$a$ is sent through an insecure line, so that Alice and Bob share an output state $\protect\rho_{AB}$. By applying rank-1 POVMs on their local systems, $A$ and $B$, they derive two correlated random variables, $X$ and $Y$, which are processed into a secret key. In the middle, Eve attacks the line using a unitary $U$ which couples system $a$ with a pure-state ancilla $e$. The output ancilla $E$ is then stored in a quantum memory, which is coherently detected at the end of the protocol.[]{data-label="picU"}](picU.eps){width="50.00000%"}

After the previous process has been repeated many times, Alice and Bob publicly compare a subset of their data. If the error rate is below a certain threshold, they apply classical procedures of error correction and privacy amplification with the help of one-way CC, which can be either forward from Alice to Bob (direct reconciliation), or backward from Bob to Alice (reverse reconciliation). Thus, they finally extract a secret key at a rate $K\leq I(X,Y)$, which is denoted by $K(Y|X)$ in direct reconciliation and $K(X|Y)$ in reverse reconciliation.

To quantify these rates, we need to model Eve’s attack. The most general attack is greatly reduced if Alice and Bob perform random permutations on their classical 