Quantum key distribution does not use quantum mechanics to encrypt a long message directly. It uses quantum measurements to create and test correlated raw data, then classical error correction and privacy amplification turn that raw data into a shorter shared secret key.
BB84 is the canonical example. Alice encodes random bits in one of two incompatible bases. Bob measures in randomly chosen bases. After transmission, they publicly compare only the basis choices, keep matched-basis positions, sacrifice some data to estimate disturbance, reconcile the remaining strings and compress away any information that an eavesdropper could plausibly hold.
The security intuition is simple: an eavesdropper who does not know the preparation basis cannot read every signal without risk of disturbing the statistics. The full proof is more demanding. It must quantify Eve’s information, account for finite samples, allow arbitrary quantum attacks under a declared model, and include information leaked during classical post-processing.
Prepare incompatible states → measure randomly → sift → estimate errors → reconcile → privacy amplify → verify → authenticate the public discussion.
1. What BB84 is trying to achieve
Alice and Bob want a shared classical key K that is nearly uniform, nearly identical on both sides and nearly independent of any quantum system E held by an adversary.
Modern security definitions express secrecy using trace distance or an equivalent composable criterion. Informally, the real protocol output should be nearly indistinguishable from an ideal system that hands Alice and Bob the same uniformly random key while giving Eve no information about it.
Correctness and secrecy are separate. A protocol can produce keys that agree but are known to Eve, or keys that are secret individually but disagree between Alice and Bob.
2. The four BB84 signal states
BB84 uses two mutually unbiased qubit bases. In the computational Z basis:
- bit 0 → |0⟩;
- bit 1 → |1⟩.
In the diagonal X basis:
- bit 0 → |+⟩=(|0⟩+|1⟩)/√2;
- bit 1 → |−⟩=(|0⟩−|1⟩)/√2.
Each X-basis state gives completely random outcomes when measured in Z, and each Z-basis state gives completely random outcomes when measured in X.
3. Prepare-and-measure BB84
For each signal position i, Alice chooses a random raw bit ai and random basis θi∈{Z,X}. She prepares the corresponding qubit and sends it through the quantum channel.
Bob independently chooses a random measurement basis θ’i∈{Z,X} and records outcome bi.
After all measurements are complete, Alice and Bob announce basis choices over an authenticated public channel. They keep positions where θi=θ’i. This is basis sifting.
With unbiased random basis choices, roughly half the transmitted detections survive sifting. Practical protocols can bias basis probabilities to improve efficiency while preserving enough test data for parameter estimation.
4. Why the public channel must be authenticated
The classical discussion may be public, but Alice and Bob must know who sent each message. Without authentication, Eve can perform a man-in-the-middle attack: run one QKD session with Alice while impersonating Bob and another with Bob while impersonating Alice.
QKD therefore expands previously shared authentication material into a longer fresh key; it does not remove the need for an initial authentication root.
Some of the newly generated key can later refresh the authentication key, allowing long-running authenticated key growth under composable security assumptions.
5. Intercept-resend disturbance
Consider a simple eavesdropper who measures every qubit in a random Z or X basis and resends the state corresponding to her outcome.
Among sifted positions, Eve chose the wrong basis with probability 1/2. When she chose the wrong basis, the state she resends is unbiased relative to Alice’s basis, so Bob gets the wrong sifted bit with probability 1/2.
Therefore the induced quantum bit error rate is
QBER=(1/2)(1/2)=1/4=25%.
This is not the general security threshold. It is a worked signature of one specific attack.
6. QBER
For a sifted binary key sample, quantum bit error rate is the fraction of positions where Alice’s and Bob’s bits disagree.
If 2000 test positions contain 84 disagreements,
QBER=84/2000=0.042=4.2%.
The observed test error is an estimator of an underlying error property. In finite-key analysis, one must account for sampling fluctuation before using that estimate to bound Eve’s information on the untested positions.
7. Parameter estimation is a sampling problem
Alice and Bob reveal a subset of sifted data or use dedicated test-basis rounds. Those revealed bits are no longer secret-key material.
From the test sample they infer, with specified confidence, an upper bound on a relevant error rate in the remaining data.
Hoeffding, Serfling, hypergeometric or entropy-based finite-sample bounds may be used depending on how the sample was selected and whether sampling is with or without replacement.
A point estimate such as 4.2% is not itself a security statement.
8. Information reconciliation
Even without Eve, channel noise and detector imperfections can cause Alice’s and Bob’s sifted strings to differ.
They therefore run a classical error-correction protocol, for example using parity checks or modern error-correcting codes. Public messages reveal some information about the raw string.
Let leak_EC denote the number of effectively revealed bits in reconciliation, including verification information under the chosen security accounting.
Privacy amplification must remove this leakage as well as Eve’s quantum side information.
9. Error-correction efficiency
For an ideal binary symmetric channel with error rate q, Shannon’s limit suggests at least approximately h₂(q) bits of syndrome information per raw bit, where
h₂(q)=−qlog₂q−(1−q)log₂(1−q).
Practical reconciliation often uses
leak_EC≈f_EC n h₂(q)
with efficiency factor fEC≥1.
At q=0.04, h₂(q)≈0.2423. If fEC=1.10, the reconciliation leakage scale is about 0.2665 bits per reconciled raw bit.
10. Privacy amplification
After reconciliation, Alice and Bob share an identical string X that may be partially known to Eve. They apply a randomly chosen universal hash function to compress X into a shorter key K.
The leftover-hash lemma states, in one modern formulation, that if X has sufficiently large smooth conditional min-entropy given Eve’s quantum system and public transcript, hashing can produce an output close to uniform and independent of Eve.
Privacy amplification does not identify which bits Eve knows. It removes information globally by compressing the string below a certified entropy threshold.
11. Conditional min-entropy
For a classical key variable X correlated with quantum side information E, the conditional min-entropy Hmin(X|E) is connected to Eve’s optimal guessing probability:
H_min(X|E)=−log₂ p_guess(X|E)
for the appropriate classical-quantum state formulation.
Smooth min-entropy permits a small failure neighbourhood and is the central finite-resource quantity in many composable QKD proofs.
12. Entropic uncertainty with quantum side information
An uncertainty relation can state that if one system would be predictable in the Z basis, then a complementary X-basis measurement is correspondingly uncertain to an observer lacking the right quantum side information.
For two measurements with overlap c, entropic uncertainty relations have a structure such as
H_min(Z|E)+H_max(X|B) ≥ log₂(1/c).
For mutually unbiased qubit Z and X bases, c=1/2 and the right-hand side is one bit per ideal single-qubit round.
In QKD, Bob’s observed X-basis errors can therefore help upper-bound his uncertainty about Alice’s X outcomes, which in turn lower-bounds Eve’s uncertainty about the Z-basis key.
13. Phase errors versus bit errors
Shor and Preskill’s security proof reformulates BB84 through entanglement purification and CSS quantum error-correcting codes. In that picture, bit-flip errors correspond to ordinary key disagreement while phase-flip errors quantify the complementary-basis information relevant to privacy.
The prepare-and-measure protocol does not physically correct phase errors. Instead, privacy amplification plays the role that phase-error correction would have played in the entanglement-based proof.
This bridge explains why quantum error-correction ideas appear inside QKD security proofs even though an ordinary BB84 implementation uses no full quantum computer. [1]
14. Asymptotic secret fraction in an idealised symmetric BB84 model
Under common ideal single-photon, symmetric-error assumptions, a familiar asymptotic secret fraction has the form
r≈1−h₂(e_bit)−h₂(e_phase).
If ebit=ephase=q, then
r≈1−2h₂(q).
At q=0.04, h₂(q)≈0.2423, so r≈0.5154 secret bits per suitable sifted raw bit before practical reconciliation inefficiency and finite-size corrections.
This formula is pedagogical, not a universal production key-rate equation.
15. A threshold is model dependent
The zero of 1−2h₂(q) occurs near q≈11%, giving the often-quoted one-way asymptotic BB84 threshold scale under the corresponding ideal assumptions.
Different proofs, two-way post-processing, biased bases, decoy states, finite-key corrections, detector models and source imperfections change the admissible region and key-rate formula.
Do not turn “11%” into a universal abort threshold for every implementation.
16. Finite-key secret-length template
A modern finite-key analysis often produces a bound of the schematic form
ℓ ≤ H_min^ε(X|E) − leak_EC − security_corrections.
The correction terms account for hashing failure, verification failure, parameter-estimation confidence and the composable secrecy target.
Every epsilon parameter belongs in the security budget. Saying “secure except with probability 10−10” requires specifying which failure events were combined to reach that number.
17. Worked finite-key bookkeeping example
Suppose an analysis certifies smooth min-entropy of 620,000 bits for a reconciled raw string before public reconciliation leakage. Suppose error correction and verification reveal 180,000 effective bits and the chosen finite-security correction is 2,000 bits.
A safe secret length under this simplified bookkeeping is
ℓ≤620000−180000−2000=438000 bits.
Choosing 438,000 bits does not make the key “438,000-bit secure”. The security level comes from the trace-distance or composable epsilon parameters used to justify the entropy and correction terms.
18. Weak coherent pulses and photon-number splitting
Real optical transmitters often approximate single photons using attenuated laser pulses with Poisson-distributed photon number.
Multi-photon pulses can create a photon-number-splitting vulnerability: Eve may keep one photon and forward another without causing the disturbance expected from measuring an unknown single photon.
Decoy-state QKD varies pulse intensity so Alice and Bob can estimate yields and error rates by photon-number class, recovering secure key rates under practical weak-coherent-pulse sources.
19. Detector side channels
A mathematical proof applies to a device model. Real detectors can exhibit efficiency mismatch, dead time, afterpulsing or controllable behaviour outside the intended model.
Measurement-device-independent QKD removes entire classes of detector side-channel attacks by allowing an untrusted middle station to perform the Bell-state measurement while security is based on the end users’ trusted sources.
Device-independent QKD goes further by trying to infer security from Bell-inequality statistics under stronger experimental requirements. Guide 36 develops the corresponding certification mathematics.
20. Authentication and key growth
The authenticated classical channel can be implemented using information-theoretic message authentication with a short pre-shared key.
If the QKD session succeeds, reserve part of the fresh key to authenticate the next session. The remaining key is net growth.
If the session aborts, authentication material may still have been consumed. A full operational key-rate calculation counts this cost.
21. Common misconception: Eve always causes 25% errors
Twenty-five percent is the sifted QBER for the simple full intercept-resend attack with random bases. General coherent attacks can produce other error-information trade-offs and are handled by the security proof, not by memorising one disturbance number.
22. Common misconception: privacy amplification fixes ordinary bit errors
Error correction makes Alice’s and Bob’s strings agree. Privacy amplification reduces Eve’s information. The two steps have different mathematical jobs.
23. Common misconception: QKD proves the hardware is secure automatically
Security is conditional on the implementation satisfying the model or on a proof that explicitly incorporates its deviations. Side channels outside the model can invalidate an otherwise correct proof.
24. Worked synthesis problem
A BB84 session has 1,000,000 sifted Z-basis key positions after parameter-estimation sampling. The conservative phase-error bound is 4.5%. Error reconciliation leaks 290,000 bits. Ignore all finite-size terms except a 5000-bit security reserve.
Step 1: Phase uncertainty. h₂(0.045)≈0.2648.
Step 2: Eve-related compression scale. The simplified entropy cost is approximately 264,800 bits.
Step 3: Reconciliation leakage. Subtract 290,000 bits.
Step 4: Security reserve. Subtract another 5000 bits.
Step 5: Simplified final length.
ℓ≈1000000−264800−290000−5000=440200 bits.
This is an educational bookkeeping example, not a production finite-key proof. A real implementation must derive its smooth-entropy bound, sampling correction and composable failure probabilities from the actual protocol.
25. Practice set
- Name the four BB84 signal states.
- Why are Z and X useful as conjugate bases?
- What is sifting?
- Why must the public classical channel be authenticated?
- Derive the 25% QBER of full intercept-resend.
- What does parameter estimation do?
- What is information reconciliation?
- What does privacy amplification do?
- What operational quantity is conditional min-entropy linked to?
- Why do complementary-basis errors help bound Eve’s information?
- Why is the often-quoted 11% threshold not universal?
- Name two implementation effects that a real QKD proof must model or neutralise.
Answers
- |0⟩, |1⟩, |+⟩ and |−⟩.
- They are mutually unbiased, so knowing one basis outcome gives maximal uncertainty about the other.
- Discard positions where Alice and Bob used different bases.
- Otherwise Eve can impersonate each endpoint and run two separate sessions.
- Eve chooses the wrong basis half the time and then causes a wrong Bob result half of those sifted events, giving 1/4.
- Uses a random sample or test basis to bound error parameters on the unseen key data.
- Classical error correction that makes Alice’s and Bob’s raw strings agree while tracking public leakage.
- Hashes a partially secret reconciled string into a shorter string that is close to uniform and independent of Eve.
- Eve’s optimal guessing probability.
- Entropic uncertainty links Bob’s ability to predict one basis to Eve’s inability to predict the complementary basis.
- It comes from a particular asymptotic one-way ideal model and changes with proof and implementation assumptions.
- Examples: multi-photon emissions, detector side channels, basis-dependent flaws, loss, finite-key statistics and source memory.
Sources and further study
[1] Peter W. Shor and John Preskill, Simple Proof of Security of the BB84 Quantum Key Distribution Protocol. The classic entanglement-purification/CSS-code security reduction for BB84.
[2] Renato Renner, Security of Quantum Key Distribution. A composable-information-theoretic treatment built around smooth entropy.
[3] Mario Berta and colleagues, The uncertainty principle in the presence of quantum memory. A foundational entropic uncertainty relation with quantum side information.
[4] Valerio Scarani and colleagues, The Security of Practical Quantum Key Distribution. A broad review of practical sources, detectors and finite implementation assumptions.
Continue through Quantum Mathematics
Guide 34: Quantum Authentication, Private Quantum Channels and the Quantum One-Time Pad protects transmitted quantum data itself. Guide 35: Quantum Repeaters, Network Entanglement, Swapping and End-to-End Rates extends secure quantum links across network distances. Guide 36: Device-Independent Randomness, Self-Testing and Bell-Certified Security derives certification from observed nonlocal statistics.