Six-State and SARG04 Protocols

BB84 built a key-agreement scheme on a single quantum fact: an unknown state drawn from two incompatible bases cannot be read without leaving a scar. The six-state and SARG04 protocols are the two natural ways to sharpen that fact — one attacks the encoding, the other the bookkeeping — each keeping BB84's premise that eavesdropping is disturbance while squeezing a better margin out of it by turning exactly one design knob. The six-state protocol (Bruß 1998; Bechmann-Pasquinucci and Gisin 1999) adds a third mutually unbiased basis, so Alice and Bob use all six Pauli eigenstates — the poles of the $X$ , $Y$ , $Z$ axes of the Bloch sphere. An eavesdropper who must guess among three axes rather than two disturbs the signal more per bit she learns, and the full Pauli symmetry forces her optimal attack into a featureless depolarizing channel. The reward is a higher tolerable error rate, from BB84's $11.0\%$ to $12.6\%$ ; the price is sifting efficiency, which falls from $1/2$ to $1/3$ because three random bases agree only one time in three. SARG04 (Scarani, Acín, Ribordy, Gisin 2004) leaves BB84's four states as they are and rewrites the public announcement. Instead of naming her basis, Alice names a pair of non-orthogonal states, one of which she sent. To decode, Bob — and any eavesdropper — must discriminate non-orthogonal states, a task the Helstrom bound makes fundamentally probabilistic. This is aimed at the photon-number-splitting attack on weak-coherent-pulse sources: a stored eavesdropper photon that would leak a BB84 bit deterministically now leaks only a fraction of one. Both live inside BB84's distillation pipeline — parameter estimation, reconciliation, privacy amplification — and both show how far protocol design alone can move the margin against Eve.

Key takeaways

The six-state protocol uses all three mutually unbiased bases of a qubit — the eigenstates of $X$ , $Y$ , $Z$ — so an eavesdropper faces three axes instead of two and must disturb the signal more per bit she learns.
That extra symmetry raises the one-way QBER threshold from BB84's $11.0\%$ to $12.6\%$ , at the cost of a sifting efficiency that drops from $1/2$ to $1/3$ (three random bases agree one time in three).
SARG04 keeps BB84's four states but changes sifting: Alice announces a pair of non-orthogonal states, so decoding requires quantum-state discrimination, which the Helstrom bound caps below certainty.
This blunts the photon-number-splitting attack — a multiphoton pulse that leaks a BB84 bit deterministically leaks only $P_{\text{guess}}=\tfrac12(1+1/\sqrt2)\approx0.854$ of one under SARG04, leaving $\approx14.6\%$ residual error.
The gains are conditional: at zero noise BB84's higher sifting wins; the six-state and SARG04 advantages appear only under real noise or multiphoton attacks.
Key idea: symmetrizing the encoding over more mutually unbiased bases (six-state) or hiding the bit behind non-orthogonal-state discrimination (SARG04) raises the disturbance an eavesdropper must cause per bit she learns, lifting the noise threshold below which a secret key can still be distilled.

The core insight

Symmetrizing the encoding over more mutually unbiased bases (six-state) or hiding the bit behind non-orthogonal-state discrimination (SARG04) increases the disturbance an eavesdropper must cause per bit she learns, thereby raising the noise threshold below which a secret key can still be distilled.

Where this lives today

Both protocols remain live reference points rather than museum pieces. The six-state scheme is a favourite testbed for security proofs because its depolarizing-channel symmetry makes the analysis exact, and its full three-axis measurement doubles as single-qubit process tomography — so a run simultaneously distributes key and characterizes the channel, attractive for high-noise or satellite links where it drifts. SARG04 is the textbook case that a sifting rule alone can buy security: built for the weak-coherent-pulse sources that dominate real hardware, it is now largely superseded by decoy-state BB84, yet still implemented and studied in measurement-device-independent and high-dimensional variants. The deeper lesson propagates into every current protocol: the two knobs these schemes turned — the encoding alphabet and the meaning of the announcement — are exactly the ones that twin-field, MDI, and continuous-variable QKD keep turning to chase distance and rate.

The physical picture

Picture Eve intercepting Alice's qubit and, ignorant of the basis, guessing a measurement axis. In BB84 she guesses between two axes; align with Alice's and she learns the bit cleanly, miss and she scrambles it. Add a third axis and a blind guess is wrong more often, so the same information costs more disturbance — precisely what a higher error threshold records. The six states sit at the poles of the three orthogonal Bloch axes, and any state on one axis is an equal-weight superposition along the others: the geometry of mutual unbias is the whole mechanism.

Figure

The three mutually unbiased bases of a qubit as three orthogonal axes of the Bloch sphere: the six eigenstates of X, Y, Z. Any eigenstate of one basis is an equal superposition in the others, so the squared overlap is exactly 1/2, and a qubit admits exactly d+1 = 3 such bases

The payoff of that geometry is a channel Alice and Bob can tolerate more noise on. Because the three-axis symmetry launders Eve's best attack into a depolarizing channel — the most structureless noise there is — she extracts less information at a given disturbance, and the break-even error rate climbs. The second figure is what a designer actually reads off: the per-sifted-bit secret key rate versus the measured error rate, for BB84 and six-state, with the two thresholds marked where each curve dies.

Figure

Per-sifted-bit secret key rate versus QBER for one-way post-processing: BB84 with r = 1 − 2H(Q) reaches zero at Q = 11.0%, while the six-state protocol r = 1 + (1−3Q/2)log₂(1−3Q/2) + (3Q/2)log₂(Q/2) survives to Q = 12.6% — 1.6 points of extra tolerance bought by the third basis

SARG04's mechanism is different: not an extra axis but an announcement that withholds more. When Alice broadcasts a non-orthogonal pair rather than a basis, no measurement — Bob's or Eve's — can resolve which state was sent with certainty. The bit is hidden in the overlap between two states, not behind a label Eve can wait for, so even a photon stolen from a multiphoton pulse cannot be read out cleanly once the announcement arrives.

The core equations

The six-state protocol is defined by its alphabet: the six eigenstates of the three Pauli operators, two per axis — the maximal set of mutually unbiased bases a qubit admits.

|0\rangle,\,|1\rangle;\quad |\pm\rangle=\tfrac{1}{\sqrt2}(|0\rangle\pm|1\rangle);\quad |\pm i\rangle=\tfrac{1}{\sqrt2}(|0\rangle\pm i|1\rangle) \qquad (1)

where: $|0\rangle,|1\rangle$ — eigenstates of $Z$ (computational basis); $|\pm\rangle$ — eigenstates of $X$ (Hadamard basis); $|\pm i\rangle$ — eigenstates of $Y$ (circular basis). Reading: three orthogonal Bloch axes, six poles, one random basis among three per party. What makes the three bases conjugate is that a definite state in one is maximally uncertain in the others — the mutually unbiased condition, which for a qubit fixes every cross-basis overlap.

|\langle a | b \rangle|^2 = \tfrac{1}{2}\quad \text{for } a,b \text{ in different bases} \qquad (2)

where: $|a\rangle,|b\rangle$ — basis states from two distinct Pauli eigenbases. Reading: measuring a $Z$ -eigenstate in $X$ or $Y$ gives a random outcome, so a wrong-basis measurement carries zero information and full disturbance. Because Alice and Bob announce and keep only matching bases, the fraction of transmitted qubits that survive sifting is set purely by how many bases each may choose from.

\eta_{\mathrm{sift}}^{\text{six-state}} = \tfrac{1}{3}, \qquad \eta_{\mathrm{sift}}^{\text{BB84}} = \tfrac{1}{2} \qquad (3)

where: $\eta_{\mathrm{sift}}$ — fraction of transmitted qubits retained after public basis comparison. Reading: three bases agree with probability $3\times(1/3)^2=1/3$ , two bases with $2\times(1/2)^2=1/2$ — extra security costs raw rate. The reason the extra basis helps is that averaging any attack over all three Pauli axes symmetrizes it into a depolarizing channel, whose single parameter is fixed by the observed error rate.

\rho \;\longmapsto\; (1-p)\,\rho + p\,\frac{I}{2}, \qquad p = 2Q \qquad (4)

where: $\rho$ — single-qubit signal density operator; $p$ — depolarizing probability; $Q$ — observed QBER; $I/2$ — maximally mixed state. Reading: the mixed part errs half the time, so $Q=p/2$ , i.e. $p=2Q$ ; equivalently each of the three Pauli errors has probability $p/4=Q/2$ . For BB84 the one-way secret fraction per sifted bit has the classic closed form, and its root is the celebrated Shor–Preskill threshold.

r_{\text{BB84}} = 1 - 2H(Q),\qquad H(Q) = -Q\log_2 Q - (1-Q)\log_2(1-Q) \qquad (5)

where: $r_{\text{BB84}}$ — asymptotic secret fraction after reconciliation and privacy amplification; $H(Q)$ — binary entropy. Reading: one $H(Q)$ pays for error correction, the other bounds Eve; $r=0$ at $11.0\%$ . The six-state rate replaces Eve's term with the entropy of the symmetric Bell-diagonal state the depolarizing channel produces — a strictly gentler cost, so its root sits higher.

r_{\text{six-state}} = 1 + \Big(1-\tfrac{3Q}{2}\Big)\log_2\!\Big(1-\tfrac{3Q}{2}\Big) + \tfrac{3Q}{2}\log_2\tfrac{Q}{2} \qquad (6)

where: $r_{\text{six-state}}$ — one-way secret fraction per sifted bit; equivalently $r=1-H\!\left(1-\tfrac{3Q}{2},\tfrac{Q}{2},\tfrac{Q}{2},\tfrac{Q}{2}\right)$ , one minus the entropy of the four Bell populations. Reading: $r=1$ at $Q=0$ , $r=0$ at $12.6\%$ . SARG04 keeps BB84's states but pays a heavier sifting toll, because each announcement yields a conclusive single-photon bit only a quarter of the time.

\eta_{\mathrm{sift}}^{\text{SARG04}} = \tfrac{1}{4}\;\;(\text{single photon}) \qquad (7)

where: $\eta_{\mathrm{sift}}$ — fraction of single-photon signals giving a conclusive bit. Reading: half the time Bob measures in a basis able to discriminate, and within those half the outcomes are conclusive: $\tfrac12\cdot\tfrac12=\tfrac14$ . The whole point of that sacrifice is the Helstrom bound: two non-orthogonal states cannot be told apart with certainty, so the announced pair caps any eavesdropper's success below unity.

P_{\text{guess}} = \tfrac{1}{2}\left(1 + \sqrt{1-|\langle\psi|\phi\rangle|^2}\,\right) \qquad (8)

where: $P_{\text{guess}}$ — maximal probability of correctly distinguishing two equiprobable pure states; $|\langle\psi|\phi\rangle|$ — overlap of the announced pair. Reading: for BB84-state pairs $|\langle\psi|\phi\rangle|=1/\sqrt2$ , so $P_{\text{guess}}=\tfrac12(1+1/\sqrt2)\approx0.854<1$ .

Derivation ASymmetry, the depolarizing channel, and the six-state threshold

The goal is to show quantitatively where the $12.6\%$ number comes from and why it beats BB84's $11.0\%$ . The claim is that the third mutually unbiased basis forces Eve's optimal collective attack to be symmetric over the three Pauli axes, that such an attack is a depolarizing channel, and that a depolarizing channel of a given QBER produces a specific Bell-diagonal shared state whose entropy is exactly what Eve can hold. Computing one minus that entropy gives the secret fraction, and its root is the tolerable error rate. We assemble the argument in four steps and check the endpoints.

Step 1. Fix the symmetry. If Alice and Bob use all three bases and estimate the error in each, Eve gains nothing by treating the axes differently — any asymmetry would show up as a basis-dependent QBER she cannot predict. Her best strategy is invariant under the group permuting and signing the Pauli axes, and the only single-qubit channel with that symmetry is the depolarizing map $\rho\mapsto(1-p)\rho+p\,I/2$ . Why: symmetrizing an attack can only help the honest parties, so the optimal Eve saturates the symmetry rather than fighting it.

Step 2. Tie the channel to the data. The channel flips a measured bit whenever the mixed component lands wrong, which happens half the time, so $p=2Q$ . In Pauli-error form $\rho\mapsto(1-\tfrac{3p}{4})\rho+\tfrac{p}{4}(X\rho X+Y\rho Y+Z\rho Z)$ , each error carries probability $Q/2$ . Why: this converts one observed number, the QBER, into the full error profile with no free parameters left.

Step 3. Read off Eve's information. The purification makes Alice and Bob share the Bell-diagonal state with populations $(1-\tfrac{3Q}{2},\tfrac{Q}{2},\tfrac{Q}{2},\tfrac{Q}{2})$ — one dominant component, three equal error components. By Devetak–Winter the one-way fraction is $r=I(A\!:\!B)-\chi(A\!:\!E)$ , and for this symmetric state the algebra collapses to $r=1-H(1-\tfrac{3Q}{2},\tfrac{Q}{2},\tfrac{Q}{2},\tfrac{Q}{2})$ , equation (6). Why: the error-correction cost and Eve's Holevo information combine into a single Shannon entropy of the Bell populations.

Step 4. Solve for the threshold. Setting $r=0$ in equation (6) gives $Q_{\text{th}}\approx12.6\%$ , against BB84's $1-2H(Q)=0$ at $11.0\%$ . Both give $r=1$ at $Q=0$ ; the six-state curve simply descends more slowly, buying about $1.6$ extra points of noise tolerance. Why: the gain is the cash value of symmetry — Eve constrained to a structureless channel must disturb more per bit she learns. *As a check: equation (6) gives $r=1$ at $Q=0$ and crosses zero at $Q=12.62\%$ , while BB84's $1-2H(Q)$ crosses zero at $Q=11.00\%$ .*

Go deeper · Derivation B · 2 minThe Helstrom bound and why SARG04 blunts photon-number splitting

Derivation BThe Helstrom bound and why SARG04 blunts photon-number splitting

The goal is to show that SARG04's announcement leaves an eavesdropper who has physically stolen a photon unable to read the bit with certainty, and to quantify the residual error. The setup is a photon-number-splitting attack: on a multiphoton pulse Eve keeps one photon, forwards the rest, and waits for the announcement. In BB84 that announcement is the basis, which turns her stored photon into a deterministic readout. In SARG04 it is a non-orthogonal pair, leaving Eve the fundamentally limited task of minimum-error state discrimination, whose optimal success is the Helstrom probability. We derive that bound and evaluate it for the BB84-state pairs SARG04 uses.

Step 1. State Eve's task. The bit is which of two equiprobable pure states, $|\psi\rangle$ or $|\phi\rangle$ , Alice sent, and the announced pair names exactly these two candidates. With one stored copy she must choose, and her best success is the minimum-error discrimination probability. Why: naming the pair does not name the state, so Eve inherits a discrimination problem, not a lookup.

Step 2. Apply the Helstrom theorem. For two equiprobable pure states the optimal success is $P_{\text{guess}}=\tfrac12\big(1+\tfrac12\|\rho_\psi-\rho_\phi\|_1\big)$ , set by the trace distance between the candidates. Why: the trace distance measures how well any measurement can tell two states apart, and Helstrom's projector onto the positive part of $\rho_\psi-\rho_\phi$ achieves it.

Step 3. Evaluate the pure-state trace distance, $\tfrac12\|\,|\psi\rangle\langle\psi|-|\phi\rangle\langle\phi|\,\|_1=\sqrt{1-|\langle\psi|\phi\rangle|^2}$ , so $P_{\text{guess}}=\tfrac12\big(1+\sqrt{1-|\langle\psi|\phi\rangle|^2}\big)$ . For SARG04's adjacent BB84 pair, e.g. $|0\rangle$ and $|+\rangle$ with overlap $|\langle 0|+\rangle|=1/\sqrt2$ , this is $\tfrac12(1+1/\sqrt2)\approx0.854$ . Why: the same non-orthogonality that lets Bob decode is exactly what caps Eve, and $0.854$ is the concrete leak per stolen photon.

Step 4. Draw the consequence. Where BB84 leaks a stored-photon bit with probability $1$ , SARG04 leaks it with probability $0.854$ , leaving $\approx14.6\%$ residual error. A multiphoton pulse is no longer a free bit, and SARG04 tolerates more channel loss against photon-number splitting than plain BB84 on the same hardware. Why: turning a certain leak into a probabilistic one pushes the secure distance outward without decoy states. *As a check: overlap $1/\sqrt2$ gives $P_{\text{guess}}=0.8536$ and residual error $0.1464$ .*

Go deeper · Derivation C · 1 minCounting sifted bits: one in three and one in four

Derivation CCounting sifted bits: one in three and one in four

The goal is to derive the sifting efficiencies $1/3$ (six-state) and $1/4$ (SARG04) from first principles, because these factors control the raw-to-secret conversion and explain why the variants are not free. Sifting is the public step where Alice and Bob discard unusable signals; the surviving fraction is a pure counting problem over independent random choices, distinct for the two protocols because they announce different things. We count each case explicitly.

Step 1. Six-state basis match. Alice and Bob each pick one of three bases uniformly and independently, keeping the signal only when they coincide: $3\times\tfrac19=\tfrac13$ . The same count for BB84's two bases gives $2\times\tfrac14=\tfrac12$ . Why: more bases to disagree over means fewer coincidences, so richer encoding directly costs sifting rate.

Step 2. SARG04, first factor. Alice sends one of four states and announces a non-orthogonal pair containing it. Only one of Bob's two possible bases can ever yield a conclusive result for a given pair, so half his measurements are in a useless basis. Why: decoding needs Bob to measure along a direction that can rule out one candidate.

Step 3. SARG04, second factor. Even in the useful basis, Bob's outcome is conclusive only when it is orthogonal to one announced state, identifying the other — half of those measurements. Multiplying, $P_{\text{conclusive}}=\tfrac12\cdot\tfrac12=\tfrac14$ . Why: an inconclusive outcome fits both candidates and is discarded, halving the yield again.

Step 4. Read the tradeoff. Single-photon SARG04 keeps only $1/4$ of signals against BB84's $1/2$ , so at zero noise BB84 wins on rate; SARG04's advantage is purely in the multiphoton regime. Why: the protocols trade guaranteed rate for conditional security, and the counting makes the price explicit. *As a check: $3\times(1/3)^2=1/3$ , $2\times(1/2)^2=1/2$ , and $\tfrac12\cdot\tfrac12=1/4$ .*

Limiting cases

Case	Result	Meaning
Drop one basis (six-state → BB84)	$\{X,Y,Z\}\longrightarrow\{X,Z\}$	Using two of the three MUBs recovers BB84 with its $11.0\%$ threshold and $1/2$ sifting.
Noiseless single-photon channel	$Q=0$	All three protocols yield a key; the higher sifting of BB84 ( $1/2$ ) then wins on raw rate.
SARG04 single-photon sifting	$\eta_{\mathrm{sift}}=1/4$	Each announcement is conclusive only a quarter of the time — half of BB84's efficiency.
Two-photon pulse under PNS	$p_{\text{leak}}^{\text{BB84}}=1\to p_{\text{leak}}^{\text{SARG04}}=0.854$	BB84 leaks the bit deterministically once the basis is public; SARG04 leaves $\approx14.6\%$ residual error.
Six-state at threshold	$Q\to12.6\%,\ r\to0$	The extra basis buys $\approx1.6$ points over BB84's $11.0\%$ before the key rate vanishes.

Common trapA higher error threshold means more secret key

It does not, and conflating the two is the usual trap. The six-state and SARG04 advantages are thresholds and robustness, not raw rate. The per-signal secret rate is (sifting) × (secret fraction), and at $Q=0$ all three have secret fraction $1$ , so BB84's $1/2$ sifting beats six-state's $1/3$ and SARG04's $1/4$ outright — BB84 simply produces more key. Six-state only pulls ahead as $Q$ climbs toward $11\%$ , where BB84's rate collapses while six-state's is still positive out to $12.6\%$ ; SARG04 only pulls ahead when the source emits multiphoton pulses a photon-number-splitting eavesdropper could otherwise harvest for free. A better threshold is a better worst-case instrument, not a universally faster one — which is why real deployments match the protocol to their noise and source, and increasingly layer decoy states on top.

Worked examples

1 · The six-state advantage at a real error rate (fully worked)

A fibre link runs at a measured QBER of $Q=8\%$ . Compare the one-way secret fraction per sifted bit for BB84 and six-state, then convert to secret bits per transmitted signal, and finally locate each protocol's threshold.

Step 1. BB84 secret fraction. Use $r_{\text{BB84}}=1-2H(Q)$ with $H(0.08)=-0.08\log_2 0.08-0.92\log_2 0.92=0.4022$ . So $r_{\text{BB84}}=1-2(0.4022)=\mathbf{0.196}$ secret bits per sifted bit.

Step 2. Six-state secret fraction. Use equation (6) with $1-\tfrac{3Q}{2}=0.88$ , $\tfrac{3Q}{2}=0.12$ , $\log_2 0.88=-0.1844$ , $\log_2 0.04=-4.6439$ : $r_{\text{six-state}}=1+0.88(-0.1844)+0.12(-4.6439)=\mathbf{0.280}$ per sifted bit — about $43\%$ above BB84.

Step 3. Per transmitted signal. Multiply by sifting: BB84 gives $\tfrac12\times0.196=\mathbf{0.098}$ , six-state $\tfrac13\times0.280=\mathbf{0.093}$ . At $8\%$ the two are nearly tied, BB84 fractionally ahead — six-state's per-sifted-bit lead is almost exactly cancelled by its $1/3$ sifting.

Step 4. Where they cross. Push to $Q=12\%$ : BB84 gives $r=1-2H(0.12)=-0.059<0$ , so it is dead, while six-state still gives $r=1+0.82\log_2 0.82+0.18\log_2 0.06=0.035>0$ . Verdict: six-state does not beat BB84 on raw rate at moderate noise, but it survives to $12.6\%$ where BB84 has already failed at $11.0\%$ — the advantage is threshold, not throughput.

2 · SARG04 versus a photon-number-splitting eavesdropper

Eve mounts a PNS attack: she splits one photon from a two-photon pulse, stores it, forwards the other, and waits for the announcement. Quantify how much of the bit she learns under BB84 and under SARG04, using the standard adjacent-state pair with overlap $1/\sqrt2$ .

Step 1. BB84 baseline. The announcement is the basis, so Eve measures her stored photon in that basis and reads the bit with certainty: $P_{\text{guess}}^{\text{BB84}}=\mathbf{1}$ . A multiphoton pulse is a free, undetectable bit — the essence of the PNS vulnerability.

Step 2. SARG04 announcement. Alice instead announces the non-orthogonal pair $\{|\psi\rangle,|\phi\rangle\}$ with $|\langle\psi|\phi\rangle|=1/\sqrt2$ . Eve must now discriminate the two, not look one up.

Step 3. Apply Helstrom (equation 8): $P_{\text{guess}}^{\text{SARG04}}=\tfrac12\big(1+\sqrt{1-1/2}\big)=\tfrac12\big(1+\tfrac{1}{\sqrt2}\big)=\tfrac12(1.7071)=\mathbf{0.854}$ . Her residual error is $1-0.854=\mathbf{0.146}$ , i.e. $\approx14.6\%$ of the bit stays hidden even with the stolen photon in hand.

Step 4. Interpretation. SARG04 converts a deterministic multiphoton leak ( $P=1$ ) into a partial one ( $P=0.854$ ), extending the secure distance against PNS on weak-coherent-pulse hardware without decoy states. The tradeoff is the heavier $1/4$ sifting SARG04 pays for single-photon signals.

Physics of the portrait

The six-state and SARG04 protocols share more than a design philosophy — they share an author. Nicolas Gisin sits on the eavesdropping analysis of one and the invention of the other, and on much of what turned QKD from a thought experiment into deployed fibre.

Origins · 1 minNicolas Gisin and how this was discovered

Nicolas Gisin

born 1952 · quantum cryptography and the foundations of quantum information

Nicolas Gisin, a Swiss physicist at the University of Geneva, is one of the figures who dragged quantum key distribution off the blackboard and into deployed hardware. Trained in both theory and experiment, he built a group that set successive records for long-distance entanglement and QKD over installed telecom fibre, and co-founded ID Quantique, one of the first companies to sell working QKD systems. His fingerprints are on both protocols here: with Helle Bechmann-Pasquinucci he worked out the eavesdropping analysis of the six-state scheme in 1999, sharpening Bruß's proposal into concrete security numbers, and in 2004 he was the G in SARG04, the paper that reworked BB84's sifting to resist photon-number splitting. Beyond protocols, Gisin has been a careful voice on the foundations of quantum mechanics — nonlocality, quantum randomness, the limits of determinism. The through-line is a refusal to separate the deep question from the working device: the instinct that makes a threshold like $12.6\%$ worth deriving is what makes it worth measuring on a real link.

History

1984

— Bennett and Brassard introduce BB84, the first prepare-and-measure QKD protocol

1998

— Bruß proposes the six-state protocol, adding the third mutually unbiased basis

1999

— Bechmann-Pasquinucci and Gisin analyse six-state eavesdropping and its error tolerance

2001

— Lo proves unconditional security of six-state QKD with a 12.6% threshold

2004

— Scarani, Acín, Ribordy, Gisin publish SARG04 to resist photon-number splitting

Going further

Texts. Nielsen and Chuang, Quantum Computation and Quantum Information, Ch. 12 (quantum cryptography) and §9 (trace distance and Helstrom) · Preskill, Lecture Notes on Quantum Information, chapter on quantum cryptography · Wilde, Quantum Information Theory, 2nd ed., security and private-capacity chapters · Watrous, The Theory of Quantum Information, state-discrimination chapter for the Helstrom bound.

Papers. Bruß, Phys. Rev. Lett. 81, 3018 (1998) — six-state protocol · Bechmann-Pasquinucci and Gisin, Phys. Rev. A 59, 4238 (1999) — six-state eavesdropping · Lo, Quantum Inf. Comput. 1, 81 (2001) — six-state security and the 12.6% threshold · Scarani, Acín, Ribordy, Gisin, Phys. Rev. Lett. 92, 057901 (2004) — SARG04 · Scarani et al., Rev. Mod. Phys. 81, 1301 (2009) — security of practical QKD. The key numerical anchors are: the MUB overlap $|\langle a|b\rangle|^2=1/2$ for the Pauli eigenbases; sifting factors $1/3$ , $1/2$ , $1/4$ from random-choice counting; the six-state rate $r=1+(1-\tfrac{3Q}{2})\log_2(1-\tfrac{3Q}{2})+\tfrac{3Q}{2}\log_2\tfrac{Q}{2}$ , which evaluates to $0.280$ at $Q=8\%$ and reaches zero at $12.6\%$ ; BB84's $r=1-2H(Q)$ , which reaches zero at $11.0\%$ ; and the Helstrom probability $\tfrac12(1+1/\sqrt2)\approx0.854$ . Note: the six-state rate is $r=1-H(\text{Bell populations})$ ; an extra $1-H(Q)$ prefactor sometimes seen is a double count and is not used here.

Prerequisites. BB84 Protocol · No-Cloning Theorem in Cryptography · Quantum Bit Error Rate and Sifting · Photon-Number-Splitting Attack. Leads to. Information Reconciliation and Privacy Amplification · Decoy-State QKD · E91 Protocol.

Ask the tutor: Ask me to solve equation (6) for the six-state threshold step by step, or to work out how SARG04's $0.854$ Helstrom leak feeds into the secure key rate against a photon-number-splitting attack.

What exactly is a mutually unbiased basis, and why does a qubit have only three?

Two orthonormal bases are mutually unbiased when a definite state in one is maximally uncertain in the other — every cross-basis overlap has modulus $1/\sqrt d$ , so a wrong-basis measurement yields a uniformly random outcome and zero information. For a qubit ( $d=2$ ) that means $|\langle a|b\rangle|^2=1/2$ , which the eigenbases of $X$ , $Y$ , $Z$ all satisfy pairwise. The maximum number of MUBs in dimension $d$ is $d+1$ for a prime power $d$ , so a qubit tops out at three. The six-state protocol uses that complete set; no fourth qubit basis is unbiased to all three, which is why "six-state" is the natural end of the road.

Does SARG04 change the quantum states Alice sends, or only what she says afterward?

Only what she says. The physical layer of SARG04 is identical to BB84: the same four states from two conjugate bases, prepared the same way on the same hardware. The entire difference is classical. In BB84 Alice announces the basis she used; in SARG04 she announces a pair of non-orthogonal states, one of which she sent. That single change in the sifting rule forces decoding to become a state-discrimination problem, and it is why SARG04 runs on an existing BB84 transmitter with only a software change to the post-processing.

Why does a higher tolerable error rate not translate into a higher key rate?

Because the secret rate per transmitted signal is the product of two factors: sifting efficiency and secret fraction per sifted bit. The threshold only concerns the second, and only near where it hits zero. Six-state improves the secret fraction at large $Q$ but pays with a worse sifting factor ( $1/3$ versus $1/2$ ), and at low noise, where the secret fraction is near $1$ for everyone, sifting dominates — so BB84 delivers more key. The threshold advantage is about how much noise you can survive, not how fast you go in good conditions.

How does the depolarizing channel enter a protocol about eavesdropping?

It is the shape Eve's best attack is forced into, not a property of the fibre. When Alice and Bob measure in all three Pauli bases and check the error in each, any attack treating the axes asymmetrically would produce a basis-dependent QBER that betrays it. Eve's optimal collective attack is therefore symmetric over the three axes, and the unique single-qubit channel with that symmetry is the depolarizing map $\rho\mapsto(1-p)\rho+p\,I/2$ . This is what makes six-state security clean: one measured number, the QBER, fixes the whole channel through $p=2Q$ , and the secret rate follows in closed form.

Is SARG04 still used, or has decoy-state QKD made it obsolete?

Both are true in part. Decoy-state BB84 is the workhorse of deployed QKD because it recovers the ideal single-photon rate and gives longer secure distance than SARG04's sifting trick, so on raw performance the decoy method has largely superseded it. But SARG04 has not vanished: it is still implemented, analysed in security proofs, and generalized into measurement-device-independent and higher-dimensional settings — partly because it needs no intensity-modulated decoy pulses, partly because it is the cleanest example of buying security from the sifting rule alone. The two ideas are complementary and sometimes combined.

Could you extend the idea past six states, to more bases or higher dimensions?

Yes, and both directions are studied. A single qubit is capped at three mutually unbiased bases, so "more bases" ends at six states — but a qudit of dimension $d$ (a prime power) admits up to $d+1$ MUBs, and high-dimensional QKD exploits this to pack more bits per photon and tolerate more noise, at the cost of harder preparation and detection. SARG04's discrimination trick likewise generalizes to larger announced sets and continuous-variable encodings. The two knobs are general — enrich the alphabet, or enrich the announcement — and the six-state and SARG04 protocols are the cleanest instances of each on the humble qubit.