Why is the efficiency of Ekert 91 Protocol 25%?

Question

In Cabello's paper Quantum key distribution without alternative measurements, the author said "the number of useful random bits shared by Alice and Bob by transmitted qubit, before checking for eavesdropping, is 0.5 bits by transmitted qubit, both in BB84 and B92 (and 0.25 in E91)" (see here, page 2).

In E91 protocol, Alice and Bob each chooses independently and randomly from three measurement bases, so there are 9 situations and only 2 of them can yeild correct bits. Does that mean the efficiency of E91 is $\frac 2 9$ ? Why does the useful random bits is 0.25 bits by transmitted qubits in E91?

Answer 1

I emailed Artur Ekert to seek help for this quesiton, and he replied:

There are different variants of the E91 protocol that may give you different efficiencies. In my original version the settings used for the keys bits were indeed chosen with the probability 2/9, but others optimised it in all kind of ways.

So at least 2/9 is the probability of the original E91 protocol, and for those who want to know the calculation for the original protocol, please refer to DaftWullie's answer which I think is correct. But as I'm not professional in this area, I'm not sure that the calculation in Cabello's paper is a mistake or he just calculated some optimized version.

Answer 2

TL;DR: The efficiency is 2/9, not 25%.

The Ekert 91 protocol involves many rounds. In each round, Alice and Bob share a Bell pair $$ (|00\rangle+|11\rangle)/\sqrt{2} $$ They both choose randomly which of 3 measurements to make. Alice chooses between the measurement bases $Z$, $(X+Z)/\sqrt{2}$ and $X$. Bob chooses between $(X+Z)/\sqrt{2}$, $X$ and $(X-Z)/\sqrt{2}$. They make their measurements, and get $\pm 1$ answers. They record both the measurement settings and the answers.

Later, they announce in public what measurement bases they used, but not the answers.

In the scenario of no eavesdropping, and no errors, Alice and Bob are guaranteed to get identical measurement results whenever they measure in the same basis, and each such outcome gives one shared secret bit. If Alice and Bob chose different measurement bases, they announce the outcomes that they got and use them in a CHSH test to detect eavesdropping.

How often do they get a secret bit out in this scenario? If we assume that all measurement bases are equally likely, then there are 9 possible combinations for Alice's and Bob's choices. Of these, two are matching pairs. Hence, the efficiency if 2/9.