Cryptanalysis of a practical quantum key distribution with polarization-entangled photons

Recently, a quantum key exchange protocol has been described [1], which served as basis for securing an actual bank transaction by means of quantum cryptography [2]. The authentication scheme used to this aim has been proposed by Peev et al. [3]. Here we show, that this authentication is insecure in the sense that an attacker can provoke a situation where initiator and responder of a key exchange end up with different keys. Moreover, it may happen that an attacker can decrypt a part of the plaintext protected with the derived encryption key.