1. The Foundations of Quantum Key Distribution (QKD)
Modern public-key cryptography (such as RSA and elliptic curve Diffie-Hellman) relies on the presumed computational intractability of mathematical problems (integer factorization and discrete logarithms). With Shor's quantum algorithm capable of solving these in polynomial time, quantum cryptography offers an unconditionally secure alternative: Quantum Key Distribution (QKD). Invented by Charles Bennett and Gilles Brassard in 1984 (BB84), QKD's security is guaranteed not by mathematical complexity, but by the immutable laws of quantum mechanics.
2. Mechanics of the BB84 Protocol
Alice and Bob communicate over two channels: an untrusted quantum optical channel (such as single-mode optical fiber or free-space satellite link) and an authenticated public classical channel.
- State Preparation: Alice generates a random stream of classical bits ($0$ or $1$) and independently selects a random measurement basis for each bit:
- Rectilinear Basis ($+$): Bit 0 encoded as horizontal polarization $|H angle$ ($0^circ$), Bit 1 encoded as vertical polarization $|V angle$ ($90^circ$).
- Diagonal Basis ($ imes$): Bit 0 encoded as $+45^circ$ diagonal $|D angle = rac{|H angle + |V angle}{sqrt{2}}$, Bit 1 encoded as $-45^circ$ antidiagonal $|A angle = rac{|H angle - |V angle}{sqrt{2}}$.
- Transmission & Detection: Alice transmits polarized single photons to Bob. For each arriving photon, Bob independently chooses a basis ($+$ or $ imes$) uniformly at random and records his measurement result.
- Key Sifting: Over the classical channel, Alice and Bob announce the bases they used (without revealing the bit values). Whenever Bob measured in the same basis Alice used ($+ / +$ or $ imes / imes$), their bits correlate perfectly. Mismatched bases are discarded, yielding the sifted key (expected length $approx N/2$).
3. Eavesdropping Detection & The No-Cloning Theorem
If an eavesdropper (Eve) attempts to intercept photons, the No-Cloning Theorem ($U|psi angle|e angle eq |psi angle|psi angle$) forbids copying an unknown quantum state without perturbation.
Under a standard Intercept-Resend Attack:
- Eve must choose a measurement basis ($+$ or $ imes$) at random. Half the time, her basis matches Alice's and she measures the correct state without error.
- The other 50% of the time, Eve chooses the incorrect basis, projecting the photon into an orthogonal superposition. When she resends this state to Bob, Bob (even if choosing Alice's original basis) has a 50% probability of measuring the wrong bit.
- Overall, Eve's eavesdropping induces an expected error probability of $0.5 imes 0.5 = 25%$ in the sifted key.
4. Quantum Bit Error Rate (QBER) and Security Thresholds
The Quantum Bit Error Rate (QBER) is defined as:
Under the Shor-Preskill security proof, the asymptotic secret key fraction $R_{sec}$ achievable after error correction and privacy amplification is:
Where $h_2(p) = -p log_2(p) - (1-p) log_2(1-p)$ is the binary entropy function. Setting $1 - 2 h_2(QBER) = 0$ yields the celebrated theoretical security threshold:
If $ ext{QBER} > 11.0%$, Alice and Bob must abort the protocol because Eve has potentially acquired sufficient mutual information to compromise the final secret key.
5. Decoy-State Protocol for Weak Coherent Pulses
Ideal QKD theoretical security proofs assume on-demand true single-photon sources. However, commercial practical implementations employ heavily attenuated semiconductor laser diodes producing Weak Coherent Pulses (WCP) with Poissonian photon number distributions:
Where $mu approx 0.5$ to $0.8$ is the mean photon number per pulse. Because Poisson statistics allow multi-photon emissions ($P(n ge 2) approx mu^2 / 2$), Eve can execute a devastating Photon Number Splitting (PNS) attack: she measures the photon number non-destructively, peels off one photon to store in a quantum memory, and forwards the remaining photon to Bob without introducing any detectable QBER!
To thwart PNS attacks, the Decoy-State Protocol (proposed by Hwang in 2003 and demonstrated by Lo, Ma, and Chen in 2005) modulates laser pulse intensities between signal states ($mu$), decoy states ($nu$), and vacuum pulses ($0$). Because Eve cannot distinguish a signal pulse from a decoy pulse during transmission, any attempt to selectively strip multi-photon pulses alters the observed transmission yields, exposing eavesdropping immediately and extending secure fiber transmission beyond 100 kilometers.
6. Step-by-Step Worked BB84 Protocol Trace
The table below traces a sample transmission of 8 individual photon pulses exchanged between Alice and Bob under a partial eavesdropping scenario:
| Pulse # | Alice Bit | Alice Basis | Eve Intercept | Bob Basis | Bob Bit | Sift Status |
|---|---|---|---|---|---|---|
| 1 | 1 | + (Rect) | No | + (Rect) | 1 | MATCH (Keep: 1) |
| 2 | 0 | × (Diag) | No | + (Rect) | 1 (Random) | DISCARD (Basis mismatch) |
| 3 | 1 | × (Diag) | Yes (used +) | × (Diag) | 0 (Flipped!) | ERROR (Eve detected!) |
| 4 | 0 | + (Rect) | No | + (Rect) | 0 | MATCH (Keep: 0) |
| 5 | 1 | + (Rect) | No | × (Diag) | 0 (Random) | DISCARD (Basis mismatch) |
| 6 | 0 | × (Diag) | No | × (Diag) | 0 | MATCH (Keep: 0) |
| 7 | 1 | × (Diag) | No | + (Rect) | 0 (Random) | DISCARD (Basis mismatch) |
| 8 | 0 | + (Rect) | No | + (Rect) | 0 | MATCH (Keep: 0) |
7. Privacy Amplification & Universal Hashing
Even if the measured QBER is below the $11%$ threshold, Eve may possess partial mutual information $I(A:E) > 0$ about the sifted key. To compress the sifted key into an unconditionally secure final secret key, Alice and Bob apply Privacy Amplification using universal$_2$ hash functions (such as Toeplitz matrices):
- Error Reconciliation: The Cascade or Winnow protocol interactively identifies and corrects all bit errors over the classical channel while revealing minimal parity information.
- Toeplitz Matrix Hashing: Alice and Bob publicly agree on a random Toeplitz matrix $T$ of dimensions $M times N$ ($M < N$). Multiplying the reconciled key by $T$ compresses the bit string, destroying Eve's partial correlation while preserving identical shared secrets between Alice and Bob.
8. Physical Implementation Platforms & Real-World Deployments
Since its theoretical inception in 1984, QKD has evolved from desktop laboratory demonstrations into continental-scale metropolitan quantum optical networks and satellite-to-ground quantum communications links:
- Phase and Time-Bin Encoding in Optical Fiber: Standard single-mode telecom fiber ($1550text{ nm}$ low-loss window) cannot reliably maintain photon polarization due to thermal birefringence fluctuations. Practical commercial fiber QKD networks (such as ID Quantique, Toshiba, and Qunnect) utilize Phase Encoding with asymmetric Mach-Zehnder interferometers (MZIs) or Time-Bin Qubit Encoding, where bit values 0 and 1 correspond to early and late photon wavepacket arrival times.
- Satellite-to-Ground Free-Space Links: Atmospheric absorption drops precipitously in the optical window ($800text{ nm}$ and $1550text{ nm}$), and the vacuum of space exhibits zero birefringence and zero attenuation. In 2017, the Chinese Academy of Sciences satellite Micius established intercontinental entanglement-based BB84 and decoy-state QKD between Xinglong (China) and Graz (Austria) over a distance of $7,600text{ kilometers}$, demonstrating global quantum key distribution.