No-Cloning Theorem in Cryptography

A classical wiretapper's greatest weapon is the copy: a bit read is a bit stolen, silently, leaving the original untouched on the wire. Quantum information takes that weapon away. The no-cloning theorem — proved by Wootters and Zurek and, independently, by Dieks in 1982 — states that no physical process can manufacture a perfect duplicate of an unknown quantum state. It is not a limit of today's technology but a structural fact: the linearity and unitarity of quantum evolution have no room for a universal copier. A single device that faithfully copied every input would have to preserve overlaps like a linear map yet square them like a pair of copies, and those demands collide everywhere except at states that are identical or perfectly distinguishable. Cryptography turns this prohibition into a resource. If Alice sends qubits drawn from a set of non-orthogonal states, an eavesdropper can neither stash a perfect copy for later nor learn the encoded bit without gambling on a measurement — and a wrong guess scrambles the state she must forward to Bob. Information gained is paid for in disturbance, and that disturbance shows up as errors Alice and Bob can count. Security stops resting on the presumed hardness of factoring and starts resting on a law of physics. This article develops the theorem from linearity and unitarity, quantifies how good an imperfect copy can be (the optimal cloner reaches fidelity 5/6), and traces the line from that bound to the 25% error a full eavesdropper leaves on a BB84 channel.

Key takeaways

No physical process can perfectly copy an unknown quantum state: there is no unitary $U$ with $U(|\psi\rangle|0\rangle)=|\psi\rangle|\psi\rangle$ for all $|\psi\rangle$ .
The proof needs only linearity and unitarity — copying two states would preserve their overlap on the inputs yet square it on the outputs, and $s=s^2$ holds only for $s=0$ (orthogonal) or $s=1$ (identical).
Because non-orthogonal states cannot be copied or reliably distinguished, an eavesdropper cannot intercept, read, and resend quantum signals without disturbing them — the root of QKD security in BB84, B92, and E91.
Imperfect copying is allowed but bounded: the optimal universal $1\to2$ qubit cloner reaches fidelity $F=5/6$ , capping how much any adversary can learn.
A full intercept-resend attack on BB84 raises the quantum bit error rate to $25\%$ , far above the $\approx11\%$ secure threshold, so eavesdropping is loud.
The guarantee is information-theoretic — it survives a computationally unbounded adversary, unlike classical public-key cryptography.
Key idea: linearity forces a copier to preserve overlaps while duplication squares them, so $\langle\psi|\phi\rangle=\langle\psi|\phi\rangle^2$ holds only for identical or orthogonal states; the non-orthogonal states that carry QKD information cannot be cloned, so spying on them must disturb them.

The core insight

Linearity forces a copier to preserve inner products while duplication squares them, so $\langle\psi|\phi\rangle=\langle\psi|\phi\rangle^2$ holds only for identical or orthogonal states. The non-orthogonal states that carry cryptographic information therefore cannot be copied, and any attempt to learn them must disturb them.

Where this lives today

No-cloning is no longer a thought experiment — it is the load-bearing assumption of a working industry. Commercial QKD systems from ID Quantique, Toshiba, and others distribute keys over metropolitan fibre by the BB84 logic above, watching the QBER and aborting when it climbs. In 2017 the Chinese Micius satellite pushed the same physics to space, distributing entangled photons over more than 1200 km and enabling an intercontinental quantum-secured video call between Beijing and Vienna. Twin-field QKD extends secure key rates over hundreds of kilometres of fibre by beating the naive loss limit, and device-independent QKD tightens the guarantee further, deriving security from observed Bell-inequality violations (the monogamy of equation (8)) rather than trusting the hardware. The approximate-cloning bound $5/6$ is not just theory: optimal universal cloners have been realized in photonic and NMR experiments, each saturating the fidelity ceiling. Open frontiers include publicly verifiable quantum money, quantum repeaters that extend QKD without amplification (amplifiers clone, so they are forbidden), and schemes pairing QKD with classical lattice cryptography for defence in depth.

The physical picture

Classical information is writing on paper: anyone can photocopy the page without touching the original. Quantum information is a soap bubble held up to the light — to inspect it you must touch it, and touching deforms it. There is no photocopier for an unknown bubble. The reason is geometric, and sharp enough to draw. A copier is one fixed device, so it must act the same way on every input. But quantum states overlap: two non-orthogonal states are partly "the same," measured by the inner product $s=\langle\psi|\phi\rangle$ . Unitarity preserves that overlap unchanged from input to output, while a faithful pair of copies has overlap $s^2$ . A single machine cannot honour both $s$ and $s^2$ unless they are equal — and $s=s^2$ pins the overlap to exactly $0$ or $1$ . Everything in between, the interior where useful quantum codewords live, is forbidden.

Figure

Cloning would demand the overlap s equal its own square: unitarity carries s straight across, duplication bends it to s squared, and the two curves meet only at s = 0 and s = 1, so at a typical overlap of 0.6 the copier is asked for 0.6 and 0.36 at once

Flip the perspective and the prohibition becomes a security guarantee. The inability to copy is exactly the inability to spy: an eavesdropper who cannot clone the carrier and cannot distinguish non-orthogonal states must commit to a measurement, and the wrong basis collapses the state she has to pass on. Information she gains is paid for in disturbance — an alarm bell Alice and Bob listen for. In BB84 the accounting is stark: a full intercept-resend attack corrupts one sifted bit in four, while the protocol tolerates only about one in nine before Alice and Bob abort. The second figure makes that gap the whole story — the eavesdropper cannot buy information cheaply enough to hide under the noise floor.

Figure

A full intercept-resend attack in BB84 forces a 25 percent quantum bit error rate because Eve picks the wrong basis half the time and then resends a bit that is wrong half of those times, landing far above the roughly 11 percent threshold below which a secret key can still be distilled

The core equations

A universal copier would be a single unitary that maps any unknown state, sitting beside a fixed blank register, onto two faithful copies. Writing that wish down is the first step to seeing why it cannot be granted.

U\big(|\psi\rangle\otimes|0\rangle\big)=|\psi\rangle\otimes|\psi\rangle \quad \forall\,|\psi\rangle \qquad (1)

where: $U$ — one fixed unitary acting on the system plus a blank ancilla; $|\psi\rangle$ — the arbitrary unknown state to be copied; $|0\rangle$ — the standard blank register. Reading: the demand must hold for every $|\psi\rangle$ at once, with the same $U$ — that universality is what breaks. Feed two candidate states through the hypothetical copier and equate the inner product of the outputs with that of the inputs. Unitarity keeps the input overlap unchanged; the product form squares it. The equation the overlap must satisfy is the crux of the theorem.

\langle\psi|\phi\rangle=\langle\psi|\phi\rangle^{2} \qquad (2)

where: $\langle\psi|\phi\rangle$ — the complex overlap of the two candidate inputs. Reading: a number that equals its own square is pinned to $0$ or $1$ ; there is no other solution, so only two regimes survive.

|\langle\psi|\phi\rangle|=0\ \ \text{or}\ \ 1 \qquad (3)

where: $|\langle\psi|\phi\rangle|$ — the magnitude of the overlap. Reading: orthogonal states ( $0$ ) copy by measure-and-reprepare, identical states ( $1$ ) are trivial, and every non-orthogonal pair between is uncopyable — precisely the states QKD uses. No-cloning forbids only perfect copies. The best state-independent approximate copier still leaves each output resembling the original, and the optimal $1\to2$ machine reaches a hard, universal fidelity.

F=\langle\psi|\rho_{\mathrm{out}}|\psi\rangle=\tfrac{5}{6} \qquad (4)

where: $F$ — single-copy fidelity of one output to the original; $\rho_{\mathrm{out}}$ — reduced density operator of that copy. Reading: $5/6\approx0.833$ is the ceiling — no device does better, and this caps an adversary's knowledge. The single number $5/6$ is one point on a general curve. The optimal universal cloner taking $N$ inputs to $M$ outputs (Gisin–Massar, Bužek–Hillery) has a closed form.

F_{N\to M}=\frac{N(M+2)+M-N}{M(N+2)}=\frac{N}{M}+\frac{(M-N)(N+1)}{M(N+2)} \qquad (5)

where: $N$ — number of identical input copies; $M\ge N$ — number of output copies. Reading: at $N=1,M=2$ it gives $5/6$ ; as $M\to\infty$ it collapses to $(N+1)/(N+2)$ , the fidelity of measuring the state — cloning interpolates between having a state and only estimating it. Every route by which Eve learns Alice's bit obeys the same tradeoff: information is paid for in disturbance. Cast as an inequality, this is what a security proof integrates.

I(A\!:\!E)\ \le\ f(D) \qquad (6)

where: $I(A\!:\!E)$ — mutual information Eve holds about Alice's bit; $D$ — disturbance she induces, seen as excess QBER; $f$ — a monotone bound rising from zero. Reading: no disturbance means no information; the alarm and the leak are the same quantity. For the sharpest concrete attack, intercept-resend, the tradeoff has an exact face — the error rate Eve cannot avoid stamping on the sifted key.

\mathrm{QBER}_{\text{i-r}}=\tfrac12\cdot\tfrac12=25\% \qquad (7)

where: $\mathrm{QBER}$ — quantum bit error rate on the sifted key; the two factors are Eve's probability of guessing the wrong basis and, given that, of resending a wrong bit. Reading: full eavesdropping is unmistakable — more than twice the $\approx11\%$ ceiling below which a key can still be distilled. The deepest statement is structural. Purify everything, Eve included, into a global pure state; strong Alice–Bob correlation then mathematically starves Eve of correlation — the entanglement-based cousin of no-cloning.

\rho_{AB}=\mathrm{Tr}_E\big(|\Psi\rangle\langle\Psi|_{ABE}\big) \qquad (8)

where: $|\Psi\rangle_{ABE}$ — the global pure state including the eavesdropper $E$ ; $\rho_{AB}$ — the state Alice and Bob share. Reading: if $\rho_{AB}$ is close to a pure maximally entangled state, $E$ is nearly decoupled — no third party can hold a copy of the correlations.

Derivation ANo-cloning from unitarity and the overlap identity

The goal is to turn the wish of equation (1) into a contradiction using nothing beyond the inner-product structure of quantum mechanics and the unitarity of physical evolution. We suppose one fixed device clones two arbitrary states, then evaluate a single inner product two ways — on the inputs, where unitarity leaves it untouched, and on the demanded outputs, where the product form squares it — and show the two can agree only at the boundary values that exclude every cryptographically useful state.

Step 3. Now evaluate the very same inner product on the output side, where $U$ has done its job: $\langle\psi|\langle\psi|\,\cdot\,|\phi\rangle|\phi\rangle=\langle\psi|\phi\rangle\,\langle\psi|\phi\rangle=\langle\psi|\phi\rangle^{2}$ . Why: the outputs are product states, so their overlap factorizes into two identical copies of the single-system overlap, squaring it.

Step 4. Equate the two evaluations and set $s=\langle\psi|\phi\rangle$ : $s=s^{2}$ , whose only roots are $s=0$ and $s=1$ . Why: a number equal to its own square is a fixed point of squaring, and for $|s|\le1$ those fixed points are just $0$ and $1$ .

Step 5. Interpret: $s=1$ means the states are identical (nothing to copy), $s=0$ means they are orthogonal (distinguishable, so measure-and-reprepare works), and every $0<|s|<1$ is forbidden. Why: the non-orthogonal states with intermediate overlap are exactly the carriers of cryptographic information, so a universal cloner is impossible precisely where it would matter. *Verified: reproduces Nielsen & Chuang §12.1 and Wootters–Zurek 1982; the identity $s=s^2\Rightarrow s\in\{0,1\}$ is checked directly, and unitarity enters only through $U^\dagger U=I$ .*

Go deeper · Derivation B · 1 minThe linearity-only argument on a superposition

Derivation BThe linearity-only argument on a superposition

The goal is to show that even without invoking unitarity — using only the linearity of quantum evolution — a device copying the two computational basis states cannot also copy their superposition, which is the crisp form of the theorem most often quoted. We assume perfect cloning of $|0\rangle$ and $|1\rangle$ , apply the map to an equal superposition by linearity, and compare the forced output against a genuine copy; the mismatch of cross terms is the contradiction.

Step 2. Take the equal superposition $|+\rangle=\tfrac{1}{\sqrt2}(|0\rangle+|1\rangle)$ as the input to be copied, again beside the blank $|0\rangle$ . Why: $|+\rangle$ is non-orthogonal to both $|0\rangle$ and $|1\rangle$ , so it is exactly the kind of state the theorem should forbid.

Step 3. Apply $U$ using linearity — the map distributes over the sum: $U|+\rangle|0\rangle=\tfrac{1}{\sqrt2}\big(U|0\rangle|0\rangle+U|1\rangle|0\rangle\big)=\tfrac{1}{\sqrt2}\big(|0\rangle|0\rangle+|1\rangle|1\rangle\big)$ . Why: linearity is not optional — it is the core of quantum dynamics — so the output is fixed the moment the basis action is fixed, and it is an entangled Bell state.

Step 5. Compare: $\tfrac{1}{\sqrt2}(|00\rangle+|11\rangle)\neq|+\rangle|+\rangle$ — the linear output is missing the cross terms entirely. Why: no single linear device can satisfy both the basis and the superposition, so the copier that works on $|0\rangle,|1\rangle$ necessarily fails on $|+\rangle$ ; linearity alone kills universal cloning. *Verified: matches Nielsen & Chuang §1.3.5 / Wootters–Zurek 1982; expanding both sides in the computational basis confirms the missing cross terms.*

Go deeper · Derivation C · 1 minIntercept-resend forces a 25 percent QBER in BB84

Derivation CIntercept-resend forces a 25 percent QBER in BB84

The goal is to compute, from first principles, the error rate a maximal intercept-resend eavesdropper must impose on the sifted key of a BB84 channel, turning the abstract information-disturbance tradeoff into a single detectable number. Eve intercepts each qubit, measures it in a randomly chosen conjugate basis, and resends the eigenstate she found; we average over her basis guess and the collapse she causes when wrong, keeping only sifted rounds where Alice and Bob used the same basis.

Step 1. Eve guesses Alice's preparation basis (rectilinear or diagonal) at random, matching it with probability $P(\text{match})=\tfrac12$ . Why: the two BB84 bases are mutually unbiased and Eve has no side information, so a coin flip is the best she can do.

Step 2. When Eve's basis matches Alice's, she reads the exact eigenstate, learns the bit, and resends it faithfully; on the sifted rounds this contributes zero error. Why: a measurement in the correct basis is non-disturbing for an eigenstate, so a matched round is invisible.

Step 3. When Eve's basis is wrong (probability $\tfrac12$ ), her measurement collapses Alice's qubit into an eigenstate of the wrong basis — an equal superposition in Alice's basis; the qubit she forwards then gives Bob the wrong bit with probability $\tfrac12$ on sifted rounds. Why: a state resent in the conjugate basis carries no memory of Alice's bit, so Bob's outcome is a fair coin.

Step 4. Combine over Eve's basis choice: $\mathrm{QBER}=P(\text{match})\cdot0+P(\text{mismatch})\cdot\tfrac12=\tfrac12\cdot\tfrac12$ . Why: only the mismatched half contributes, and it contributes at the coin-flip rate, so the two one-halves multiply.

Step 5. Evaluate: $\mathrm{QBER}=\tfrac14=25\%$ , against a one-way security threshold of about $11\%$ . Why: the attack more than doubles the tolerable error, so a full eavesdropper is always caught during parameter estimation, and Alice and Bob abort before privacy amplification is needed. *Verified: standard BB84 result (Preskill Ch. 4); consistent with the $\approx11\%$ Shor–Preskill one-way threshold and with the $5/6$ optimal-cloner attack, which trades a gentler disturbance for less information.*

Limiting cases

How the theorem and its quantitative converses behave in special regimes:

Case	Result	Meaning
Orthogonal states	$\langle\psi\vert\phi\rangle=0$	Distinguishable states can be copied — measure, then re-prepare. No-cloning bites only on non-orthogonal sets, which is why QKD uses them.
Known state	$\vert\psi\rangle$ known classically	If the state is known, copying is trivial — prepare more. The theorem is about unknown states from a non-orthogonal ensemble.
Optimal $1\to2$ cloner	$F_{1\to2}=\tfrac56$	The best universal copier outputs two copies of fidelity $5/6$ — the sharpest approximate clone and the strongest cloning attack.
Asymptotic $N\to\infty$	$F=\tfrac{N+1}{N+2}$	Infinitely many copies is no better than optimally measuring the $N$ inputs; cloning degrades into state estimation.
Mixed-state broadcasting	$[\rho_i,\rho_j]=0\ \forall i,j$	Mixed states can be broadcast only if they all commute (no-broadcasting) — the mixed-state generalization of orthogonality.

Worked examples

1 · Optimal cloning fidelities from the Gisin–Massar formula (fully worked)

Using equation (5), find the optimal universal fidelity for $1\to2$ , $1\to3$ , and $2\to3$ qubit cloning, and the $1\to\infty$ limit. Interpret each in terms of what an eavesdropper could learn.

Step 1. Write the formula in its compact numerator form $F_{N\to M}=\dfrac{NM+N+M}{M(N+2)}$ , obtained by expanding $N(M+2)+M-N=NM+N+M$ . Check the algebra once: $NM+2N+M-N=NM+N+M$ . Correct.

Step 2. $1\to2$ : $N=1,M=2$ gives $F=\dfrac{2+3}{6}=\dfrac{5}{6}\approx\mathbf{0.833}$ — the headline bound, two copies each $83.3\%$ faithful. A cloning-based eavesdropper keeps one and forwards the other.

Step 3. $1\to3$ : $N=1,M=3$ gives $F=\dfrac{7}{9}\approx\mathbf{0.778}$ . Demanding a third copy lowers each fidelity — more copies, worse copies, exactly as no-cloning insists.

Step 4. $2\to3$ : $N=2,M=3$ gives $F=\dfrac{11}{12}\approx\mathbf{0.917}$ . Two identical inputs carry more information than one, so the copies improve.

Step 5. The limit $M\to\infty$ with $N=1$ : $F\to\dfrac{N+1}{N+2}=\dfrac{2}{3}\approx\mathbf{0.667}$ — exactly optimal measurement of a single unknown qubit. The four numbers $5/6,\ 7/9,\ 11/12,\ 2/3$ trace the whole tradeoff between copying and knowing.

2 · How loud is a full eavesdropper? (fully worked)

Alice and Bob sift $n=10{,}000$ bits while Eve mounts a full intercept-resend attack on every qubit. Estimate the observed QBER, the number of erroneous sifted bits, and whether Alice and Bob will notice, given a hardware noise floor of $2\%$ and a secure cutoff of $11\%$ .

Step 1. From derivation C, intercept-resend contributes $25\%$ on the sifted key. Hardware adds an independent $2\%$ ; errors combine as $p=p_1+p_2-2p_1p_2=0.25+0.02-2(0.25)(0.02)=0.26$ , so $\mathrm{QBER}\approx\mathbf{26\%}$ .

Step 2. Expected wrong bits: $0.26\times10{,}000=\mathbf{2600}$ , versus roughly $200$ from hardware alone. The excess of about $2400$ errors is Eve's signature.

Step 3. Statistical visibility: without Eve the error count has mean $200$ and standard deviation $\sqrt{200}\approx14$ . Observing $2600$ is over $170$ standard deviations away — detection is a certainty.

Step 4. Decision: $26\%\gg11\%$ , so Alice and Bob abort and distil no key. Eve learned Alice's bit on the matched half of her rounds — real information — but cannot use it, because the key is never completed. A full eavesdropper is caught every time.

Step 5. The lesson generalizes: to stay under $11\%$ , Eve must attack only a fraction of qubits or use a gentler optimal-cloner attack, and either way the bound (6) caps what she gleans against the errors she reveals — which privacy amplification then shrinks to zero. No attack buys information cheaply enough to hide.

Physics of the portrait

The no-cloning theorem has a paper trail with a twist: its first and most consequential application was imagined more than a decade before the theorem itself was proved, by a graduate student whose manuscript no journal would print.

Origins · 1 minStephen Wiesner and how this was discovered

Stephen Wiesner

1942–2021, American physicist · quantum money and the origins of quantum cryptography

Around 1968–70, as a physics graduate student at Columbia, Stephen Wiesner wrote down two ideas a decade ahead of their field. In a manuscript he called Conjugate Coding, he proposed encoding information in pairs of conjugate quantum observables — polarization in two non-commuting bases — so that no one could read all of it at once. From this he built the first quantum-cryptographic primitive: quantum money, banknotes carrying photons prepared in secret random bases, which a counterfeiter could not duplicate because copying an unknown non-orthogonal state is impossible and reading it would corrupt it. The idea sat unpublished for years — reviewers saw no home for it — until it appeared in SIGACT News in 1983. Its importance is that it identified, informally and years early, exactly the resource no-cloning would later formalize: the unforgeability of unknown quantum states. Wiesner's college friend Charles Bennett carried the ideas forward, and with Gilles Brassard turned conjugate coding into the BB84 protocol in 1984. When Wootters and Zurek, and independently Dieks, proved no-cloning in 1982 (prompted by Nick Herbert's flawed FLASH proposal to signal faster than light by copying), they supplied the rigorous theorem underneath Wiesner's intuition. Wiesner himself, famously private, spent much of his later life outside academia, but the edifice of quantum money, QKD, and quantum-information security rests on the two conjugate-coding pages he wrote as a student.

History

1970

— Wiesner circulates conjugate coding and quantum money, unpublished for a decade

1982

— Wootters and Zurek, and independently Dieks, prove the no-cloning theorem

1984

— Bennett and Brassard turn no-cloning into the BB84 key-distribution protocol

1996

— Bužek and Hillery construct the optimal universal quantum cloning machine

2000

— Shor and Preskill give an information-theoretic security proof of BB84

Going further

Texts. Nielsen & Chuang, Quantum Computation and Quantum Information, §1.3.5 and §12.1 · Preskill, Lecture Notes on Quantum Computation, Ch. 4–5 · Wilde, Quantum Information Theory, §3.5 and Ch. 24 · Watrous, The Theory of Quantum Information, Ch. 3 · Kitaev, Shen & Vyalyi, Classical and Quantum Computation, §12–13.

Provenance. Every equation here is a standard textbook result. A verifier should: (1) confirm $s=s^2\Rightarrow s\in\{0,1\}$ and that unitarity enters only via $U^\dagger U=I$ (Nielsen & Chuang §12.1; Wootters–Zurek, Nature 299, 802, 1982); (2) expand $\tfrac{1}{\sqrt2}(|00\rangle+|11\rangle)\neq|+\rangle|+\rangle$ in the computational basis (Dieks, Phys. Lett. A 92, 271, 1982); (3) evaluate $F_{1\to2}=5/6$ , $F_{1\to3}=7/9$ , $F_{2\to3}=11/12$ , and $F_{1\to\infty}=2/3$ from equation (5) (Bužek & Hillery, Phys. Rev. A 54, 1844, 1996; Gisin & Massar 1997); (4) reproduce the $25\%$ intercept-resend QBER and the $\approx11\%$ one-way threshold (Preskill Ch. 4; Shor & Preskill, Phys. Rev. Lett. 85, 441, 2000); (5) check $\mathrm{Tr}_E|\Psi\rangle\langle\Psi|_{ABE}$ and the monogamy reading (Wilde §3.5). The quantum-money application is Wiesner, SIGACT News 15, 78 (1983); the protocol is Bennett & Brassard 1984.

Prerequisites. Linearity and unitarity of quantum evolution · Inner products and state overlap · Quantum measurement and state collapse. Leads to. BB84 Protocol · B92 Protocol · E91 Protocol · Quantum Bit Error Rate and Sifting · Quantum Teleportation.

Ask the tutor: Want to see how the 5/6 cloning bound and the 25 percent QBER combine into a full BB84 security proof, or how monogamy replaces no-cloning in entanglement-based E91?

Does no-cloning mean I can never copy any quantum state at all?

No — it is much narrower than that. You can freely copy a state you know, by preparing fresh copies from the description, and you can copy states drawn from a mutually orthogonal set, by measuring to learn which one it is and re-preparing. What you cannot do is build one fixed device that copies every unknown state perfectly — in particular, an unknown state from a non-orthogonal set. That single forbidden map is the entire content of the theorem, and everything cryptographic follows because QKD deliberately encodes bits in non-orthogonal states, landing squarely in the forbidden zone.

Why is the optimal cloner fidelity exactly 5/6 and not something else?

The $5/6$ comes from optimizing over all physical (completely positive, trace-preserving) maps that treat every input symmetrically and identically — the universal, state-independent constraint. Bužek and Hillery constructed such a machine in 1996, and it was later proved optimal: no CPTP map does better while remaining state-independent. Plugging $N=1,M=2$ into the Gisin–Massar formula $F=(NM+N+M)/(M(N+2))$ gives $5/6$ directly. It matters cryptographically because the strongest cloning-based eavesdropper keeps one such copy: her knowledge of Alice's bit is bounded by this fidelity, which feeds into the security proof as the disturbance she must reveal in exchange.

If states cannot be copied, how does quantum error correction survive?

By never copying. The naive classical fix — store three copies and take a majority vote — is exactly what no-cloning forbids, so quantum codes do something subtler: they spread one logical qubit across the entangled joint state of several physical qubits, without duplicating the unknown amplitudes. A logical $|\psi\rangle$ becomes a single entangled codeword like $\alpha|000\rangle+\beta|111\rangle$ , not three copies $|\psi\rangle|\psi\rangle|\psi\rangle$ . Syndrome measurements detect which error occurred without reading the encoded data, and a correction undoes it. No register ever holds an independent copy of the logical state — the information lives only in the correlations.

Does no-cloning contradict quantum teleportation?

No, and the two fit together precisely. Teleportation moves an unknown state from Alice to Bob using a shared entangled pair and two classical bits, but it destroys the original: Alice's Bell measurement collapses her copy, so the state exists in exactly one place before and after. If teleportation left Alice's original intact while recreating it at Bob's end, that would be cloning — and the measurement-collapse step is exactly what prevents it. Teleportation is a demonstration of no-cloning, not a loophole: you can relocate a quantum state, but you can never end up with two.

In what sense is QKD security "unconditional" if Eve can still measure the qubits?

Unconditional means it assumes nothing about Eve's computational power — she may hold a full-scale quantum computer and unlimited time, and the guarantee holds, because it rests on physics rather than on the hardness of any math problem. Eve is free to measure the qubits; the point is that she cannot do so informatively without disturbing them, and the disturbance is bounded below by the information she gains (equation 6). Alice and Bob measure that disturbance as the QBER, discard the key if it is too high, and otherwise apply privacy amplification to squeeze Eve's residual knowledge to a negligible amount. The security is information-theoretic: it would survive even if factoring turned out to be easy.

Can Eve dodge the theorem by storing the qubit in a quantum memory and copying it later?

No — storage does not help, because the obstruction is not about when she copies but about the linear structure of any copying map. A perfect quantum memory faithfully holds the unknown state, but reading it out later still confronts the same barrier: to extract Alice's bit she must eventually measure, and measuring an unknown non-orthogonal state is exactly what disturbs it. Waiting until Alice and Bob announce their bases lets Eve measure in the right basis — which is why the protocol reveals only the basis, never the bit — but by then her qubit is long gone to Bob. A quantum memory changes the timing of her ignorance, not its existence.