$\def\i{\mathbf {i}}\def\ket#1{|{#1}\rangle}\def\bra#1{\langle{#1}|}\def\braket#1#2{\langle{#1}|{#2}\rangle}\mathbf{Exercise\ 2.11}$

*B92 quantum key distribution protocol*. In 1992 Bennett proposed the following quantum key distribution protocol. Instead of encoding each bit in either the standard basis or the Hadamard basis as is done in the BB84 protocol, Alice encodes her random string $x$ as follows

and sends them to Bob. Bob generates a random bit string $y$. If $y_i = 0$ he measures the $i$-th qubit in the Hadamard basis $\{\ket{+}, \ket{-} \}$, if $y_i = 1$ he measures in the standard basis $\{\ket 0, \ket 1 \}$. In this protocol, instead of telling Alice over the public classical channel which basis he used to measure each qubit, he tells her the results of his measurements. If his measurement resulted in $\ket +$ or $\ket 0$ Bob sends $0$, if his measurement indicates the state is $\ket 1$ or $\ket{-}$, he sends $1$. Alice and Bob discard all bits from strings $x$ and $y$ for which Bob's bit value from measurement yielded $0$, obtaining strings $x'$ and $y'$. Alice uses $x'$ as the secret key and Bob uses $y'$. Then, depending on the security level they desire, they compare a number of bits to detect tampering. They discard these check bits from their key.

a) Show that if Bob receives exactly the states Alice sends, then the strings $x'$ and $y'$ are identical strings.

b) Why didn't Alice and Bob decide to keep the bits of $x$ and $y$ for which Bob's bit value from measurement was $0$?

c) What if an eavesdropper Eve measures each bit in either the standard basis or the Hadamard basis to obtain a bit string $z$ and forwards the measured qubits to Bob. On average, how many bits of Alice and Bob's key does she know for sure after listening in on the public classical? If Alice and Bob compare $s$ bit values of their strings $x'$ and $y'$, how likely are they to detect Eve's presence?