Eavesdropping in case of the BB84 Protocol

Question

I try to understand eavesdropping in case of the BB84 protocol (lets assume we have single photons, no noise etc.). Alice and Bob generate a classical random bit $a_i'$ and $b_i'$. Alice generates an encoded quantum bit $a_i$ based on $a_i'$ and sends it to Bob. Bob decodes $a_i$ based on the $b_i'$. Alice and Bob share $a_i'$ and $b_i'$ on a classical channel. If they used the same encoding/decoding (i.e. $a_i' = b_i'$) the decoded bit can be used, otherwise it will be ignored. Now, Eve tries eavesdropping. She would measure $a_i$ based on a random base. Her guess will be correct by a chance of 50 %. In case she used the wrong base she will still measure the correct value by 50 % change. In total, by 25 % chance she would not measure the correct value. Alice and Bob can monitor thier error rate and if it is too high there is a high probability of eavesdropping.

But I do have to questions regaring eavesdropping:

1. What if Eve generates an entangled Qubit of $a_i$? Eve could wait to measure $a_i$ until Alice and Bob exchange $a_i'$ and $b_i'$ (in this case it would not be a problem that the superposition of $a_i$ already collapsed because Eve would know the correct base). Since Eve could know how to decode/encode based on $a_i'$ and $b_i'$ she could reconstruct $a_i$.

2. Moreover, what if Eve behaves like a fake Alice and Bob? That is, Eve pretends to be Bob when communicating with Alice. Once she decoded the information she could send it to Bob while she would pretend to be Alice.

Answer 1

Both are valid concerns.

Regarding number 2, it is an assumption that Alice and Bob are reliably identified to each other and cannot be spoofed. At this point it is usually said "there are good classical protocols for this" and we don't worry about it any further. I know I've never looked into how the classical protocols work (so I can't give you an explanation here).

As for another possible eavesdropping protocol (whether that's replacing with half of an entangled state, attempting to clone the qubit, measure in some other basis, or some more even more sophisticated possibilities where you don't just act independently over individual runs, but coherently), as you can see, there are many such options. While it's helpful to understand why the protocol is secure against a given strategy, once you've convinced yourself for one or two possibilities, what you really needs is a security proof. This has the potential to prove that the protocol is secure against any eavesdropping protocol. For example, you might try Renato Renner's PhD thesis.

As for the specific case of substituting an entangled state, ordering is important here. Let's imagine that Eve keeps Alice's qubit, and sends Bob half an entangled pair. If Alice announces her bases before Bob measures, Eve could measure the qubit she got from Alice to find the bit value. She might try and send that to Bob by measuring her entangled state. But there are two possible outcomes. So 50:50 she gets the one she wants, or not. It's the same problem as before. In fact, however, the protocol is that Eve would have to make that choice before Alice announces the basis, so it's even harder for Eve (she has less information). Formally, we'd describe the state of Bob's qubit from Eve as a maximally mixed state, meaning that whatever basis he measures in, he'll get the two answers with equal probability. So there's always the same chance of Eve being detected.