Alice encodes each bit in one of several mutually unbiased bases (MUBs) on the Bloch sphere. BB84 uses two: Z (rectilinear, blue) and X (diagonal, green). The six-state protocol adds a third, Y (circular, magenta) — the full set of MUBs for one qubit.
Bases: Z = {|0>, |1>}
X = {|+>, |-> }
Y = {|+i>, |-i>}
Sifting: keep a bit only if Bob's basis == Alice's basis
P(sift) = 1 / n_bases (50% for BB84, 33.3% for six-state)
Bob picks a basis independently at random for every qubit. Only when his basis matches Alice's announced basis is the bit kept — this is the public "sifting" step. With no eavesdropper, a matched basis always gives a perfectly correlated bit.
An intercept-resend Eve measures each qubit in a random basis of her own and resends whatever state she collapsed it to. If she guesses Alice's basis correctly (probability 1/n), nothing changes. If she guesses wrong (probability (n-1)/n), she resends the wrong state — so even when Alice and Bob's bases match, Bob's outcome is now a coin flip:
QBER(Eve) = (n-1)/n * 1/2
BB84 (n=2): 1/2 * 1/2 = 25.0%
Six-state (n=3): 2/3 * 1/2 = 33.3%
The extra basis costs six-state a lower sifted-key rate (1/3 instead of 1/2) but forces any intercept-resend eavesdropper to leave a bigger, more reliably detectable fingerprint in the quantum bit error rate — Alice and Bob compare a public sample of sifted bits and abort the key if the QBER exceeds their security threshold.