are projecting the momentum qubit of $|\psi_{\rm out}\rangle$ onto $|d_-\rangle$ and the vertical paths into photodetectors in Fig. 6 are projecting this state onto $|d_+\rangle$. Eve records the combined results of the two $|d_+\rangle$ versus $|d_-\rangle$ detections, whereas Bob, who only sees the combined photodetections for the upper and lower branches entering the measurement box, gets his BB84 polarization data. Bob’s data is impaired, of course, by the effect of Eve’s P-CNOT.

Single-photon on-demand sources are now under development at several institutions [@single], and their use in BB84 QKD has been demonstrated [@singleBB84]. At present, however, it is much more practical to use SPDC as a heralded source of single photons [@herald]. In SPDC, signal and idler photons are emitted in pairs, thus detection of the signal photon heralds the presence of the idler photon. Moreover, with appropriate configurations [@bidirectional], SPDC will produce photons that are simultaneously entangled in polarization and in momentum. This hyperentanglement leads us to propose the Fig. 8 configuration for physically simulating the FPB-probe attack on BB84. Here, a pump laser drives SPDC in a type-II phase matched $\chi^{(2)}$ crystal, such as periodically-poled potassium titanyl phosphate (PPKTP), producing pairs of orthogonally-polarized, frequency-degenerate photons that are entangled 