**5. Conclusions**

Based on high-resolution SNPs, we compared the genetic response of *H. chrysotricha* to short-term and long-term habitat fragmentation. The levels of genetic diversity and the population substructure of *H. chrysotricha* populations were both higher in the TIL region than in the ZA region, while gene flow was higher and less asymmetric among ZA populations. The differences in genetic diversity between island and mainland populations in both regions were not significant, suggesting that genetic erosion of island populations does not increase as the spatial and temporal scales of fragmentation increase. Population connectivity in *H. chrysotricha* has also not been greatly modified by either short-term or long-term habitat fragmentation. The strong fruit (seed) dispersal capacity of *H. chrysotricha*, facilitated by the matrix of water in the island system, could buffer against the negative effects of habitat fragmentation and maintain the population connectivity over thousands of years.

**Supplementary Materials:** The following supporting information can be downloaded at: https: //www.mdpi.com/article/10.3390/plants11141800/s1. Table S1: Raw statistical data for *Hedyotis chrysotricha* samples from the Thousand-Island Lake (TIL) and Zhoushan Archipelago (ZA) regions, generated by Illumina sequencing; Table S2: Genotype information for the 185 filtered SNPs from the TIL dataset; Table S3: Genotype information for the 188 filtered SNPs from the ZA dataset; Table S4: Migration rates (the fraction of individuals in population i (pop i) from population j (pop j)) and confidence intervals between populations of *H. chrysotricha* from the TIL region. Bold values represent the proportion of non-migrants within a population, and italic values indicate asymmetrical migration rates between populations; Table S5: Migration rates (the fraction of individuals in population i (pop i) from population j (pop j)) and confidence intervals between populations of *H. chrysotricha* from the ZA region. Bold values represent the proportion of non-migrants within a population, and values in italics indicate asymmetrical migration rates between populations; Figure S1: Analysis of isolation by distance based on *F*ST/(1 − *F*ST) and the geographic distance (log10 transformed) in (A) the Thousand-Island Lake (TIL) region and (B) the Zhoushan Archipelago (ZA) region; Figure S2: Histogram of the STRUCTURE analysis in the TIL region for the model with *K* = 2, 4, and 5. A vertical bar represents a single individual, and each color corresponds to a suggested cluster; Figure S3: Histogram of the STRUCTURE analysis in the ZA region for the model with *K* = 3–5. A vertical bar represents a single individual, and each color corresponds to a suggested cluster.

**Author Contributions:** N.Y. and Y.Q. conceived the study; N.Y., R.L. and S.L. collected the samples. N.Y. extracted the DNA samples. N.Y., S.W. and R.L. analyzed the genetic data and wrote the manuscript. H.P.C., R.L. and Y.Q. revised the manuscript. All authors have read and agreed to the published version of the manuscript.

**Funding:** This research was funded by the Chinese National Natural Science Foundation (No. 31800312), the Jiangsu Innovative and Enterpreneurial Talent Programme (JSSCBS20211311), the Natural Science Foundation of Guangdong Province, China (No. 2021A1515010946), and the Forestry Science and Technology Innovation Project of Guangdong Province, China (No. 2020KJCX003).

**Institutional Review Board Statement:** Not applicable.

**Informed Consent Statement:** Not applicable.

**Data Availability Statement:** SNPs in VCF files across the Thousand-Island Lake (TIL) and the Zhoushan Archipelago (ZA) populations were deposited in Mendeley Data, V1, https://doi.org/10.1 7632/wsx8swxd27.1 (accessed on 22 May 2022).

**Acknowledgments:** Special thanks go to the anonymous referees for providing valuable and constructive comments to improve the manuscript.

**Conflicts of Interest:** The authors declare no conflict of interest.


**Author details**

Aishah Najiah Dahnel\*, Mohamad Noor Ikhwan Naiman, Muhammad Azim Mirza Mohd Farid, Ahmad Faris Abdul Rahman and Nur Munirah Meera Mydin Department of Manufacturing and Materials Engineering, International Islamic University Malaysia, Kuala Lumpur, Malaysia

\*Address all correspondence to<EMAIL_ADDRESS>
© 2022 The Author(s). Licensee IntechOpen. This chapter is distributed under the terms of the Creative Commons Attribution License (http://creativecommons.org/licenses/ by/3.0), which permits unrestricted use, distribution, and reproduction in any medium, provided the original work is properly cited.


*Supporting open minds since 2005*

Recent Advances in Heat Pipes http://dx.doi.org/10.5772/intechopen.75280 Edited by Wael I. A. Aly

#### Contributors

Chunsheng Guo, Bala Abdullahi, Raya K. Al-dadah, Sa'ad Mahmoud, Xudong Zhao, Xingxing Zhang, Zhangyuan Wang, Xinru Wang, Chuangbin Weng, Wael I.A. Aly

#### © The Editor(s) and the Author(s) 2019

The rights of the editor(s) and the author(s) have been asserted in accordance with the Copyright, Designs and Patents Act 1988. All rights to the book as a whole are reserved by INTECHOPEN LIMITED. The book as a whole (compilation) cannot be reproduced, distributed or used for commercial or non-commercial purposes without INTECHOPEN LIMITED's written permission. Enquiries concerning the use of the book should be directed to INTECHOPEN LIMITED rights and permissions department (permissions@intechopen.com).

Violations are liable to prosecution under the governing Copyright Law.

Individual chapters of this publication are distributed under the terms of the Creative Commons Attribution 3.0 Unported License which permits commercial use, distribution and reproduction of the individual chapters, provided the original author(s) and source publication are appropriately acknowledged. If so indicated, certain images may not be included under the Creative Commons license. In such cases users will need to obtain permission from the license holder to reproduce the material. More details and guidelines concerning content reuse and adaptation can be found at http://www.intechopen.com/copyright-policy.html.

#### Notice

Statements and opinions expressed in the chapters are these of the individual contributors and not necessarily those of the editors or publisher. No responsibility is accepted for the accuracy of information contained in the published chapters. The publisher assumes no responsibility for any damage or injury to persons or property arising out of the use of any materials, instructions, methods or ideas contained in the book.

First published in London, United Kingdom, 2019 by IntechOpen IntechOpen is the global imprint of INTECHOPEN LIMITED, registered in England and Wales, registration number: 11086078, The Shard, 25th floor, 32 London Bridge Street London, SE19SG – United Kingdom Printed in Croatia

British Library Cataloguing-in-Publication Data A catalogue record for this book is available from the British Library

Additional hard and PDF copies can be obtained from<EMAIL_ADDRESS>
Recent Advances in Heat Pipes Edited by Wael I. A. Aly p. cm. Print ISBN 978-1-83962-643-2 Online ISBN 978-1-83962-208-3 eBook (PDF) ISBN 978-1-83962-209-0


**2.2.4 Treatment after cryopreservation**

In cryopreservation of plant genetic resources, regeneration after rewarming is the key. Surviving cells or tissues after cryopreservation readily succumb due to different environmental agents because they have been injured by the dehydration or temperature change during the cryopreservation procedure. Moreover, when plant specimens were injured by the cryopreservation process, polyphenol can be produced. Thus, this may threaten the survival of plant specimens after cryopreservation. In that case, regeneration of tissues after preservation reportedly increased when activated charcoal (Bagniol & Engelmann, 1992) and polyvinyl pyrrolidone (Niino et al., 2003), an adsorbent of polyphenol, was mixed with a culture medium.

In recent years, it is also reported that regrowth percentages of rewarming tissues increased by mixing surfactant with regrowth medium (Anthony et al., 1996; Niu et al., 2010). Therefore, special consideration must be given to certain plant species. From previous reports, the regrowth after preservation increases sharply also by decreasing NH4+ concentration in a culture medium (Niino et al., 1992a, 1992b; Suzuki et al., 1994; Pennycooke & Towill, 2001).

Next, I would like to explain this paragraph with actual experimental data I obtained. I examined the effects of various nutrient media (Table 2) on regrowth of cryopreserved

Fig. 9. Effects of exchange times of PVS2 during 60-min PVS2 loading treatment on shoot apices immersed in LN using vitrification. 2 ml of fresh PVS2 were exchanged at 0oC for 60 mins prior to cooling. A PVS2 exchange just after PVS2 loading treatment was not counted as the exchanging time of PVS2 in this study. After cooling for 1hour in LN, rewarming apices were transplanted into 1/4MS. Values represent mean ± SE of three determinations. Differences in mean values of regrowth with different letters are statistically significant

In cryopreservation of plant genetic resources, regeneration after rewarming is the key. Surviving cells or tissues after cryopreservation readily succumb due to different environmental agents because they have been injured by the dehydration or temperature change during the cryopreservation procedure. Moreover, when plant specimens were injured by the cryopreservation process, polyphenol can be produced. Thus, this may threaten the survival of plant specimens after cryopreservation. In that case, regeneration of tissues after preservation reportedly increased when activated charcoal (Bagniol & Engelmann, 1992) and polyvinyl pyrrolidone (Niino et al., 2003), an adsorbent of

In recent years, it is also reported that regrowth percentages of rewarming tissues increased by mixing surfactant with regrowth medium (Anthony et al., 1996; Niu et al., 2010). Therefore, special consideration must be given to certain plant species. From previous reports, the regrowth after preservation increases sharply also by decreasing NH4+ concentration in a culture medium (Niino et al., 1992a, 1992b; Suzuki et al., 1994;

Next, I would like to explain this paragraph with actual experimental data I obtained. I examined the effects of various nutrient media (Table 2) on regrowth of cryopreserved

(Tukey's HSD at *p*<0.05) in each treatments. (from Kami et al., 2010)

**2.2.4 Treatment after cryopreservation**

polyphenol, was mixed with a culture medium.

Pennycooke & Towill, 2001).

apices (*Cardamine yezoensis* Maxim.). It was demonstrated that 4-fold dilution of inorganic salts of Murashige and Skoog's medium (1/4MS) or Woody Plant medium (WPM) as basal medium resulted in higher regrowth percentages (both 66.7%) than six other media (Fig. 10; Kami et al., 2010).

Table 2. Compositions of eight types of nutrient medium for the regrowth of cryopreserved shoot apices

Fig. 10. Effects of nutrient media on the regrowth of shoot apices immersed in LN using vitrification. Apices were dehydrated with PVS2 at 0oC for 60-mins prior to immersion in LN. The PVS2 in a cryovial was exchanged once just after PVS2 loading treatment. After cooling for 1hour in LN, rewarming apices were transplanted into 8 types of basal medium. Values represent mean ± SE of three determinations. Differences in mean values of regrowth with different letters are statistically significant (Tukey's HSD at *p*<0.05) in each treatments. (from Kami et al., 2010)

Cryopreservation of Plant Genetic Resources 453

Kami, D.; Uenohata, M., Suzuki, T. & Oosawa, K. (2008). Cryopreservation of black

Kami, D.; Shi, L., Sato, T., Suzuki, T. & Oosawa, K. (2009). Cryopreservation of shoot apices

Kami, D.; Kido, S., Otokita, K., Suzuki, T., Sugiyama, K. & Suzuki, M. (2010).

Kartha,K.K. (1985). *Cryopreservation of Plant Cells and Organs,* CRC Press, ISBN 0-8493-6102-8,

Kendall, E.J.; Kartha, K.K., Qureshi, J.A. & Chermak, P. (1993). Cryopreservation of

Kim, H.H.; Kim, J.B., Baek, H.J., Cho, E.G., Chae, Y.A. & Engelmann, F. (2004). Evolution of

Kim, J.B.; Kim, H.H., Baek, H.J., Cho, E.G., Kim, Y.H. & Engelmann, F. (2005). Changes in

Kumu, Y.; Harada, T. & Yakuwa, T. (1983). Development of a whole plant from a shoot tip

*Hokkaido University*, Vol.61, No.3, (May 1983), pp. 285-294, ISSN 0018-344X Kuranuki, Y. & Sakai, A. (1995). Cryopreservation of *in vitro*-grown shoot tips of tea

Kuranuki, Y. & Yoshida, S. (1996). Differential responses of embryogenic axes and

Leunufna, S. & Keller, E.R.J. (2003). Investigating a new cryopreservation protocol for yams

Maruyama, E., Tanaka, T., Hosoi, Y., Ishii, K. & Morohoshi, N. (2000). Embryogenic cell

Matsumoto, T.; Sakai, A., Takahashi, C. & Yamada, K. (1995). Cryopreservation of *in vitro*-

Vol.120, No.2, (August 2008), pp. 84-88, ISSN0304-4238

pp.119-126, ISSN 1340-7902 (in Japanese with English summary)

*Cell Reports*, Vol.12, No.2, (Octobar 1992), pp. 89-94, ISSN 0721-7714

*Letters*, Vol.25, No.1, (October 2003), pp. 91-100, ISSN 0143-2044

*Biotechnology*, Vol.22, No.2, (March 2005), 105-112, ISSN 1342-4580

46, No.2, pp. 149-154, (March 1996), ISSN 1347-3735

Vol.17, No.4, (April 2000), 281-296, ISSN 1342-4580

2008), ISSN 0143-2044

Florida, U.S.A.

352, ISSN 0143-2044

0721-7714

chokeberry *in vitro* shoot apices. *Cryo-Letters*, Vol.29, No.3, pp.209-216, (January

of hawthorn *in vitro* cultures originating from East Asia. *Scientia Horticulturae*,

Cryopreservation of shoot apices of *Cardamine yezoensis in vitro*-cultures by vitrification Method. *Cryobiology and Cryotechnology*, Vol.56, No.2, (September 2010),

immature spring wheat zygotic embryos using an abscisic acid pretreatment. . *Plant*

DMSO concentration in garlic shoot tips during a vitrification procedure, *Cryo-*

sucrose and glycerol content in garlic shoot tips during freezing using PVS3 solution, *Cryo-Letters*, Vol.26, No.2, (December 2004), pp. 103-112, ISSN 0143-2044 Kobayashi, T.; Niino, T. & Kobayashi, M. (2005). Simple cryopreservation protocol with an

encapsulation technique for tabacco BY-2 supension cell cultures. *Plant*

of *Asparagus officinalis* L. frozen to –196oC. *Journal of the Faculty of Agriculture,*

(*Camellia sinensis*) by vitrification. *Cryo-Letters*, Vol.16, No.4, (April 1995), pp. 345-

cotyledons from tea seeds to desiccation and cryoexposure. *Breeding Science,* Vol.

(*Discorea* spp.). *Plant Cell Reports*, Vol.21, No.12, (April 2003), pp. 1159-1166, ISSN

culture, protoplast regeneration, cryopreservation, biolistic gene transfer and plant renegeration in Japanese cedar (*Cryptomeria japonica* D. Don). *Plant Biotechnology*,

grown apical meristems of wasabi (*Wasabia japonica*) by encapsulation-vitrification method. *Cryo-Letters*, Vol.16, No.2, (November 1994), pp. 189-196, ISSN 0143-2044


*Article* **Attacks against a Simplified Experimentally Feasible Semiquantum Key Distribution Protocol**

**Michel Boyer 1, Rotem Liss 2,\* and Tal Mor 2**

Received: 16 June 2018; Accepted: 16 July 2018; Published: 18 July 2018

**Abstract:** A semiquantum key distribution (SQKD) protocol makes it possible for a quantum party and a classical party to generate a secret shared key. However, many existing SQKD protocols are not experimentally feasible in a secure way using current technology. An experimentally feasible SQKD protocol, "classical Alice with a controllable mirror" (the "Mirror protocol"), has recently been presented and proved completely robust, but it is more complicated than other SQKD protocols. Here we prove a simpler variant of the Mirror protocol (the "simplified Mirror protocol") to be completely non-robust by presenting two possible attacks against it. Our results show that the complexity of the Mirror protocol is at least partly necessary for achieving robustness.

**Keywords:** quantum key distribution; semiquantum key distribution; security; attack

#### **1. Introduction**

Quantum key distribution (QKD) protocols allow two parties, Alice and Bob, to share a secret random key that is secure even against the most powerful adversaries. Semiquantum key distribution (SQKD) protocols achieve the same goal even if one of the two parties (Alice or Bob) is limited to use only classical operations: the classical party can use only the computational basis {|0, |1}, while the quantum party can use any basis—for example, both the computational basis and the Hadamard basis {|+ - |0+|1 √2 , |− - |0−|1 √2 }. As explained in [1,2], the importance of SQKD protocols is both conceptual and practical: they make it possible to investigate the amount of "quantumness" needed for QKD, and they may, in some cases, be easier to implement than standard QKD protocols.

The first SQKD protocol was "QKD with classical Bob" [1]. Later, other SQKD protocols have been suggested, including "QKD with classical Alice" [3,4] and many others (e.g., [2,5–9]). Most SQKD protocols have been proven "robust": namely [1], if the adversary Eve succeeds in getting some secret information, she must cause some errors that may be noticed by Alice and Bob. A few SQKD protocols also have a security analysis [10–13]. Proving robustness is a step towards proving security; proving the security of SQKD protocols is difficult because those protocols are usually two-way: for example, Alice sends a quantum state to Bob, and Bob performs a specific classical operation and sends the resulting quantum state back to Alice.

However, many SQKD protocols, including [1,3], are vulnerable to practical attacks and cannot be experimentally constructed in a secure way using current technology. An important classical operation of those protocols is named SIFT. The definition of a SIFT operation performed by Alice (assuming that Alice is the classical party) is as follows: Alice measures the incoming quantum state in the computational basis {|0, |1} and then generates the state she measured and resends it towards Bob. Security of those SQKD protocols relies on the assumption that during the SIFT operation, Alice's measurement devices can measure the *precise* states {|0, |1} and distinguish those precise

states from any imperfect similar state, and Alice's photon generation devices can generate the *precise* states {|0, |1} and not any other (imperfect) state. In particular, the generated states {|0, |1} must be indistinguishable from states that Alice *reflects* towards Bob. Using current photonic technology, Alice's devices are imperfect, which makes this assumption incorrect and makes possible attacks by the eavesdropper Eve: for example, Eve may send a slightly modified state towards Alice (a "tagging attack") or may distinguish between the states sent by Alice. Full details about those practical attacks are available in [14–16].

An experimentally feasible SQKD protocol named "classical Alice with a controllable mirror" (the "Mirror protocol") has recently been presented [16]. This protocol is safe against the "tagging" attack presented by [14]. Moreover, the protocol was proved by [16] to be completely robust against any attacker Eve, even if Eve is all-powerful and limited only by the laws of physics, and even if Eve can send multi-photon pulses. The robustness proof is still correct even if the detectors of Alice and Bob cannot *count* how many photons arrive in each mode: namely, when either Alice or Bob looks at a detector, which detects a specific mode, they can only notice whether it "clicks" (detects one photon or more in that mode) or not (finds the mode to be empty). This is the standard situation when using current technology.

In this paper, we present a simpler variant of the Mirror protocol (the "simplified Mirror protocol"), which is easier to implement. Our variant allows the classical party, Alice, to choose one of three operations, while the Mirror protocol allows Alice to choose one of four operations. We present two attacks against this variant, proving it to be non-robust. Our results show that the four classical operations allowed by the Mirror protocol are probably necessary for robustness.

In Section 2 we present the Mirror protocol described by [16]. In Section 3 we present the simplified Mirror protocol and its motivation. In Section 4 we prove the simplified Mirror protocol to be non-robust by presenting two attacks against it: a full attack and a weaker attack. In Section 5 we discuss potential implications of our results.

#### **2. The Mirror Protocol**

For describing the Mirror protocol (presented by [16]), we assume a photonic implementation consisting of two modes: the mode of the qubit state |0 and the mode of the qubit state |1(below we call them "the |0 mode" and "the |1 mode", respectively). For example, the |0 mode and the |1 mode can represent two different polarizations or two different time bins. We use the Fock space notations: if there is exactly one photon (and, thus, our Hilbert space is the qubit space), the Fock state |0, 1 (equivalent to |0) represents one photon in the |0 mode, and the Fock state |1, 0 (equivalent to |1) represents one photon in the |1 mode. We can extend the qubit space to a 3-dimensional Hilbert space by adding the Fock "vacuum state" |0, 0, which represents an absence of photons. Most generally, the Fock state |*m*1, *m*0 represents *m*1 indistinguishable photons in the |1 mode and *m*0 indistinguishable photons in the |0 mode. Similarly (in the Hadamard basis), the Fock state |*m*−, *m*+x represents *m*− indistinguishable photons in the |− mode and *m*+ indistinguishable photons in the |+ mode. More details about the Fock space notations are given in [16]; it is vital to use those mathematical notations for describing and analyzing all practical attacks on a QKD protocol (see [17] for details).

In the Mirror protocol, in each round, Bob sends to Alice the |+B state—namely, the |0,1x,B - |0,1B √ + |1,0B 2 state. Then, Alice prepares an ancillary state in the initial vacuum state |0, 0A and chooses at random one of the following four classical operations:

• **I** (**CTRL**) Reflect all the photons towards Bob, without measuring any photon. The mathematical description is:

$$I \mid 0,0 \rangle\_{\mathcal{A}} \,\vert m\_{\mathbf{1}\prime} m\_{\mathbf{o}} \rangle\_{\mathcal{B}} = \,\vert 0,0 \rangle\_{\mathcal{A}} \,\vert m\_{\mathbf{1}\prime} m\_{\mathbf{o}} \rangle\_{\mathcal{B}}.\tag{1}$$

• **S1** (**SWAP-10**) Reflect all photons in the |0 mode towards Bob, and measure all photons in the |1 mode. The mathematical description is:

$$\mathcal{S}\_1 \left| 0, 0 \right\rangle\_{\mathcal{A}} \left| m\_{\mathbf{1}\prime} m\_{\mathbf{o}} \right\rangle\_{\mathcal{B}} = \left| m\_{\mathbf{1}\prime}, 0 \right\rangle\_{\mathcal{A}} \left| 0, m\_{\mathbf{o}} \right\rangle\_{\mathcal{B}}.\tag{2}$$

• **S0** (**SWAP-01**) Reflect all photons in the |1 mode towards Bob, and measure all photons in the |0 mode. The mathematical description is:

$$S\_0 \left| 0, 0 \right\rangle\_{\mathcal{A}} \left| m\_{\mathbf{1}}, m\_{\mathbf{o}} \right\rangle\_{\mathcal{B}} = \left| 0, m\_{\mathbf{o}} \right\rangle\_{\mathcal{A}} \left| m\_{\mathbf{1}}, 0 \right\rangle\_{\mathcal{B}}.\tag{3}$$

• **S** (**SWAP-ALL**) Measure all the photons, without reflecting any photon towards Bob. The mathematical description is:

$$\mathcal{S}\left|0,0\right\rangle\_{\mathsf{A}}\left|m\_{\mathsf{L}},m\_{\mathsf{S}}\right\rangle\_{\mathsf{B}} = \left|m\_{\mathsf{L}},m\_{\mathsf{S}}\right\rangle\_{\mathsf{A}}\left|0,0\right\rangle\_{\mathsf{B}}.\tag{4}$$

(We note that in the above mathematical description, Alice measures her ancillary state |·A in the computational basis and sends back to Bob the |·B state.)

The states sent from Alice to Bob (without any error, loss, or eavesdropping) are detailed in Table 1.

**Alice's Classical Operation Did Alice Detect a Photon? State Sent from Alice to Bob** CTRL no (happens with certainty) |0, 1x,B = √1 2 [ |0, 1B + |1, 0B] SWAP-10 no (happens with probability 1 2 ) |0, 1B SWAP-10 yes (happens with probability 1 2 ) |0, 0B SWAP-01 no (happens with probability 1 2 ) |1, 0B SWAP-01 yes (happens with probability 1 2 ) |0, 0B SWAP-ALL yes (happens with certainty) |0, 0B

**Table 1.** The state sent from Alice to Bob in the Mirror protocol without errors or losses, depending on Alice's classical operation and on whether Alice detected a photon or not.

Then, Bob measures the incoming state in a random basis (either the computational basis { |0, |1} or the Hadamard basis { |+, |−}). After completing all rounds, Alice sends over the classical channel her operation choices (CTRL, SWAP-*x*, or SWAP-ALL; she keeps *x* ∈ {01, 10} in secret), Bob sends over the classical channel his basis choices, and both of them reveal some non-secret information on their measurement results (as elaborated in [16]). Then, Alice and Bob reveal and compute the error rate on test bits for which Alice used SWAP-10 or SWAP-01 and Bob measured in the computational basis, and the error rate on test bits for which Alice used CTRL and Bob measured in the Hadamard basis. They also check whether other errors exist (for example, they verify Bob detects no photons in case Alice uses SWAP-ALL). Alice and Bob also discard mismatched rounds, such as rounds in which Alice used SWAP-10 and Bob used the Hadamard basis. Alice and Bob share the secret bit 0 if Alice uses SWAP-10 and detects no photon while Bob measures in the computational basis and detects a photon in the |0 mode; similarly, they share the secret bit 1 if Alice uses SWAP-01 and detects no photon while Bob measures in the computational basis and detects a photon in the |1 mode.

Finally, Alice and Bob verify that the error rates are below some thresholds, and they perform error correction and privacy amplification in the standard way for QKD protocols. At the end of the protocol, Alice and Bob hold an identical final key that is completely secure against any eavesdropper.

A full description of the protocol and a proof of its complete robustness are both available in [16].

The experimental implementation of the protocol can use two time bins (namely, two pulses), one for the |0 mode and one for the |1 mode. In this case, Alice's possible operations can be described

as possible ways for operating a controllable mirror, so that Alice can choose whether to reflect or measure the photon(s) in each time bin. The mirror can be experimentally implemented in various ways; for example:

More details about the experimental implementations are available in [16].

#### **3. The "Simplified Mirror Protocol": A Simpler and Non-Robust Variant of the Mirror Protocol**

In this paper, we discuss a simpler variant of the Mirror protocol, which we name the "simplified Mirror protocol". The simplified Mirror protocol is identical to the Mirror protocol described in Section 2, except that it does not include the SWAP-ALL operation. In other words, in the simplified protocol, Alice chooses at random one of the three classical operations CTRL, SWAP-10, and SWAP-01.

The simplified protocol is easier to implement, because the SWAP-ALL operation poses some experimental challenges to the electronic implementation discussed in Section 2: for implementing SWAP-ALL, the Pockels cell should either remain working for a long time (changing polarization for both time bins) or be operated twice (changing polarization for each time bin separately). In more details, for the two pulses representing the |0 mode and the |1 mode: if we assume the duration of each pulse is *t* and the time difference between the two pulses is *T* (where *t T*), the first solution means keeping the Pockels cell operating during the time period [0, *T* + 2*t*], and the second solution means operating the Pockels cell during the two time periods [0, *t*] and [*T* + *t*, *T* + 2*t*]. The first solution may be problematic for some models of the Pockels cell, and the second solution may be problematic because of the recovery time needed for the Pockels cell. Therefore, at least in some implementations, the simplified Mirror protocol is much easier to implement than the standard Mirror protocol.

Moreover, analyzing the simplified protocol gives a better understanding of the properties required for an SQKD protocol to be robust. In particular, this analysis explains why the structure and complexity of the Mirror protocol are necessary for robustness.

For completeness, we provide below the full description of the simplified Mirror protocol. We note that this description is almost the same as the description of the Mirror protocol in Section 2.

In the simplified Mirror protocol, in each round, Bob sends to Alice the |+B state—namely, the |0,1x,B - |0,1B √ + |1,0B 2 state. Then, Alice prepares an ancillary state in the initial vacuum state |0, 0A and chooses at random one of the following three classical operations:

• **I** (**CTRL**) Reflect all the photons towards Bob, without measuring any photon. The mathematical description is:

$$I \mid 0,0 \rangle\_{\mathcal{A}} \mid m\_{\mathbf{1}\prime} m\_{\mathbf{o}} \rangle\_{\mathcal{B}} = \mid 0,0 \rangle\_{\mathcal{A}} \mid m\_{\mathbf{1}\prime} m\_{\mathbf{o}} \rangle\_{\mathcal{B}}.\tag{5}$$

• **S1** (**SWAP-10**) Reflect all photons in the |0 mode towards Bob, and measure all photons in the |1 mode. The mathematical description is:

$$S\_1 \left| 0, 0 \right\rangle\_{\mathcal{A}} \left| m\_{\mathbf{1} \prime} m\_{\mathbf{o}} \right\rangle\_{\mathcal{B}} = \left| m\_{\mathbf{1} \prime} 0 \right\rangle\_{\mathcal{A}} \left| 0, m\_{\mathbf{o}} \right\rangle\_{\mathcal{B}}.\tag{6}$$

• **S0** (**SWAP-01**) Reflect all photons in the |1 mode towards Bob, and measure all photons in the |0 mode. The mathematical description is:

$$S\_0 \left| 0, 0 \right\rangle\_{\mathcal{A}} \left| m\_{\mathbf{1}}, m\_{\mathbf{o}} \right\rangle\_{\mathcal{B}} = \left| 0, m\_{\mathbf{o}} \right\rangle\_{\mathcal{A}} \left| m\_{\mathbf{1}}, 0 \right\rangle\_{\mathcal{B}}.\tag{7}$$

(We note that in the above mathematical description, Alice measures her ancillary state |·A in the computational basis and sends back to Bob the |·B state.)

The states sent from Alice to Bob (without any error, loss, or eavesdropping) are detailed in Table 2.

**Table 2.** The state sent from Alice to Bob in the simplified Mirror protocol without errors or losses, depending on Alice's classical operation and on whether Alice detected a photon or not.

Then, Bob measures the incoming state in a random basis (either the computational basis { |0, |1} or the Hadamard basis { |+, |−}). After completing all rounds, Alice sends over the classical channel her operation choices (CTRL or SWAP-*x*; she keeps *x* ∈ {01, 10} in secret), Bob sends over the classical channel his basis choices, and both of them reveal some non-secret information on their measurement results (as elaborated in [16]). Then, Alice and Bob reveal and compute the error rate on test bits for which Alice used SWAP-10 or SWAP-01 and Bob measured in the computational basis, and the error rate on test bits for which Alice used CTRL and Bob measured in the Hadamard basis. They also check whether other errors exist (for example, it must never happen that *both* Alice and Bob detect a photon). Alice and Bob also discard mismatched rounds, such as rounds in which Alice used SWAP-10 and Bob used the Hadamard basis. Alice and Bob share the secret bit 0 if Alice uses SWAP-10 and detects no photon while Bob measures in the computational basis and detects a photon in the |0 mode; similarly, they share the secret bit 1 if Alice uses SWAP-01 and detects no photon while Bob measures in the computational basis and detects a photon in the |1 mode.

Finally, Alice and Bob verify that the error rates are below some thresholds, and they perform error correction and privacy amplification in the standard way for QKD protocols. At the end of the protocol, Alice and Bob hold an identical final key that is completely secure against any eavesdropper.

#### **4. Attacks against the Simplified Mirror Protocol**

We prove the simplified protocol to be non-robust by presenting two attacks: a "full attack" described in Section 4.1, which gives Eve full information but causes full loss of the CTRL bits, and a "weaker attack" described in Section 4.2, which gives Eve less information but causes fewer losses of CTRL bits.

#### *4.1. A Full Attack on the Simplified Protocol that Gives Eve Full Information*

In this attack, Eve gets full information of all the information bits. Namely, she gets full information on the SWAP-10 and SWAP-01 bits that were measured by Bob in the computational basis.

Eve applies her attack in two stages: the first stage is on the way from Bob to Alice, and the second stage is on the way from Alice to Bob. In both stages she uses her own probe space (namely, ancillary space) HE = H3 spanned by the orthonormal basis { |0E, |1E, |2E}. We assume that Eve fully controls the environment, the errors, and the losses (this is a standard assumption when analyzing the security of QKD): namely, no losses and no errors exist between Bob and Eve or between Alice and Eve.

*Entropy* **2018**, *20*, 536

In the first stage of the attack (on the way from Bob to Alice), Eve intercepts the state |+B (namely, |0, 1x,B) sent by Bob, generates instead the state

$$\frac{1}{\sqrt{3}}\left[|0,1\rangle\_{\rm B}|1\rangle\_{\rm E} + |1,0\rangle\_{\rm B}|1\rangle\_{\rm E} + |0,0\rangle\_{\rm B}|0\rangle\_{\rm E}\right] = \sqrt{\frac{2}{3}}\left|0,1\right\rangle\_{\rm x,B}|1\rangle\_{\rm E} + \sqrt{\frac{1}{3}}\left|0,0\right\rangle\_{\rm B}|0\rangle\_{\rm E} \tag{8}$$

and sends to Alice the B part of the state. This state causes Alice to get no photons with probability 1 3 and get the expected |+B state with probability 2 3 . Alice then performs at random one of the three classical operations CTRL, SWAP-10, or SWAP-01. The resulting possible states of Bob+Eve are described in Table 3.

**Table 3.** The state of Bob+Eve afterAlice's classical operation for the attacks describedin Sections4.1 and 4.2, depending on Alice's classical operation and on whether Alice detected a photon or not.

In the second stage of the attack (on the way from Alice to Bob), Eve applies the unitary operator *V* on the joint Bob+Eve state, where *V* is defined as follows:

$$V|0,1\rangle\_{\rm B}|1\rangle\_{\rm E} = -\sqrt{\frac{1}{3}}\,|1,0\rangle\_{\rm B}|1\rangle\_{\rm E} + \sqrt{\frac{2}{3}}\,|0,0\rangle\_{\rm B}|0\rangle\_{\rm E} \tag{9}$$

$$\left| V \left| 1, 0 \right> \right\rangle \left| 1 \right>\_{\mathcal{E}} = \underbrace{- \sqrt{\frac{1}{3}}}\_{=} \left| 0, 1 \right>\_{\mathcal{B}} \left| 0 \right>\_{\mathcal{E}} + \underbrace{\sqrt{\frac{2}{3}}}\_{=} \left| 0, 0 \right>\_{\mathcal{B}} \left| 1 \right>\_{\mathcal{E}} \tag{10}$$

$$\begin{array}{rcl} V \,\vert 0,0\rangle\_{\text{B}} \,\vert 0\rangle\_{\text{E}} &=& \sqrt{\frac{1}{3}} \,\vert 0,1\rangle\_{\text{B}} \,\vert 0\rangle\_{\text{E}} + \sqrt{\frac{1}{3}} \,\vert 1,0\rangle\_{\text{B}} \,\vert 1\rangle\_{\text{E}} + \sqrt{\frac{1}{3}} \,\vert 0,0\rangle\_{\text{B}} \,\vert + \rangle\_{\text{E}} \end{array} \tag{11}$$

$$V \left| 0, 0 \right\rangle\_{\mathcal{B}} \left| 1 \right\rangle\_{\mathcal{E}} = \left| 0, 0 \right\rangle\_{\mathcal{B}} \left| 2 \right\rangle\_{\mathcal{E}}.\tag{12}$$

*V* is indeed a unitary operator, because we can prove the right-hand sides to be orthonormal: all the right-hand sides are normalized vectors; the first two vectors are clearly orthogonal; the third vector is orthogonal to the first two, because 0|+E = 1|+E = √1 2 ; and the fourth vector is orthogonal to the three others. Thus, *V* defines (or, more precisely, can be extended to) a unitary operator on HB ⊗ HE.

Applying the unitary operator *V* on Table 3 gives the states listed in Table 4. Comparing it with Table 2, we conclude that this attack never causes Alice and Bob to detect an error. Moreover, Eve detects the whole secret key: Eve measures "0" in her probe if Alice and Bob agree on the bit 0, and she measures "1" in her probe if Alice and Bob agree on the bit 1. However, Eve causes several kinds of losses; in particular, all the CTRL bits are lost.

Therefore, this attack makes it possible for Eve to get full information without inducing any error. However, Eve causes many losses, including full loss of the CTRL bits.

**Table 4.** The state of Bob+Eve after completing Eve's attack described in Section 4.1, depending on Alice's classical operation and on whether Alice detected a photon or not.

*4.2. A Weaker Attack on the Simplified Protocol Causing Fewer Losses of the CTRL Bits*

The full attack described in Section 4.1 makes it impossible for Bob to ever detect a CTRL bit, which may look suspicious. We now present a weaker attack that lets Bob detect some CTRL bits but gives Eve less information.

The first stage of the attack (on the way from Bob to Alice) remains the same: that is, the state Eve sends to Alice is still given by Equation (8), and the resulting Bob+Eve state after Alice's classical operation is still shown in Table 3. Eve's probe space is, too, the same as before: HE = H3 - Span{ |0E, |1E, |2E}.

This attack is characterized by the parameter 0 ≤ ≤ 1. We will see that = 0 gives the full attack described in Section 4.1, while = 1 gives Eve no information at all.

Another important parameter used by the attack is

$$\kappa \triangleq \sqrt{\frac{1-\epsilon^2}{3-2\epsilon^2}}.\tag{13}$$

We notice that for small values of , the value of *κ* is close to -1 3 . Moreover, for all 0 ≤ ≤ 1, it holds that 0 < 2 + *κ*2 ≤ 1 and 2*κ*2 < 1.

In the second stage of the attack (on the way from Alice to Bob), Eve applies the unitary operator *V* on the joint Bob+Eve state, where *V* is defined as follows:

$$\begin{array}{rcl} V \left| 0, 1 \right\rangle\_{\rm B} \left| 1 \right\rangle\_{\rm E} &=& \ \ \ \epsilon \left| 0, 1 \right\rangle\_{\rm B} \left| 2 \right\rangle\_{\rm E} - \kappa \left| 1, 0 \right\rangle\_{\rm B} \left| 1 \right\rangle\_{\rm E} + \sqrt{1 - \kappa^2 - \epsilon^2} \left| 0, 0 \right\rangle\_{\rm B} \left| 0 \right\rangle\_{\rm E} \end{array} \tag{14}$$

$$V|1,0\rangle\_{\rm B}|1\rangle\_{\rm E} = -\kappa|0,1\rangle\_{\rm B}|0\rangle\_{\rm E} + \epsilon|1,0\rangle\_{\rm B}|2\rangle\_{\rm E} + \sqrt{1-\kappa^2-\epsilon^2}|0,0\rangle\_{\rm B}|1\rangle\_{\rm E} \tag{15}$$

$$V|0,0\rangle\_{\rm B}|0\rangle\_{\rm E} = \int \left|0,1\right\rangle\_{\rm B}|0\rangle\_{\rm E} + \kappa \left|1,0\right\rangle\_{\rm B}|1\rangle\_{\rm E} + \sqrt{1-2\kappa^2} \left|0,0\right\rangle\_{\rm B}|+\rangle\_{\rm E} \tag{16}$$

$$V|0,0\rangle\_{\rm B}|1\rangle\_{\rm E} = \begin{array}{c} \quad |0,0\rangle\_{\rm B}|2\rangle\_{\rm E}. \tag{17}$$

*V* is indeed a unitary operator, because we can prove the right-hand sides to be orthonormal: all the right-hand sides are clearly normalized; the first two vectors are orthogonal; the fourth vector is orthogonal to the three others; and the third vector is orthogonal to the first and to the second, because

$$1 - 2\epsilon^2 \quad = \quad \frac{3 - 2\epsilon^2 - 2(1 - \epsilon^2)}{3 - 2\epsilon^2} = \frac{1}{3 - 2\epsilon^2} \tag{18}$$

$$(1 - \kappa^2 - \epsilon^2) \quad = \frac{(3 - 2\epsilon^2) - (1 - \epsilon^2) - (3\epsilon^2 - 2\epsilon^4)}{3 - 2\epsilon^2} = \frac{2(1 - \epsilon^2)^2}{3 - 2\epsilon^2},\tag{19}$$

and thus √ 1−*κ*2−2 √ 1−2*κ*2 √2 = *κ*2. Therefore, *V* extends to a unitary operator on HB ⊗ HE.

The final global state after Eve's attack is described in Table 5 (calculated by applying the operator *V* on Table 3), given the following definitions:

$$a \quad \triangleq \quad \sqrt{1 - \kappa^2 - \epsilon^2} + \frac{\sqrt{1 - 2\kappa^2}}{\sqrt{2}},\tag{20}$$

$$b \triangleq \frac{\sqrt{1 - 2\kappa^2}}{\sqrt{2}}.\tag{21}$$

**Table 5.** The state of Bob+Eve after completing Eve's attack described in Section 4.2, depending on Alice's classical operation and on whether Alice detected a photon or not. The parameters *a* and *b* are defined in Equations (20) and (21).

We notice that for = 0, the attack is the same as in Section 4.1. If = 1, the loss rate of CTRL bits is 1 3 , and Eve gets no information at all on the information bits (because *κ* = 0).

In general, if Alice and Bob share a "secret" bit *b* ∈ {0, 1}, Eve's probe state is in the (normalized) state

$$\frac{\mathfrak{e}\left|2\right\rangle\_{\mathrm{E}} + \kappa \left|b\right\rangle\_{\mathrm{E}}}{\sqrt{\mathfrak{e}^{2} + \kappa^{2}}}.\tag{22}$$

When Eve measures her probe state in the computational basis { |0E, |1E, |2E}, she gets the information bit *b* with probability

$$p = \frac{\kappa^2}{\epsilon^2 + \kappa^2} = \frac{1 - \epsilon^2}{1 + 2\epsilon^2 - 2\epsilon^4},\tag{23}$$

and the loss rates of CTRL and SWAP-*x* bits (where *x* ∈ {01, 10}) are

$$R\_{\rm CTRL} = 1 - \frac{2\epsilon^2}{3} \,\text{.}\tag{24}$$

$$R\_{\text{SWAP-x}} = 1 - \frac{\epsilon^2 + \kappa^2}{2},\tag{25}$$

respectively.

Table 6 shows the probabilities *p* and the loss rates *R*CTRL, *R*SWAP-x for various values of . For example, for = 0.5, Eve still gets the information bit with probability *p* ≈ 0.55, Bob's loss rate for the CTRL bits is *R*CTRL ≈ 0.83, and his loss rate for the SWAP-*x* bits is *R*SWAP-x ≈ 0.73.

**Table 6.** The probability *p* of Eve obtaining an information bit, and the loss rates *R*CTRL and *R*SWAP-x of CTRL and SWAP-*x* bits (where *x* ∈ {01, 10}), respectively, for several values of the attack's parameter .

For all values of , the attack causes no errors. However, in principle, it can be detected because it causes different loss rates to different types of bits: the loss rate experienced by Bob in the CTRL bits, *R*CTRL, is usually different from the loss rate in the SWAP-*x* bits, *R*SWAP-x (see Table 6 for details). Therefore, in principle, the attack can be detected by a statistical test for most values of .

The loss rates become equal only for the value = 0 - -3− √3 2 ≈ 0.796 (which gives *κ*2 = 2 3 ). It seems that this specific attack *cannot* be detected, even in principle: it causes no errors, and it causes the same loss rate for all qubits. For this attack, Eve gets the information bit with probability *p* = 1 4 , and the loss rates are *R*CTRL = *R*SWAP-x = √1 3 ≈ 0.577. Therefore, this attack gives Eve a reasonable amount of information, and it is not detectable by looking at errors or comparing loss rates. (We can slightly modify the attack to make the loss rate the same in both directions of the quantum channel, too.)

We conclude that this weaker attack gives Eve partial information, causes no errors, and causes several loss rates. We also conclude that since the loss rates caused by the attack are usually different for different types of bits, the attack can be detected, in principle, for any value of except 0. However, for = 0, the attack seems undetectable.

#### **5. Discussion**

We have discussed a simpler and natural variant of the Mirror protocol (the "simplified Mirror protocol") which is easier to implement. We have found the simplified Mirror protocol to be completely non-robust; therefore, this protocol is actually an "over-simplified" Mirror protocol. We have presented in Section 4.1 an attack giving Eve full information without causing any error; in addition, since this attack also causes full loss of the CTRL bits, we have presented in Section 4.2 weaker attacks giving Eve partial information, causing no errors, and causing fewer losses. In particular, we have presented a specific attack (characterized by the parameter = 0 - -3− √3 2 ≈ 0.796) that seems undetectable and gives Eve one quarter ( 1 4 ) of all information bits.

Those attacks prove that the simplified Mirror protocol, which allows Alice to use only three classical operations (CTRL, SWAP-10, and SWAP-01), is completely non-robust. On the other hand, the Mirror protocol is proved completely robust (see Section 2 and [16]). As explained in Section 3, the only difference between the simplified Mirror protocol and the Mirror protocol is that the Mirror protocol allows a fourth classical operation, SWAP-ALL; therefore, allowing the SWAP-ALL operation is necessary for robustness. More generally, the Mirror protocol probably cannot be made much simpler while remaining robust: its complexity is crucial for robustness. Therefore, we have seen that if we want to use an SQKD protocol that is experimentally feasible in a secure way, we may have to use a relatively complicated protocol.

In this paper, we have not checked the experimental feasibility of Eve's attacks, because Eve is usually assumed to be all-powerful. Nonetheless, it can be interesting to check in the future the experimental feasibility of those attacks and discover whether the simplified Mirror protocol is flawed also in practice and not "only" in theory. Other interesting directions for future research include trying to find experimentally feasible SQKD protocols that are simpler than the Mirror protocol, and trying to find similar attacks against other QKD and SQKD protocols that have no complete robustness proof.

**Author Contributions:** T.M. suggested to investigate the robustness of the simplified protocol. M.B. suggested and designed the two attacks. All authors performed the careful analysis of the attacks, wrote the manuscript, and reviewed and commented on the final manuscript.

**Funding:** The work of Tal Mor and Rotem Liss was partly supported by the Israeli MOD Research and Technology Unit.

**Acknowledgments:** The authors thank Natan Tamari and Pavel Gurevich for useful discussions about the experimental implementation of SWAP-ALL.

**Conflicts of Interest:** The authors declare no conflict of interest.

#### **Abbreviations**

The following abbreviations are used in this manuscript:

QKD Quantum Key Distribution

SQKD Semiquantum Key Distribution

#### **References**

© 2018 by the authors. Licensee MDPI, Basel, Switzerland. This article is an open access article distributed under the terms and conditions of the Creative Commons Attribution (CC BY) license (http://creativecommons.org/licenses/by/4.0/).


**Liposome-Encapsulated Botulinum Toxin A in Treatment of Functional Bladder Disorders**

**Fan-Ching Hung 1 and Hann-Chorng Kuo 2,\***

**Abstract:** Botulinum toxin A (BoNT-A) intravesical injections have been used to treat patients with refractory functional bladder disorders such as overactive bladder (OAB) and interstitial cystitis/bladder pain syndrome (IC/BPS), but the risk of adverse events and the need for repeated injections continue to prevent widespread application of this treatment. Liposomes are vesicles that comprise concentric phospholipid layers and an aqueous core; their flexible compositions enable them to adsorb and fuse with cell membranes and to deliver drugs or proteins into cells. Therefore, liposomes have been considered as promising vehicles for the less invasive delivery of BoNT-A. In previous placebo-controlled trials including patients with OAB refractory to medical treatment, it was shown that liposomal BoNT-A could significantly decrease the frequency and urgency of urination. In patients with IC/BPS, it was shown that liposomal BoNT-A could also improve bladder pain, but the therapeutic efficacy was not superior to that of the placebo. As the therapeutic mechanisms of BoNT-A include the decreased expression of nerve growth factors, P2X3 receptors, and vanilloid receptors on C-fibers, liposomal BoNT-A might play a more promising role in the treatment of bladder oversensitivity. This article features the contemporary literature regarding BoNT-A, liposomes, and liposomal BoNT-A treatment for functional bladder disorders and potential clinical applications in the future.

**Keywords:** botulinum toxin A; liposome; bladder oversensitivity; interstitial cystitis; detrusor overactivity

**Key Contribution:** Intravesical instillation of liposome-encapsulated botulinum toxin A can be a potential treatment option to treat functional bladder disorders such as OAB, IC/BPS, and bladder oversensitivity.