treatment—where, for simplicity, we assume ideal conditions in which Alice transmits a single photon per bit interval, there is no propagation loss and no extraneous (background) light collection, and both Eve and Bob have unity quantum efficiency photodetectors with no dark counts. These ideal conditions imply there will not be any errors on sifted bits in the absence of eavesdropping; the case of more realistic conditions will be discussed briefly in Sec. IV.

In each bit interval Alice transmits, at random, a single photon in one of the four BB84 polarization states. Eve uses this photon as the control-qubit input to a CNOT gate whose computational basis—relative to the BB84 polarization states—is shown in Fig. 2, namely $$\begin{aligned}
|0\rangle &\equiv& \cos(\pi/8)|H\rangle + \sin(\pi/8)|V\rangle \\ %[.05in]
|1\rangle &\equiv& -\sin(\pi/8)|H\rangle + \cos(\pi/8)|V\rangle,\end{aligned}$$ in terms of the $H/V$ basis. Eve supplies her own probe photon, as the target-qubit input to this CNOT gate, in the state $$|T_{\rm in}\rangle \equiv C|+\rangle + S|-\rangle,
\label{probeinput}$$ where $C = \sqrt{1-2P_E}$, $S = \sqrt{2P_E}$, $|\pm\rangle = (|0\rangle \pm |1\rangle)/\sqrt{2}$, and $0\le P_E\le 1/2$ will turn out to be the error probability that Eve’s probe creates on Bob’s sifted bits [@footnote1]. So, as $P_E$ increases from 0 to 