D@ra
← Concepts

BB84 Quantum Key Distribution : The Protocol

April 28, 2026

In the first part we did all the groundwork. We saw what information is, what a key is, what encryption is, and we ended on the real villain of the whole story: key distribution. Sending a secret key over a classical channel is hopeless, because classical bits can be copied silently. Eve just listens, makes a perfect copy, and nobody ever knows.

We ended with a promise: quantum physics changes the rules. To see how, we said we first need to understand how information can be encoded in quantum systems.

So let’s do exactly that.

Encoding a bit in a photon

Forget wires and voltages. In quantum cryptography, the carrier of information is usually a single photon, a single particle of light. And the property we use to store a bit is its polarization, the direction in which the photon’s electric field oscillates.

Here is the beautiful part. We do not use just one way of encoding. We use two, and the whole protocol lives or dies on that choice.

Basis 1 — the rectilinear basis (we’ll write it +):

  • horizontal polarization (→) means bit 0
  • vertical polarization (↑) means bit 1

Basis 2 — the diagonal basis (we’ll write it ×):

  • diagonal at 45° (↗) means bit 0
  • diagonal at 135° (↖) means bit 1

So a single bit, say 0, can be sent in two different ways: as a horizontal photon (in the + basis) or as a 45° photon (in the × basis). Same bit value, physically different states.

Why on earth would we complicate things like this? Patience. This redundancy is not a bug. It is the entire trap we are setting for Eve.

The two rules of the quantum game

Before we assemble the protocol, we need two facts from quantum mechanics. Everything else follows from them.

Rule 1 — Measurement in the wrong basis is a coin flip

Suppose Alice sends a horizontal photon (→), which is a 0 in the + basis. If Bob measures it in the correct basis (+), he gets 0 every single time. Clean, deterministic, perfect.

But if Bob measures that same horizontal photon in the wrong basis (×), something strange happens: he gets 0 or 1 with 50/50 probability, completely at random. Worse, the act of measuring forces the photon into a diagonal state. The original information is gone.

This is the heart of it. You only get a reliable answer if you already knew which basis to use. Guess wrong, and you get pure noise and you destroy the evidence.

Rule 2 — You cannot clone an unknown quantum state

In the classical world, Eve’s whole attack was “copy the bit, pass the original along.” In the quantum world that move is forbidden. The no-cloning theorem says there is no physical process that can take an unknown quantum state and produce two identical copies of it.

So Eve cannot make a backup to study later. If she wants Alice’s photon, she has to measure it, and by Rule 1, if she doesn’t know the basis, her measurement is a guess that scrambles the state.

Put those two rules together and you can already smell the trap: Eve cannot look without touching, and she cannot touch without leaving a mark.

The BB84 protocol, step by step

Now we assemble the machine. This is the 1984 Bennett–Brassard recipe.

Step 1 — Alice prepares. For each bit she wants to send, Alice does two random coin flips:

  • one to pick the bit value (0 or 1),
  • one to pick the basis (+ or ×).

She encodes the bit in that basis and fires the photon down the quantum channel to Bob.

Step 2 — Bob measures. Bob has no idea which basis Alice used. So for each incoming photon, he also picks a basis at random and measures. Sometimes he’ll guess right, sometimes wrong. When he guesses right, he reads Alice’s bit correctly. When he guesses wrong, he gets a random result (Rule 1).

Let’s look at a small run:

Alice's bits:    0    1    1    0    1    0    0    1
Alice's bases:   +    +    ×    ×    +    ×    +    ×
Bob's bases:     +    ×    ×    +    +    ×    ×    ×
Bob's results:   0    ?    1    ?    1    0    ?    1
                 ✓    ✗    ✓    ✗    ✓    ✓    ✗    ✓

Where the bases match (✓), Bob’s bit is guaranteed correct. Where they don’t (✗), his result is a random coin flip and useless.

Step 3 — Sifting (the public basis chat). Now Alice and Bob talk over a normal, public classical channel, the internet, a phone call, whatever. Here’s the clever bit: they announce which bases they used, but never the bit values.

They keep only the positions where their bases matched, and throw away the rest. The surviving bits form the sifted key:

Kept positions:  0    -    1    -    1    0    -    1
Sifted key:      0         1         1    0         1   →  0 1 1 0 1

On average, they agree on the basis half the time, so they keep roughly 50% of the transmitted bits. Announcing the bases publicly is safe, because knowing the basis tells Eve nothing about the bit value.

If there is no eavesdropper and no noise, Alice and Bob now share an identical secret string. Done. But we should never assume Eve is polite.

Catching Eve in the act

Here is where all that careful setup pays off. Let’s watch Eve try her best classical-style attack, called intercept-and-resend: she grabs each photon, measures it, then sends a fresh photon on to Bob based on what she saw.

The problem for Eve is Rule 1. She doesn’t know Alice’s basis either, so she has to guess.

  • 50% of the time Eve guesses the right basis. She reads the bit correctly, resends it correctly, and nobody notices.
  • 50% of the time Eve guesses wrong. She gets a random result and she collapses the photon into the wrong basis. She then resends this corrupted photon to Bob.

Now focus on the cases where Alice and Bob did use the same basis, the bits that survive sifting and should be perfectly correlated. On those, whenever Eve guessed wrong (half the time), the photon reaching Bob is now in the wrong state, so even measuring in the correct basis Bob gets the right answer only half the time.

Let’s do the arithmetic on the sifted bits:

  • Eve guesses right (prob ½): Bob’s bit is correct.
  • Eve guesses wrong (prob ½): Bob’s bit is correct only with prob ½ → wrong with prob ½.

So Eve introduces errors at a rate of:

½ × 0   +   ½ × ½   =   ¼   =   25%

Eve’s snooping forces a 25% error rate into the sifted key. This number, the fraction of sifted bits that disagree, is called the Quantum Bit Error Rate (QBER).

Step 4 — Error checking. So Alice and Bob sacrifice a random sample of their sifted key and compare those bits publicly. If the channel were clean, they’d agree almost perfectly. If they see a QBER creeping up toward 25%, they know someone was intercepting, and they simply throw the whole key away and start over. Eve gains nothing, because a discarded key is never used to encrypt anything.

That is the punchline the entire first article was building toward: with classical bits, interception is invisible; with quantum bits, interception is self-announcing.

But wait, real channels are noisy too

An honest objection: real fibers and detectors introduce errors even when there is no Eve. A photon can get depolarized, a detector can misfire. So Bob will always see some QBER, maybe a few percent, from nature alone.

How do Alice and Bob tell “harmless noise” from “Eve”? They don’t, and they don’t need to. They take the pessimistic view: assume every single error is Eve’s fault. Then:

  • If the QBER is below a critical threshold (for BB84, around 11% for the standard security proofs), they can still distill a secure key, they just have to work for it.
  • If the QBER is above that threshold, Eve could in principle know too much, so they abort.

Getting from a partially-leaked, slightly-erroneous sifted key to a short, perfectly secret, perfectly identical final key takes two more classical post-processing stages:

Error correction (information reconciliation). Alice and Bob run a classical protocol (exchanging parity checks over the public channel) to fix the mismatched bits so their strings become identical. This leaks a little information to Eve, which they carefully account for.

Privacy amplification. This is the magic-eraser step. Even after correction, Eve might hold partial information about the key. Alice and Bob deliberately shrink their key by feeding it through a public hash function, compressing, say, 1000 bits down to 700. The output is shorter, but any partial knowledge Eve had about the original bits gets smeared out to essentially nothing. They trade length for secrecy.

What comes out the other end is a shorter key that is, provably, almost perfectly secret and identical for both parties. That key can now feed the One-Time Pad we met in Part 1, and that combination, quantum key distribution plus a one-time pad, is the closest thing we have to unconditionally secure communication.

Putting it all together

Let’s trace the full pipeline one last time, top to bottom:

1. Alice → random bits + random bases → photons  ┐
2. Bob   → random bases → measurements            │  quantum channel
3. Sift  → keep matching bases (~50% survive)     ┘
4. Check → estimate QBER on a sample              ┐
5. If QBER too high → ABORT                       │  public classical channel
6. Correct errors → identical strings             │
7. Privacy amplification → short, secret key      ┘
8. Use key with One-Time Pad → secure message

Steps 1–3 are pure quantum mechanics. Steps 4–7 are pure classical information theory, done out loud in the open. The security doesn’t come from hiding the classical conversation; it comes from the fact that the only place Eve could have interfered, the quantum channel, punishes her with detectable errors.

That is BB84. A protocol whose entire genius is turning quantum mechanics’ most annoying feature, that measurement disturbs the system, into a burglar alarm.

Where to go from here

BB84 is the beginning, not the end. A few threads worth pulling if this grabbed you:

  • E91 (Ekert, 1991): the same goal, but using entangled photon pairs and Bell’s theorem instead of single-photon polarization. Security there comes from the violation of a Bell inequality.
  • The real-world caveats: perfect single-photon sources don’t exist, so practical systems face the photon-number-splitting attack. The fix, decoy states, restores security and is what real deployments use today.
  • The trust problem: what if you don’t even trust your own hardware? That leads to device-independent QKD, one of the most beautiful ideas in the field.

But those are stories for another day.

Original protocol: C. H. Bennett and G. Brassard, “Quantum Cryptography: Public Key Distribution and Coin Tossing” (1984). For the security thresholds and post-processing, see V. Scarani et al., “The Security of Practical Quantum Key Distribution,” Rev. Mod. Phys. 81, 1301 (2009); and the no-cloning theorem in W. K. Wootters and W. H. Zurek, “A single quantum cannot be cloned,” Nature 299, 802 (1982).