Quantum Key Distribution and the BB84 Protocol

Quantum key distribution (QKD) is a method for two parties to establish a shared secret key whose security is guaranteed by the laws of physics rather than by computational hardness. It matters because, unlike classical key exchange, its security does not erode if an adversary gains more computing power, quantum or otherwise. The BB84 protocol, the first and most influential QKD scheme, shows how the quantum properties of single photons let communicating parties detect any eavesdropper who tries to intercept their key.

What Quantum Key Distribution Achieves

QKD does not encrypt messages directly; it produces shared random key material that can then key a symmetric cipher or a one-time pad. Its defining feature is eavesdropper detection: measuring a quantum system generally disturbs it, so any interception introduces detectable errors. If the parties observe too much disturbance, they abort and try again, ensuring that a key they accept has not been secretly copied.

The No-Cloning Theorem

QKD's guarantees stem from the no-cloning theorem, which states that an unknown quantum state cannot be copied perfectly. An eavesdropper therefore cannot duplicate a photon in flight, keep one copy, and forward another untouched. To learn anything, they must measure, and measuring in the wrong basis irreversibly alters the state, leaving statistical fingerprints the legitimate parties can spot.

The BB84 Protocol Step by Step

Following convention, the sender is Alice, the receiver is Bob, and the eavesdropper is Eve. BB84 encodes bits in the polarization of single photons using two conjugate bases.

Encoding Bits in Conjugate Bases

Alice encodes each random bit in one of two randomly chosen bases:

Rectilinear (+) basis:  bit 0 = |0°>    bit 1 = |90°>
Diagonal   (x) basis:   bit 0 = |45°>   bit 1 = |135°>

The bases are conjugate: measuring a diagonal photon in the rectilinear basis gives a completely random result, and vice versa. Alice sends a stream of such photons, recording each bit and the basis she used.

Transmission and Measurement

For each incoming photon, Bob independently picks a random basis and measures. When his basis matches Alice's, he recovers her bit correctly. When it does not, his result is random and carries no reliable information.

Sifting

Over an authenticated public channel, Alice and Bob announce which basis they used for each photon, but never the bit values. They discard every position where the bases differed. The surviving bits, where their bases agreed, form the sifted key, and on average about half the photons survive.

Error Estimation and Eavesdropper Detection

Alice and Bob publicly compare a random sample of their sifted bits and compute the quantum bit error rate (QBER). Because Eve does not know Alice's basis, any interception forces her to guess, and her measurements inject errors into roughly a quarter of the intercepted bits. An elevated QBER signals eavesdropping (or excessive noise), and the parties abort. A low QBER bounds how much information Eve could possibly hold.

From Raw Key to Secret Key

A sifted key with a tolerable error rate is not yet usable. Two classical post-processing steps finish the job:

1. Information reconciliation. An error-correction exchange fixes the remaining mismatches between Alice's and Bob's keys while leaking minimal information.
2. Privacy amplification. The parties compress the reconciled key with a universal hash function, shrinking it to a shorter final key about which Eve's residual knowledge is negligible.

The output is a shared secret suitable for keying a symmetric cipher.

Authentication and Practical Limitations

QKD is powerful but not a universal solution, and understanding its constraints is essential:

• Classical authentication is required. The public channel must be authenticated, or an attacker can mount a man-in-the-middle attack. That authentication needs a pre-shared secret or a signature scheme, so QKD does not eliminate the need for other cryptography.
• Distance and rate limits. Photon loss in fiber limits range and throughput; extending reach requires trusted relays or quantum repeaters.
• Specialized hardware. QKD needs dedicated optical equipment and is vulnerable to implementation side channels, where real detectors deviate from the idealized model.
• Point-to-point scope. It secures a link between two endpoints rather than providing scalable, internet-wide key management.

QKD Versus Post-Quantum Cryptography

QKD and post-quantum cryptography both address the quantum threat but differently. QKD offers physics-based security over specialized links, while post-quantum algorithms run in software on existing networks and scale easily. For most organizations, post-quantum cryptography is the practical path, with QKD suited to niche, high-assurance point-to-point links.

Key Takeaways

• Quantum key distribution shares secret key material with security rooted in physics, not computational hardness.
• The no-cloning theorem prevents an eavesdropper from copying photons undetected.
• BB84 encodes bits in two conjugate polarization bases, then sifts keys by publicly comparing bases, not bit values.
• A raised quantum bit error rate reveals eavesdropping, and reconciliation plus privacy amplification yield the final key.
• QKD still requires classical authentication and dedicated hardware, so it complements rather than replaces post-quantum cryptography.