Quantum Key Distribution: BB84 and Why Eavesdropping Shows

Before any physics, a distinction that is constantly muddled and that determines what this cursus is about.

Post-quantum cryptography is classical mathematics. It runs on ordinary computers, uses no quantum hardware, and consists of algorithms whose underlying problems are believed hard even for a quantum computer. Lattice problems, hash-based signatures, codes. This is what is actually being deployed, and the third lesson of this cursus covers it.

Quantum cryptography, sometimes called quantum key distribution, is the opposite arrangement. It uses quantum physics to accomplish a cryptographic task, requires specialised optical hardware, and derives its security from the laws of physics rather than from any assumption about computational difficulty.

The names invite confusion and the two are almost unrelated in practice. One is software you install; the other is equipment you install.

What is worth holding on to from the start. Their security claims are different in kind. A post-quantum scheme is secure because nobody knows an efficient algorithm to break it, which is a statement about the current state of mathematics. A quantum key distribution scheme is secure because copying an unknown quantum state is impossible, which is a statement about physics.

That sounds like an overwhelming advantage for the second, and this lesson explains the mechanism that produces it. The next lesson explains why, despite that advantage, essentially nobody is deploying it, and why the agencies responsible for national security recommend against it.

Both halves are needed to understand the field, and taking the first without the second is how the subject is usually mis-taught.

The result the entire field rests on, and it follows from linearity alone rather than from anything exotic.

The claim, proved by Wootters and Zurek and independently by Dieks in 1982: there is no unitary operation that copies an arbitrary unknown quantum state.

The argument is short. Suppose a machine exists that takes an unknown state and a blank, and produces two copies. Write that as U acting on the pair. For two specific states it would give the state paired with itself, in each case.

Quantum mechanics requires U to be linear, so its action on a superposition is determined by its action on the components. Apply it to an equal superposition of the two states and linearity gives you a superposition of the two copied pairs. But a genuine copier should have produced the copy of the superposition, which when expanded contains cross terms the linear result does not have. The two disagree, so no such U exists.

What this does and does not forbid, because both matter.

It forbids copying an unknown state. You can copy a state you already know how to prepare, since you simply prepare it twice.

It forbids perfect copying. Approximate cloning is possible with bounded fidelity, which is why real security proofs bound an eavesdropper's information rather than declaring it zero.

And it does not prevent measurement. An eavesdropper can measure. The point, developed next, is that measurement of an unknown state disturbs it, and the disturbance is what becomes visible.

So the security mechanism is not that interception is impossible. It is that interception cannot be silent.

The second ingredient is that measurement requires choosing a basis, and choosing wrongly destroys the information you were trying to read.

Encode a bit in the polarisation of a single photon, using two bases.

The rectilinear basis: horizontal for zero, vertical for one.

The diagonal basis: forty-five degrees for zero, one hundred and thirty-five degrees for one.

These bases are conjugate, meaning each state in one is an equal superposition of the states in the other. A photon prepared as horizontal, measured in the diagonal basis, gives forty-five or one hundred and thirty-five with probability one half each, and afterwards the photon is in the state that was measured. The original information is gone, not merely unread.

That is the crucial asymmetry. Measuring in the correct basis returns the encoded bit with certainty and leaves the state intact. Measuring in the wrong basis returns a random bit and destroys the original.

And the receiver does not know which basis was used, because that is the point. Neither does an eavesdropper.

So consider an interceptor who measures each photon and resends what they found. On average they choose the wrong basis half the time. When they do, they resend a state in the wrong basis, and the legitimate receiver measuring in the correct basis then gets a random answer, wrong half the time.

Combining those: intercepting and resending every photon introduces an error rate of about twenty-five percent in the positions where sender and receiver used the same basis. The eavesdropper has learned something and has left a signature proportional to what they learned.

That trade-off, information gained against disturbance caused, is the whole of quantum key distribution.

The protocol published by Charles Bennett and Gilles Brassard in 1984, which remains the reference design.

Alice generates two random bit strings: the key bits, and the basis choices. For each position she prepares a photon encoding that bit in that basis, and sends it.

Bob, for each arriving photon, chooses a basis at random independently and measures. He now has a bit for each detection, correct where his basis matched Alice's and random where it did not.

Then they talk over a public classical channel, and what they exchange matters. They announce their bases, not their bits. Positions where the bases differ are discarded, which is about half. What remains is the sifted key, which should be identical if nobody interfered.

They then sacrifice a random subset of the sifted key, comparing those bits publicly to estimate the quantum bit error rate. Those bits are discarded regardless, being now public.

If the error rate exceeds a threshold, they abort: either an eavesdropper is present or the channel is too noisy, and the protocol deliberately does not distinguish these.

If it is below threshold, two classical post-processing steps follow. Information reconciliation corrects the remaining discrepancies, and privacy amplification compresses the key through a hash to a shorter one about which the eavesdropper's partial information becomes negligible.

What comes out is a shared secret key. Note what did not happen: no message was encrypted. QKD distributes keys, and the encryption is a separate classical step.

The abort threshold is where the physics becomes a quantitative security statement, and the reasoning is worth following.

The two post-processing steps consume key material. Information reconciliation leaks information to anyone listening on the public channel, in an amount related to the error rate. Privacy amplification then shortens the key to remove what an eavesdropper might know. The final key length is what remains after both.

As the error rate rises, reconciliation leaks more and privacy amplification must remove more. At some rate the two costs consume everything and the extractable secret key length falls to zero. That crossing point is the threshold.

For BB84 with one-way classical post-processing, the widely cited figure is about eleven percent, established by the security proof of Peter Shor and John Preskill in 2000, building on earlier work by Dominic Mayers and by Lo and Chau. Protocols with two-way reconciliation tolerate somewhat more.

Two consequences that are frequently misunderstood.

The protocol does not detect eavesdroppers as such. It measures a disturbance and treats all of it as adversarial, which is the conservative and correct assumption. Ordinary channel noise is indistinguishable from an attack, so noise consumes security budget.

And this is why a noisy link produces no key at all rather than a less secure key. The system either delivers information-theoretically secure bits or delivers nothing, which is an unusual and genuinely attractive property.

The strength of the claim is worth stating precisely. Given the assumptions hold, the key is secure against an adversary with unlimited computational power, including a quantum computer, forever. No computational scheme offers that. Whether the assumptions hold in a real device is the subject of the next lesson.

A different route to the same result, published by Artur Ekert in 1991, which is conceptually deeper and matters for what comes later.

Instead of Alice preparing and sending states, a source produces entangled photon pairs and distributes one photon to each party. Alice and Bob each measure their photon in a randomly chosen basis. Where their choices align, their outcomes are correlated, giving shared bits.

What makes this more than a rearrangement is where the security comes from. Rather than reasoning about disturbance, Ekert's protocol uses the measurements in mismatched bases to test a Bell inequality.

The significance of that test. A Bell inequality is satisfied by any theory in which the outcomes were determined in advance by local variables. Quantum mechanics violates it, and the violation has been experimentally confirmed in increasingly loophole-free forms, work recognised by the 2022 Nobel Prize in Physics awarded to Alain Aspect, John Clauser and Anton Zeilinger.

So if Alice and Bob observe a sufficiently strong Bell violation, they can conclude that their outcomes were not predetermined, and therefore that no third party holds a copy. An eavesdropper who entangled themselves with the pair, or a source that emitted correlated but predetermined states, would reduce the violation.

The deep consequence, which the next lesson returns to. The Bell test certifies the correlations without any assumption about what the devices are doing internally. That opens the possibility of device-independent quantum key distribution, where security holds even if the equipment was built by your adversary.

That is a remarkable theoretical position, and it comes at a severe cost in key rate, which is why it remains largely a laboratory result rather than a product.

A practical point that is skipped in most introductions and that shapes the entire value proposition.

Quantum key distribution produces shared random bits. It does not transmit messages. To protect data you still use a classical cipher with that key, and which cipher you choose determines what security you actually end up with.

Two options, with very different properties.

The one-time pad. Exclusive-or the message with a key of equal length, never reusing any of it. This is the only cipher with proven information-theoretic security, established by Claude Shannon in 1949, and combining it with QKD gives an end-to-end system whose security rests on no computational assumption at all.

The difficulty is throughput. A one-time pad consumes one key bit per message bit, and QKD key rates over real distances are modest, typically in the kilobits to megabits per second range over metropolitan fibre and falling sharply with distance. Encrypting a gigabit link with a one-time pad would require a gigabit per second of key, which is far beyond what any deployed system produces.

So in practice the key is used with a symmetric cipher such as AES, refreshed frequently.

And that choice has a consequence worth being clear about. Once the key feeds AES, the system's security is the security of AES. The information-theoretic guarantee applies to the key distribution step only. The overall system is now computationally secure, like everything else, with a very well-studied cipher.

AES with a two hundred and fifty-six bit key is already considered secure against quantum attack, since Grover's algorithm provides only a quadratic speedup on search and is addressed by doubling the key length.

Which raises the question the next lesson takes up: what problem is being solved by distributing that AES key quantum-mechanically.

The mechanism, before the critique.

The no-cloning theorem follows from linearity and forbids copying an unknown quantum state. It does not forbid measurement, and the security does not come from making interception impossible.

It comes from conjugate bases. Measuring in the wrong basis returns a random result and destroys the original state, so an eavesdropper who does not know the preparation basis must guess, and guessing wrong leaves an error. Intercept-and-resend on every photon produces roughly a twenty-five percent error rate in the sifted positions.

BB84 turns that into a protocol. Random bits in random bases, public reconciliation of bases but never bits, sifting, error estimation on a sacrificed subset, and abort above threshold. Then information reconciliation and privacy amplification produce a shorter key about which an eavesdropper knows negligibly little.

The threshold, around eleven percent for BB84 with one-way post-processing, is where reconciliation leakage and privacy amplification consume the entire key. Below it you get information-theoretically secure bits; above it you get nothing. Noise is treated as an adversary, conservatively and correctly.

Ekert's entanglement-based protocol reaches the same place through a Bell test, which certifies that outcomes were not predetermined and opens the door to device-independent security.

And the output is a key, not a channel. Used with a one-time pad it gives unconditional end-to-end security at impractical rates; used with AES, which is the realistic option, the system's overall security is that of AES.

Everything above is correct, elegant, and experimentally demonstrated. The next lesson is about the gap between that and a deployed system, which is where the field's actual controversy lives.