  We analyze the set of two-qubit states from which a secret key can be
extracted by single-copy measurements plus classical processing of the
outcomes. We introduce a key distillation protocol and give the corresponding
necessary and sufficient condition for positive key extraction. Our results
imply that the critical error rate derived by Chau, Phys. Rev. A {\bf 66},
060302 (2002), for a secure key distribution using the six-state scheme is
tight. Remarkably, an optimal eavesdropping attack against this protocol does
not require any coherent quantum operation.
