Non-graded · offline · explore at your own pace

A key exchange that exposes eavesdroppers

A classical key exchange can be recorded without anyone noticing. Its secrecy rests on math being hard, so a recording can be broken later if the math falls. BB84 (Bennett and Brassard, 1984) sends key bits on single photons instead. Because measuring a quantum state disturbs it, anyone listening in leaves errors behind, and Alice and Bob can detect them before they ever use the key.

Sinclair College - Dr. Mike Libassi

Photons polarized in two bases: + (→ ↑) and × (↗ ↖). Only someone using the right basis reads the bit reliably.

01 · Refresher

Two bases, four polarizations

From pages 02 and 03: the Z basis distinguishes |0⟩ from |1⟩, and the X basis distinguishes |+⟩ from |−⟩. With photons, these are directions of polarization. Measuring in the wrong basis gives a 50/50 random result and destroys the original.

Click an encoding to see how it's measured.

02 · The protocol

Six steps from photons to a shared key

1 · Send. Alice picks a random bit and a random basis (+ or ×) for each photon and sends it to Bob.

2 · Measure. Bob picks his own random basis for each photon. He doesn't know Alice's choices.

3 · Sift. Over an ordinary public channel, they compare bases only, never bits. They keep the positions where the bases matched (about half) and discard the rest.

4 · Check. They publicly compare a sample of the kept bits. If the error rate is too high, they can't rule out an eavesdropper, so they throw the key away. A low error rate doesn't prove nobody listened; it limits how much an eavesdropper could have learned.

5 · Correct errors. Over the authenticated public channel, Alice and Bob find and fix the few bits that still disagree (information reconciliation). This leaks a little more information, which they count.

6 · Shrink the key. They hash the corrected bits down to a shorter key, sized so that whatever an eavesdropper might know is wiped out (privacy amplification). The public discussion in every step must be authenticated, or an attacker could impersonate Bob.

QBER (quantum bit error rate) — the fraction of sifted bits where Alice and Bob disagree. Without an eavesdropper and with perfect equipment it is 0%. Real channels have a few percent of natural noise. In theory BB84 can still produce a secure key up to about 11% errors (the Shor–Preskill bound); real systems with finite key lengths stop well before that, and other protocols have different limits.

03 · The core idea

Run BB84, with or without Eve

Try it: send photons and look for an eavesdropper

Run it once with Eve off, then turn Eve on. She intercepts every photon, measures it in a random basis, and sends Bob a replacement.

photons Eve intercepts

04 · Eve's fingerprint

Why intercepting costs Eve 25%

For every sifted bit, Eve guesses the wrong basis half the time. When she does, she sends Bob a photon in the wrong basis, and Bob's result is a coin flip, wrong half the time. So ½ × ½ = ¼ of the sifted bits become errors. That 25% is for this specific attack on every photon; if Eve intercepts only a fraction f of them, the error rate is about f/4. Small runs are noisy, so run thousands of photons to see the numbers settle.

Try it: large-scale runs

Simulates 5,000 photons each way and compares the error rates.

05 · Reality check

Where QKD works, and where it doesn't

Click a term for the practical limits.

The bigger picture: because of these limits, the U.S. NSA does not recommend QKD for protecting national security systems and instead points to post-quantum cryptography. QKD remains an active research area and is deployed in some specialized networks. Page 09 covers the post-quantum approach.