# How does BB84 fare against an attacker who can entangle qubits?

Consider the following attack on the BB84 quantum key exchange protocol (as far as I can tell, it should work similarly for E91):

After Alice sends her key bits encoded in qubits with randomly chosen bases, Eve intercepts them without making a measurement.

She uses her quantum computer, prepares it in a |0⟩ state and, for each bit, does a CNOT with her own qubits as targets and Alice's bits as controls, thus entangling them.

Then, she sends Alice's bits on to Bob, who measures them. This projects them into an eigenstate of Bob's chosen base. It also projects Eve's qubits into the same states.

After Bob and Alice have publically announced their bases, Eve measures her qubits in the same bases that Bob chose, getting the same result.

This way, she will not learn which bits Alice sent, but she will learn which bits Bob received, which is enough. She will also not be detected when Alice and Bob compare part of their keys, because she makes her measurements only after Bob makes his.

Does this attack (theoretically) work? If not, what's the problem? If it does, why is BB84 considered (theoretically) secure?

• Funnily enough I was asked this (or at least a very similar) question yesterday. Having thought about it again, I see the following problem: in order to entangle the states Eve needs to know Alice's states - which she obviously doesn't. Your proposed method will probably work if she sends |0>+|1>, but what if she sends |0>? there will be no entanglement. Does it make sense? – Lukas Jun 7 '16 at 11:01
• It seems there's no "intercept without measurement" in quantum world. Please consider to elaborate on scenario and terms. – Vadym Fedyukovych Jun 9 '16 at 16:29