{'fraction_non_alphanumeric': 0.03399475851740921, 'fraction_numerical': 0.011231748408835642, 'mean_word_length': 4.113323124042879, 'pattern_counts': {'":': 0, '<': 0, '<?xml version=': 0, '>': 0, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 1, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
Third Party CNOT Attack on MDI QKD

In this letter, we concentrate on the very recently proposed Measurement Device Independent Quantum Key Distribution (MDI QKD) protocol by Lo, Curty and Qi (PRL, 2012). We study how one can suitably present an eavesdropping strategy on MDI QKD, that is in the direction of the fundamental CNOT attack on BB84 protocol, though our approach is quite different. In this strategy, Eve will be able to know expected half of the secret bits communicated between Alice and Bob with certainty (probability 1) without introducing any error. Further, for the remaining bits, where Eve will only be able to predict the bit values as in random guess (with probability 1/2), she will certainly find out whether her interaction induced an error in the secret bits between the communicating parties. Given the asymmetric nature of the CNOT attack, we also introduce Hadamard gates to present a symmetric version. Though our analysis does not refute the security claims in MDI QKD, adapting the CNOT attack in this scenario requires nontrivial approach using entanglement swapping.


I. INTRODUCTION
The idea of quantum key distribution was introduced by Bennet and Brassard, that is famous as the BB84 protocol [1,2]. Against BB84 [2], one of the most fundamental attack in this area is known as the CNOT attack that uses a CNOT gate. In this case, Eve can obtain complete information for the qubits sent in Z basis without creating any disturbance. However, for the qubits sent in X basis, Eve can not have any advantage and it also induces a disturbance as high as 1 2 . There are several variants of the traditional BB84 protocol that received attention in literature. The very recent proposals [3,4] are motivated from resistance against side channel attacks where they allow an untrusted party in the protocol. In particular, to resist detector side channel attacks, measurement device independent quantum key distribution idea has been presented in [4]. We will show how the fundamental idea of CNOT attack can be suitably modified to be accommodated in this scenario. As this proposal is very recent, to the best of our knowledge, such attack has not yet been studied. The CNOT attack is inherently asymmetric. Thus, we exploit the Hadamard gate towards a symmetric version of this attack.
In MDI QKD [4], Alice and Bob need not measure any qubit, and all the measurements are executed at Eve's end, an untrusted third-party. Thus, for eavesdropping strategies, it is natural to consider that Eve herself will try to gather information about the secret key while assisting Alice and Bob. That is why, this attack can be termed as third-party attack. While the idea of [3] uses entanglement swapping [5] for building the protocol, it is interesting to note that we exploit this for third-party CNOT attack against MDI QKD [4]. The application of entanglement swapping is evident in such protocols (either in design or in analysis) due to the involvement of the third-party.
Let us now present a few notations that we will be using. By BER AB we denote the Bit Error Rate for the key bits between Alice and Bob. By P E , we denote the Success Probability of Eve in correctly guessing the bit that Alice sent to Bob in form of a qubit. The eavesdropping technique (that we present here) considers that Eve will either get the complete information about the bit, i.e., P E = 1 or she will have no information at all other than the random guess, i.e., P E = 1 2 . However, in the second case, Eve will have some other kind of information as follows. By π E , we denote the success probability of Eve in correctly guessing whether an error gets introduced during the communication between Alice and Bob. That is, in this case, Eve may not have any knowledge about the value of the bit, but she exactly knows whether an error has occurred or not during the communication between Alice and Bob, i.e., π E = 1.
II. CNOT ATTACK ON MDI QKD [4] To understand this algorithm, we use Bell states. These are two-qubit entangled states that can form orthogonal basis. The four Bell states can be written as The untrusted third-party Eve measures the states received from Alice and Bob in this basis and informs the measurement result back to them. For eavesdropping purposes, we will also study some other measurements by Eve on the qubits through which she will interact with the qubits sent by Alice and Bob. For such purposes, based on the public discussion between Alice and Bob, Eve will either measure in Bell basis or in computational basis, i.e., |00 , |01 , |10 , |11 . Before proceeding further, let us first explain MDI QKD [4]. ends and encodes the bits in either Z or X basis randomly and send those to Eve. 4. Information reconciliation (using error correcting codes) and privacy amplification are performed by Alice and Bob on the remaining n bits (let us call that the raw key) to obtain m shared key bits (final key).
In the actual implementation, Eve can identify only two (|Ψ ± ) of the four Bell states and that is claimed to be enough for the security proof to go through [4]. Our analysis will also go through in a similar manner in such a scenario. We present the following table for understanding all the cases. When Alice and Bob generate qubits in different bases then those pairs of qubits are discarded and thus this is not shown in the table.

Qubits sent by Probability (Eve's end) Flip
The eavesdropping model in this case is as follows, where the untrusted third-party Eve will try to obtain the information. Eve will take the qubits from Alice and Bob and put each one of them in the control input of a CNOT gate and she will supply |0 in the target. The outputs corresponding to the control qubits of the CNOT gates will be measured in the Bell basis by Eve and the result will be communicated to Alice and Bob. Eve stores the output corresponding to the target in her quantum memory. Then Alice and Bob will go for public discussion to announce their bases. Knowing these, Eve will try to extract information from the outputs corresponding to the target qubits of the CNOT gates.
Consider that both Bob and Alice communicated in Z basis. In such a case, Eve will be able to copy these perfectly using CNOT gates without creating any disturbance to the qubits sent by Alice and Bob. If the measurement output at Eve is |Φ ± , then the bits of Alice and Bob match. Similarly, if the measurement output at Eve is |Ψ ± , then the bits of Alice and Bob do not match and one of them needs to toggle his/her bit. Thus in this case, Eve will obtain all the information without creating any disturbance. Note that, in this case, Eve will measure her target qubit in computational basis, i.e., |00 , |01 , |10 , |11 .
When Bob and Alice communicate in X basis, then error is introduced by the CNOT attack and the situation can be seen as an example of entanglement swapping [5]. Let us explain one specific case here. The other cases will be similar. Consider that Alice and Bob both send |+ . Thus, after the application of CNOT gates by Eve, there will be entangled states corresponding to Alice and Bob respectively. Now the qubits corresponding to Alice and Bob will be measured in Bell basis. One can see that can be written as 1 . The correct measurement in this case is |Φ + AB or |Ψ + AB that happens with probability 1 2 and in such a case after the bases of Alice and Bob are published, Eve will measure either |Φ + E1E2 or |Ψ + E1E2 and she will be able to know that no error has been introduced. However, if the measurement result becomes |Φ − E1E2 or |Ψ − E1E2 (this happens with probability 1 2 too), then Eve knows that an error has been introduced, and she will not be able to know the secret bit. Similarly, we can analyse the other cases and get the following as in Table I. After Bob and Alice publicly declares their bases, if that is Z, then Eve obtains all the information without introducing any error by measuring in computational basis |00 , |01 , |10 , |11 . If the basis is X, then Eve's interaction introduces error at the rate of 1 2 , but Eve does not obtain any information about the secret bits. In these cases, if Eve measures |Φ + E1E2 or |Ψ + E1E2 then she knows that no disturbance has been introduced. If Eve measures |Φ − E1E2 or |Ψ − E1E2 then she understands that error has been introduced, i.e., Bob and Alice will land into a complement bit value at this location of the secret key. To summarize, we have the following situation.

Basis
Operation BER AB P E π E (Alice, Bob) by Eve

From Bob
To

B. The symmetric version
As we have seen in the previous section, the third-party CNOT attack does not introduce any error in Z basis, but induces errors in half of the cases in X basis. Thus this eavesdropping scenario is asymmetric. To provide a symmetric scenario, we make the following modification.
Let H be the Hadamard gate, I be the identity gate (both works on a single qubit) and C be the CNOT gate (that works on two qubits). Let us define P u = (H ⊗ I) u C(H ⊗ I) u for u = 0, 1, i.e., P 0 = C and P 1 = (H ⊗ I)C(H ⊗ I). One can check that Eve applies either P 0 or P 1 based on the outcome of an unbiased coin toss. The case of applying P 0 (CNOT) for each of Bob and Alice has been described in previous section.
In case, P 1 is applied, and both Bob and Alice communicate in X basis then Eve will be able to obtain the secret bits completely without creating any disturbance by measuring her target qubits in computational basis |00 , |01 , |10 , |11 .
However, if Alice and Bob communicate in Z basis and P 1 is applied, then Eve will only be able to predict the secret bit as in the case of random guess (i.e., with probability 1 2 ), though she will be able to exactly identify whether error has been introduced. This case is similar to the one where Alice and Bob communicate in X basis and P 0 , i.e., CNOT is applied. The different cases are explained as follows in Table II Thus, when P 0 and P 1 are used randomly with probability 1 2 in each case, we have the following outcomes.

Basis
Operation BER AB P E π E (Alice, Bob) by Eve The complete algorithm for Hadamard assisted CNOT attack is as follows.
1. Eve applies either P 0 or P 1 on the qubits |µ A and |µ B (communicated by Alice and Bob to Eve) and |0 (ancilla supplied by Eve) for both the cases.
2. The two-qubit state (outputs corresponding to |µ A , |µ B ) is measured in Bell basis and the result is communicated to Alice and Bob. Further, both the outputs corresponding to the |0 qubits (the target ones) are kept with Eve.
3. After the public discussion between Alice and Bob, Eve comes to know about the cases where Alice and Bob communicated in the same basis. The cases where Bob and Alice communicated in different bases are in any case discarded.
4. If Alice and Bob both communicated qubits in Z (respectively X) basis and Eve applied P 0 (respectively P 1 ), then Eve obtains the corresponding secret bit correctly without introducing any error by measuring the pair of qubits in computational basis.

If Alice and Bob both communicated qubits in Z
(respectively X) basis and Eve applied P 1 (respectively P 0 ), then Eve can only guess about the communicated bit with probability 1 2 (i.e., no information better than the random guess) inducing a bit error with probability 1 2 . In such cases, Eve measures her qubits in Bell basis and if the measurement output is |Φ + E1E2 or |Ψ + E1E2 (respectively |Φ − E1E2 or |Ψ − E1E2 ) then Eve knows that error has not been (respectively has been) introduced in the communication.
As Alice and Bob settle on either Z or X basis equally likely, and Eve also applies P 0 or P 1 based on the outcome of an unbiased coin, the error rate in both Z and X basis will be equal. Thus the attack is a symmetric one. On an average, BER AB = 1 4 , P E = 3 4 and π E = 1. Moreover, the eavesdropping by Eve may be induced in a portion of the communicated bits instead of all, say a proportion ζ. This is due to the fact that if Alice and Bob notice a channel noise more than some threshold value, then they will abort the protocol. In such a case, Eve will be able to guess expected ζ 2 proportion of bits with probability 1. For the remaining bits, though she will not gain anything other than the random guess, she will be able to know whether error has been induced during the communication between Alice and Bob. Thus, on an average, BER AB = ζ 4 , P E = 3ζ 4 and π E = ζ. Due to the symmetric nature of this eavesdropping strategy, Alice and Bob would not be able to distinguish this eavesdropping from channel noise.

III. CONCLUSION
In this letter, we have considered how CNOT kind of attack can be mounted on a recently proposed variant of BB84, which is referred as Measurement Device Independent Quantum Key Distribution (MDI QKD) protocol [4]. Though our analysis is in the direction of CNOT attack on BB84 [2], it requires a different approach by the third-party to execute the attack exploiting entanglement swapping. Through this kind of eavesdropping, Eve will exactly obtain around half of the secret bits communicated between Alice and Bob. For the rest of the bits, Eve will only be able to predict the bit values as in random guess. However, she will certainly find out whether her interaction induced an error between Alice and Bob.