BB84 Protocol

Every classical key-agreement scheme rests on a wish: that some computation — factoring, discrete log — is too hard for the adversary's machine. BB84 replaces the wish with a law. Proposed by Charles Bennett and Gilles Brassard in 1984, it was the first protocol to make the secrecy of a shared key a consequence of quantum mechanics rather than an assumption about the enemy's resources. Two parties, Alice and Bob, want a shared random secret key; between them runs an untrusted quantum channel that an eavesdropper, Eve, may probe at will, plus a public classical channel she can read but not forge. The trick is that Alice encodes each random bit in one of four single-photon polarization states drawn from two conjugate bases, and the impossibility of reading such a state without knowing its basis — the no-cloning theorem and the disturbance of incompatible measurement, made quantitative — is what turns eavesdropping from an undetectable copy into a measurable scar on the data. The protocol runs in two acts. In the quantum phase Alice transmits and Bob measures, each choosing a basis at random; in the classical phase they publicly compare which basis (never which value) they used and keep only matched positions — sifting, which discards half the data. On the survivors they sacrifice a random test sample to estimate the quantum bit error rate, the QBER: a low QBER certifies that little could have leaked, a high one flags an attack (or a noisy channel) and aborts the run. Below the security threshold the raw key is passed through information reconciliation and privacy amplification, distilling a key secure against the most general attack quantum theory permits. This article assembles the whole machine — the four states, the sifting factor $\tfrac12$ , the $25\%$ signature of intercept-resend, and the celebrated $11\%$ Shor–Preskill threshold — from the physics its prerequisites own.

Key takeaways

BB84 (Bennett and Brassard, 1984) is the first quantum key distribution protocol: Alice encodes random bits in single-photon states drawn from two conjugate bases, $Z=\{|0\rangle,|1\rangle\}$ and $X=\{|+\rangle,|-\rangle\}$ , each mutually unbiased with $|\langle a|b\rangle|^2=\tfrac12$ .
Bob measures each photon in a randomly chosen basis; they publicly announce bases and keep only matched positions — sifting, which discards half the transmissions ( $p_{\text{sift}}=\tfrac12$ ).
Security rests on no-cloning and basis incompatibility: an eavesdropper who measures without knowing the basis inevitably disturbs the state, raising the QBER — her information gain is bounded by the error she injects.
A full intercept-resend attack imprints a $25\%$ QBER on the sifted key, far above the one-way security threshold, so it is detected with near-certainty.
Reconciliation then privacy amplification yield a secret-key fraction $r=1-2h(Q)$ , which vanishes at the Shor–Preskill threshold $Q_{\max}\approx 11\%$ .
Key idea: Information encoded in two conjugate bases cannot be measured or cloned without disturbance; Eve's information gain is fundamentally bounded by the error she introduces, making her presence detectable through the QBER.

The core insight

Information encoded in two conjugate bases cannot be measured or cloned without disturbance; an eavesdropper's gain in information is fundamentally bounded by the error she introduces, making her presence detectable through the QBER.

Where this lives today

BB84 is the workhorse of a real, deployed technology. Commercial QKD systems from vendors such as ID Quantique and Toshiba run decoy-state BB84 over metropolitan fiber, and laboratory records now push key exchange past $600$ km of ultralow-loss fiber. In free space, China's Micius satellite demonstrated satellite-to-ground key distribution over more than $1000$ km in 2017 and anchored a $4600$ -km integrated fiber-and-satellite network by 2021, while the Tokyo and SECOQC (Vienna) networks earlier proved metropolitan multi-node operation. Every one of these uses attenuated laser pulses rather than true single photons, so all layer the decoy-state method on top of BB84 to defeat the photon-number-splitting attack — the single most important practical patch to the 1984 protocol. The frontier is the rate-distance trade-off. Point-to-point QKD without a repeater is capped by the Pirandola-Laurenza-Ottaviani-Banchi (PLOB) bound, whereby the secret-key rate falls linearly with channel transmissivity — a hard ceiling for long fiber. Twin-field QKD, proposed in 2018 and since demonstrated past $800$ km, beats that scaling by interfering weak fields at a central untrusted node. Measurement-device-independent QKD removes the most dangerous real-world loophole — detector attacks — by making the measurement apparatus untrusted, and device-independent QKD, the ultimate goal, would certify security from observed Bell-inequality violation alone. All are descendants of the same 1984 insight, and BB84 remains the reference against which each new scheme's rate, distance, and assumptions are measured.

The physical picture

Picture each photon as a coin that may be queried along either of two axes — but querying one axis erases everything about the other. Alice chooses an axis (a basis) and a value at random; Bob chooses an axis at random, independently. When their axes agree the value transfers faithfully; when they disagree Bob's outcome is pure coin-flip noise. The public basis comparison keeps only the faithful transfers and throws the rest away. The first figure follows a short run and shows why exactly half the photons survive that comparison.

Figure

A ten-photon BB84 run. Alice picks basis and bit at random, Bob picks basis at random. Bases agree on 5 of the 10 photons, so those five positions are kept and the sifting fraction is one half; the retained bits form the sifted key 0 1 0 1 1

Now put Eve in the middle. To learn a bit she must measure, but she does not know the basis until Alice announces it — and by then the photon is gone. If she measures in the wrong basis, which happens half the time, she reads noise and collapses the state onto the wrong axis; when she resends that mangled photon, Bob, even in the matching basis, gets the wrong answer half the time. The information she extracts and the disturbance she causes are two faces of one coin, and the second figure plots the exchange rate: the secret-key fraction $r=1-2h(Q)$ as a function of the QBER Eve is forced to leave behind.

Figure

The information-disturbance trade-off. The secret-key fraction r = 1 − 2h(Q) falls as the QBER rises and reaches zero at the Shor–Preskill threshold Q ≈ 11 percent. A full intercept-resend attack sits at Q = 25 percent, well past the cliff, so it is always caught

The curve is the whole story in one line. Below $11\%$ there is secret key to distill — though honest channel noise already eats into that budget and any eavesdropper eats further; above $11\%$ nothing survives and the run aborts. The full entanglement-based proof (Ekert's picture, sharpened by Shor and Preskill) recasts BB84 as Alice preparing Bell pairs and both parties measuring in $Z$ or $X$ : Eve disturbing photons is exactly Eve degrading entanglement, and the QBER measures how far the shared state has fallen from a perfect Bell pair.

The core equations

The protocol is built on four states in a single qubit, split across two bases. The rectilinear ( $Z$ ) basis is the computational basis; the diagonal ( $X$ ) basis is its equal-superposition partner, physically the $\pm45^\circ$ linear polarizations of a photon.

|0\rangle,\ |1\rangle,\qquad |+\rangle=\tfrac{1}{\sqrt{2}}(|0\rangle+|1\rangle),\quad |-\rangle=\tfrac{1}{\sqrt{2}}(|0\rangle-|1\rangle) \qquad (1)

where: $|0\rangle,|1\rangle$ — rectilinear ( $Z$ -basis) states encoding bits 0 and 1; $|+\rangle,|-\rangle$ — diagonal ( $X$ -basis) states encoding bits 0 and 1. Alice picks one of the four with equal probability $\tfrac14$ ; the bit is the intra-basis label, the basis is the extra secret. The security-critical property of these two bases is that they are mutually unbiased: a state definite in one basis is maximally uncertain in the other. Every cross-overlap has the same squared magnitude, so a measurement in the wrong basis returns a fair coin flip carrying zero information about the encoded bit.

|\langle a|b\rangle|^2=\tfrac{1}{2}\qquad\text{for all } a\in\{0,1\},\ b\in\{+,-\} \qquad (2)

where: $|a\rangle$ — any $Z$ -basis state; $|b\rangle$ — any $X$ -basis state. Reading: the two bases are conjugate, so knowing the value in one tells you nothing about the value in the other — the algebraic root of BB84's security. Because Alice and Bob each choose $Z$ or $X$ uniformly and independently, their bases agree exactly half the time. Sifting keeps those matched positions and discards the rest; it is the price of never announcing the basis in advance.

p_{\text{sift}}=P(ZZ)+P(XX)=\tfrac12\cdot\tfrac12+\tfrac12\cdot\tfrac12=\tfrac12 \qquad (3)

where: $p_{\text{sift}}$ — probability Bob's random basis matches Alice's. Reading: on average one photon in two survives to the sifted key; the factor $\tfrac12$ is the fixed sifting overhead of two-basis BB84. To detect eavesdropping Alice and Bob reveal the bit values on a random test subset of the sifted key and count disagreements. The fraction that disagree is the quantum bit error rate — the single number on which the abort decision, and the final key length, both turn.

Q=\mathrm{QBER}=\frac{N_{\text{err}}}{N_{\text{sift}}} \qquad (4)

where: $N_{\text{err}}$ — sifted positions where Alice's and Bob's bits differ; $N_{\text{sift}}$ — sifted positions compared. Reading: $Q$ folds honest channel noise and Eve's disturbance into one estimator — the protocol conservatively blames all of it on Eve. Correcting a fraction $Q$ of errors, and later erasing Eve's correlated knowledge, both cost bits measured by the binary Shannon entropy. This function sets the exchange rate between error and secrecy.

h(Q)=-Q\log_2 Q-(1-Q)\log_2(1-Q) \qquad (5)

where: $h(Q)$ — binary entropy in bits; it rises from $0$ at $Q=0$ to $1$ at $Q=\tfrac12$ . Reading: $h(Q)$ is simultaneously the reconciliation leakage and the privacy-amplification compression, which is why it appears twice below. Combining reconciliation and privacy amplification gives the asymptotic secret-key fraction per sifted bit — the Shor–Preskill rate for one-way (Alice-to-Bob) post-processing against the optimal collective attack.

r=1-2\,h(Q),\qquad r=0 \iff Q_{\max}\approx 11.0\% \qquad (6)

where: $r$ — secret bits per sifted bit; $2h(Q)=h(Q)+h(Q)$ — reconciliation leakage plus privacy-amplification compression. Reading: the key survives only while $Q<Q_{\max}\approx0.110$ , the famous eleven-percent tolerance of one-way BB84. Finally, the worst-case simple attack — intercept every photon, measure in a random basis, resend the collapsed state — betrays itself through a fixed, calculable error rate that dwarfs the threshold.

Q_{\text{IR}}=\underbrace{\tfrac12\cdot 0}_{\text{Eve's basis right}}+\underbrace{\tfrac12\cdot\tfrac12}_{\text{Eve's basis wrong}}=\tfrac14 \qquad (7)

where: $Q_{\text{IR}}$ — QBER injected by full intercept-resend. Reading: a $25\%$ error is more than double the $11\%$ ceiling, so even a modest test sample exposes the attack with overwhelming confidence.

Derivation AThe twenty-five percent error of intercept-resend eavesdropping

The goal is to show that the simplest complete attack — intercept every photon, measure it, and forward whatever the measurement leaves — cannot be made quiet: it stamps a fixed $25\%$ error onto the sifted key regardless of Alice's basis or bit. We fix a representative signal, split on whether Eve's guessed basis matches Alice's, propagate the collapsed state to Bob, and average, so that $\tfrac14$ emerges from the mutual-unbiasedness relation alone.

Step 1. Restrict attention to sifted events, where Alice and Bob used the same basis; unmatched positions are discarded and never enter the key or the QBER estimate. By the symmetry of the four states under the protocol, the error rate is independent of Alice's basis and bit, so we may take Alice to send $|0\rangle$ in the $Z$ basis and let Bob also measure in $Z$ . Why: fixing one representative signal is legitimate because BB84 treats all four states identically, so one branch computes the average.

Step 2. With probability $\tfrac12$ Eve measures in Alice's basis ( $Z$ ). She obtains $0$ , projects onto $|0\rangle$ , and resends $|0\rangle$ ; Bob measures $Z$ and reads $0$ correctly — zero error. Why: when Eve's basis matches, her measurement is non-disturbing on that eigenstate — she learns the bit for free and leaves no trace.

Step 3. With probability $\tfrac12$ Eve measures in the wrong basis ( $X$ ). Acting on $|0\rangle$ , an $X$ measurement returns $|+\rangle$ or $|-\rangle$ each with probability $\tfrac12$ , and she resends whichever she got. Why: a wrong-basis measurement on a $Z$ eigenstate is maximally disturbing — it destroys the $Z$ value and leaves an $X$ eigenstate uncorrelated with the bit.

Step 4. Bob receives that diagonal state and measures it in $Z$ . Using mutual unbiasedness, $P(\text{Bob reads }1\mid\text{Eve sent }|\pm\rangle)=|\langle 1|\pm\rangle|^2=\tfrac12$ , so Bob errs with probability $\tfrac12$ in this branch. Why: equation (2) is doing all the work — a diagonal state is a fair coin in the rectilinear basis, so half of Eve's meddled photons flip Bob's bit.

Step 5. Combine the branches: $Q_{\text{IR}}=\tfrac12\cdot 0+\tfrac12\cdot\tfrac12=\tfrac14$ . A $25\%$ QBER lies far above the $11\%$ threshold, and with $m$ independent test bits the chance the attack shows no error at all is $(1-\tfrac14)^m=(0.75)^m$ , about $3\times10^{-13}$ for $m=100$ . Why: this makes the security operational — full intercept-resend is not merely detectable in principle but caught with near-certainty on a handful of test bits.

Go deeper · Derivation B · 2 minThe secret-key rate and the eleven-percent threshold

Derivation BThe secret-key rate and the eleven-percent threshold

The aim is to derive the closed-form secret-key fraction $r=1-2h(Q)$ and locate where it vanishes, using the entanglement-based view of BB84 as Bell-pair distillation with a CSS code. We write the one-way rate as a difference of mutual informations, evaluate the Alice-Bob term as a binary symmetric channel, bound Eve's term by the symmetry of the optimal depolarizing attack, and solve $r=0$ to expose the threshold as the root of $h(Q)=\tfrac12$ .

Step 1. The Devetak-Winter theorem gives the optimal one-way secret-key rate against a collective attack as $r=I(A{:}B)-I(A{:}E)$ , the Alice-Bob mutual information minus the Alice-Eve mutual information, with Alice's string as the reconciliation reference. Why: reconciliation must leak enough for Bob to match Alice — that costs $I(A{:}B)$ 's complement — while privacy amplification must destroy everything Eve shares with Alice, namely $I(A{:}E)$ ; the net is their difference.

Step 2. Between Alice and Bob the sifted key is a binary symmetric channel with crossover probability $Q$ , whose capacity is $I(A{:}B)=1-h(Q)$ . Why: a fraction $Q$ of matched-basis bits are flipped by combined noise, and the mutual information of a symmetric bit channel is exactly one minus the entropy of its flip rate.

Step 3. For the depolarizing channel that maximizes Eve's power at fixed $Q$ — the symmetric attack BB84's proof must tolerate — her accessible information per bit is bounded by $I(A{:}E)\le h(Q)$ , the same entropy as the visible errors. Why: the entanglement picture forces symmetry between the bit-flip errors Bob sees and the phase-flip information Eve can hold; a CSS code corrects both, so Eve's share is capped at $h(Q)$ .

Step 4. Substituting, $r=[1-h(Q)]-h(Q)=1-2h(Q)$ , and the factor of two splits cleanly into $h(Q)$ spent on reconciliation and $h(Q)$ spent on privacy amplification. Why: the two post-processing stages are literally the two $h(Q)$ terms, which is why doubling the tolerable error is not enough — each stage independently taxes the raw key.

Step 5. Set $r=0$ : $1-2h(Q_{\max})=0$ requires $h(Q_{\max})=\tfrac12$ . Solving numerically, $h(0.110)=0.4999$ , so $Q_{\max}\approx 11.0\%$ . Why: the threshold is not an engineering choice but the root of a transcendental equation — the error rate at which reconciliation leakage plus Eve's information first consume the entire sifted key. *Numerically: $h(0.11)=0.49992$ , giving $r=1-2(0.49992)=0.00017\approx0$ at the threshold, and $r=1-2h(0.03)=0.611$ at $Q=3\%$ .*

Go deeper · Derivation C · 1 minWhy two conjugate bases defeat a single measurement

Derivation CWhy two conjugate bases defeat a single measurement

The purpose is to prove the sharpest form of BB84's core claim: an eavesdropper ignorant of the basis holds a photon whose state, averaged over the four equiprobable signals, is the maximally mixed state — featureless, carrying zero information about Alice's bit. We form Eve's average density operator, evaluate it by the resolution of identity in each basis, and read off that any information requires committing to a basis before it is announced, which is what the QBER detects.

Step 1. Ignorant of the basis, Eve faces the equal-weight ensemble of all four states, described by the density operator $\rho=\tfrac14(|0\rangle\langle0|+|1\rangle\langle1|+|+\rangle\langle+|+|-\rangle\langle-|)$ . Why: a quantum system prepared from an ensemble is fully described by its density operator, and any measurement statistic Eve can produce is a function of this $\rho$ alone.

Step 2. Each basis resolves the identity: $|0\rangle\langle0|+|1\rangle\langle1|=I$ and $|+\rangle\langle+|+|-\rangle\langle-|=I$ , so $\tfrac14(|0\rangle\langle0|+|1\rangle\langle1|)=\tfrac{I}{4}$ and likewise for the diagonal pair. Why: completeness of an orthonormal basis is exactly the statement that its projectors sum to the identity — the same fact for both bases is the quantitative content of "conjugate".

Step 3. Adding the two contributions, $\rho=\tfrac{I}{4}+\tfrac{I}{4}=\tfrac{I}{2}$ , the maximally mixed single-qubit state. Why: the average is proportional to the identity, so it is identical for every possible encoded bit in either basis — Eve's photon carries no imprint of the value she wants.

Step 4. Any measurement on $\tfrac{I}{2}$ yields outcomes statistically independent of the bit, so to gain information Eve must commit to a basis before the public announcement. Committing to the wrong basis disturbs the state — precisely the mechanism the intercept-resend derivation turned into a $25\%$ QBER. Why: this closes the loop — information and disturbance are not merely correlated but bound by the same algebra, so every bit Eve learns is a bit of error she must pay.

Limiting cases

Case	Result	Meaning
Noiseless channel, no Eve	$Q=0,\ r=1$ per sifted bit ( $\tfrac12$ per photon)	every sifted bit is secret; reconciliation and privacy amplification cost nothing, and the only overhead is the $\tfrac12$ sifting factor
Full intercept-resend	$Q=25\%$	random-basis measure-and-resend forces a quarter of sifted bits wrong, far above threshold, so the run always aborts
Shor–Preskill threshold	$r=1-2h(Q),\ Q_{\max}\approx 11\%$	one-way key survives only below $Q\approx0.110$ , the root of $h(Q)=\tfrac12$ ; beyond it, leakage plus Eve's information exhaust the key
Six-state protocol	$Q_{\max}\approx 12.6\%$	adding a third mutually unbiased basis tightens Eve's constraints and raises the threshold, at the cost of a lower sifting efficiency $\tfrac13$
Two-way reconciliation	$Q_{\max}\approx 20\%$	advantage-distillation and other two-way protocols push tolerance well past the one-way $11\%$ , trading interaction rounds for robustness

Common trapthe misconception that raw sifted bits are already a usable secret key

Running the quantum phase and sifting does not hand Alice and Bob a key. The sifted strings are correlated but neither identical nor secret: honest channel noise means some matched-basis bits still disagree, and Eve may hold partial information even at a tolerable QBER. Three more steps are mandatory — parameter estimation (measure $Q$ and decide abort or proceed), information reconciliation (correct the residual disagreements over the public channel, leaking $h(Q)$ bits), and privacy amplification (hash the reconciled string down by another $h(Q)$ to squeeze out Eve's knowledge). Skipping any of them yields a string that is either mismatched or partly known to the adversary. A second, subtler trap: real transmitters emit attenuated laser pulses, not true single photons, so a fraction of pulses contain two or more photons — the opening for the photon-number-splitting attack that basic BB84 does not address and that decoy-state methods were invented to close.

Worked examples

1 · From a million photons to a secret key (fully worked)

Alice sends $N=1\,000\,000$ BB84 photons over a fiber link. After sifting they compare a random test sample and measure a QBER of $Q=3.0\%$ , comfortably below threshold. Estimate the sifted length, the secret-key fraction, and the final key length, assuming ideal one-way post-processing and negligible detector loss.

Step 1. Sifting keeps a fraction $p_{\text{sift}}=\tfrac12$ (equation 3), so the sifted key has about $N_{\text{sift}}=\tfrac12\times10^6=\mathbf{500\,000}$ bits; the other half is discarded because Bob's basis missed Alice's. (A real link also loses photons to attenuation and detector inefficiency, set aside here to isolate the protocol accounting.)

Step 2. Evaluate the binary entropy at the measured error rate: $h(0.03)=-0.03\log_2 0.03-0.97\log_2 0.97=\mathbf{0.1944}$ bits. This is the per-bit cost that reconciliation leaks and, again, that privacy amplification removes.

Step 3. The secret-key fraction is $r=1-2h(Q)=1-2(0.1944)=\mathbf{0.611}$ secret bits per sifted bit. Since $0.611>0$ , the run is viable — the $3\%$ error sits well inside the $11\%$ ceiling.

Step 4. Multiply: the final secret key is about $r\times N_{\text{sift}}=0.611\times500\,000\approx\mathbf{3.1\times10^{5}}$ bits, i.e. roughly $0.31$ secret bits per transmitted photon. (In practice a small further slice of the sifted key is consumed as the QBER test sample and as authentication of the classical channel; both are asymptotically negligible.) The million photons distill to about 306 000 shared secret bits.

2 · Catching the intercept-resend eavesdropper

Eve intercepts, measures in a random basis, and resends every photon. Alice and Bob sacrifice $m=100$ sifted bits as a test sample. What error rate do they expect, and how likely is Eve to slip through unnoticed?

Step 1. On sifted positions the attack injects $Q_{\text{IR}}=\tfrac14$ (equation 7 and derivation 1): Eve's basis matches Alice's half the time with no error, and the other half she resends a state that flips Bob with probability $\tfrac12$ , for $\tfrac12\cdot\tfrac12=\tfrac14$ overall. Alice and Bob therefore expect about $\mathbf{25}$ disagreements among the 100 test bits.

Step 2. For Eve to escape detection the test sample would have to show a benign error rate by chance. The probability that a single test bit happens not to reveal an error is $1-\tfrac14=0.75$ , so the probability all 100 test bits look clean is $(0.75)^{100}\approx\mathbf{3.2\times10^{-13}}$ .

Step 3. Even a far smaller sample suffices: $(0.75)^{20}\approx 3\times10^{-3}$ and $(0.75)^{40}\approx1\times10^{-5}$ . Because the expected $25\%$ is more than double the $11\%$ threshold, the observed QBER lands far outside the acceptance band with near-certainty and the key is discarded. Full intercept-resend is essentially always caught — its 25% signature cannot be hidden.

Physics of the portrait

BB84 is the point where cryptography stopped asking the adversary to be computationally weak and started asking physics to be right. Its portrait is not an equation but a protocol — and the two people who saw that a photon's refusal to be copied could be turned into a security guarantee.

Origins · 1 minCharles Bennett and how this was discovered

Charles Bennett

born 1943 · founder of quantum information theory

Charles Henry Bennett, a physicist at IBM Research, is one of the principal architects of quantum information. In the early 1970s the graduate student Stephen Wiesner had drafted an idea he called "conjugate coding" — using non-orthogonal quantum states to make unforgeable banknotes — but no journal would publish it. Bennett, a friend of Wiesner, carried the seed for a decade until, in conversation with the theoretical computer scientist Gilles Brassard, he saw that Wiesner's states could do something more useful than money: they could distribute a cryptographic key whose secrecy a physical law would enforce. Their 1984 paper, presented at a conference in Bangalore and for years an obscure entry in the proceedings, laid out the four-state, two-basis protocol now universally called BB84. Bennett and Brassard did not stop at theory — in 1989 they built the first working quantum key distribution apparatus, sending photons a proof-of-principle 32 centimeters through open air, and joked that the prototype was secure against any eavesdropper who happened to be deaf, since the power supply hummed at a pitch that encoded the basis. Bennett's reach across the field is singular: with Brassard, Crépeau, Jozsa, Peres, and Wootters he co-discovered quantum teleportation in 1993, and his name sits on entanglement-assisted communication and the thermodynamics of reversible computing. BB84 endures because it is the cleanest demonstration of the field's founding idea — that information is physical, and the laws governing a photon can be conscripted to keep a secret.

History

1970

— Stephen Wiesner conceives conjugate coding, using non-orthogonal states for unforgeable quantum money (published only in 1983)

1984

— Bennett and Brassard present the BB84 protocol at the IEEE conference in Bangalore

1989

— Bennett and Brassard build the first quantum key distribution demonstrator, over 32 cm of air

1991

— Artur Ekert proposes the entanglement-based E91 protocol, recasting security via Bell inequalities

2000

— Shor and Preskill give a simple security proof, fixing the one-way threshold at 11 percent

2017

— the Micius satellite distributes decoy-state BB84 keys between ground stations 1200 km apart

Going further

Texts. Nielsen and Chuang, Quantum Computation and Quantum Information, section 12.6 (quantum cryptography) · Preskill, Lecture Notes on Quantum Computation, chapter 4 · Wilde, Quantum Information Theory, chapters on private communication · Watrous, The Theory of Quantum Information (distinguishability and channel bounds) · Scarani et al., "The security of practical quantum key distribution", Rev. Mod. Phys. 81, 1301 (2009). The key numbers in this article are: (1) the four cross-overlaps $|\langle a|b\rangle|^2=\tfrac12$ from equation (1); (2) the sifting factor $p_{\text{sift}}=\tfrac12$ from independent uniform basis choices; (3) the intercept-resend error rate $Q_{\text{IR}}=\tfrac14$ ; (4) the key fraction $r=1-2h(Q)$ and its root $Q_{\max}\approx0.110$ from $h(Q)=\tfrac12$ , with $h(0.11)=0.4999$ ; (5) the six-state threshold $\approx12.6\%$ . The average $\rho=I/2$ follows from resolution of identity in each basis.

Prerequisites. No-Cloning Theorem in Cryptography · Quantum Bit Error Rate and Sifting · Mutually Unbiased Bases. Leads to. Information Reconciliation and Privacy Amplification · E91 Protocol · B92 Protocol · Photon-Number-Splitting Attack · Decoy-State QKD.

Ask the tutor: Ask me to walk through the Shor–Preskill entanglement reduction step by step, or to compute the finite-key secret length for your own photon count and measured QBER.

Why exactly two bases, and why must they be conjugate?

Two is the minimum that makes eavesdropping detectable. If Alice used a single fixed basis, Eve would simply measure in that basis, read every bit, and resend perfect copies, leaving no error — the states would be orthogonal and perfectly distinguishable. The security comes from forcing Eve to guess a basis she cannot know in advance. The bases must be mutually unbiased (conjugate) so that a wrong guess is maximally punishing: a state definite in one basis is a fair coin flip in the other, $|\langle a|b\rangle|^2=\tfrac12$ , so Eve's wrong-basis measurement both learns nothing and maximally disturbs the state. Any less-than-maximal overlap would leak Eve some information at lower disturbance, weakening the protocol.

If half the bits are thrown away in sifting, isn't BB84 hopelessly wasteful?

The factor of two lost to sifting is real but cheap — it is a constant overhead, not an exponential one, and it buys the entire security argument. Announcing bases only after transmission is precisely what denies Eve the knowledge she would need to eavesdrop silently; paying half the raw photons for that is a bargain. There are refinements: the efficient-BB84 variant biases the basis choice heavily toward one basis (say $Z$ ) for the key and reserves the other only for checking, pushing the asymptotic sifting efficiency toward $1$ while keeping full security. The genuinely limiting resource in practice is not sifting but channel loss, which scales exponentially with fiber length.

Does a QBER below 11% guarantee no eavesdropper was present?

No — and this is a subtle, important point. A low QBER does not certify that Eve was absent; it certifies that whatever she did, the information she could have gained is small enough that privacy amplification can erase it. The protocol conservatively attributes the entire measured error, including honest channel noise, to Eve, then hashes the key down by exactly enough to render her expected information negligible. So BB84 does not detect eavesdropping and then produce a clean key; it produces a key that is provably secret given the observed error rate, whether that error came from Eve, from the fiber, or from both. Below threshold there is enough secrecy to distill; above it, there is not.

Why does real BB84 need decoy states if the 1984 protocol is provably secure?

Because the proof assumes true single photons and real sources emit weak laser pulses. An attenuated pulse contains a Poisson-distributed photon number, so a fraction of pulses carry two or more identical photons. Against those, Eve can mount the photon-number-splitting attack: siphon off one photon, store it, let the rest through, and measure her copy once the basis is announced — learning the bit with no disturbance. The decoy-state method defeats this by having Alice randomly vary the pulse intensity; because the eavesdropper cannot tell a signal pulse from a decoy of different mean photon number, any photon-number-selective attack changes the transmission statistics of the decoys detectably. Decoy-state BB84 recovers nearly the single-photon key rate from realistic sources and is what every deployed system actually runs.

How does the entanglement-based picture make the security proof easier?

It converts a statement about measurement disturbance into a statement about entanglement, which is far easier to bound. In the equivalent picture Alice prepares Bell pairs $|\Phi^+\rangle=(|00\rangle+|11\rangle)/\sqrt2$ and sends half of each to Bob; measuring her half in $Z$ or $X$ prepares exactly the corresponding BB84 state on Bob's side, so the prepare-and-measure and entanglement versions produce identical statistics and are equally secure. The payoff is that Eve's disturbance is now visible as degradation of the shared entanglement: the bit-flip and phase-flip error rates Alice and Bob measure in the $Z$ and $X$ bases are precisely the errors a CSS quantum code would need to correct to distill pure Bell pairs. Shor and Preskill's proof runs this reduction and inherits the clean threshold $r=1-2h(Q)$ from the theory of CSS codes.

Is BB84 creating a key from nothing, or does it need a pre-shared secret?

BB84 is a key-growing protocol, not a key-creating one. Its security rests on the classical channel being authenticated — Alice and Bob must be sure they are talking to each other and not to Eve impersonating one of them during basis announcement and reconciliation. Authenticating that channel (for instance with a Wegman-Carter message authentication code) consumes a short pre-shared secret. So BB84 takes a small initial shared key and grows it into a much larger one, and the honest interpretation of its "unconditional security" is: given an authenticated classical channel, the resulting key is secure against any computationally unbounded quantum adversary. Without initial authentication, a man-in-the-middle attack defeats it entirely, exactly as it would defeat classical key exchange.