B92 Protocol

The B92 protocol is quantum key distribution stripped to a single idea. Where BB84 juggles four states across two conjugate bases, B92 uses just two — and they need not be orthogonal, only distinct. Alice encodes her bit $a\in\{0,1\}$ by sending $\lvert\psi_a\rangle$ with overlap $\lvert\langle\psi_0\lvert\psi_1\rangle\rvert=s>0$ . Because the carriers are not orthogonal, no measurement — Bob's or an eavesdropper's — can tell them apart with certainty, and no-cloning forbids copying the unknown state. That one fact, the indistinguishability of non-orthogonal states, is the entire cryptographic resource. Charles Bennett's 1992 paper showed it is enough: entanglement and a second basis are luxuries, not necessities, for provably secure key exchange. Bob's job is not to guess the bit but to occasionally be certain of it. He runs an unambiguous state discrimination (USD) measurement, a three-outcome POVM returning "definitely not $\lvert\psi_0\rangle$ ", "definitely not $\lvert\psi_1\rangle$ ", or "inconclusive". A verdict excluding $\lvert\psi_0\rangle$ could only have come from $\lvert\psi_1\rangle$ , so a conclusive click is error-free on an ideal channel. Bob publicly announces which slots were conclusive — never the outcome value — and those bits become the sifted key for reconciliation and privacy amplification. The overlap $s=\cos2\theta$ is the protocol's single dial: shrink it and Bob's yield rises but so does the eavesdropper's information; grow it and the bit hides from everyone, Bob included. B92 makes the distinguishability-versus-secrecy trade-off more transparent than any other QKD scheme — which is why it is the field's favourite teaching example, and its favourite cautionary tale about channel loss.

Key takeaways

B92, proposed by Charles Bennett in 1992, encodes the two key-bit values in just two non-orthogonal states with overlap $s=\lvert\langle\psi_0\lvert\psi_1\rangle\rvert=\cos2\theta$ .
Security rests on one theorem-pair: non-orthogonal states cannot be perfectly distinguished, and unknown states cannot be cloned — so any eavesdropper must either disturb the signal or forfeit information.
Bob detects with an unambiguous-discrimination POVM, keeping only slots where he conclusively excludes one state, achieving the optimal rate $P_{\text{concl}}=1-s$ (the Ivanovic–Dieks–Peres bound).
The overlap is a rate-versus-secrecy dial: small $s$ gives high yield $1-s$ but exposes up to $H_2((1+s)/2)$ bits to the eavesdropper; large $s$ hides the bit but starves the key.
Bare B92 is fragile against loss — an eavesdropper runs USD herself, forwards only conclusive slots, and hides inside honest attenuation — which is why real systems add strong reference pulses or decoy states.
Key idea: encode bits in two non-orthogonal states and accept a bit only when an unambiguous-discrimination measurement conclusively excludes the other state — security flows entirely from the unclonability and indistinguishability of non-orthogonal quantum states.

The core insight

Encode bits in two non-orthogonal states and have the receiver accept a bit only when an unambiguous-discrimination measurement conclusively excludes the other state — security flows entirely from the unclonability and indistinguishability of non-orthogonal quantum states.

Where this lives today

B92 survives less as a deployed protocol than as the field's sharpest teaching instrument and a live research testbed. Because its two-state structure makes the Holevo bound, the Ivanovic–Dieks–Peres limit, and the disturbance-information trade-off analytically tractable, it appears in Nielsen & Chuang, in Preskill's lectures, and as the worked example in the Tamaki–Koashi–Imoto unconditional-security proof — which showed a two-state protocol can be secure even over a lossy channel when a strong reference pulse monitors the vacuum component. Strong-reference-pulse B92 has been demonstrated over metropolitan fibre and free-space links, and its minimal modulation makes it attractive for chip-scale and continuous-variable QKD. Its most enduring role, though, is cautionary: the vulnerability of bare B92 to USD intercept-resend in lossy channels is the canonical motivation for decoy-state QKD and the whole photon-number-splitting analysis. When a modern proof wants to show that loss is a security parameter, not an engineering nuisance, it reaches for B92.

The physical picture

Picture two arrows on the Bloch sphere separated by a modest angle. A single measurement can never reliably tell them apart — that is state indistinguishability. But a measurement can occasionally return an answer that is logically impossible for one of the arrows, and B92 harvests exactly those rare "impossible for state $X$ " events as key bits. The price of certainty is yield: most pulses give Bob nothing, and the fraction that pay off is fixed by the angle. The first figure fixes the geometry and vocabulary — the two states, their overlap $s=\cos2\theta$ , and the three verdicts Bob's receiver returns.

Figure

B92 geometry and flow: Alice sends one of two non-orthogonal states with overlap s = cos2θ = 0.707 at θ = 22.5°, and Bob's unambiguous measurement returns bit 0, bit 1, or an inconclusive verdict he discards

The secrecy of the protocol is a conservation law of information: the more distinguishable Alice makes her states, the better Bob's yield — but the more an eavesdropper learns, and the less she must disturb the signal to learn it. Push the states to orthogonality and the bit becomes public property; push them together and the channel carries nothing. Every useful operating point sits between those extremes, and the second figure plots the two competing curves the overlap sets against each other: Bob's yield $1-s$ and the eavesdropper's ceiling $H_2((1+s)/2)$ .

Figure

The rate versus secrecy trade-off fixed by the overlap s: Bob's conclusive yield 1 − s in green falls as the two states separate while Eve's Holevo ceiling H₂((1+s)/2) in red rises, and at s = 0.5 Bob keeps 0.50 sifted bits per received qubit while Eve learns at most 0.81 bits

Two features matter below. The green line is Bob's, the red curve the eavesdropper's, and they cross near $s\approx0.4$ ; a secure protocol must operate where the honest parties still net more than the eavesdropper after reconciliation and privacy amplification. And Bob announces only when he succeeded, never what he measured — an eavesdropper who hears "slot 7 was conclusive" cannot tell whether it excluded $\lvert\psi_0\rangle$ or $\lvert\psi_1\rangle$ , so the public sifting information is worthless by itself. No entanglement appears anywhere here: B92's security is about measurement disturbance and unclonability, not Bell nonlocality — a clean contrast with the entanglement-based E91 scheme.

The core equations

The starting point is the encoding. Alice maps her bit to one of two pure qubit states, the only requirement being that they are neither identical nor orthogonal. The asymmetric choice below and the symmetric $\lvert\psi_{0,1}\rangle=\cos\theta\lvert0\rangle\pm\sin\theta\lvert1\rangle$ give the same physics.

\lvert\psi_0\rangle=\lvert 0\rangle,\qquad \lvert\psi_1\rangle=\cos2\theta\,\lvert 0\rangle+\sin2\theta\,\lvert 1\rangle \qquad (1)

where: $\lvert\psi_a\rangle$ — qubit Alice sends for bit $a\in\{0,1\}$ ; $\theta$ — half-angle setting the overlap; $\lvert0\rangle,\lvert1\rangle$ — computational basis. Reading: the whole protocol is tuned by one angle. That angle enters every later formula through one scalar — the overlap, the inner product of the two carriers, strictly between the orthogonal and identical extremes.

s\equiv\lvert\langle\psi_0\lvert\psi_1\rangle\rvert=\cos2\theta,\qquad 0<s<1 \qquad (2)

where: $s$ — overlap magnitude, $s=0$ orthogonal and $s=1$ identical; $\cos2\theta$ — its value for encoding (1). Reading: $s$ is the master dial — read the previous figure as a function of it. Bob's receiver is the optimal unambiguous discriminator. Its elements are built from the states orthogonal to each carrier, so a click of $E_1$ has zero overlap with $\lvert\psi_0\rangle$ and certifies bit $1$ ; $E_?$ absorbs the inconclusive weight.

E_0=\frac{\lvert\psi_1^{\perp}\rangle\langle\psi_1^{\perp}\rvert}{1+s},\quad E_1=\frac{\lvert\psi_0^{\perp}\rangle\langle\psi_0^{\perp}\rvert}{1+s},\quad E_?=\mathbb{1}-E_0-E_1 \qquad (3)

where: $E_a$ — element whose click certifies bit $a$ by excluding $\lvert\psi_{1-a}\rangle$ ; $\lvert\psi_a^{\perp}\rangle$ — state orthogonal to $\lvert\psi_a\rangle$ ; $E_?$ — inconclusive, no key. Reading: the prefactor $1/(1+s)$ is the largest keeping $E_?\ge0$ , extracting the maximum conclusive weight. Averaging the conclusive weight over Alice's equally likely bits gives Bob's sifting efficiency — the fraction of received qubits that become key.

P_{\text{concl}}=\tfrac12\langle\psi_0\lvert E_0\lvert\psi_0\rangle+\tfrac12\langle\psi_1\lvert E_1\lvert\psi_1\rangle=1-s \qquad (4)

where: $P_{\text{concl}}$ — probability Bob returns a conclusive verdict; $\tfrac12$ — the uniform prior on each bit. Reading: yield falls linearly in the overlap, everything at $s=0$ to nothing at $s=1$ . No measurement can beat this. The Ivanovic–Dieks–Peres bound caps the success of any unambiguous discriminator of two equiprobable pure states, and the POVM (3) saturates it.

P_{\text{concl}}^{\max}=1-\lvert\langle\psi_0\lvert\psi_1\rangle\rvert=1-s \qquad (5)

where: $P_{\text{concl}}^{\max}$ — maximum unambiguous success probability over all measurements. Reading: the sifting ceiling is fixed by the overlap, not a design choice. The eavesdropper, lacking Alice's bit, sees the equal mixture of the two carriers, whose eigenvalues are all her accessible information depends on.

\rho_A=\tfrac12\lvert\psi_0\rangle\langle\psi_0\rvert+\tfrac12\lvert\psi_1\rangle\langle\psi_1\rvert,\qquad \lambda_{\pm}=\tfrac12\bigl(1\pm s\bigr) \qquad (6)

where: $\rho_A$ — carrier density operator averaged over Alice's bits; $\lambda_{\pm}$ — its eigenvalues, which feed the Holevo bound. Reading: these two numbers are the eavesdropper's whole world, pinching to $\{1,0\}$ only as $s\to1$ . The eigenvalues fix the ceiling through the Holevo quantity, a binary entropy of the larger eigenvalue.

\chi(A\!:\!E)\le S(\rho_A)=H_2\!\left(\tfrac{1+s}{2}\right),\qquad H_2(p)=-p\log_2 p-(1-p)\log_2(1-p) \qquad (7)

where: $\chi(A\!:\!E)$ — Holevo quantity bounding the eavesdropper's information; $S$ — von Neumann entropy; $H_2$ — binary Shannon entropy. Reading: the red curve — zero as the states merge, one full bit as they orthogonalize. Finally the sifted-key rate combines Bob's yield with the transmittance. The optimal single USD gives a factor $P_{\text{concl}}=1-s$ ; Bennett's original two-projector receiver gives strictly less.

R_{\text{sift}}\approx\eta\,(1-s)\ \ (\text{optimal USD}),\qquad R_{\text{orig}}\approx\tfrac12\,\eta\,(1-s^2)\ \ (\text{two-projector}) \qquad (8)

where: $R_{\text{sift}}$ — sifted bits per signal; $\eta$ — channel-times-detector transmittance; $R_{\text{orig}}$ — Bennett's simpler receiver. Reading: since $\tfrac12(1-s^2)<(1-s)$ , the historical receiver forfeits a factor $(1+s)/2$ .

Derivation AThe conclusive rate of the optimal unambiguous measurement

The goal is to show that Bob's sifting efficiency is exactly $P_{\text{concl}}=1-s$ , and that this both saturates the Ivanovic–Dieks–Peres bound and cannot be beaten by any measurement. We take equiprobable inputs $\lvert\psi_0\rangle,\lvert\psi_1\rangle$ with overlap $s=\cos2\theta$ , run them through the POVM $\{E_0,E_1,E_?\}$ of equation (3), and average over Alice's bits. It is a short calculation but the load-bearing one: it fixes the key rate and the price of a given overlap.

Step 1. First confirm the measurement is genuinely unambiguous. Evaluate $E_1$ on the state it must reject: $\langle\psi_0\lvert E_1\lvert\psi_0\rangle=\lvert\langle\psi_0^{\perp}\lvert\psi_0\rangle\rvert^2/(1+s)=0$ , since $\lvert\psi_0^{\perp}\rangle$ is orthogonal to $\lvert\psi_0\rangle$ . Why: a click of $E_1$ has zero amplitude to have come from $\lvert\psi_0\rangle$ , so it certifies bit 1 with no error — the meaning of "unambiguous".

Step 2. Now the conclusive weight on the matching input. Resolve $\lvert\psi_1\rangle$ in the frame $\{\lvert\psi_0\rangle,\lvert\psi_0^{\perp}\rangle\}$ ; its perpendicular component has magnitude $\sqrt{1-s^2}$ , so $\langle\psi_1\lvert E_1\lvert\psi_1\rangle=(1-s^2)/(1+s)$ . Why: only the part of $\lvert\psi_1\rangle$ perpendicular to $\lvert\psi_0\rangle$ can trigger the "not $\psi_0$ " outcome, and that projection is where the overlap enters.

Step 3. Simplify by difference of squares: $(1-s^2)/(1+s)=1-s$ , and by symmetry $\langle\psi_0\lvert E_0\lvert\psi_0\rangle=1-s$ too. Why: the two carriers play interchangeable roles, so each contributes the same conclusive weight with no bias between bit values.

Step 4. Average over Alice's uniform prior: $P_{\text{concl}}=\tfrac12(1-s)+\tfrac12(1-s)=1-s$ , which for $s=\cos2\theta$ is $1-\cos2\theta=2\sin^2\theta$ . Because $E_?$ was made as small as positivity allows, no measurement can do better, so $P_{\text{concl}}=P_{\text{concl}}^{\max}$ . Why: minimizing the inconclusive weight subject to $E_?\ge0$ is exactly the optimization the IDP bound solves. *Verified: at $\theta=\pi/4$ (orthogonal, $s=0$ ) $P_{\text{concl}}=1$ ; at $\theta=0$ (identical, $s=1$ ) $P_{\text{concl}}=0$ ; and $2\sin^2(\pi/8)=1-\cos(\pi/4)=0.293$ , matching the operating point in the figures.*

Go deeper · Derivation B · 1 minThe eavesdropper's information ceiling from the Holevo bound

Derivation BThe eavesdropper's information ceiling from the Holevo bound

The goal is to compute the maximum information any eavesdropper can hold about Alice's bit given only the carrier, with no knowledge of which bit was encoded. Her accessible information is bounded by the Holevo quantity, which for an equal mixture of the two pure carriers reduces to the von Neumann entropy of that mixture. We build the mixture, diagonalize it, take its entropy, and check the extremes — establishing the red curve the yield must beat for positive key.

Step 1. Form the state the eavesdropper sees. Not knowing $a$ , she holds the ensemble average $\rho_A=\tfrac12\lvert\psi_0\rangle\langle\psi_0\rvert+\tfrac12\lvert\psi_1\rangle\langle\psi_1\rvert$ , a $2\times2$ density matrix. Why: the Holevo bound is about ensembles, and hers is "either carrier, equally likely" — exactly what ignorance of the key produces.

Step 2. Diagonalize. An equal mixture of two pure states with overlap $s$ has eigenvalues $\lambda_{\pm}=\tfrac12(1\pm s)$ . Why: the Bloch vector of $\rho_A$ lies along the bisector of the two states with length $s$ , and a qubit's eigenvalues are $\tfrac12(1\pm\lvert\text{Bloch vector}\rvert)$ .

Step 3. Take the entropy: $S(\rho_A)=-\lambda_+\log_2\lambda_+-\lambda_-\log_2\lambda_-=H_2\!\left(\tfrac{1+s}{2}\right)$ , and this equals the ceiling $\chi(A\!:\!E)$ because the signal states are pure. Why: the Holevo quantity is $S(\rho_A)-\tfrac12 S(\psi_0)-\tfrac12 S(\psi_1)$ , and pure states drop the subtracted terms.

Step 4. Limits: as $s\to1$ the states merge, $H_2(1)=0$ , and she learns nothing; as $s\to0$ , $H_2(\tfrac12)=1$ , a full bit is exposed. Why: the rate-versus-secrecy trade-off in one line — the distinguishability that raises Bob's yield hands the eavesdropper her information. *Verified: $H_2((1+0.5)/2)=H_2(0.75)=0.811$ bits at $s=0.5$ , matching the marked point; $H_2(1)=0$ and $H_2(0.5)=1$ at the extremes.*

Go deeper · Derivation C · 1 minThe disturbance an intercept-resend eavesdropper must impose

Derivation CThe disturbance an intercept-resend eavesdropper must impose

The goal is to show that an eavesdropper who runs Bob's USD herself and resends cannot stay invisible on an ideal lossless channel: she is forced to inject a bit-error rate of exactly $\text{QBER}=s/2$ into the sifted key — the quantitative face of "measurement disturbs the state". We split her outcomes into conclusive and inconclusive, track what she must forward in each case, and follow those states through Bob's USD to tally the errors he sees.

Step 1. With probability $1-s$ her USD is conclusive; she learns $a$ exactly and forwards a perfect copy of $\lvert\psi_a\rangle$ , so Bob's later USD is error-free on these slots. Why: a conclusive verdict is certain, so on this fraction the eavesdropper is a transparent relay contributing no disturbance.

Step 2. With probability $s$ her USD is inconclusive; not knowing the bit, yet needing to keep the pulse count honest on a lossless line, she forwards a random guess $\lvert\psi_g\rangle$ with $g$ uniform. Why: she cannot drop the pulse without changing the count, so she gambles — and the gamble is uncorrelated with the true bit because her outcome was inconclusive.

Step 3. Follow the guess through Bob. His USD is conclusive with probability $1-s$ and returns $g$ ; but the true bit $a$ is independent of $g$ , so he is wrong half the time. The error weight is $s(1-s)\tfrac12$ out of total conclusive weight $(1-s)(1-s)+s(1-s)=1-s$ . Why: the total conclusive weight is unchanged because Bob always receives a valid carrier, so disturbance appears as flipped bits, not lost counts.

Step 4. Divide: $\text{QBER}=\dfrac{s(1-s)/2}{1-s}=\dfrac{s}{2}$ , vanishing at $s\to0$ (always conclusive, invisible) and reaching $\tfrac12$ at $s\to1$ (always guessing). Why: this is the honest tripwire — an anomalous QBER flags the attack, sharpest at large overlap where the yield is already small. *Verified: at $s=0.5$ , $\text{QBER}=0.25$ ; the total conclusive weight $1-s$ is unchanged by the attack, so the disturbance is pure bit-error, consistent with a lossless channel.*

Limiting cases

The overlap $s=\cos2\theta$ controls every regime at once — yield, secrecy, and vulnerability to loss move together as the dial turns.

Case	Result	Meaning
Orthogonal limit $s\to0$ ( $\theta\to\pi/4$ )	$P_{\text{concl}}\to1$ , $\chi\to1$ bit	States become perfectly distinguishable: Bob reads every pulse, but so can anyone. No secrecy remains; B92 degenerates to classical signalling.
Indistinguishable limit $s\to1$ ( $\theta\to0$ )	$P_{\text{concl}}\to0$ , $\chi\to0$	States nearly coincide: the eavesdropper learns almost nothing, but Bob's yield vanishes. Maximum hiding, zero throughput.
Optimal USD yield	$P_{\text{concl}}^{\max}=1-s$	The Ivanovic–Dieks–Peres bound caps any unambiguous discriminator at $1-s$ ; B92's sifting efficiency cannot exceed this for a given overlap.
Intercept-resend, lossless	$\text{QBER}=s/2$	Full USD intercept-resend injects a bit-error rate $s/2$ that Alice and Bob detect on a public sample — the honest tripwire.
Lossy channel	$\eta_{\text{Bob}}\ \text{vs}\ 1-s$	If honest transmittance drops below the eavesdropper's conclusive fraction, she intercept-resends losslessly and hides inside the attenuation; bare B92 becomes insecure.

Common trapB92 is not just BB84 with two states for free

Dropping BB84's second basis is not harmless — it removes a symmetry that protected BB84 against loss, and that missing symmetry is exactly what a lossy channel exploits. An eavesdropper runs USD on every pulse, forwards only the conclusive (error-free) slots, and blocks the rest. Bob sees a reduced but clean rate indistinguishable from honest attenuation, and no QBER tripwire fires because she never had to guess. Once the channel loss exceeds her inconclusive fraction $s$ , the attack is free, so naive B92 is insecure beyond a modest loss threshold. The standard repairs restore a monitorable signal: a bright strong reference pulse co-propagating with the weak signal, or decoy states that expose photon-number-selective blocking. The lesson: in QKD, robustness to loss is a security property, not a mere engineering convenience.

Worked examples

1 · A symmetric B92 operating point (fully worked)

Alice uses the symmetric encoding $\lvert\psi_{0,1}\rangle=\cos\theta\lvert0\rangle\pm\sin\theta\lvert1\rangle$ at $\theta=22.5^\circ$ . Find the overlap, Bob's optimal conclusive yield, the eavesdropper's information ceiling, the yield of Bennett's original two-projector receiver, and the sifted rate for a channel-plus-detector transmittance $\eta=0.10$ .

Step 1. The symmetric states have overlap $s=\cos^2\theta-\sin^2\theta=\cos2\theta$ . At $\theta=22.5^\circ$ , $2\theta=45^\circ$ , so $s=\cos45^\circ=\mathbf{0.7071}$ and the carriers are separated by $4\theta=90^\circ$ on the Bloch sphere.

Step 2. Bob's optimal USD yield is $P_{\text{concl}}=1-s=\mathbf{0.2929}$ conclusive bits per received qubit — roughly seven pulses in ten are inconclusive and discarded, the price of certainty at this overlap.

Step 3. The eavesdropper's ceiling uses eigenvalues $\lambda_\pm=\tfrac12(1\pm s)=\{0.8536,\,0.1464\}$ : $\chi\le H_2(0.8536)=\mathbf{0.601}$ bits per qubit — more than Bob's raw yield, which is why reconciliation and privacy amplification are mandatory, not optional.

Step 4. Bennett's original two-projector receiver yields only $\tfrac12(1-s^2)=\mathbf{0.25}$ , about 15% below optimal.

Step 5. Fold in transmittance: $R_{\text{sift}}\approx\eta(1-s)=0.10\times0.2929=\mathbf{0.0293}$ sifted bits per signal. So at $\theta=22.5^\circ$ : $s=0.707$ , $P_{\text{concl}}=0.293$ , Eve $\le0.601$ bits, and $R_{\text{sift}}\approx0.029$ per pulse at 10% transmittance.

2 · The intercept-resend tripwire

An eavesdropper runs full USD intercept-resend on a lossless line at the same overlap $s=0.5$ . What bit-error rate does she inject, and how large a sample must Alice and Bob test to see it at five standard deviations?

Step 1. From the third derivation the induced error is $\text{QBER}=s/2=\mathbf{0.25}$ — one sifted bit in four flipped, against zero on an undisturbed line. That is enormous next to the few-percent QBER of a real channel, so the attack is loud.

Step 2. To resolve 25% against a $\sim1\%$ honest baseline at five standard deviations, the binomial error $\sigma=\sqrt{p(1-p)/N}$ must fall below $\sim0.048$ , giving $N\gtrsim\mathbf{80}$ test bits. A few hundred publicly compared bits expose full intercept-resend with overwhelming confidence — the tripwire is cheap on an ideal channel, which is exactly why the eavesdropper's real hope is to hide inside channel loss instead.

3 · A weak-coherent-pulse implementation

A phase-encoded B92 sends weak coherent states $\lvert\pm\alpha\rangle$ with mean photon number $\mu=\lvert\alpha\rvert^2=0.1$ . What is the effective overlap and optimal conclusive yield?

Step 1. Two coherent states of opposite phase overlap as $\langle\alpha\lvert-\alpha\rangle=e^{-2\lvert\alpha\rvert^2}=e^{-2\mu}$ , so $s=e^{-0.2}=\mathbf{0.8187}$ — the weak pulses are highly non-orthogonal, which is the point (a bright pulse would be nearly orthogonal and insecure). The yield is then $P_{\text{concl}}=1-s=\mathbf{0.181}$ per received pulse: weakening the pulse buys secrecy at the cost of throughput, the overlap trade-off now set by the mean photon number rather than a Bloch angle.

Physics of the portrait

The B92 protocol carries one man's fingerprints more than any other in quantum cryptography — the moment Charles Bennett showed that secure key from quantum states needs almost nothing: two states, one channel, and the refusal of nature to let non-orthogonal states be told apart.

Origins · 1 minCharles Bennett and how this was discovered

Charles Bennett

born 1943 · IBM Research, founder of quantum information theory

Charles H. Bennett is, with Gilles Brassard, the co-inventor of quantum cryptography, and B92 is his demonstration of just how little the idea requires. Trained as a chemist and then a physicist, Bennett spent his career at IBM Research turning deep questions about information into concrete protocols — proving computation can be made reversible (1973) and connecting Landauer's principle to Maxwell's demon. In 1984 he and Brassard published BB84, drawing on Stephen Wiesner's idea of conjugate coding. Then in 1992 he asked whether BB84's four states and two bases were really necessary, and answered no: two non-orthogonal states suffice, because their indistinguishability alone forbids eavesdropping without disturbance. The same year he was central to quantum teleportation, and later to entanglement distillation. B92 is characteristic of his style — take a working idea, strip it to the load-bearing physics, and show the essence was smaller and stranger than anyone expected.

History

1984

— Bennett and Brassard publish the four-state BB84 protocol

1987

— Ivanovic shows non-orthogonal states admit unambiguous discrimination

1992

— Bennett introduces the two-state B92 protocol in Phys. Rev. Lett. 68, 3121

2003

— Tamaki, Koashi and Imoto prove B92 unconditionally secure over a lossy channel

Going further

Texts. Nielsen & Chuang, Quantum Computation and Quantum Information, §12.6 (quantum cryptography) · Preskill, Lecture Notes on Quantum Computation, Ch. 4 · Wilde, Quantum Information Theory, chapters on private communication · Watrous, The Theory of Quantum Information, on state discrimination and POVMs · Kitaev, Shen & Vyalyi, Classical and Quantum Computation, on measurement.

Papers. Bennett, "Quantum cryptography using any two nonorthogonal states", Phys. Rev. Lett. 68, 3121 (1992) · Ivanovic, "How to differentiate between non-orthogonal states", Phys. Lett. A 123, 257 (1987); Dieks (1988); Peres (1988) — the IDP bound · Tamaki, Koashi & Imoto, "Unconditionally secure key distribution based on two nonorthogonal states", Phys. Rev. Lett. 90, 167904 (2003).

Provenance. A verifier should recompute: (1) $P_{\text{concl}}=(1-s^2)/(1+s)=1-s$ from the USD POVM (Bennett 1992; Nielsen & Chuang §12.6); (2) the eigenvalues $\tfrac12(1\pm s)$ and Holevo entropy $H_2((1+s)/2)$ , giving $0.811$ at $s=0.5$ and $0.601$ at $s=0.707$ ; (3) the IDP ceiling $1-s$ (Ivanovic 1987, Dieks 1988, Peres 1988); (4) the disturbance $\text{QBER}=s/2$ ; (5) the coherent-state overlap $e^{-2\mu}=0.8187$ at $\mu=0.1$ . Conventions and $s=\cos2\theta$ follow Bennett's paper and the Tamaki–Koashi–Imoto proof.

Prerequisites. No-Cloning Theorem in Cryptography · BB84 Protocol · Quantum Bit Error Rate and Sifting. Leads to. Information Reconciliation and Privacy Amplification · Photon-Number-Splitting Attack · Decoy-State QKD · Six-State and SARG04 Protocols.

Ask the tutor: Ask me why the strong reference pulse rescues B92 from the loss attack, or to derive the secret-key rate after privacy amplification for a given QBER.

How is B92 different from BB84 in one sentence?

BB84 uses four states in two conjugate bases and sifts by comparing basis choices, whereas B92 uses only two non-orthogonal states and sifts by having Bob announce which USD measurements were conclusive. The simplification is real — no basis reconciliation, half the preparation complexity — but not free: BB84's second basis gives a symmetry that keeps it secure under channel loss, and B92 gives that up. So B92 is the more elegant protocol on paper and the more fragile one in a lossy fibre, the trade every practical comparison turns on.

Why can't Bob just measure every pulse and always get the bit?

Because no measurement can perfectly distinguish non-orthogonal states — that is a theorem, not an engineering limit. Any strategy that always answers must sometimes answer wrong. Unambiguous state discrimination trades that away: it never errs, but pays with an inconclusive outcome that fires with probability $s$ . Bob could instead accept occasional errors (minimum-error discrimination), but B92 chooses silence, because a clean sifted key with a known low error rate is far easier to distil into a secret key than a noisy one.

What does the overlap s physically represent?

It is the magnitude of the inner product $\lvert\langle\psi_0\lvert\psi_1\rangle\rvert$ , one number between 0 and 1 measuring how much the two carriers resemble each other: 0 orthogonal and perfectly distinguishable, 1 identical and carrying nothing. On the Bloch sphere $s=\cos(\gamma/2)$ with $\gamma$ the angle between the vectors, so the symmetric encoding at half-angle $\theta$ gives $s=\cos2\theta$ . Every key quantity — Bob's yield $1-s$ , the eavesdropper's ceiling $H_2((1+s)/2)$ , the intercept-resend disturbance $s/2$ — is a function of this one dial.

Does B92 need entanglement or a shared reference frame?

No to entanglement — B92 is a prepare-and-measure protocol whose security comes entirely from no-cloning and the indistinguishability of non-orthogonal states, which is exactly why it is a clean counterexample to the idea that QKD needs Bell nonlocality (contrast E91). The reference frame is subtler: the bare protocol assumes Alice and Bob share a phase reference so "non-orthogonal" is well defined, supplied in practice by the strong reference pulse — which does double duty, since monitoring it also detects the loss-exploiting attack that defeats naive B92.

Why is the eavesdropper's Holevo bound sometimes larger than Bob's yield?

Because they count different things. Bob's yield $1-s$ is how often he gets an error-free, unambiguous bit, deliberately conservative, while the Holevo bound $H_2((1+s)/2)$ is the most an ideal eavesdropper could extract from the raw carrier before privacy amplification. At $s=0.707$ her ceiling (0.60) exceeds Bob's yield (0.29), which sounds alarming but is not fatal: privacy amplification distils a shorter final key on which her actual information — bounded by the measured QBER, not the worst-case Holevo value — is provably negligible. The raw comparison just says how much the key must shrink.

Is B92 used in real quantum-cryptography systems today?

Rarely in its bare form, but its ideas are everywhere. Deployed QKD leans on BB84 and its decoy-state variants because they tolerate loss well, and bare B92's loss vulnerability keeps it out of long-haul links. Where two-state encodings do appear — some chip-scale and continuous-variable designs prepare only $\lvert\pm\alpha\rangle$ — they inherit B92's security-from-non-orthogonality while adding the machinery that makes it loss-robust. In the classroom and the security-proof literature, though, B92 is ubiquitous, because it isolates the single physical fact that makes all of QKD work.