{'fraction_non_alphanumeric': 0.037572807569252645, 'fraction_numerical': 0.016762831906806313, 'mean_word_length': 4.3200465522257785, 'pattern_counts': {'":': 0, '<': 1, '<?xml version=': 0, '>': 0, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 5, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
On the Optimality of Basis Transformations to Secure Entanglement Swapping Based QKD Protocols

In this article, we discuss the optimality of basis transformations as a security measure for quantum key distribution protocols based on entanglement swapping. To estimate the security, we focus on the information an adversary obtains on the raw key bits from a generic version of a collective attack strategy. In the scenario described in this article, the application of general basis transformations serving as a counter measure by one or both legitimate parties is analyzed. In this context, we show that the angles, which describe these basis transformations can be optimized compared to the application of a Hadamard operation, which is the standard basis transformation recurrently found in literature. As a main result, we show that the adversary's information can be reduced to an amount of approximately 0.20752 when using a single basis transformation and to an amount of approximately 0.0548 when combining two different basis transformations. This is less than half the information compared to other protocols using a Hadamard operation and thus represents an advantage regarding the security of entanglement swapping based protocols.


INTRODUCTION
Quantum key distribution (QKD) is an important application of quantum mechanics and QKD protocols have been studied at length in theory and in practical implementations [1][2][3][4][5][6][7][8]. Most of these protocols focus on prepare and measure schemes, where single qubits are in transit between the communication parties Alice and Bob. The security of these protocols has been discussed in depth and security proofs have been given for example in [9][10][11]. In addition to these prepare and measure protocols several protocols based on the phenomenon of entanglement swapping have been introduced [12][13][14][15][16]. In these protocols, entanglement swapping is used to obtain correlated measurement results between the legitimate communication parties, Alice and Bob. In other words, each party performs a Bell state measurement and due to entanglement swapping their results are correlated and further on used to establish a secret key.
Entanglement swapping has been introduced by Bennett et al. [17], Zukowski et al. [18] as well as Yurke and Stolen [19], respectively. It provides the unique possibility to generate entanglement from particles that never interacted in the past. In detail, Alice and Bob share two Bell states of the form |Φ + 12 and |Φ + 34 such that afterwards Alice is in possession of qubits 1 and 3 and Bob of qubits 2 and 4 (cf. Figure 1). Then Alice performs a complete Bell state measurement on the two qubits in her possession, which results in After the measurement, the qubits 2 and 4 at Bob's side collapse into a Bell state although they originated at completely different sources. Moreover, the state of Bob's qubits depends on Alice's measurement result. As pre-sented in eq. (1), Bob always obtains the same result as Alice when performing a Bell state measurement on his qubits. The security of QKD protocols based on entanglement swapping has been discussed on the surface so far. It has only been shown that these protocols are secure against intercept-resend attacks and basic collective attacks (cf. for example [12,13,15]). Therefore, we analyze a general version of a collective attack where the adversary tries to simulate the correlations between Alice and Bob [20]. A basic technique to secure a QKD protocol is to use a basis transformation, usually a Hadamard operation, to make it easier to detect an adversary as implemented, for example, in the prepare and measure schemes described in [1] and [3]. Hence, we analyze the security with respect to a general basis transformation defined by the angles θ A and φ A applied by Alice and a transformation defined by the angles θ B and φ B applied by Bob. In the course of that, we are going to identify which values for θ A , φ A , θ B and φ B are optimal such that an adversary has only a minimum amount of information on the secret raw key.
In the following section, we give a short review of the simulation attack, a generic collective attack strategy where an adversary applies a six-qubit state to eavesdrop Bob's measurement result. A detailed discussion of this attack strategy can be found in [20]. Further, we look at the general definition of basis transformations and their effect onto Bell states and entanglement swapping. Using the definitions of general basis transformations, we discuss in the next sections the effects on the security of entanglement swapping based QKD protocols regarding two scenarios: we distinguish between the application of a basis transformation by only one communication party and the combined application of two different basis transformations by each of the communication parties. Additionally, we analyze for each of these scenarios the application of a simple transformation with only one degree of freedom and a general transformation. In the end, we sum up the implications of the results on the security of entanglement based QKD protocols.

THE SIMULATION ATTACK STRATEGY
In entanglement swapping based QKD protocols like [12][13][14][15][16] Alice and Bob rest their security check onto the correlations between their respective measurement results coming from the entanglement swapping (cf. eq. (1)). If these correlations are violated to a certain amount, Alice and Bob have to assume that an eavesdropper is present. Hence, a general version of a collective attack has the following basic idea: the adversary Eve tries to find a multi-qubit state, which preserves the correlation between the two legitimate parties. Further, she introduces additional qubits to distinguish between Alice's and Bob's respective measurement results. If she is able to find such a state, Eve stays undetected during her intervention and is able to obtain a certain amount of information about the key. In a previous article [20], we already described such a collective attack called simulation attack for a specific protocol [16]. The generalization is straight forward as described in the following paragraphs.
It has been pointed out in detail in [20] that Eve uses four qubits to simulate the correlations between Alice and Bob and she further introduces additional systems, i.e. |ϕ i , to distinguish between Alice's different measurement results. This leads to the state which is a more general version than described in [20]. This state preserves the correlation of Alice's and Bob's measurement results coming from the entanglement swapping (cf. eq. (1)): from eq. (2) it is easy to see that Alice obtains one of the four Bell states when performing a Bell state measurement on qubits P and R. This measurement leaves Bob's qubits Q and S in a Bell state fully correlated to Alice's result. Accordingly, Eve's qubits T and U are in one of the auxiliary states |ϕ i she prepared. Eve has to choose the auxiliary systems |ϕ i such that which allows her to perfectly distinguish between Alice's and Bob's respective measurement results. Thus, she is able to eavesdrop Alice's and Bob's measurement results and obtains full information about the classical raw key generated out of them.
There are different ways for Eve to distribute the state |δ P −U between Alice and Bob. One possibility is that Eve is in possession of Alice's and Bob's source and generates |δ P −U instead of Bell states. This is a rather strong assumption, because the sources are usually located at Alice's or Bob's laboratory, which should be a secure environment. Eve's second possibility is to intercept the qubits 2 and 3 flying from Alice to Bob and vice versa and to use entanglement swapping to distribute the state |δ . This is a straight forward method as already described in [20].
In detail, Eve distributes qubits P , Q, R and S between Alice and Bob using entanglement swapping such that Alice is in possession of qubits 1 and R and Bob is in possession of qubits Q and 4 (cf. (1) in Figure 2). When Alice performs a Bell state measurement on qubits 1 and R the state of qubits Q and 4 collapses into the same Bell state, which Alice obtained from her measurement (cf. eq. (2) and picture (4) in Figure 2). In particular, if Alice obtains |Φ + 1R the state of the remaining qubits is and similarly for Alice's other results |Φ − and |Ψ ± . This is the exact correlation Alice and Bob would expect from entanglement swapping if no adversary is present (cf. eq. (1) from above). Hence, Eve stays undetected when Alice and Bob compare some of their results in public to check for eavesdroppers. The auxiliary system |ϕ i remains at Eve's side and its state is completely determined by Alice's measurement result. Therefore, Eve has full information on Alice's and Bob's measurement results and is able to perfectly eavesdrop the classical raw key. We want to stress that the state |δ is generic for all protocols where 2 qubits are exchanged between Alice and Bob during one round of key generation as, for example, the QKD protocols presented by Song [15], Li et al. [16] or Cabello [12]. As already pointed out in [20], the state |δ can also be used for different initial Bell states. For protocols with a higher number of qubits the state |δ has to be extended accordingly.

BASIS TRANSFORMATIONS
In QKD, the most common way to detect the presence of an adversary is to use a random application of a basis transformation by one of the legitimate communication parties. This method can be found in prepare an measure protocols (e.g. in [1] or [3]) as well as entanglement swapping based protocols (e.g. in [13,15] or the improved version of the protocol in [16]). The idea is to randomly alter the initial state to make it impossible for an adversary to eavesdrop the information transmitted without introducing a certain error rate, i.e. without being detected. The operation most commonly used in these protocols is the Hadamard operation described by the matrix which is a transformation from the Z-into the X-basis. For our further discussion, the X-basis is given by the states |x+ and |x− with and the Z-basis is the computational basis consisting of the states |0 and |1 . The effect of the Hadamard operation is simply described as In general, a transformation T x from the Z basis into the X-basis can be described as a rotation about the X-axis by some angle θ combined with two rotations about the Z-axis by some angle φ, i.e.
The rotations about the X-or Z-axis are described in the most general way by the operators (cf. for example [21] for further details on rotation operators) For the sake of completeness we want to add that a rotation about the Y -axis is similarly defined by the operator but will not be used in the context of this article. Based on these operators, we directly obtain the matrix repre- and accordingly for the other Bell states. The superscript "(1)" in eq. (13) indicates that the transformation T x θ, φ is applied on qubit 1. As a consequence, the application of T x (θ, φ) before the entanglement swapping is performed changes the results based on the angles θ and φ. In detail, we have the state upon which Alice performs her Bell state measurement on qubits 1 and 3 (cf. Figure 1). Here, the superscripts "(1)" and "(2)" in eq. (14) indicate that after Alice's Bell state measurement on qubits 1 and 3 the transformation T x θ, φ swaps from qubit 1 onto qubit 2. When Bob performs his Bell state measurement on qubits 2 and 4, he obtains a result correlated to Alice's measurement outcome only with probability (cf. eq. (13) and eq. (14) above) Otherwise, he obtains an uncorrelated result, which differs from Alice's result by a Pauli operation, i.e. σ z or σ x . That becomes a problem because Bob is no longer able to compute Alice's state based on his result and vice versa. Fortunately, Bob can resolve this problem by transforming the state back into its original form. Following eq. (14), where Alice performs T x θ, φ on qubit 1, he achieves that by applying the inverse T −1 x θ, φ on qubit 2 of his state. As we will see in the following section, if an adversary interferes with the communication, the effects of Alice's basis transformation can not be represented as in eq. (14) any longer. Thus, even if Bob applies the inverse transformation, Alice's and Bob's results are uncorrelated to a certain amount. This amount is reflected in an error rate detected by Alice and Bob during post processing.

APPLICATION OF SIMPLE BASIS TRANSFORMATIONS
In this section we want to give a short review on the results in [22,23] dealing with the scenarios where Alice or Bob or both parties randomly apply a simplified version of the basis transformation described above. The simplification addresses the angle φ, i.e. the rotation about the Z-axis. In the security discussions in [22], the angle φ is fixed at π/2 for reasons of simplicity. That means, the rotation about the Z-axis is constant at an angle of π/2 such that only the angle θ can be chosen freely. As already pointed out above, the Hadamard operation equals T x (π/2, π/2) (cf. eq. (8)). Hence, the focus of this section is to analyze, whether the Hadamard operation is optimal when applied by one party and by both parties, respectively. To distinguish between the basis transformations applied by Alice and Bob, we discuss a setup where a basis transformation about an angle θ A is applied by Alice and a transformation about an angle θ B is applied by Bob, respectively (cf. Figure 1).

Application of a Single Transformation
From the structure of |δ 1QR4T U given in eq. (2) we see that Eve is able to obtain full information about Alice's and Bob's secret whenever Alice and Bob do not apply any basis transformation, i.e. they use the state |δ Eve introduced into the protocol. For the first scenario, where only Alice randomly applies the basis transformation, the overall state of the system after Eve's distribution of the state |δ P −U can simply be described as where the superscript "(1)" again indicates that T x (θ A , π/2) is applied on qubit 1. When Eve sends qubits R and Q to Alice and Bob, respectively, the state after Alice's Bell state measurement on qubits 1 and R is cos assuming Alice obtained |Φ + 1R (for Alice's other three possible results the state changes accordingly). Comparing this with eq. (13) and eq. (14) it indicates that in this case Bob's transformation back into the Z-basis does not re-establish the correlations between Alice and Bob properly. Performing the calculations we see that Bob's operation T x (θ A , π/2) brings qubits Q, 4, T and U into the form When Bob performs a Bell state measurement, we can directly see from this expression that Bob obtains either the correlated result |Φ + Q4 with probability or an error, i.e. the state |Ψ − Q4 , otherwise. In detail, Eve introduces an error with probability (sin 2 θ A )/2 and since Alice applies the basis transformation at random, i.e. with probability 1/2, this yields an expected error probability It is of major interest for the adversary Eve that Bob obtains a correlated result with a high probability such that her interference stays undetected. Nevertheless, based on the results in eq. (18) we see that it is not possible for Eve to perform an operation on T and U such that Bob will obtain a correlated result with higher probability than given in eq. (19). This is due to the fact that Eve has to choose the states |ϕ i in a way that she is able to perfectly distinguish between them. Therefore, they have to be orthogonal, as already pointed out in eq. (3) above.
Besides staying undetected, Eve's second interest is to obtain as much information on the classical raw key bits as possible. The probability that Eve obtains the same classical bit from her measurement as Alice and Bob obtain from their Bell state measurements is called the collision probability P c . As already pointed out above, if Alice and Bob do not apply a basis transformation, Eve always has full information about Alice's and Bob's measurement outcomes, i.e. their classical raw key bits (cf. eq. (2) above). In the current scenario with one basis transformation T x (θ A , π/2), Eve obtains the state |ϕ 2 T U from her Bell state measurement on qubits T and U with probability as long as Alice's and Bob's results are correlated. This probability comes directly from eq. (18) and eq. (19) above and in that case Eve knows that Bob obtained |Φ + Q4 and further on the respective raw key bits. Summing over all possible measurement outcomes for Alice, Bob and Eve in all possible scenarios (i.e. application of T x (θ A , π/2) and no basis transformation at all) the expected collision probability for the whole protocol can be computed and results in This directly leads to the Shannon entropy Looking at the plot of P e and H in Figure 3, we see that the optimal angle θ A for a single basis transformation is π/2, i.e. the Hadamard operation. Hence, for protocols using only one basis transformation, the application of the Hadamard operation is optimal, as it is already known from literature [13,20,22]. In this case the average error probability as well as the Shannon entropy are maximal at P e = 0.25 and H = 0.5 (cf. Figure  3). If only Bob applies the basis transformation the calculations run analogous and therefore provide the same results. Further, Eve's information on the bits of the secret key is given by the mutual information which means that Eve has 0.5 bits of information on every bit of the secret key. Using post processing methods, i.e. error correction and privacy amplification, Eve's information can be brought below 1 bit of the whole secret key as long as the error rate is below ∼ 11% [11]. This is more or less the standard threshold value for the prepare and measure QKD protocols.

Application of Combined Transformations
In the previous paragraphs, we discussed the application of a basis transformation at either Alice's or Bob's side. When both parties apply a basis transformation with a different angle, i.e. T x (θ A , π/2) and T x (θ B , π/2), then the overall state changes to After Alice's Bell state measurement on qubits 1 and R and Bob's application of T x (θ B , π/2) on qubit Q the state of the remaining qubits is Also in this case Eve measures either |ϕ 1 or |ϕ 4 and has no opportunity to perform an operation such that Bob obtains a result correlated to Alice's outcome. Consequently, Bob observes a correlated result with a probability similar to eq. (19) above, i.e.
and obtains an error with probability (sin 2 (θ A − θ B ))/2 The average error probability for all possible scenarios, i.e. either no basis transformation, a single basis transformation by one party or the combination of two different basis transformations, is computed as the weighted sum over the error probabilities of these scenarios. Since Alice and Bob apply their basis transformations at random, each error probability is weighted with 1/4. This yields an average error probability for all scenarios (cf. Figure  4 for a plot of this function) When the results are correlated, Eve obtains either |ϕ 1 T U or |ϕ 4 T U , as it can be computed from eq. (26). Based on this fact, the collision probability and further on Alice's and Bob's Shannon entropy can be computed following the same argumentation as described in the other scenarios. The Shannon entropy of all for scenarios is again computed as the weighted sum of the single Shannon entropies (cf. eq. (23)). Due to the interference term resulting from the application of two different basis transformations, the Shannon entropy is higher compared to a single basis transformation (cf. Figure 5 for a plot of this function): This is due to the fact that it is more difficult for Eve to react on two separate basis transformations with different angles θ A and θ B . Further, we see that eq. (29) reduces to eq. (23) if either θ A = 0 or θ B = 0. Hence, taking the optimal choice for only one basis transformation, i.e. the Hadamard operation, we see that if both parties apply the Hadamard operation at the same time, the operations cancel out each other. Therefore, a requirement to reach a better result is that the angles θ A and θ B have to be different. As we can further see from Figure 5, the Shannon entropy for a combined application of basis transformations is higher than 0.5 for some regions. In detail, the maximum of the function plotted in Figure 5 is for θ A ∈ {π/4, 3π/4} and θ B = π/2 or vice versa. Hence, if just one of the parties applies a Hadamard operation and the other one a transformation about an angle of π/4 or 3π/4, Eve's mutual information is about 10% lower compared to the application of a single basis transformation (cf. eq. (24)). At the same time, we see from Figure  4 that for these two values of θ A and θ B the error probability is still maximal with P e = 0.25. This means, Alice and Bob are able to further increase the security by the combined application of two basis transformations.

APPLICATION OF GENERAL BASIS TRANSFORMATIONS
In the following paragraphs, we want to extend the results from the previous section by applying general basis transformations, which means Alice and Bob are able to choose both angles θ and φ in eq. (8) freely. Following the scenarios from the previous section, we are at first looking only on one party performing a basis transformation on their respective qubits and afterwards on two different basis transformations performed by each of the parties. For each scenario we will show, which values for θ and φ are optimal to give an adversary the least information about the raw key bits. In the course of the two scenarios, we will denote Alice's operation as T x θ A , φ A and accordingly Bob's operation as T x θ B , φ B .

Application of a Single Transformation
As already pointed out above, the application of the basis transformation occurs at random and Eve is able to obtain full information about Alice's and Bob's secret due to the structure of the state |δ , if the two parties do not apply any basis transformation at all. Therefore, we look at first at the effects of a basis transformation at Alice's side. Her initial application of the general basis transformation T x θ A , φ A does alter the state |δ 1QR4T U introduced by Eve such that it is changed to After a little algebra, we see that Alice obtains all four Bell states with equal probability and after her measurement the state of the remaining qubits is assuming Alice obtained |Φ + 1R . We are presenting just the state for this particular result in detail because it would be simply too complex to present the representation of the whole state for all possible outcomes here. Nevertheless, for the other three possible results the remaining qubits end up in a similar state, where only Bob's Bell states of the qubits Q and 4 as well as Eve's auxiliary states of the qubits T and U change accordingly to Alice's measurement result.
Before Bob performs his Bell state measurement, he first has to reverse Alice's basis transformation. This can be achieved by applying T −1 x θ A , φ A on qubit Q in his possession. Whereas this would reverse the effect of Alice's basis transformation if no adversary is present, the structure of Eve's state |δ makes this reversion impossible, as already pointed out in the previous section. Therefore, the state in eq. (32) changes into for Alice's result |Φ + 1R and accordingly for the other results. Therefore, Bob obtains the correlated state |Φ + Q4 only with probability and the other results with probability Hence, due to Eve's intervention Bob obtains a result uncorrelated to Alice's outcome with probability Assuming that Bob obtains |Φ + Q4 , i.e. the expected result based on Alice's measurement outcome, Eve obtains either |ϕ 1 , |ϕ 2 or |ϕ 3 from her measurement on qubits T and U in the state described in eq. (33) with the respective probabilities P ϕ1 = cos 4 θA 2 cos 4 φ A Since Alice applies the basis transformation at random, i.e. with probability 1/2, the average error probability P e can be directly computed using eq. (36) and its variations based on Alice's measurement result as Keeping in mind that Eve does not introduce any error when Alice does not use the basis transformation T x θ A , φ A , the average collision probability P c can be computed as (cf. also eq. (37)) P c = 1 64 53 − 4 cos θ A + 7 cos 2θ A In further consequence this leads to the Shannon entropy H of the raw key, i.e.
As we can directly see from Figure 6, the average error probability P e has its maximum at 1/3 with θ A ≃ 0.39183π and φ A = π/4 or φ A = 3π/4. For this choice of θ A and φ A we see from Figure 7 that the Shannon entropy is also maximal with H ≃ 0.79248. Hence, the adversary Eve is left with a mutual information of This value for the mutual information is less than half of Eve's information on the raw key compared to the application of a simplified basis transformation (cf. eq. (24) and eq. (30) above). Hence, the application of a general basis transformation by either Alice or Bob decreases Eve's information on the raw key and simultaneously increases the probability to detect the eavesdropping attempt compared to the application of one or two simple basis transformations. Unfortunately, the angle for θ A ≃ 0.39183π to reach the maximum value is rather odd and difficult to realize in a practical implementation. In contrast, an angle θ A = 3π/8 is more convenient and much easier to realize. For this scenario we can compute from eq. (38) an average error rate of P e ≃ 0.33288 and from eq. (40) the respective Shannon entropy H ≃ 0.79148 (cf. also Figure  6 and Figure 7), which are both just insignificantly lower than their maximum values. Accordingly, Eve's mutual information on the raw key is slightly above 20%, i.e. I AE ≃ 0.20852. Hence, the security of the protocol is drastically increased using a general basis transformation compared to the application of a Hadamard operation.

Application of Combined Transformations
In the previous paragraphs, we discussed the application of one general basis transformation T x θ A , φ A on Alice's side. It is easy to see that the results for the average error probability P e in eq. (38) as well as the Shannon entropy H in eq. (40) are the same if only Bob randomly applies the basis transformation T x θ B , φ B on his side.
Hence, the more interesting scenario is the combined random application of two different basis transformations T x θ A , φ A on Alice's side and T x θ B , φ B on Bob's side. The application of these two different basis transformations alters the initial state accordingly to where again the superscripts "(1)" and "(4)" indicate that T x θ A , φ A is applied on qubit 1 and T x θ B , φ B on qubit 4, respectively. Following the protocol, Alice has to undo Bob's transformation using T −1 x θ B , φ B before she can perform her Bell state measurement. Similar to the application of one basis transformation described above, Alice obtains all four Bell states with equal probability from her measurement. The state of the remaining qubits changes in a way analogous to eq. (32) above and Bob has to reverse Alice's transformation using T −1 x θ A , φ A . This changes the state similar to eq. (33) above. Hence, when Bob performs his measurement on qubits Q and 4, he does not only obtain a result correlated to Alice's outcome, but all four possible Bell states with different probabilities such that an error is introduced in the protocol. As already discussed in the previous section, the results from Eve's measurement on qubits T and U are not fully correlated to Alice's and Bob's results and therefore Eve's information on the raw key bits is further reduced compared to the application of only one transformation.
Due to the fact that Alice as well as Bob choose at random whether they apply their respective basis transformation, the average error probability is calculated over all scenarios, i.e. no transformation is applied, either Alice or Bob applies T x θ A , φ A and T x θ B , φ B , respectively, or both transformations are applied. Therefore, using the results from eq. (38) above, the overall error probability can be computed as having its maximum at P e ≃ 0.41071. One possibility to reach the maximum is to choose the angles In fact, as long as φ A = π/4 or φ A = 3π/4 the value of φ B can be chosen freely to reach the maximum. Hence, the average error probability is plotted in Figure 8 taking φ A = φ B = π/4. Following the same argumentation and using eq. (40) from above, the Shannon entropy can be calculated as having its maximum at H ≃ 0.9452. This maximum is reached, for example, using The maximal Shannon entropy can also be reached using other values but they are not as nicely distributed as in the case of the average error probability.
Since the maximal Shannon entropy is reached with a different set of values for θ {A,B} and φ {A,B} than the maximal error probability, it is necessary to find a set of parameters for the basis transformation, which results in a high error probability as well as a high Shannon entropy at the same time. On the one hand, inserting the values to reach the maximal Shannon entropy in eq. (43) we obtain an average error probability P e ≃ 0.3993. On the other hand, using the parameters for a maximal error probability in eq. (45) we get H ≃ 0.90635. Therefore, Alice and Bob have to decide, whether they want to maximize P e or H, being aware that the respective other value is not optimal any more.
Looking again at set of values for θ {A,B} and φ {A,B} , which are more suitable for a physical implementation than the values mentioned above, one possibility for Alice and Bob is to choose leading to an almost optimal Shannon entropy H ≃ 0.9399 and a average respective error probability P e ≃ 0.39288. Keeping φ A and φ B fixed -as already discussed in the previous section -such that the same average error probability P e ≃ 0.39288 and a slightly smaller Shannon entropy H ≃ 0.91223 compared to the previous values are achieved. Hence, we see that using a set of parameters more suitable for a physical implementation still results in a high error rate and leaves Eve's mutual information I AE below 10%.

RESULTS AND IMPLICATIONS
The results presented in the previous sections have direct implications on the security of QKD protocols based on entanglement swapping. Where in some QKD protocols [13,15,16] a random application of a Hadamard operation is used to detect an eavesdropper and secure the protocol, the above results indicate that the Hadamard operation is not the optimal choice. Using the Hadamard operation leaves an adversary with a mutual information I AE = 0.5 and an expected error probability P e = 0.25 (cf . Table I), which is comparable to standard prepare and measure protocols [1][2][3]. An application of the Hadamard operation by both communication parties does not increase these values since the interference terms in eq. (28) and eq. (29) cancel out each other (cf. also Figure 4).
A slight change in one of the basis transformations, e.g. from θ B = π/2 (in case of the Hadamard operation) to θ B = π/4 is enough to decrease the adversary's information by about 10% to I AE ≃ 0.45 while leaving the expected error probability at the same value of  P e = 0.25 (cf. eq. (29) and Table I). This gives Alice and Bob a slight advantage compared to other entanglement swapping based protocols like [13,15,16]. In particular, looking at the protocol by Song [15], where a basis transformation about an angle θ A = 2π/3 is applied, Eve's information is reduced by almost 25% from I AE ≃ 0.594 (coming directly from eq. (23) above) in the original protocol to I AE ≃ 0.45 (cf. also [23] for details).
Giving Alice an additional degree of freedom, i.e. choosing both θ A and φ A freely, she is able to further decrease the adversary's information about the raw key bits. By shifting φ A from π/2 to π/4 and θ A from π/2 or π/4 to 3π/8 the adversary's information is reduced to I AE ≃ 0.208 (cf. eq. (40)). This is a reduction by almost 60% compared to QKD schemes described in [1-3, 13, 16] and more than 50% compared to the combined application of two different basis transformations (cf. also [22,23]). At the same time, the expected error probability is increased by one third to P e ≃ 0.333 (cf. eq. (38)). Hence, an adversary does not only obtain fewer information about the raw key bits but also introduces more errors and therefore is easier detectable.
Following these arguments, the best strategy for Alice and Bob is to apply different basis transformations at random to reduce the adversary's information to a minimum. As already pointed out above, this minimum of I AE ≃ 0.0548 is reached with a rather odd configuration for θ {A,B} and φ {A,B} as described in the previous section. Hence, it is important to look at configurations more suitable for physical implementations, i.e. configurations of θ {A,B} and φ {A,B} described by simpler fractions of π as given in eq. (47) and (48). In this case, we showed that φ {A,B} can be fixed at φ A = φ B = π/4 and with θ A = 3π/16 and θ B = 7π/16 almost maximal values can be achieved resulting in I AE ≃ 0.088 and P e ≃ 0.393 (cf. eq. (48) and also Table I).
Regarding physical implementations, another -even simpler -configuration can be found, involving only π/2 and π/4 rotations (cf. Table I). In this case θ A = 0, φ A = π/4 and θ B = φ B = π/2 which leaves the expected error probability at P e ≃ 0.334. The adversary's information is nowhere near the minimum but still rather low at I AE = 0.125.
In terms of security these results represent a huge advantage over QKD protocols based on entanglement swapping [13,15,16] or standard prepare and measure protocols [1][2][3]. Such protocols usually have an expected error probability of P e = 0.25 and a mutual information I AE = 0.5. Due to the four degrees of freedom, the error rate is between one third ( P e ≃ 0.334) and more than one half ( P e = 0.411) higher in the scenarios described here than in the standard protocols, which makes it easier to detect an adversary. Taking the practical threshold value of about 11% for the error rate [11] into account, it is easy to see that an adversary has to attack fewer qubits in transit to stay below this threshold compared to standard prepare and measure protocols. Further, the adversary's information is reduced by 75% (to I AE = 0.125) in a conservative setting, and up to almost 90% (to I AE = 0.055) in the optimal setting. This makes it possible to allow a higher threshold value than 11% for entanglement swapping based QKD protocols.

CONCLUSION
In this article, we discussed the effects of basis transformations on the security of quantum key distribution protocols based on entanglement swapping. We showed that the Hadamard operation, a transformation from the Z-into the X-basis often used in prepare and measure protocols, is not optimal in connection with entanglement swapping based protocols. Starting from a general basis transformation described by two angles θ and φ, we inspected the effects on the security when the adversary follows a collective attack strategy. We showed that the application of a basis transformation by one of the communication parties decreases the adversary's information to about I AE ≃ 0.2075, which is less than half of the information compared to an application of the Hadamard operation. At the same time, the average error probability introduced by the presence of the adversary increases to P e = 1/3. A combined application of two different basis transformations further reduces the adversary's information to about I AE ≃ 0.0548 at an average error probability of slightly more than 0.41.
Since the configuration of the angles θ and φ to reach these maximal values is not very suitable for a physical implementation, we also showed that these maximal values are almost reached with more convenient values for θ and φ. In this case, the adversary's information is still I AE < 0.1 with an average error rate P e ≃ 0.393 for a combined application of two basis transformations.
These results have a direct impact on the security of such protocols. Due to the reduced information of an adversary and the high error probability introduced during the attack strategy, Alice and Bob are able to accept higher error thresholds compared to standard entanglement-based QKD protocols.