BB84

BB84 is a prepare-and-measure quantum key distribution protocol introduced by Charles Bennett and Gilles Brassard in 1984. Alice encodes random candidate key bits in one of two conjugate qubit bases. Bob measures each received signal in a randomly chosen basis. After transmission, they use an authenticated public channel to keep compatible events, estimate disturbances, reconcile their strings, verify agreement, and compress away an adversary’s possible information.

Raw measurement outcomes are not yet a secret key. BB84 aims to produce matching, nearly uniform secret strings or to abort, under a specified device and attack model. The QKD overview defines the acceptance-weighted composable guarantee. Here the focus is how the four states, basis tests and phase-error bound make that guarantee possible.

Required background. Quantum key distribution supplies authentication and postprocessing; the Bloch sphere, density operators and projective measurement supply the qubit states and Born rule. No-cloning and no-signaling explains the limits on copying and the role of classical messages.

The Four Signal States

Let $x\in\{0,1\}$ be Alice’s bit and let $\theta\in\{0,1\}$ be her basis choice. Write

$$|\psi_{x\theta}\rangle = H^\theta|x\rangle,$$

where $H$ is the Hadamard gate. The four states are:

Basis	$\theta$	Bit $x$	Signal state
computational, $Z$	$0$	$0$	$\lvert0\rangle$
computational, $Z$	$0$	$1$	$\lvert1\rangle$
Hadamard, $X$	$1$	$0$	$\lvert+\rangle=(\lvert0\rangle+\lvert1\rangle)/\sqrt2$
Hadamard, $X$	$1$	$1$	$\lvert-\rangle=(\lvert0\rangle-\lvert1\rangle)/\sqrt2$

Within either basis, the two states are orthogonal. Across bases, every squared overlap is one half:

$$\left| \langle x|H|x'\rangle \right|^2 = \frac12.$$

Bob chooses a basis $\phi\in\{0,1\}$ and measures with projectors

$$M_y^{(\phi)} = H^\phi|y\rangle\langle y|H^\phi, \qquad y\in\{0,1\}.$$

The Born probabilities are

$$\Pr(y|x,\theta,\phi) = \begin{cases} \delta_{xy}, & \theta=\phi,\\ \tfrac12, & \theta\neq\phi. \end{cases}$$

Thus a matched ideal measurement reproduces Alice’s bit, whereas a mismatched measurement is uniformly random.

What the signal reveals before basis announcement

If Alice’s bit is uniform, the average state in either basis is maximally mixed:

$$\begin{aligned} \rho_Z &= \frac12\left( |0\rangle\langle0| +|1\rangle\langle1| \right) = \frac{I}{2}, \\ \rho_X &= \frac12\left( |+\rangle\langle+| +|-\rangle\langle-| \right) = \frac{I}{2}. \end{aligned}$$

No measurement on the ideal signal can reveal which basis was chosen before the later announcement, because the two basis ensembles define the same density operator. This does not mean Eve learns nothing from every possible interaction. It means that security must be analyzed as a tradeoff among her quantum side information, the public transcript, and the disturbance seen in the test data.

The four states occupy the $+z$, $-z$, $+x$, and $-x$ directions on the Bloch sphere. A stronger statement holds for these single-copy signals: no outcome can unambiguously identify even one of the four labels. The other three states span the whole qubit space, so a positive measurement effect that never clicks on them must vanish. Allowing an inconclusive outcome does not give a nonzero success probability for this four-state alphabet (Chefles, 1998). This statement changes if Eve receives extra copies or leaked degrees of freedom.

The four signal rays form two complementary bases. A $Z$ error leaves either $Z$-basis ray unchanged but exchanges $|+\rangle$ and $|-\rangle$. Consequently, zero key-basis error does not by itself establish zero phase error. Exercise 6 calculates this example.

Sending, selecting and testing signals

For rounds $i=1,\ldots,N$, the ideal protocol proceeds as follows.

1. Choose: Alice samples independent random bits $(x_i,\theta_i)$.
2. Prepare: She transmits $H^{\theta_i}|x_i\rangle$ through an insecure quantum channel.
3. Measure: Bob independently samples $\phi_i$ and measures in that basis, recording outcome $y_i$ or a no-detection event.
4. Acknowledge detections: Bob authenticates which rounds produced a valid record before Alice reveals her basis choices.
5. Reveal bases: Alice and Bob disclose $\theta_i$ and $\phi_i$ over the authenticated public channel, but not the unrevealed key bits.
6. Sift: They retain detected rounds satisfying $\theta_i=\phi_i$.
7. Estimate: They reveal a designated random sample or test-basis data, estimate relevant error parameters, and abort when the acceptance test fails.
8. Reconcile and verify: They correct differences between their remaining strings and verify that the results agree, accounting for every disclosed syndrome and tag.
9. Amplify privacy: They choose a fresh independent two-universal hash to produce shorter final keys $K_A$ and $K_B$.
10. Refresh authentication: They reserve key material for later transcript authentication when the system is intended to expand a continuing secret.

The ordering matters. For example, if an unmodeled detector can choose which rounds survive after learning Alice’s basis, loss can become a basis-dependent postselection channel. A security proof defines which announcements occur when, which systems may remain quantum, and what Eve knows at every step.

Sifting and Quantum Bit Error Rate

Let $D$ be the set of detected rounds and let

$$S = \{i\in D:\theta_i=\phi_i\}$$

be the sifted set. With independent uniform basis choices,

$$\Pr(\theta_i=\phi_i) = \frac12.$$

This is a probability for the independent basis choices. With basis-independent acceptance it is also the fraction of detections that survive sifting. In general, conditioning on detection can change a distribution, so that extra assumption must be checked.

If Alice and Bob choose $Z$ with probabilities $p_Z^A$ and $p_Z^B$, the probability of matching before detection is

$$p_{\rm match}=p_Z^A p_Z^B+(1-p_Z^A)(1-p_Z^B).$$

Let $Y_{\theta\phi}$ denote the detection probability for settings $(\theta,\phi)$, averaged over uniformly random signal bits. Then

$$\Pr(\text{match}\mid\mathrm{det})= \frac{\sum_\theta p_A(\theta)p_B(\theta)Y_{\theta\theta}} {\sum_{\theta,\phi}p_A(\theta)p_B(\phi)Y_{\theta\phi}}.$$

Here “det” is the event that a signal is detected. The numerator counts matched detections; the denominator counts all detections. Only when the relevant efficiencies cancel does this reduce to the simpler formula. Exercise 7 uses a receiver with unequal basis efficiencies.

Biased-basis BB84 reduces sifting loss by using one basis predominantly for the key and the other for testing. It still needs enough complementary-basis data, analyzed separately, to bound phase errors (Lo, Chau and Ardehali, 2005).

For a revealed test set $T\subset S$, the observed quantum bit error rate (QBER) is

$$Q_T = \frac{1}{|T|} \sum_{i\in T} \mathbf 1[x_i\neq y_i].$$

No-detection events are not automatically bit errors. They are losses whose security treatment depends on the source and detector model. The test QBER is also not automatically the error rate of the unrevealed key block. A finite-key proof supplies a random-sampling bound and a failure probability for that inference.

Intercept–Resend Attack

The simplest attack illustrates information–disturbance without proving full security. Eve intercepts every signal, measures it in a uniformly random $Z$ or $X$ basis, prepares the state indicated by her outcome, and sends that replacement to Bob.

Condition on a sifted round, so Bob happened to use Alice’s basis.

• With probability $1/2$, Eve also chose Alice’s basis. She learns the bit and resends the correct state, causing no ideal error.
• With probability $1/2$, Eve chose the conjugate basis. Her outcome is random, and Bob’s measurement of the resent state is wrong with probability $1/2$.

Therefore

$$\begin{aligned} Q_{\rm IR} &= \Pr(\text{Eve wrong basis}) \Pr(\text{Bob error}|\text{wrong}) \\ &= \frac12\cdot\frac12 = \frac14. \end{aligned}$$

If Eve attacks only a fraction $f$ of otherwise ideal rounds, this model gives

$$Q_{\rm IR}=\frac{f}{4}.$$

After basis disclosure, Eve knows the sifted bit perfectly on the half of her intercepted rounds where she chose correctly. For this particular hard-decision attack, her mutual information is $f/2$ bit per sifted bit before error correction and privacy amplification.

The number $25\%$ is not the BB84 security threshold. General individual, collective, and coherent attacks need not behave like intercept–resend. Device noise can create errors without Eve, and flawed devices can leak information without producing this disturbance. The security theorem bounds Eve over its entire allowed attack class from the complete observed statistics and device assumptions.

The intercept–resend calculation is one possible interaction. No-cloning does not exclude partial information from approximate measurements or coherent probes. The security argument must bound the adversary over all interactions allowed by its assumptions.

Source-Replacement Picture

The prepare-and-measure protocol has an equivalent virtual description. Alice may be imagined to prepare

$$|\Phi^+\rangle_{AB} = \frac{|00\rangle+|11\rangle}{\sqrt2},$$

keep system $A$, and send $B$ through the channel. Measuring $A$ in basis $\theta$ with outcome $x$ prepares Bob’s system in $H^\theta|x\rangle$ because the BB84 basis vectors are real in the computational basis. The conditional emitted states and their probabilities agree with direct preparation, including their relation to the later classical basis and bit records. This is stronger than equality of the signal density operator after averaging over every label.

This source-replacement step makes two error classes visible:

• a bit error means Alice and Bob disagree when both measure in the key basis;
• a phase error is the hypothetical disagreement that would occur in the conjugate basis and controls Eve’s information about the key.

In a CSS-code entanglement-purification argument, one syndrome corrects bit errors and another corrects phase errors. If Alice and Bob could distill nearly perfect Bell pairs, measuring those pairs in the key basis would produce a nearly ideal secret key. Shor and Preskill (2000) showed that the required CSS operations can be rearranged and removed until the remaining observable procedure is prepare-and-measure BB84 with classical error correction and privacy amplification.

Entanglement Distillation develops the distributed syndrome viewpoint. Stabilizer Formalism explains the code and syndrome machinery.

Standard Asymptotic Key Fraction

Let $e_b$ and $e_p$ be valid asymptotic upper bounds on bit- and phase-error rates for the sifted key block, with $0\leq e_b,e_p\leq1/2$. Define the binary entropy

$$h_2(q) = -q\log_2q -(1-q)\log_2(1-q).$$

In the ideal single-photon BB84 model with one-way postprocessing, an achievable secret fraction per sifted key bit is

$$r \geq \max\{0,1-h_2(e_b)-h_2(e_p)\}.$$

The first entropy term is the ideal error-correction cost; the second is the privacy cost associated with phase uncertainty. For symmetric BB84 statistics under the standard reduction,

$$e_b=e_p=Q,$$

so

$$r \geq \max\{0,1-2h_2(Q)\}.$$

This lower bound becomes positive when

$$Q<0.11003\ldots.$$

The familiar $11.0\%$ value is therefore an ideal asymptotic threshold for this proof and one-way processing, not a universal abort setting. Two-way postprocessing, different proof techniques, finite statistics, source flaws, detector models, and protocol variants change the achievable boundary.

Real reconciliation reveals more than the Shannon limit. If its inefficiency is represented by $f_{\rm EC}\geq1$, a common asymptotic engineering estimate is

$$r_{\rm est} \approx 1-f_{\rm EC}h_2(e_b)-h_2(e_p),$$

before verification, authentication, finite-size, and implementation penalties. This estimates entropy cost; it is not a composable finite-key theorem.

The rate per transmitted optical mode must also include detection, basis selection, parameter-estimation sacrifice, dead time, and every other accepted mode criterion. Multiplying $r$ only by a clock frequency is not enough.

Authentication and physical assumptions

The classical channel can be public but must be authenticated. Otherwise Eve can run separate low-error BB84 sessions while impersonating each endpoint. The QKD overview explains this attack and how preshared keys or computational credentials change the assumptions. Authentication covers detection records, basis choices, samples, reconciliation, verification and the final hash seed.

The qubit calculation describes particular source and measurement behavior. Real sources can reveal settings in timing, spectrum or intensity. Detectors can have basis-dependent efficiency, afterpulsing or responses outside the intended optical modes. Random choices and laboratory isolation must also match the model. A proof can include imperfections, but their effect must be bounded; a low measured QBER alone is not a substitute (Gottesman et al., 2004).

Weak coherent pulses

A phase-randomized coherent pulse of mean photon number $\mu$ has Poisson photon-number probabilities

$$P_\mu(n) = e^{-\mu} \frac{\mu^n}{n!}.$$

Multiphoton pulses invalidate the literal single-qubit story because Eve may, under an insufficient proof model, retain one photon and forward another. Decoy-State QKD varies intensity to estimate single-photon contributions without assuming Eve treats signal and decoy labels honestly. That analysis requires the photon-number sector to be indistinguishable between intensity settings except for its occurrence probability. Cryptography case studies applies such estimates to a modeled optical link.

Loss and accepted events

In an ideal model, channel loss can be treated as erasure and Eve may control which signals arrive. Security comes from the statistics of accepted events, not from the absence of detections. If acceptance depends on basis, bit, wavelength, arrival time, detector control, or a leaked source mode, the surviving sample may not represent the intended qubit ensemble.

Finite statistics

The asymptotic identity between test and key error rates is replaced by a confidence statement. A finite-key analysis must account for sampling without replacement, smoothing or entropy-estimation terms, error-correction leakage, verification failure, privacy-amplification failure, authentication failure, and all abort branches. Quantum Key Distribution explains those finite-block terms; Tomamichel et al. (2012) derive a finite-key BB84 bound.

BBM92 implements an entanglement-based version of the two-basis idea; E91 and entanglement-based QKD explains why distributing entanglement does not itself remove measurement trust. MDI-QKD instead sends characterized states from both endpoints to an untrusted relay. These changes require their own security arguments.

Exercises

1. Verify mutual unbiasedness

Compute all four cross-basis probabilities $|\langle z_x|x_y\rangle|^2$.

Solution

Using

$$|+\rangle = \frac{|0\rangle+|1\rangle}{\sqrt2}, \qquad |-\rangle = \frac{|0\rangle-|1\rangle}{\sqrt2},$$

one obtains

$$\begin{aligned} |\langle0|+\rangle|^2 &= |\langle0|-\rangle|^2 = \frac12, \\ |\langle1|+\rangle|^2 &= |\langle1|-\rangle|^2 = \frac12. \end{aligned}$$

Thus either state in one basis gives a uniform outcome when measured in the other basis.

2. Count sifted rounds

Suppose $80{,}000$ signals produce valid detections, with detection independent of both basis choices. How many sifted rounds are expected with uniform independent bases? What is the basis-match probability if both parties choose $Z$ with probability $0.9$?

Solution

Uniform choices match with probability $1/2$, so the expected sifted count is

$$80{,}000\times\frac12 = 40{,}000.$$

With $p_Z^A=p_Z^B=0.9$,

$$p_{\rm match} = (0.9)^2+(0.1)^2 = 0.82.$$

This would yield $65{,}600$ matched detections on average, but the $X$-matched subset has expected fraction $0.01$ and may be too small for the desired finite statistical bound.

3. Partial intercept–resend

In an otherwise noiseless ideal system, the measured QBER is $3\%$. If every error is attributed to the partial intercept–resend model, what attacked fraction $f$ would explain it, and how much sifted-bit information would Eve have in that model?

Solution

Since $Q=f/4$,

$$f=4Q=0.12.$$

Eve knows the bit on half of the intercepted sifted rounds, so her mutual information in this simplified model is

$$\frac{f}{2}=0.06$$

bit per sifted bit. This inference is not valid for a general attack or a noisy implementation; it is specific to the stated model.

4. A biased bit can reveal the basis

Alice chooses the two bases with equal probability, but her encoded bit is zero with probability $p$. Find $\rho_Z$ and $\rho_X$. What is the optimal single-signal probability of guessing the basis?

Solution

Writing $a=2p-1$, the two averages are

$$\rho_Z=\tfrac12(I+aZ),\qquad\rho_X=\tfrac12(I+aX).$$

The difference $a(Z-X)/2$ has eigenvalues $\pm a/\sqrt2$. Thus their trace distance and optimal equal-prior discrimination success are

$$D(\rho_Z,\rho_X)=\frac{|2p-1|}{\sqrt2},\qquad P_{\rm guess}=\frac12+\frac{|2p-1|}{2\sqrt2}.$$

Uniform bits give $P_{\rm guess}=1/2$, as expected. For $p=0.9$, the success probability is about $0.783$. Equality of the two basis ensembles therefore depends on uniform bit preparation. This example does not imply that every known bias destroys key generation; it changes the source model and its security analysis. Trace distance explains the optimal equal-prior discrimination rule.

5. Find the ideal one-way threshold

Solve $1-2h_2(Q)=0$ numerically. Evaluate the asymptotic fraction at $Q=5\%$.

Solution

The root satisfies $h_2(Q)=1/2$ and is

$$Q_*\approx0.11003.$$

At $Q=0.05$,

$$h_2(0.05)\approx0.28640,$$

so

$$r \geq 1-2h_2(0.05) = 0.42721$$

secret bit per sifted key bit under the ideal asymptotic assumptions.

6. Zero bit error with a nonzero phase error

Take $Z$ as the key basis. The channel applies $Z$ with probability $q$ and does nothing otherwise. Find the $Z$-basis bit-error rate, the $X$-basis test-error rate and the asymptotic key-fraction bound for $0\leq q\leq1/2$.

Solution

The channel is

$$\mathcal N(\rho)=(1-q)\rho+qZ\rho Z.$$

Both $|0\rangle$ and $|1\rangle$ are unchanged as physical rays, so $e_b=0$. But $Z|+\rangle=|-\rangle$ and $Z|-\rangle=|+\rangle$, so the $X$-basis disagreement rate is $q$. In this ideal model it bounds the phase-error rate of the $Z$ key, giving

$$e_p=q,\qquad r\geq1-h_2(q).$$

At $q=1/2$ the channel fully dephases in the key basis and the bound is zero despite perfect key-basis agreement. Measuring in $Z$ and resending realizes that channel and lets Eve know every $Z$ bit. Complementary-basis tests reveal the lost coherence.

7. Sifting with unequal detection efficiencies

Both parties choose $Z$ with probability $0.9$. Bob detects a signal with probability $0.2$ when he chooses $Z$, and probability one when he chooses $X$, independently of Alice’s setting and bit. What fraction of detections have matching bases?

Solution

The detection probability is $0.9(0.2)+0.1(1)=0.28$. The matching-detection probability is $0.9^2(0.2)+0.1^2(1)=0.172$. Hence

$$\Pr(\text{match}\mid\mathrm{det})=\frac{0.172}{0.28}\approx0.6143.$$

The unconditional basis-match probability is $0.82$, so it cannot be applied to the detected count here. Among $80{,}000$ detections, about $49{,}143$ are matched in a large sample. This elementary counting example does not by itself establish a security reduction for the inefficient receiver.

8. Estimate an asymptotic output length

After testing, Alice has $n=80{,}000$ sifted key bits. Suppose a justified asymptotic model gives $e_b=e_p=0.04$, reconciliation uses $f_{\rm EC}=1.15$, and all finite-size, verification, and authentication terms are temporarily omitted. Estimate the remaining secret bits.

Solution

The engineering estimate is

$$\begin{aligned} \ell &\approx n\left[ 1-f_{\rm EC}h_2(e_b)-h_2(e_p) \right] \\ &= 80{,}000 \left[ 1-2.15h_2(0.04) \right]. \end{aligned}$$

Since $h_2(0.04)=0.242292\ldots$,

$$\ell\approx38{,}326.$$

This is not a finite-key output length because the exercise explicitly omitted statistical, smoothing, verification, and authentication penalties. A real protocol must use a proven finite-key entropy bound and its associated failure parameters before choosing the hash length.

References

• C. H. Bennett and G. Brassard, “Quantum Cryptography: Public Key Distribution and Coin Tossing,” in Proceedings of the IEEE International Conference on Computers, Systems and Signal Processing, Bangalore, 175–179 (1984); reprinted in Theoretical Computer Science 560, 7–11 (2014), doi:10.1016/j.tcs.2014.05.025.
• A. Chefles, “Unambiguous Discrimination Between Linearly-Independent Quantum States,” Physics Letters A 239, 339–347 (1998), arXiv:quant-ph/9807022.
• D. Gottesman, H.-K. Lo, N. Lütkenhaus, and J. Preskill, “Security of Quantum Key Distribution with Imperfect Devices,” Quantum Information and Computation 4, 325–360 (2004), doi:10.26421/QIC4.5-1.
• H.-K. Lo, H. F. Chau, and M. Ardehali, “Efficient Quantum Key Distribution Scheme and Proof of Its Unconditional Security,” Journal of Cryptology 18, 133–165 (2005), arXiv:quant-ph/0011056.
• P. W. Shor and J. Preskill, “Simple Proof of Security of the BB84 Quantum Key Distribution Protocol,” Physical Review Letters 85, 441–444 (2000), doi:10.1103/PhysRevLett.85.441.
• M. Tomamichel, C. C. W. Lim, N. Gisin, and R. Renner, “Tight Finite-Key Analysis for Quantum Cryptography,” Nature Communications 3, 634 (2012), doi:10.1038/ncomms1631.