BB84: quantum key distribution that detects eavesdropping

Two people can build a shared secret key while noticing any eavesdropper. Learn Bennett and Brassard’s 1984 protocol and see in a simulation the 25% error an eavesdropper leaves behind.

The secret key problem

If two people share a secret key they can encrypt their messages unbreakably. The hard part is sharing the key without anyone else getting it. Today this is done with methods such as RSA; but as Shor’s algorithm shows, the security of these methods rests on a mathematical assumption.

Quantum key distribution (QKD) bases security on the laws of physics: measurement disturbs a state and a quantum state cannot be copied. So an eavesdropper cannot gain information without leaving a trace.

The protocol

For each bit Alice picks a random basis: the Z basis (|0⟩, |1⟩) or the X basis (|+⟩, |−⟩, the states with H applied). Bob measures each qubit in a basis he also picks at random. If the bases match, Bob reads Alice’s bit with certainty; if they differ, his result is a coin flip.

Then the two of them compare only their bases (not the bits) over a public channel and throw away the bits where the bases differed. By comparing part of the remaining bits they measure the error rate. If Eve steps in, measures the qubits in random bases and resends them, she causes about 25% errors in the kept bits and is noticed at once.

import random

def bb84(n, eve, seed=7):
    rng = random.Random(seed)
    kept = errors = 0
    for _ in range(n):
        bit, alice, bob = rng.randint(0, 1), rng.randint(0, 1), rng.randint(0, 1)
        sent_bit, sent_basis = bit, alice
        if eve:                              # Eve measures in a random basis and resends
            eve_basis = rng.randint(0, 1)
            if eve_basis != sent_basis:
                sent_bit = rng.randint(0, 1)
            sent_basis = eve_basis
        result = sent_bit if bob == sent_basis else rng.randint(0, 1)
        if alice == bob:                     # only bits with matching bases are kept
            kept += 1
            errors += result != bit
    return kept, round(errors / kept, 3)

print(bb84(4000, eve=False))
print(bb84(4000, eve=True))
# (1982, 0.0)      about half are kept, no errors
# (1970, 0.248)    with Eve, about 25% errors

QKD in the real world

BB84 was proposed by Charles Bennett and Gilles Brassard in 1984; in 1991 Artur Ekert found the E91 protocol, based on entanglement. In 2017 China’s Micius satellite distributed entangled photons to ground stations 1,200 km apart, and a QKD-encrypted video call was held between Beijing and Vienna.

QKD still has limits: it needs special hardware and fibre, its range is limited by losses, and the imperfections of real devices can open them to attacks. That is why post-quantum encryption, the subject of the next lesson, is preferred for protecting most of the internet.

Try it yourself

The interference example shows measuring in the same basis: Alice sends 0 in the X basis with an H, Bob measures in the X basis with an H and reads 0 with certainty. The coin flip example shows a different basis: the same qubit measured in the Z basis gives 50–50. When Eve picks the wrong basis she gets exactly this kind of random result.

Open the circuit in your browser

The circuit playground is in Turkish. Button guide: “1000 kez ölç” = measure 1000 times, “Durum vektörünü göster” = show the state vector, “Bu devrenin Qiskit kodu” = this circuit’s Qiskit code, “Geri al” = undo, “Temizle” = clear. Click a gate in the circuit to remove it.

Key points

In BB84 Alice sends each bit in a random basis (Z or X) and Bob measures in a random basis.
The bases are compared publicly; only bits measured in the same basis go into the key.
An eavesdropper who measures and resends leaves about 25% errors in the kept bits and is noticed.
The security of QKD rests not on mathematics but on measurement disturbing the state and on no-cloning.

Test yourself

In BB84, about how much error does an eavesdropper who measures and resends cause in the kept bits?

Show the answer

25%. Eve picks the wrong basis for half the bits, and for half of those Bob reads the wrong bit: ½ × ½ = ¼.

← Superdense coding: two bits with one qubit · Post-quantum cryptography: maths that resists quantum computers →