean, it's not that there is no, there's the presence or absence of a noise dropper on the line. The noise dropper is always assumed to be on the line. But it is important to quantify, okay, how much this dropper is getting as a function of the noise disturbance that is introducing on the line. If that disturbance, that noise is too high, it means that the attack is quite, well, quite strong, too strong to noisy. And the protocol is abortive. It's a kind of denial service, okay? So what we see is that this is like a threshold. As you add to some noise, I can proceed with the protocol. I have both that noise, I can't. And if I have below that noise, I can apply some procedure to derive a key. Above that noise, no, I can just add to abort. So, I think I have a table about this interceptor send which is quite, so basically that's the, okay, let me try to do this. This was going on with the interceptor send. Well, let's just take a look first at the first idea. Okay, so, remember, okay, so Alison Bob are going to throw away here the wrong basis, okay? So in the sifting, at the end of the protocol, they agree what instance is to keep. So Bob is only getting to, so you only get Z and Z, and you have like X and X, okay? And this is thrown away. So after sifting, the situation is that LZ, Bob Z, or LX, Bob X. So for instance, this is the situation here. So suppose like, okay, so after sifting, you have this situation here. So Alice was using Z and Bob applies corrected Z, okay? Now remember, if this no noise on the channel, everything is perfect. So Bob is going to get zero one, okay? So it is no problem. But if this Eve doing an interceptor send, that's, I mean, this is now the issue. So Bob Eve in each of these shifted instance where they are picking the same basis, of course Eve doesn't know beforehand if they were using ZZ or XX, okay? So this is kind of randomly, I mean this is agreed at the end. So when she was using, when she was attacking the line, she could only switch between the two. And so 50% of the time in this ZZ instance, Eve has been using the Z correct basis or the other 50% the X basis. Well, when she has, that's using the Z basis, so she's okay, projecting like the input, I guess state, okay? When the correct basis, so she's losing no noise. So if she gets zero, she gets zero. If the input is one, she gets one. So there's no noise. These are I guess states of the Z poly operator. And then she has the output from this measurement and the state are not perturbed at all. And the same state are sent to Bob, Bob applied, I mean Bob in the case was applying Z, so Bob achieves zero one. And in all this process, there's no noise. But also in all this process, Eve is getting all the information from us. Now, in this other situation, Bob, Eve is using the X basis. Okay, now she's making the wrong choice. And what's happening is that for any input, let's say zero, X give you randomly plus or minus, okay? So it's this idea here, apply for, okay, the other basis if you want. So when she gets one of the input and apply X, so one is projected onto plus or minus with the sample updated. So the information is completely randomized, right? So Shirley doesn't know how, I mean she has a random input. And she realized that after, I mean they declare now the basis that okay, in this case I used the X. So what I got is just a completely random number. It's not related to, I mean it's really 50% of the time is correct, 50% of the time is not correct. And then it's the same, when she release one of these states to Bob, so suppose that okay, she measure plus and plus is sent to Bob, but now Bob is using Z here. And again he's getting, because he's measuring plus in the Z basis, is going to get again here, I mean 50% of the time, one value, 50% the other. So it's completely random, okay? So this question marks here now comes from the fact that it wasn't with dropper, okay? And so it's, the dropper causes noise, right? Here, and this is kind of important point. Now similarly, for the other X instances, so when Alice and Bob were using the X basis, it's the same. If the dropper is using the same basis, so it has the perfect information and no noise, but if it is dropper using the other basis, then she has a randomized output and she's sending a lot of somehow garbage to Bob because Bob is going to now getting stuff which is in the Z basis and is measuring this stuff into the X basis. So again, Bob is going to get a random output. So yes, she doesn't know. She just randomly switching. Because it's done before any classical communication between Alice and Bob. So Bob, Alice, the advantage somehow between Alice and Bob with respect to Alice, is in the agreement of the basis because I mean they do, I mean Bob is switching, Eve is switching, okay? Also Alice is switching. So everybody is switching here. But at the end, it's Alice and Bob picking the correct basis. So shifting. And so when they agreed that, I mean it's not basically a posteriori at the very end. So when they agreed that, they will drop and say, okay, for those instances, I mean she was using X or Z, X or Z. Of course if Alice was going to agree with the dropper, it would be different, but that would be another case. So the idea is that, okay, is that clear? I'm too fast or too simple? Yes, it's not to Eve. Yeah, she knows about the classical communication, the public channel, okay, which is the public classical communication channel, is used to somehow at this level, this point, is used by Alice and Bob to agree the basis. So to reveal the basis. Of course, I mean, Eve is hearing that. Eve's dropper also gets this, she gets this information. And she knows when Alice and Bob were using Z and when Alice and Bob were using X. The point where I was saying is that, even if she knows this information, this information is only available at the very end. After basically all the interactions, all the interactions that the is dropper was using in each channel. So somehow she was, I mean, during the protocol she was using randomly switching between the basis. She didn't have this information. This information is basically given at the very end. And they agree the same basis. And she somehow, I mean, she basically, for each agreement of the basis, she still have a randomness, just because she was left out of the game somehow, right? But she knows when it's Z, Z, and XX, as she also knows that information afterwards, because the public communication channel is used by Ace and Bob also for other things that I'm going to explain. Okay, now, okay, so, let's see, where am I? Probably, I should run a little bit. Okay, now, so here it's important to a very important point, okay? Now, so, the first observation is okay, let's see about noise, okay? How to quantify noise? So now, so that's the picture of, okay, let me just look at one basis because it's actually symmetric, okay? Just this space for, okay. But just look at this basis. Okay, now, now it's important to use, okay, suppose that this is going on, this attack, okay? Which is the most basic, one of the most important as well. Probably I can also raise this. Okay, now we have to, as I was saying, okay, that's pretty powerful attack because that's where it's called intercept resend. There are some point here to understand. First of all, when we talk about noise of the attack, this is quantified by quantity, which is called cube, okay? Which is quantum bit error rate. It's a quantum bit error rate. So this is the first point to understand. So what is the quantum bit error rate? Okay, so Alice and Bob have this noise. I said, it's like this noisy channel even the middle, right? I remember there's also like this kind of classical communication channel and it's only this, okay? Where they can actually communicate like with the phone or whatever. Now, the point is that they are doing this process. So they are like, so like it is like this quantum army that are like say n rounds and uses of the channel, of the quantum channel where n is typically very large. So it means that Alice is doing that this encoding n times where n is typically is quite large and Bob is doing this decoding n times, okay? Now we know that using the classical communication channel, I mean they actually can do this sifting, okay? So basically they throw up, I mean basically they just select n over two. So after the instances, basically after sifting, so they use this to say, okay, you're using this so let's pick x, x, z, z. So after the times they are fine, they pick those instances. Now, if it's assumed to be on the line, how to quantify the noise? First of all, how to understand basically what how to estimate the noise in the first place. So what you have to do actually, after this process, so you can imagine that they have like a number of, I mean locally they have basically very large, very long strings, okay? So let's say Alice, so they have Alice as basically n over two bits like, I don't know, something like this and Bob has corresponding bits like this. Okay, just for example at the first n so on, n over two. Okay, now, these two strings in the absence of noise would be identical, okay? And it's what is called the shifted key, okay? Now the problem is that not this seems to be, because there's Eve, there's noise, and you may have like that one Eve is speaking, one Eve is speaking the wrong basis is interfering with the process and basically it's like creating like a bit flip. There, for instance, oh, there, and so on, right? And this comes from the fact of basically the random switching that Eve is doing. So she's introducing errors, okay? In this keys, in these strings. So how to do that? So what we have to do? So they need to quantify the rate of this error in these strings, okay? So what do you mean quantify? Given an input bit in the shifted key, okay? What is the probability that the corresponding output bit is wrong, okay? So somehow it's like, okay, what is the probability that given one, you got zero, probability of given one, sorry, given one, you get zero, probability of given zero, you get one, something like this, no? So something like this, probability of error, so you got probability of zero times, no? Plus, so that would be the average error, the average error probability. So with some probability one-half, Alice is picking the value zero, but there is some chance there is a bit flip, okay? So probability one-half, Alice pick the value one, is corresponding, probability there is a bit flip. Now, the process is completely symmetric, this is what is known as, no, binary symmetric channel, okay? So remember, the binary symmetric channel is a very cleverness, the basic channel in information theory, where, so suppose that is like the encoding, right? And it's like the decoding. So you get some probability, you get something like this, where this cross probability is basically P, right? And one minus P, so there's a probability of bit flip which is equal to P, okay? So basically we say that this is actually equal P, equal to P, and that's equal to P, right? So this guy is actually equal to bit flip, okay? So you have a bit flip probability. Now, this bit flip probability applied to the safety, the strings, is the cube bar, what is called the cube bar? Where is that? There, okay? So is the probability all error? Now, when you look at this process here, right? Roughly you can understand how is this, how large is this probability of error, okay? So let's take a look. So of course, when you have, for instance, when you have like, when you are in this situation here, there is no error, okay? When you are here, I mean, you can look at this basis, be the same for the other basis. When you are here, what does it mean this? So this basically, it's a random output. It means that Bob is getting zero or one with the same probability. So 50% of the time, it gets zero, which is fine. 50% of the time here, it gets one, which is wrong, okay? So what's happening? It's happening that here is always perfect at the coding. Here, half of the time is wrong. So the probability of error is 25%, right? You think about that. Even Alice is encoding zero, okay? Here, it's perfect decoded. Here, it's going to get zero, 50% of the time, one, 50% of the time. I can see that it is a random switching, which is one half between the two basis, okay? You have basically, you have four possible outputs here. I mean, three times, so these uptops are fine. So it gets zero, zero, zero, and then a one. Do you agree with this? It's 25% dq bar. Is that clear? Is that? Sorry, okay, okay. So remember, this is basically, it's one half of the time when you are here, one half of the time when you are here, okay? Now, given the one half of the time that you are there, one half of the time, the output is zero is correct. So one half times, one half, so one quarter, 25%. So this is the same for the same basis, for both basis. So in BBFD4, with the sector send, dq bar is 25%, okay? So there is like one quarter of the times, there's a bit flip in the data. Now, how they can actually quantify this? Well, the trick is that, I mean, they need to know this. They need to know this quantity, because that's a lot of noise, okay? So how do they can do that? So basically they are going to pick random subsets of their local data, okay? And I'm going to, I mean, they agree that. They say, okay, let's reveal, okay, to everyone a random subset, okay? Say the first instance, the second instance, and so on. So for instance, they're going to say, okay, let's declare that one, that one, and it's a random subset. So they pick it also probably that one. They don't know if it's different, that one, that one, okay, that one, that one, that one, that one. So they're going to reveal part of the data. Of course, when they reveal this part of the data, this part of the data is no longer usable for a key, okay? So, but this data is now compared on the public channel. So let's say that they use M instances, for what is called the parameter estimation, for the parameter estimation, okay? So for instance, they get, okay, they get zero, zero, they get, okay, one, zero, and then one, one, zero, one, zero, zero, and then, I mean, they compare this on the channel, using this classical channel. They say, okay, I got zero, you got zero. I get one, I got the, oh, it's an error. And then they count, okay, how many errors I have? At this rate, asymptotically, because I mean, this is yet to understand, this N is very quite large, so somehow this frequency give you the probability of error, okay, and then they can understand, oh, okay, we are wrong, 25% of the time. And they say, okay, so the cube error is 25%. That's now is known to them. Okay, so when they do this, they are left with N over two minus M bits, which are still, I mean, all the one which are remaining, you know, so the one which are not revealed, okay? This could be a quite large number, actually, because for the parameter estimation, this M doesn't need to be so big, okay, while N is quite big. So this procedure of probability estimation is not actually going to affect what is the asymptotic performance of the protocol. It has an effect in so-called finite size performance, but asymptotically it's fine, right? And okay, now potentially they may use this remaining bits for as a key or to do something, to do other stuff, like error correction, I will tell you about that in a bit. But for this specific protocol, 25% is too much, okay? And then they say, okay, we just abort the protocol because 25% is comparable to an interceptor send. And when there is this interceptor send attack, okay, basically if is getting more information than Bob, just because if is kind of applying the same decoding as Bob in the line, when it does the same decoding, she get the same information. And when she, I mean, she get at least the same information and when she's doing the wrong decoding, she's basically destroying the information and that information is also destroyed for Bob. So if is getting at least the same information of Bob. So 25% is too high, and they have to abort the protocol. Okay? So, well, do you want to take a break? Or, yeah? Okay, let's have a break. Let's see you in, I don't know, 15 minutes.