BB84: Quantum Key Distribution and the Physics of Eavesdropping

Encoding a bit in a photon's polarization

BB84, proposed by Charles Bennett and Gilles Brassard in 1984, encodes each bit of a secret key in the polarization of a single photon. Alice has two possible bases to choose from: the rectilinear basis (+), where 0° means bit 0 and 90° means bit 1, and the diagonal basis (×), where 45° means bit 0 and 135° means bit 1. For every bit she wants to send, she picks a random basis and a random bit, and fires one photon prepared in that exact state.

rectilinear basis (+):  0deg -> bit 0      90deg  -> bit 1
diagonal basis    (x):  45deg -> bit 0      135deg -> bit 1

Why measuring in the wrong basis destroys information

Bob receives each photon and, not knowing which basis Alice used, picks a basis of his own at random and measures. If he happens to choose the same basis as Alice, quantum mechanics guarantees he reads back her exact bit. If he chooses the wrong basis, the two bases are conjugate observables — measuring polarization at 45 degrees to a photon prepared at 0 or 90 degrees collapses it into a genuinely random outcome, 0 or 1 with equal probability. There is no way to extract Alice's original bit from a mismatched-basis measurement; the information is not hidden, it is gone.

The protocol step by step

1. Alice picks N random bits and N random bases, sends N photons.
2. Bob picks N random bases (independently) and measures each photon.
3. Over a PUBLIC classical channel, Alice and Bob compare only which
   BASES they used for each photon -- never the bit values.
4. SIFTING: keep only the roughly 50% of results where the bases
   matched. Discard the rest. This is the "sifted key".
5. ERROR CHECK: publicly reveal and compare a random sample of the
   sifted key. If the error rate is above threshold, abort -- an
   eavesdropper (or noise) is present.
6. PRIVACY AMPLIFICATION: hash the remaining, unrevealed bits down
   to a shorter, fully secret final key.

The no-cloning theorem is what makes eavesdropping visible

Suppose Eve intercepts a photon in transit. She cannot simply copy it and forward the original, because the no-cloning theorem forbids any device from duplicating an arbitrary unknown quantum state. Her only option is to measure it and send Bob a fresh photon based on what she found — but she does not know Alice's basis either, so half the time she measures in the wrong basis, gets a random result, and resends a photon in the wrong state. When Bob later happens to measure in the basis Alice actually used, there is now a real chance his result disagrees with Alice's original bit, even though bases matched. Averaged over the protocol, an intercept-resend attack introduces roughly a 25% error rate into the sifted key, which Alice and Bob catch during the public error-check step and use to abort the exchange.

From raw key to a usable secret key

A real quantum channel is noisy even without an eavesdropper, so a small error rate is expected and tolerated. Alice and Bob run information reconciliation (a classical error-correction protocol, such as Cascade) over the public channel to agree on an identical bit string, at the cost of leaking a little extra information to a potential Eve. They then apply privacy amplification: a universal hash function that compresses the reconciled key into a shorter one, mathematically guaranteed to reduce Eve's knowledge of the final key to a negligible amount for any information she might have gathered. What comes out the other end is a key that is provably secret, with security resting on physics rather than on an unproven computational assumption.

Frequently asked questions

Try it live

Everything above runs in your browser — open BB84 Quantum Key Distribution and change the parameters while it is running. Nothing is installed, nothing is uploaded, the whole model lives in one tab.