Quantum Key Distribution (BB84)
Turning basis-dependent measurement into a provably secure key exchange
By the end of this topic you'll be able to
Bennett and Brassard's 1984 paper opens with a simple observation: when elementary quantum systems like polarized photons carry information, the uncertainty principle creates cryptographic possibilities no classical transmission medium can offer. That single idea is the seed of quantum key distribution.
The resulting protocol, now known as BB84: Alice generates a random bit string, and for each bit randomly chooses one of two conjugate bases — say the computational basis {|0⟩,|1⟩} or the Hadamard basis {|+⟩,|−⟩} — to encode it, then sends the resulting qubits to Bob one at a time.
Bob has no way to know which basis Alice used for any given qubit, so he measures each one in a basis he also picks at random. When his basis happens to match Alice's, his result reliably reproduces her bit; when the bases differ, his outcome is essentially random noise, exactly as the basis-dependence of measurement predicts.
Once every qubit has been sent, Alice and Bob publicly announce — over an ordinary classical channel, and without revealing the bit values themselves — which basis they used for each qubit, and they keep only the positions where both bases matched. This surviving 'sifted key' should be identical for both of them, if nothing went wrong.
This is where basis-dependence stops being a curiosity and becomes a security mechanism. An eavesdropper, Eve, intercepting a qubit doesn't know Alice's basis either, so roughly half the time she measures in the wrong one — and that measurement, exactly as the postulates covered earlier describe, collapses and disturbs the state before it ever reaches Bob.
Before measuring, and above are just probabilities — press Measure to collapse the state to one definite outcome.
Alice and Bob can detect this disturbance directly: they sacrifice a random subset of their sifted key, compare those specific bits publicly, and check the error rate. Any eavesdropping raises this rate measurably above what a noise-free quantum channel would produce — interception leaves physical evidence, not just a hypothetical risk.
This is the crucial contrast with the security of RSA, which Shor's algorithm targets: RSA rests on an unproven assumption (that factoring is hard) that a sufficiently capable quantum computer overturns outright. BB84's security instead rests on the laws of quantum mechanics themselves — no-cloning and measurement disturbance — which no future computer, quantum or otherwise, can violate.
BB84 does carry one real prerequisite of its own: the basis-comparison step needs an authenticated, though not necessarily secret, classical channel, or an attacker could simply impersonate one party to the other. Modern QKD systems, including satellite experiments distributing entangled photons over hundreds of kilometers, still build directly on this four-decade-old protocol.
Try It Yourself
Alice sends 8 qubits, each randomly in the computational or Hadamard basis. Bob independently guesses a basis for each. On average, how many bits survive sifting, and — if Eve intercepts and measures every qubit in a random basis before resending — roughly what extra error rate does that introduce on the surviving bits?
- 1Bob's basis choice is independent of Alice's and each is 50/50, so for each qubit there's a 1/2 chance Bob happens to match Alice's basis. Over 8 qubits, the expected number of matches is 8 × 1/2 = 4 — about 4 bits survive sifting.
- 2Now consider Eve intercepting: for each qubit, Eve also guesses a basis independently, matching Alice's with probability 1/2.
- 3When Eve's basis matches Alice's (probability 1/2), she measures and resends the correct state undisturbed — no error introduced. When Eve's basis doesn't match (probability 1/2), her measurement collapses the qubit into a state that, when Bob later measures in Alice's original basis (one of the sifted cases), gives the wrong outcome with probability 1/2.
- 4So on a sifted bit, Eve introduces an error with probability (1/2 chance she guessed wrong) × (1/2 chance that wrong guess flips Bob's result) = 1/4 — a 25% error rate on the sifted key, far above what a clean channel would show.
About 4 of the 8 qubits survive sifting on average, and Eve's interception introduces roughly a 25% error rate on those surviving bits — easily detectable against the near-zero error rate of an unintercepted channel.
Reference
| Conjugate bases | Two mutually unbiased bases used to encode each bit | |
| Sifted key | On average, about half of the transmitted qubits survive sifting | |
| Security basis | A physical law, not a computational hardness assumption | |
| Eavesdropping signature | Interception is detectable directly, not merely assumed absent |
Quick Check
Why can't an eavesdropper intercept a BB84 qubit, measure it, and resend an identical copy to Bob without being detected?
What does BB84's security rely on, in contrast to RSA's?