The one-time pad is a way to use a shared secret key to encode a message.  It provides complete security provided the secret key is only used to encode once, and the secret ket is at least as long as the message (no portion of the key should be repeated).

You can do a simple addition mod 2 (in the case of bits) to encode and then decode the message.  

In all QKD protocols, it is an important assumption that an eavesdropper cannot copy (or clone) an unknown quantum state. The proof (by contradiction) is relatively straightforward:

Assume you have a 'cloning machine'.  Such a machine would take an unknown state $\ket{\psi}$ and a blank state (let's call it $\ket{b}$) and turn it into two copies of $\ket{\psi}$.  Mathematically, we write it as:  $U_{clone} (\ket{\psi} \otimes \ket{b}) = \ket{\psi} \otimes \ket{\psi} $

Since we want to be able to clone an arbitrary state, the cloning machine should also work if we input the state $\ket{\phi}$:  $U_{clone} (\ket{\phi} \otimes \ket{b}) = \ket{\phi} \otimes \ket{\phi} $

We want to take the inner product of the two equations: 

$ [ ( \bra{\psi} \otimes \ket{b} ) U_{clone}^\dagger ] [U_{clone} ( \ket{\psi} \otimes \ket{b} ) ] = [ \bra{\phi} \otimes \bra{\phi} ] [ \ket{\psi} \otimes \ket{\psi} ] $

• $U_{clone}^\dagger U_{clone} = 1$ since $U$ is unitary
• Make sure to take the inner product of qubit 1 (from eqn 1) with qubit 1 (from eqn 2) and then for qubit 2 (from eqn 1) with qubit 2 (from eqn 2)

Then we have that:

$ \ip{\phi}{\psi} \ip{b}{b} = \ip{\phi}{\psi} \ip{\phi}{\psi} $

$ \ip{\phi}{\psi} = \ip{\phi}{\psi}^2$

This is only true if $\ip{\phi}{\psi}$ is equal to 1 or 0.  Meaning the cloning machine will only work for states that are identical or orthogonal.  In other words, you can build a cloning machine, but it will only clone a set of basis states, not an arbitrary superposition of those basis states.

This is one of the more common QKD protocols and is perfect for use in intro quantum mechanics classes as it only requires knowledge of two-level superposition states and the results of measurements.  

In our example, we will use spin-1/2 particles, and we will discuss measurements of spin in the $x$ and $z$ directions.  

Players:
     Alice - Wants to share a secret key with Bob.  She sends qubits to Bob, randomizing what she ends. 
     Bob - Wants to share a secret key with Alice.  Bob receives the qubits sent by Alice and will measure them in a randomly chosen basis.
     Eve - An eavesdropper who wants to gain information about the secret key without being detected.  She will intercept the qubits that Alice sends to Bob and make measurements before sending the qubit on to Bob.

The Protocol: The following steps can be recorded in the handout (available for download below).

1. Alice sends qubits to Bob in either the X or the Z basis.  She randomly sends one of
   $ \ket{\psi_{0z}}=\ket{0} \;\;\quad \quad \ket{\psi_{0x}}= \ket{+} = \frac{1}{\sqrt{2}}(\ket{0} + \ket{1}) $
   $ \ket{\psi_{1z}}=\ket{1} \;\;\quad \quad \ket{\psi_{1x}}= \ket{-} = \frac{1}{\sqrt{2}}(\ket{0} - \ket{1}) $
   Alice records the basis she sent (X or Z) and whether she sent the (0 or 1) for each basis.  The sequence of 0s and 1s will turn into the secret key.
2. Bob receives the qubits and makes a measurement.  He randomly chooses to measure in either the Z or the X basis and records the results (0 or 1) and the basis he chose (X or Z).
3. Alice and Bob reveal the basis they sent or measured.  They do this publically.  They will throw away all elements of their key (the 0s and 1s) where their basis choice did not match.
4. Test for an eavesdropper: Once Alice and Bob have the remaining key, it should match perfectly.  The only reason their keys might differ is if there was an eavesdropper messing things up or if there was some decoherence in their qubit channel.  They select a portion of their key to compare publically (they will then need to throw away these elements of the key as they are no longer secret).  If that portion of their keys is identical, they can feel confident that the rest of their key also matches.  If their keys are not identical, they do not have confidence in the rest of their key and will abandon the protocol and start again.  

In reality, anything can happen to the qubit as it travels from Alice to Bob. We are going to assume the worst: that a very powerful and quantum-savvy enemy has intercepted the qubit and knows enough of the protocol to make the best measurements they can before sending the qubit to Bob.

Here is the best that an eavesdropper can do:

• Measure the intercepted qubit in either the X or Z basis.  Record everything.
• Send the resulting qubit to Bob.

You can follow along in the handout to see the repercussions of this interception.  In short:

• Eve will randomly pick the "right" basis to measure in 50% of the time.  When she does this, the state she sends to Bob will be unchanged from what Alice sent.  In these instances, she is undetectable.
• The other 50% of the time, Eve will select the "wrong" basis (the basis that is opposite to what Alice sent). In these instances, by chance, Eve will get the same key value as Alice 50% of the time and get an opposing value 50% of the time.
• Altogether, Eve has a 25% chance of messing up each qubit that gets sent to Bob.

If Alice and Bob did not test for the presence of an eavesdropper, even with an error rate of 25%, Eve would certainly gain valuable information if Alice and Bob tried to use their "secret" key to encode a message.