Quantum cryptography: BB84

The problem with keys

The unbreakable one-time pad has one weakness: Alice and Bob must first share a long secret key, and any courier or wire carrying it can be silently tapped. Classical physics offers no way to detect a careful copy of data in transit.

Quantum mechanics does, thanks to two facts you've already met: an unknown qubit can't be cloned, and measuring in the wrong basis disturbs the state. Bennett and Brassard turned these into the BB84 protocol in 1984.

The BB84 protocol

For each key bit, Alice randomly picks one of two bases: the Z basis {|0⟩, |1⟩} or the X basis {|+⟩, |−⟩} (the states H makes — you can prepare all four in the workbench with at most one X and one H). She encodes her bit in the chosen basis and sends the qubit. Bob, not knowing her choice, measures in a random basis of his own.

When Bob happens to pick Alice's basis, his result matches her bit perfectly; when he picks wrong, he gets a coin flip. Afterwards they publicly compare bases (never bits!) and keep only the ~50% of rounds where the bases matched. Those bits form the shared key.

Now for Eve. To learn anything she must measure in-flight qubits, guessing the basis half the time wrong — and a wrong-basis measurement re-prepares the qubit in the wrong basis. That corrupts about 25% of the bits Alice and Bob expect to match. By sacrificing a random sample of their key and comparing it publicly, they either see ~0% errors (no Eve — use the key) or ~25% (Eve! — throw it away and start over). Eavesdropping is not just detectable; it's loud.

Ekert's twist: keys from entanglement

In 1991 Artur Ekert rebuilt key distribution on entanglement: Alice and Bob each take half of a stream of Bell pairs and measure in randomly chosen directions. Matching-direction rounds give perfectly correlated key bits; a sample of the rest is used to run the Bell test from the previous lesson. If the correlations violate Bell's inequality, no third party can hold copies of the outcomes — the randomness demonstrably didn't exist before they measured it.

Both flavors are real technology today: quantum key distribution runs over metropolitan fiber networks and has been demonstrated via satellite between continents. The security rests not on math being hard, but on no-cloning and collapse being true.