Quantum Key Distribution Principles

Quantum key distribution solves the key agreement problem: Alice and Bob, connected by a public quantum channel and an authenticated (but not secret) classical channel, want to end up sharing a random bit string unknown to any eavesdropper, Eve. The central resource is a set of non-orthogonal quantum states. Alice encodes each key bit into one of several possible quantum states chosen from two or more bases, such that a bit value $0$ or $1$ can be represented by states that are not mutually orthogonal across bases. Because non-orthogonal states cannot be perfectly distinguished by any measurement, an eavesdropper who tries to read the transmitted state faces an unavoidable tradeoff between the information she gains and the disturbance she introduces. Two theorems from quantum information make this precise. The no-cloning theorem says there is no unitary process that maps an arbitrary unknown state $|\psi\rangle$ to two copies $|\psi\rangle|\psi\rangle$ for all $|\psi\rangle$ simultaneously; hence Eve cannot simply duplicate the qubit, keep a copy, and forward the original untouched. The measurement postulate says that any measurement capable of extracting information about which non-orthogonal state was sent must, on states that are not eigenstates of the measured observable, probabilistically collapse the state — changing the statistics Bob later observes. Together these facts imply an information–disturbance tradeoff: any strategy Eve uses to gain nonzero information about the raw key induces a nonzero, quantifiable increase in the error rate Alice and Bob observe when they compare a random subsample of their data. This tradeoff is the physical mechanism; the protocol layer converts it into a security guarantee. QKD protocols follow a common template: (1) a quantum transmission phase, where nonorthogonal states carry raw key material across the quantum channel; (2) a sifting/reconciliation phase, where Alice and Bob use the classical channel to discard mismatched or unusable measurement outcomes; (3) parameter estimation, where they sacrifice a random sample of the surviving data to estimate the channel/eavesdropper-induced error rate; (4) error correction, reconciling any remaining discrepancies; and (5) privacy amplification, which uses universal hashing to compress the reconciled string into a shorter key about which Eve's information is provably negligible. This general scaffold applies to prepare-and-measure schemes such as the forthcoming BB84 protocol and to entanglement-based schemes rooted in Bell inequality violations, which certify security via nonlocal correlations rather than direct disturbance monitoring.

The mechanism can be isolated from any specific protocol by considering a minimal abstract game. Alice draws a random bit $b$ and a random basis choice $\theta$, and sends a qubit state $|\psi_{b,\theta}\rangle$ chosen so that states from different bases are non-orthogonal. Bob independently chooses a measurement basis and records an outcome. Crucially, neither party reveals their basis choice until after the quantum transmission is complete — this is what prevents Eve from simply matching Bob's later-announced basis in real time. The essential physical claim to verify is: if Eve performs any measurement (or more general quantum operation) on the qubit in transit that gives her nonzero average information about $b$, then the probability that Bob's measurement outcome disagrees with what Alice sent — when Alice and Bob happen to use matching bases — is strictly greater than the noise-free channel's baseline error rate. This is what makes eavesdropping detectable: Alice and Bob don't need to know how Eve attacked; they only need to measure the disagreement rate.

Step-by-step protocol skeleton (deliberately protocol-agnostic; BB84 is the canonical instantiation): ``` QKD-CORE(N, security_threshold)

# N: number of qubits to transmit; security_threshold: max tolerable error rate

# --- Phase 1: Quantum transmission --- for i = 1 to N: Alice picks random bit b_i in {0,1} Alice picks random basis theta_i from a set of >= 2 mutually non-orthogonal bases Alice prepares qubit q_i in state |psi(b_i, theta_i)> Alice sends q_i to Bob over the quantum channel Bob picks random basis phi_i (independently of theta_i) Bob measures q_i in basis phi_i, records outcome r_i

# --- Phase 2: Basis reconciliation (classical, public) --- Alice and Bob publicly announce theta_i and phi_i for all i (NOT b_i, r_i) S = { i : theta_i == phi_i } # sifted/matching-basis indices raw_key_A = { b_i : i in S } raw_key_B = { r_i : i in S }

# --- Phase 3: Parameter estimation --- T = random sample of S, size m << |S| publicly reveal b_i, r_i for i in T observed_error_rate = mismatch_count(T) / m remove T from raw_key_A, raw_key_B # sacrificed bits are discarded if observed_error_rate > security_threshold: ABORT # possible eavesdropping or excessive channel noise

# do not use this session's key material

# --- Phase 4: Information reconciliation (error correction) --- sifted_key_A, sifted_key_B = error_correct(raw_key_A, raw_key_B)

# uses public error-correcting information; leaks some bits' worth

# of information to Eve, accounted for in the privacy amplification step

# --- Phase 5: Privacy amplification --- final_key = universal_hash(sifted_key_A, output_length = L(observed_error_rate, N))

# L is chosen so that Eve's expected information about final_key

# is below a target security parameter epsilon return final_key ``` The critical design decision is in Phase 1: the state set $\{|\psi(b,\theta)\rangle\}$ must be chosen so that for $\theta \neq \theta'$, the corresponding encodings of the same bit value are non-orthogonal across bases (e.g., a $0$ encoded in the computational basis is not orthogonal to a $1$ encoded in the Hadamard basis). If the bases were mutually orthogonal to each other's encodings, Eve could measure in a fixed basis and always extract the bit without error — orthogonality is precisely what permits noiseless discrimination, and non-orthogonality is precisely what QKD exploits to forbid it.

The classical phases (2–5) are equally essential to the "how": reconciliation discards the roughly half of transmissions where Alice's and Bob's basis choices disagreed (in a two-basis scheme), since those give Bob a uniformly random, uncorrelated outcome. Parameter estimation converts raw disagreement counts into an empirical bound on Eve's information via the information-disturbance tradeoff. Privacy amplification then applies universal hashing so that even the information Eve did manage to extract (bounded by the estimated error rate) is squeezed to a negligible amount in the final key, at the cost of shortening the key by a corresponding factor.

Communication and computational complexity. For a target final key length $L$, generating $N = O(L / \eta)$ raw qubits suffices, where $\eta \in (0,1]$ is the sifting efficiency (fraction of transmissions surviving basis reconciliation, typically $\eta \approx 1/2$ for two-basis schemes) times $(1 - h(Q))$ type reconciliation efficiency factors, with $Q$ the observed error rate and $h(\cdot)$ the binary entropy function. Every phase after transmission is classical and polynomial-time:

• Basis reconciliation: $O(N)$ classical communication and comparison.
• Parameter estimation: $O(m)$ for sample size $m$, chosen so that statistical fluctuations are controlled (Chernoff/Hoeffding bounds give $m = O(\log(1/\varepsilon)/\delta^2)$ to estimate the error rate to precision $\delta$ with failure probability $\varepsilon$).
• Error correction (e.g., Cascade or LDPC-based reconciliation): $O(N)$ to $O(N \log N)$ depending on the code, leaking at most $\text{leak}_{EC} \approx N \cdot h(Q)$ bits of information to Eve via public syndromes, in the honest-channel-noise idealization.
• Privacy amplification (universal hashing, e.g., Toeplitz-matrix hashing): $O(N \log N)$ using FFT-based multiplication, or $O(N^2)$ naively.

So the whole classical post-processing pipeline is near-linear in $N$, and $N$ itself scales linearly in the desired key length — QKD is efficient, not merely theoretically possible.

Correctness / security argument. The security claim is not "Eve cannot break this specific attack" but a composable bound: for any strategy Eve uses—any unitary interaction with an ancilla, any subsequent measurement, performed at any time including after basis announcement—her expected mutual information with the final key is bounded above by a function of the observed error rate $Q$, tending to zero as privacy amplification output length $L$ shrinks relative to $N(1 - 2h(Q))$ (the essence of the quantitative statement behind protocols descending from these principles, tightened rigorously for BB84 and its variants). The proof sketch rests on three pillars introduced as prerequisites: 1. No-cloning rules out the trivial attack: Eve cannot make an indistinguishable copy of each qubit, keep it, and forward a perfect original, because no unitary $U$ satisfies $U|\psi\rangle|0\rangle = |\psi\rangle|\psi\rangle$ for every state in a non-orthogonal state set (a direct consequence of linearity of quantum operations). 2. Measurement disturbance rules out delayed strategies: any interaction Eve's probe has with the qubit that yields nonzero information about which non-orthogonal state was sent must correlate her probe with the state in a way that, by the structure of the measurement postulate, cannot leave every possible transmitted state unperturbed. Formally, if $\{|\psi_i\rangle\}$ are not mutually orthogonal, no measurement (POVM) achieves both perfect state discrimination and zero disturbance on the ensemble — this can be shown via the Helstrom bound, which caps distinguishability of non-orthogonal states below unity, and via information-disturbance tradeoff theorems that lower-bound the fidelity loss as a function of information gained. 3. Randomized basis testing turns a worst-case adversary into a detectable one. Because Alice and Bob choose bases uniformly at random and independently, and reveal them only after transmission, Eve cannot know in advance which basis to measure in to evade detection; any fixed strategy she commits to before basis revelation induces disturbance detectable in the sifted, matching-basis subset with probability governed by the tradeoff bound. This is the role played more explicitly by CHSH-style nonlocality tests in entanglement-based QKD, where security is certified by observing Bell-inequality violation rather than direct basis comparison — but the underlying logic (local realism/classical strategies cannot reproduce quantum correlations without detectable statistical signature) is the same disturbance principle in different clothing. The correctness argument is thus not "we tried to catch Eve and succeeded" but a worst-case bound over all physically allowed adversary strategies, a much stronger claim than any classical protocol can offer, because it does not depend on Eve's computational resources, only on the laws of quantum mechanics.

Honest tradeoffs. QKD security proofs typically assume: an authenticated (though not secret) classical channel — otherwise Eve mounts a man-in-the-middle attack by impersonating both parties; ideal or well-characterized detectors — real detectors have side channels (e.g., detector blinding attacks) not covered by the abstract disturbance argument; and a finite tolerable error rate — if the channel is too noisy (high intrinsic loss/decoherence), $Q$ exceeds threshold even with no eavesdropper, and the protocol must abort, meaning QKD systems have a hard maximum transmission distance/loss budget, unlike classical cryptography which is loss-tolerant.

Consider a stripped-down two-basis scheme (structurally identical to what BB84 will formalize) with a small run of $N = 12$ qubits, to make the sifting and error-detection mechanics concrete. Basis $Z$ has eigenstates $|0\rangle, |1\rangle$; basis $X$ has eigenstates $|+\rangle, |-\rangle$, non-orthogonal to the $Z$ eigenstates. Alice encodes bit $b$ in basis $\theta$: bit $0 \to |0\rangle$ or $|+\rangle$; bit $1 \to |1\rangle$ or $|-\rangle$, depending on $\theta \in \{Z, X\}$.

Walk through what happens at $i=1$: Alice sends $|0\rangle$ intending Bob to measure in $Z$. Eve, guessing wrong, measures in the $X$ basis. Measuring $|0\rangle = \frac{1}{\sqrt2}(|+\rangle + |-\rangle)$ in the $X$ basis yields $|+\rangle$ or $|-\rangle$ each with probability $1/2$, collapsing the state. Eve forwards whatever she measured (say $|-\rangle$) to Bob. Bob, measuring in $Z$ (matching Alice's intended basis), now measures $|-\rangle = \frac{1}{\sqrt2}(|0\rangle - |1\rangle)$ in the $Z$ basis and gets $0$ or $1$ with 50/50 odds — here we recorded a flip to $1$. Even though Alice and Bob's bases matched, Eve's wrong-basis measurement introduced a 50% chance of error precisely on this round — this is the disturbance signature. At $i=8$, a similar wrong-basis measurement by Eve on a $Z$-basis-intended transmission again introduces a coin-flip error, independent of what actually gets recorded. At $i=3$, Eve happens to guess Bob's later basis correctly and thus can measure without disturbing (an $X$-basis eigenstate measured in $X$).

Sifting keeps indices $\{1,2,3,5,7,8,10,12\}$ (matching bases), discarding $\{4,6,9,11\}$. That gives a sifted key of length 8 from 12 transmissions — a sifting efficiency near the expected $1/2$.

Parameter estimation: suppose Alice and Bob sacrifice indices $\{1, 8\}$ from the sifted set for public comparison. At $i=1$: Alice's bit was $0$, Bob measured $1$ — a mismatch. At $i=8$: Alice's bit was $1$, suppose Bob measured $1$ by chance (matching despite Eve's interference) — a match. Observed error rate on this tiny sample: $1/2 = 50\%$, dramatically above any reasonable noise floor (a real fiber link without eavesdropping typically shows $Q \lesssim 1$–$5\%$ from detector dark counts and loss). Alice and Bob would abort: the anomalously high error rate, precisely because Eve guessed the wrong basis on roughly half her intercepted qubits, is the physical fingerprint of intercept-resend eavesdropping. This tiny example is exaggerated in scale (real protocols use thousands of sifted bits for statistically significant estimation), but the mechanism — wrong-basis interception causing detectable extra errors specifically among matching-basis rounds — is exactly what scales up to the rigorous security bounds discussed above.

The conceptual seed for QKD came from recognizing that quantum uncertainty, usually seen as an obstacle, could be turned into a cryptographic asset: information gain implies disturbance, so eavesdropping becomes self-revealing. This reframing connected foundational quantum measurement theory directly to a practical cryptographic primitive, decades after Heisenberg and the founders of quantum mechanics had established the uncertainty principle as a physical fact rather than a security feature.

Quantum key distribution is deployed today in government, financial, and telecommunications infrastructure precisely because it removes a computational-hardness assumption from the security chain. Metropolitan QKD networks link data centers and government facilities in several countries, layering QKD-derived keys underneath conventional symmetric encryption (e.g., AES) for the bulk data — QKD generates and refreshes keys; it does not replace bulk encryption. Satellite-based QKD, demonstrated at continental scale, extends the reachable distance beyond fiber-loss limits by using free-space optical links and trusted-node or entanglement-swapping architectures. The forthcoming ubiquity of quantum computers, capable of breaking RSA and Diffie–Hellman via Shor-adjacent quantum algorithms, is the primary long-term driver of interest: QKD's security proof does not depend on any computational hardness assumption, so it is immune to future quantum cryptanalytic advances by construction, unlike "post-quantum" classical schemes which merely substitute one hardness assumption for another believed to resist quantum attack. Standards bodies and network operators increasingly discuss hybrid architectures combining QKD-derived keys with post-quantum classical cryptography for defense-in-depth. The physical principles developed here — non-orthogonal state encoding, the no-cloning barrier, and the information-disturbance tradeoff — are exactly the ingredients assembled explicitly in the next layer of this subject, the BB84 protocol, and echoed in device-independent variants that lean on CHSH-type Bell tests for even stronger, assumption-light security guarantees.

Ask the tutor: How exactly does the observed error rate get translated into a provable upper bound on Eve's mutual information with the final key in a full BB84 security proof?