SARG04 (Scarani–Acín–Ribordy–Gisin, 2004) reuses the same four BB84 polarization states — |0⟩, |1⟩ (rectilinear basis Z) and |+⟩, |−⟩ (diagonal basis X) — but changes what Alice reveals during sifting.
|+⟩ = (|0⟩+|1⟩)/√2 |−⟩ = (|0⟩−|1⟩)/√2
Set A (bit 0): {|0⟩,|+⟩} {|1⟩,|−⟩}
Set B (bit 1): {|0⟩,|−⟩} {|1⟩,|+⟩}
Alice sends one state at random, then announces one of the two non-orthogonal pairs that contains it — the OTHER member of that pair is picked independently at random, and the pair's set (A or B) is the round's key bit. Bob's random measurement basis matches exactly one pair member:
- If Bob's basis matches the announced partner's basis and his outcome is orthogonal to it, he rules out the partner — the sent state must be Alice's real one, and he reads its key bit correctly.
- If Bob's basis instead matches the real, sent state's basis and his outcome is orthogonal to it — which cannot happen without noise or an eavesdropper — he wrongly rules out the real state and concludes the (independently-chosen) partner's bit instead: this is exactly where an error slips in.
- Otherwise the round is inconclusive and discarded (sifting efficiency ≈25% with no eavesdropper, matching BB84's own 50%×50%).
Fix note: the 3D sibling of this sim always paired both members of a pair with the same key bit, so its "wrongly ruled out the real state" branch also resolved to the correct bit — the concluded bit could never actually disagree with the sent bit, so its QBER read a flat 0% even with the eavesdropper on (confirmed numerically: 2,000,000-photon runs, statErrors always 0 regardless of the Eve toggle). This 2D engine gives the announced partner its own independent random bit per the real SARG04 A/B-set convention above, so an eavesdropper's disturbance can genuinely surface as a wrong concluded bit. Re-verified numerically: no-Eve QBER 0.00% / sift 25.0% (matches this page's own claim), Eve-on QBER ≈16.7% / sift ≈37.5%.
Because Eve never learns which pair Alice will announce, and the two states in a pair are only 45° apart on the Bloch circle (Born-rule overlap |⟨+|0⟩|² = 0.5), an intercept-resend attack disturbs the state before the pair is even known — this is what makes SARG04 more resistant than plain BB84 to photon-number-splitting attacks on weak coherent-pulse sources, at the cost of a lower raw key rate. Toggle the eavesdropper above to watch the QBER climb in the strip chart on the right.