Quantum Bit Error Rate and Sifting

After the quantum phase of a prepare-and-measure protocol such as BB84, Alice and Bob do not yet share a key — they share raw data riddled with rounds that carry no correlation at all. Alice holds the bits she encoded with the bases she used; Bob holds his outcomes with the bases he chose. Because a measurement in the wrong basis returns a uniformly random result, the two hold genuinely correlated bits only where their bases coincide. Sifting is the public conversation, over an authenticated classical channel, in which both announce their basis choices — never their bit values — and throw away every round where the bases disagreed. What survives is the sifted key. The sifted key is still imperfect. Depolarizing noise, dark counts, imperfect optics, and any eavesdropping leave discrepancies between Alice's and Bob's copies. The quantum bit error rate $Q$ is the probability that a sifted bit of Bob's disagrees with Alice's, and the parties estimate it by publicly comparing a random subset of their sifted bits and then discarding them. Because the estimate carries a statistical uncertainty that shrinks with sample size, a conservative protocol works with an upper confidence bound on $Q$ rather than the raw sample fraction. The physical heart of quantum key distribution is that an eavesdropper cannot gain information without disturbing the quantum states — no-cloning and complementarity forbid it — and that disturbance shows up as elevated $Q$ . So $Q$ is two things at once: a measure of channel noise and a bound on Eve's knowledge. A full intercept-resend attack forces $Q = 25\%$ , and the BB84 threshold $Q_\mathrm{th} \approx 11\%$ is exactly where Bob's information about the key equals Eve's. Sifting and QBER estimation are the bridge from the quantum exchange to classical post-processing: reconciliation and privacy amplification.

Key takeaways

Sifting is the public step where Alice and Bob announce only their bases and discard every round where the bases disagreed, keeping the correlated raw key.
The quantum bit error rate $Q$ is the disagreement fraction among sifted bits, estimated by publicly comparing a random sample that is then thrown away.
For symmetric BB84 the bases match half the time, so the sift factor is $p_\mathrm{sift} = 1/2$ (pushed toward $1$ by biasing the basis choice).
$Q$ upper-bounds Eve's information: a one-way BB84 key exists only below $Q_\mathrm{th} \approx 11\%$ , where $1 - 2h(Q) = 0$ .
Honest noise and eavesdropping errors are indistinguishable, so security attributes all observed error to Eve — the worst case behind privacy amplification.
Key idea: discarding incompatible-basis rounds (sifting) yields correlated raw bits, and their residual disagreement rate — the QBER — both characterizes channel noise and upper-bounds the eavesdropper's information, fixing the security threshold and the achievable secret-key rate.

The core insight

Discarding incompatible-basis rounds (sifting) yields correlated raw bits, and their residual disagreement rate — the QBER — simultaneously characterizes channel noise and upper-bounds the eavesdropper's information, fixing the security threshold and the achievable secret-key rate.

Where this lives today

QBER is the single number operational QKD systems live by. In deployed metropolitan fiber links — the Beijing-Shanghai trunk, the Tokyo QKD network, Swiss and EU testbeds — it is the primary health metric, typically $1$ to $3\%$ from dark counts and polarization drift, and a rising value triggers recalibration or an abort. The 2016 Micius satellite pushed the same accounting to space, where the achievable QBER, not raw loss alone, sets whether a key can be distilled. Modern high-speed systems run efficient BB84 with biased bases to drive $p_\mathrm{sift}$ toward $1$ , and pair the measured $Q$ with tuned LDPC or cascade codes leaking about $f\,h(Q)$ bits. On the theory frontier the asymptotic $r_\infty = 1 - 2h(Q)$ has been sharpened into finite-key proofs that fold the statistical uncertainty of $\hat Q$ into the extractable length, so the sample size $m$ and confidence $\delta$ from Derivation 3 become part of the security parameter — the form in which sifting and QBER estimation now ship.

The physical picture

Picture Alice and Bob each flipping a private coin before every round to pick a basis, $Z$ or $X$ . When the coins land alike, Bob's outcome is a faithful (if occasionally noisy) copy of Alice's bit; when they land opposite, Bob has measured an equal superposition in his basis, so his outcome is a fair coin flip — pure noise, uncorrelated with anything Alice sent. Sifting compares coins in public and keeps only the matched rounds, discarding half the raw labour so what remains is genuinely shared. The first figure follows eight rounds through this filter.

Figure

Sifting keeps only rounds where Alice and Bob chose the same basis — here 4 of 8 survive, the sift factor 1/2. Bases (Z blue, X amber) are announced publicly; bit values never are. A public sample of the kept bits exposes disagreements like the flagged one, whose fraction is the QBER Q

An eavesdropper is like a courier forced to guess the orientation of every sealed envelope before reading it and re-sealing a fresh copy. Half her guesses are wrong, and each wrong guess scrambles the state she forwards, so Bob's outcome becomes random exactly where she blundered — no-cloning and complementarity forbid her from doing better. Her interference leaves a fingerprint, extra QBER, that grows with how much she learns. The second figure turns that trade-off into the number a protocol lives or dies by.

Figure

The one-way secret fraction r∞ = 1 − 2h(Q) falls from 1 bit per sifted bit at Q = 0 to zero at the threshold Q_th ≈ 0.110, where h(Q) = 1/2. A full intercept-resend attack sits at Q = 0.25, far to the right, so it always drives the key to zero and aborts

Because honest noise and eavesdropping produce identical-looking errors, the cautious operator credits every error to Eve. That is why a merely noisy fiber that pushes $Q$ past $\sim 11\%$ kills the key even with no spy present: the security proof cannot tell the two apart. QBER is therefore a design knob, not just an alarm — lowering $Q$ widens the gap between Bob's and Eve's information, and the point where that gap closes is the threshold.

The core equations

The quantum bit error rate is defined on the sifted string alone: the conditional probability that Bob's bit differs from Alice's, given matched bases. Everything downstream — reconciliation cost, Eve's information, the key rate — is a function of it.

Q = \Pr[\,b_B \neq b_A \mid \text{bases match}\,] \qquad (1)

where: $Q$ — quantum bit error rate, the disagreement probability among sifted bits; $b_A,\,b_B$ — Alice's sent bit and Bob's received bit at a sifted position. Reading it: $Q$ lives strictly on matched-basis rounds; mismatched rounds never enter the count. Nobody knows $Q$ directly, so Alice and Bob estimate it by sacrificing a random sample of $m$ sifted bits, announcing them, and counting disagreements — an unbiased estimator.

\hat Q = \frac{1}{m}\sum_{i=1}^{m} \mathbb{1}[\,b_B^{(i)} \neq b_A^{(i)}\,] \qquad (2)

where: $\hat Q$ — sample estimate of the QBER; $m$ — number of publicly compared positions; $\mathbb{1}[\cdot]$ — indicator, $1$ when the bits differ. Reading it: the announced bits are now public, so they are discarded — you never reuse a bit Eve has heard. The gap between $\hat Q$ and the true $Q$ is controlled by a concentration inequality: treating the sampled indicators as independent Bernoulli $(Q)$ variables, Hoeffding's bound makes the failure probability shrink exponentially in $m$ .

\Pr\big[\,|\hat Q - Q| \ge \varepsilon\,\big] \le 2\,e^{-2 m \varepsilon^{2}} \qquad (3)

where: $\varepsilon$ — tolerated deviation of the estimate from the true value; $m$ — sample size. Reading it: pinning $Q$ within $\varepsilon$ at confidence $1-\delta$ costs only $m \gtrsim \varepsilon^{-2}\ln(2/\delta)/2$ bits — logarithmic in confidence, so cheap. The bridge from a bit-flip rate to an information quantity is the binary entropy function — the Shannon entropy of a single biased bit, the uncertainty in bits carried by an error of probability $x$ .

h(x) = -x\log_2 x - (1-x)\log_2(1-x) \qquad (4)

where: $h(x)$ — binary entropy of a bit with bias $x$ ; $x$ — error probability, here $Q$ . Reading it: $h(0)=h(1)=0$ , $h(1/2)=1$ , symmetric about $x=1/2$ . The sifted channel from Alice to Bob is a binary symmetric channel with crossover $Q$ , so their per-bit mutual information is one bit minus the entropy the errors inject.

I(A{:}B) = 1 - h(Q) \qquad (5)

where: $I(A{:}B)$ — mutual information per sifted bit; $h(Q)$ — entropy of the symmetric channel with crossover $Q$ . Reading it: at $Q=0$ Bob knows the bit perfectly ( $I=1$ ); at $Q=1/2$ he learns nothing ( $I=0$ ). Against collective attacks the extractable fraction is Bob's information minus Eve's (Devetak-Winter). For symmetric BB84 the optimal attack saturates Eve's information at $h(Q)$ , leaving a clean one-way rate.

r_\infty = 1 - 2\,h(Q) \qquad (6)

where: $r_\infty$ — asymptotic secret fraction per sifted bit; the two copies of $h(Q)$ — one paid to reconciliation, one to privacy amplification against Eve. Reading it: the key survives only while $r_\infty > 0$ , i.e. while Bob out-informs Eve. Real hardware never reaches the ideal, so the deployed rate folds in the sift factor, a reconciliation penalty, and the raw detection rate to give bits per second.

R = p_\mathrm{sift}\,\big[\,1 - f\,h(Q) - h(Q)\,\big]\,\nu \qquad (7)

where: $R$ — secret bits per second; $p_\mathrm{sift}$ — fraction surviving sifting ( $1/2$ for symmetric BB84); $f \ge 1$ — reconciliation inefficiency ( $f\approx 1.1$ for good codes); $\nu$ — raw detection rate before sifting. Reading it: real reconciliation leaks $f\,h(Q) \ge h(Q)$ , so finite $f$ lowers both the rate and the tolerable $Q$ . Setting the ideal rate to zero fixes the threshold — the largest QBER at which any one-way key can be distilled.

Q_\mathrm{th}: \quad 1 - 2h(Q_\mathrm{th}) = 0 \;\Rightarrow\; h(Q_\mathrm{th}) = \tfrac12 \;\Rightarrow\; Q_\mathrm{th} \approx 0.110 \qquad (8)

where: $Q_\mathrm{th}$ — maximum tolerable QBER for a positive one-way BB84 key. Reading it: above $11\%$ the protocol aborts; the six-state protocol relaxes this to $\approx 12.6\%$ .

Derivation AThe 25 percent fingerprint of intercept-resend

The goal is to compute exactly how much QBER an eavesdropper injects if she runs the crudest attack — measuring every qubit and forwarding a fresh copy of what she saw — and to show that the answer, one error in four, sits so far above the security threshold that this attack can never succeed against BB84. We weight the two things that can happen on each round by probability and average, so the celebrated $25\%$ falls out of elementary case analysis.

Step 1. Fix a round where Alice and Bob use the same basis, so the bit would be error-free without Eve; only such rounds survive sifting and enter $Q$ . Eve, ignorant of that basis, picks her own at random and guesses correctly with probability $1/2$ . Why: only matched rounds contribute to the sifted error rate, so we condition on them and let Eve's basis be the sole random ingredient.

Step 2. When Eve guesses right (probability $1/2$ ), she measures in Alice's basis, learns the true bit, and resends the correct state; Bob recovers Alice's bit exactly, contributing zero error. Why: measuring an eigenstate in its own basis is non-disturbing, so a correct guess leaves no trace.

Step 3. When Eve guesses wrong (probability $1/2$ ), she measures in the conjugate basis and collapses the qubit onto an equal superposition in Alice's basis. The fresh qubit she forwards gives Bob a uniformly random outcome, wrong half the time — this branch contributes $\tfrac12$ error. Why: a wrong-basis measurement destroys the original bit and replaces it with a fair coin, the whole mechanism by which learning disturbs.

Step 4. Average the two branches: $Q_\mathrm{IR} = \tfrac12\cdot 0 + \tfrac12\cdot \tfrac12 = \tfrac14 = 25\%$ . If Eve attacks only a fraction $p$ of rounds, the error scales linearly, $Q \approx p/4$ . Why: the linear scaling lets the security proof account for a continuum of attack strengths through the single observed number $Q$ . *Verified: reproduces the standard textbook value $Q=25\%$ for full intercept-resend (Nielsen and Chuang §12.6; Preskill Ch. 5), and $Q_\mathrm{IR}=0.25 \gg Q_\mathrm{th}\approx 0.11$ , so the attack always aborts the key.*

Go deeper · Derivation B · 1 minWhy eleven percent is the wall

Derivation BWhy eleven percent is the wall

The goal is to derive the $\approx 11\%$ QBER ceiling from first principles, by writing the extractable key as Bob's information minus Eve's, reducing both to the binary entropy of the observed error rate, and solving for the crossover where they balance. This is the Devetak-Winter rate specialized to symmetric BB84, and it is what makes $Q$ a hard security parameter and not merely a quality metric.

Step 1. Start from the collective-attack key rate $r = I(A{:}B) - \chi(A{:}E)$ , where $\chi(A{:}E)$ is Eve's Holevo information about Alice's sifted bit. Any distillable secret is information Bob has that Eve does not. Why: the Devetak-Winter theorem certifies this difference is asymptotically achievable, so a positive value guarantees a secret key exists.

Step 2. The Alice-Bob sifted channel is binary symmetric with crossover $Q$ , giving $I(A{:}B) = 1 - h(Q)$ from equation (5). Why: symmetric noise means every sifted bit carries the same $1-h(Q)$ bits, so the channel is fully summarized by $Q$ .

Step 3. For the symmetric BB84 channel the optimal collective attack saturates $\chi(A{:}E) \le h(Q)$ : Eve's best possible knowledge, once every error is blamed on her, is exactly the entropy of the error rate. Substituting, $r_\infty = (1-h(Q)) - h(Q) = 1 - 2h(Q)$ . Why: attributing all error to Eve is the worst case, pinning her information to $h(Q)$ .

Step 4. Set $r_\infty = 0$ : this requires $h(Q_\mathrm{th}) = \tfrac12$ , i.e. $-Q\log_2 Q - (1-Q)\log_2(1-Q) = \tfrac12$ . Inverting the binary entropy gives $Q_\mathrm{th} \approx 0.1100$ , the Shor-Preskill threshold; below it a positive key exists, above it the protocol aborts. Why: $h$ is monotonic on $[0,1/2]$ , so the root is a single sharp boundary between secure and insecure operation. *Verified: $h(0.110)=0.49992\approx 0.500$ to three decimals, the standard Shor and Preskill (PRL 85, 441) threshold; the six-state protocol's tighter constraint raises it to $\approx 12.6\%$ .*

Go deeper · Derivation C · 1 minHow much to sacrifice, and how many bits to trust Q

Derivation CHow much to sacrifice, and how many bits to trust Q

The goal is to establish the two statistical facts that make sifting and estimation cheap: that on average exactly half the transmitted qubits survive symmetric-BB84 sifting, and that only a modest random sample bounds the true QBER to any desired precision and confidence. Together they quantify the overhead — the price in raw bits — of turning a noisy quantum channel into a trusted error estimate.

Step 1. Each party chooses $Z$ or $X$ uniformly and independently, so per round $\Pr[\text{match}] = \Pr[ZZ] + \Pr[XX] = \tfrac14 + \tfrac14 = \tfrac12$ . By linearity of expectation over $n$ rounds, $\mathbb{E}[L_\mathrm{sift}] = n/2$ , giving $p_\mathrm{sift} = 1/2$ . Why: independence makes the rounds identical Bernoulli trials, so the expected sift length is $n$ times the match probability.

Step 2. From the surviving $\approx n/2$ bits, sacrifice a random subset of $m$ to estimate $Q$ via $\hat Q$ in (2). Under the i.i.d. assumption each compared position is Bernoulli $(Q)$ , so Hoeffding's inequality (3) bounds the error. Why: random sampling keeps the compared bits representative of the whole string, so $\hat Q$ tracks the true $Q$ .

Step 3. Demand $|\hat Q - Q| < \varepsilon$ with failure probability at most $\delta$ . Solving $2e^{-2m\varepsilon^2} \le \delta$ gives $m \ge \dfrac{\ln(2/\delta)}{2\varepsilon^2}$ . For $\varepsilon = 0.01$ , $\delta = 10^{-6}$ this is $m \ge 72{,}543$ bits — a fixed cost independent of key length. Why: $m$ grows only as $\ln(1/\delta)$ , so even astronomical confidence is affordable and negligible against millions of sifted bits.

Step 4. Because the sampled bits are now public, discard them; the retained key is $\approx n/2 - m$ . A conservative protocol then uses the upper confidence bound $\hat Q + \varepsilon$ , not $\hat Q$ , wherever $Q$ enters the security accounting. Why: underestimating $Q$ would under-shrink the key in privacy amplification and leak secrecy, so one always rounds up. *Verified: binomial mean $n\cdot\tfrac12$ for the sift factor; Hoeffding sample size $m = \lceil \ln(2/\delta)/(2\varepsilon^2)\rceil = 72{,}543$ for $\varepsilon=0.01$ , $\delta=10^{-6}$ .*

Limiting cases

The sift factor and the QBER thresholds take clean values in the regimes that matter for protocol design and attack analysis.

Case	Result	Meaning
Symmetric BB84 sifting	$p_\mathrm{sift} = \tfrac12$	Independent uniform basis choices match half the time, halving the raw key.
Biased (efficient) BB84	$p_\mathrm{sift} \to 1$	Skew the basis probabilities so one basis dominates the key; the rare opposite rounds still check errors, and sift loss vanishes asymptotically.
Intercept-resend on BB84	$Q = \tfrac14 = 25\%$	Eve measures and resends every qubit; wrong basis half the time, then an error half of those.
One-way security threshold	$Q_\mathrm{th} \approx 11\%$	Root of $1 - 2h(Q) = 0$ ; above it no one-way secret key exists.
Six-state protocol	$Q_\mathrm{th} \approx 12.6\%$	Three mutually unbiased bases constrain Eve more tightly, raising tolerable QBER at the cost of $p_\mathrm{sift}=1/3$ .
Noiseless channel	$Q = 0,\ r_\infty = 1$	One secret bit per sifted bit; nothing leaked or corrected.

Worked examples

1 · Secret-key rate of a metropolitan fiber link (fully worked)

A symmetric-BB84 link runs at raw detection rate $\nu = 1.0\times 10^{6}$ counts/s after channel loss. Monitoring reports a stable QBER $Q = 2.0\%$ , and the reconciliation code runs at efficiency $f = 1.10$ . Find the asymptotic secret fraction, the practical fraction, and the delivered key rate $R$ .

Step 1. Evaluate the binary entropy of the error rate. With $Q = 0.02$ , $h(Q) = -0.02\log_2 0.02 - 0.98\log_2 0.98 = 0.11288 + 0.02857 = \mathbf{0.14144}$ bits. This is both the reconciliation cost and Eve's information per sifted bit.

Step 2. The ideal one-way rate is $r_\infty = 1 - 2h(Q) = 1 - 2(0.14144) = \mathbf{0.7171}$ per sifted bit — the point plotted on the second figure, comfortably positive because $2\% \ll 11\%$ .

Step 3. The practical fraction charges reconciliation the real cost $f\,h(Q)$ : $1 - f\,h(Q) - h(Q) = 1 - 1.10(0.14144) - 0.14144 = \mathbf{0.7030}$ per sifted bit; the $f$ penalty costs only about $0.014$ bit.

Step 4. Fold in the sift factor and detection rate: $R = p_\mathrm{sift}\,[\,1 - f\,h(Q) - h(Q)\,]\,\nu = 0.5\times 0.7030\times 10^{6} = \mathbf{3.5\times 10^{5}\ \text{bits/s}}$ , about 351 kbit/s — half the raw counts lost to sifting, and $\sim70\%$ of survivors becoming final key.

2 · Detecting an eavesdropper and sizing the check sample

The honest link sits at $Q = 2\%$ . (a) If Eve mounts a full intercept-resend attack, what QBER does Alice see? (b) How large a check sample $m$ pins the QBER to $\pm 1\%$ with failure probability $10^{-6}$ ? (c) How much traffic could Eve intercept-resend before pushing the link to threshold?

Step 1. A full intercept-resend attack injects $Q_\mathrm{IR} = 25\%$ (Derivation 1). The observed rate leaps from $2\%$ to roughly $25\%$ , more than double the $11\%$ threshold, so the protocol aborts on the first estimation round.

Step 2. For $\varepsilon = 0.01$ and $\delta = 10^{-6}$ , Hoeffding gives $m \ge \ln(2/\delta)/(2\varepsilon^2)$ . With $\ln(2\times 10^{6}) = 14.509$ , $m \ge 14.509/(2\times 10^{-4}) = \mathbf{72{,}543}$ sampled bits — a fixed overhead, negligible against a multi-megabit sifted string.

Step 3. If Eve intercept-resends only a fraction $p$ of rounds, she adds $\approx p/4$ to the QBER. To lift the link from $2\%$ to the $11\%$ threshold she needs $p/4 \approx 0.09$ , i.e. $p \approx 0.36$ . Attacking about a third of the rounds already saturates the threshold — and there $r_\infty \to 0$ , so even a partial attack yields her nothing while denying Alice and Bob a key.

Step 4. Intercept-resend loses at any strength: small $p$ keeps $Q$ near baseline but gives Eve almost nothing; large $p$ gives her more but drives $Q$ over threshold. There is no $p$ at which she both hides and learns a usable key.

Physics of the portrait

Sifting and QBER are the load-bearing ideas of quantum cryptography, and they carry the fingerprints of a chain of physicists who turned a curiosity about conjugate observables into a security guarantee grounded in the laws of measurement.

Origins · 1 minquantum key distribution and how this was discovered

quantum key distribution

secret key distilled from the disturbance every measurement leaves · quantum cryptography and information theory

Quantum key distribution is one of the few technologies whose security rests not on computational hardness but on physical law, and it took two decades to mature. Stephen Wiesner conceived conjugate coding around 1970 — encoding information in complementary observables so no one can read it all without disturbance — but the idea languished unpublished until 1983. Charles H. Bennett and Gilles Brassard seized it in 1984 and built the BB84 protocol, introducing the very steps of this article: transmit in random conjugate bases, then sift by publicly comparing bases and discarding the mismatches. Artur Ekert reformulated security through entanglement and Bell-inequality violation in 1991. The disturbance-equals-information intuition was made rigorous by privacy amplification (Bennett, Brassard, Crépeau, and Maurer, 1995), which distills a provably secret key from a partially compromised one. First full security proofs came from Mayers and, independently, Lo and Chau in the late 1990s; Peter Shor and John Preskill recast them in 2000 into a transparent argument fixing the $\approx 11\%$ QBER threshold via quantum error-correcting codes. Igor Devetak and Andreas Winter completed the picture in 2005 with the rate $I(A{:}B) - \chi(A{:}E)$ that turns an observed error rate directly into a secret-key length. What began as Wiesner's unpublishable puzzle is now a number a fiber operator watches on a dashboard.

History

1984

— Bennett and Brassard introduce BB84 with basis sifting over a public authenticated channel

1991

— Ekert derives QKD security from Bell-inequality violation of entangled pairs

1995

— Generalized privacy amplification ties the secret length to the eavesdropper's information

2000

— Shor and Preskill prove BB84 security and fix the ≈ 11 percent QBER threshold

2005

— Devetak and Winter establish the r = I(A:B) − χ(A:E) secret-key rate

Going further

Texts. Nielsen and Chuang, Quantum Computation and Quantum Information, §12.6 (quantum cryptography) · Preskill, Lecture Notes for Physics 219, Ch. 5 (quantum cryptography and BB84) · Wilde, Quantum Information Theory, chapters on private communication and the Devetak-Winter rate · Watrous, The Theory of Quantum Information · Mermin, Quantum Computer Science, cryptography chapter · Scarani et al., Rev. Mod. Phys. 81, 1301 (2009), "The security of practical quantum key distribution."

Provenance. All results are standard QKD facts, re-derived and re-checked here. A verifier should: (1) confirm intercept-resend QBER $=25\%$ by the two-branch average (Nielsen and Chuang §12.6; Preskill Ch. 5); (2) solve $1-2h(Q)=0$ for $Q_\mathrm{th}\approx 0.110$ and check $h(0.110)=0.49992\approx 0.500$ (Shor and Preskill, PRL 85, 441, 2000); (3) verify the sift factor $1/2$ from independent uniform basis choice; (4) reproduce the Hoeffding sample $m=72{,}543$ for $\varepsilon=0.01$ , $\delta=10^{-6}$ ; (5) confirm $r_\infty=0.7171$ and practical fraction $0.703$ at $Q=2\%$ , $f=1.1$ , giving $R\approx 3.5\times10^{5}$ bits/s at $\nu=10^{6}$ /s.

Prerequisites. BB84 Protocol · No-Cloning Theorem in Cryptography · E91 Protocol. Leads to. Information Reconciliation and Privacy Amplification · Decoy-State QKD · Photon-Number-Splitting Attack.

Ask the tutor: Ask me why a full intercept-resend attack lands at exactly 25 percent QBER, or to size the check sample for a QBER you want to trust to a given precision.

Why must only bases, never bit values, be announced during sifting?

Because the classical discussion channel is public — anyone, including Eve, hears it, so announcing a bit value hands it straight to her. Basis labels are safe: knowing a round used the $Z$ basis tells Eve nothing about whether the bit was $0$ or $1$ , since she would still have had to measure that qubit in that basis at the time to learn it, which she cannot do without disturbance. So Alice and Bob compare bases openly to choose which rounds to keep, and the surviving bit values stay secret. The one exception is the small random sample sacrificed to estimate $Q$ — and those bits, spoken aloud, are immediately discarded.

Are the errors from noise and from eavesdropping really indistinguishable?

Operationally, yes, and that is the whole point. A depolarizing fiber, a dark count, and a collective attack that mimics depolarizing noise all produce the same statistic: a bit that disagrees with probability $Q$ . No measurement on the sifted strings separates an honest flip from a malicious one, so security refuses to try — it assigns all observed error to Eve and shrinks the key accordingly. This is pessimistic on a genuinely spy-free link, but it is the only assumption that stays safe when a spy is present and disguised as noise.

Where does the 11 percent threshold actually come from?

From setting the asymptotic rate $r_\infty = 1 - 2h(Q)$ to zero. The first $h(Q)$ is what reconciliation leaks to fix Bob's errors; the second is Eve's Holevo information, which the worst-case collective attack drives up to $h(Q)$ too. When the two consume a full bit — $2h(Q) = 1$ , i.e. $h(Q) = 1/2$ — nothing is left to distill, and inverting the binary entropy gives $Q_\mathrm{th} \approx 0.110$ . It is not a hardware limit but the exact error rate at which Bob's advantage over Eve vanishes. The six-state protocol constrains Eve harder and reaches $\approx 12.6\%$ ; two-way reconciliation pushes tolerable QBER higher still.

Why is the sift factor exactly one half, and can it be improved?

In standard BB84 both parties pick between two bases uniformly and independently, so they agree with probability $\tfrac14 + \tfrac14 = \tfrac12$ ; half the rounds are discarded. This is pure overhead, not a security requirement. Efficient BB84 biases the basis probabilities — say $Z$ chosen $90\%$ of the time by both — so nearly all key rounds use the dominant basis and the match probability climbs toward $1$ . The rare minority-basis rounds still estimate the error rate in both bases (an asymmetry check against basis-dependent attacks) but no longer dominate the count. Asymptotically $p_\mathrm{sift}\to 1$ , roughly doubling throughput at no cost to security.

How is a full intercept-resend attack still useless if it gathers information?

Because the information it gathers never outweighs the disturbance it leaves. Eve guesses Alice's basis correctly only half the time; on those rounds she learns a bit, but on the other half she learns nothing usable and scrambles the qubit. Averaged over the sifted key her Holevo information stays bounded by $h(Q)$ , while she injects $25\%$ QBER — far past the $11\%$ threshold where $r_\infty$ hits zero, so privacy amplification removes at least as much as she could know. Throttling back to a fraction $p$ of rounds drops her information in step with $Q \approx p/4$ . There is no operating point where she both hides and profits.

What is the difference between the sifted key, the reconciled key, and the secret key?

They are three successive stages of the same string, each shorter and cleaner. The sifted key survives basis matching: correlated but still carrying errors at rate $Q$ and partly known to Eve. The reconciled key follows information reconciliation, where Alice and Bob exchange error-correction data (leaking $\approx f\,h(Q)$ bits per bit) so both hold an identical string. The secret key follows privacy amplification, hashed down by roughly $h(Q)$ per bit to squeeze out Eve's knowledge, leaving a string uniformly random from her view. The QBER estimated during sifting sizes both later steps.