BB84 Explained: How Quantum Key Distribution Actually Works

The problem BB84 was built for

In December 1984, at a conference in Bangalore, Charles Bennett and Gilles Brassard presented a way for two parties to agree on a shared secret key by sending single photons down a channel. Their paper was titled “Quantum cryptography: Public key distribution and coin tossing.” The protocol took their initials and the year, and it remains the reference design for quantum key distribution (QKD) systems built today.

The problem it addresses is older than public-key cryptography. Gilbert Vernam patented a symmetric cipher in 1919 in which each bit of the message is combined with one bit of key. Claude Shannon proved in 1949 that this construction gives perfect secrecy under three conditions. The key must be truly random, at least as long as the message, and used exactly once. Meet all three and the ciphertext tells an attacker nothing, regardless of the computing power aimed at it.

One difficulty has always spoiled the result. Alice and Bob have to be holding the same random key before they can use it, and moving that key from one to the other is the hard part. Public-key cryptography exists largely as an answer to this. RSA, Diffie-Hellman and the elliptic-curve schemes let two parties negotiate a shared secret across an open channel, and they pay for that convenience with a computational assumption. Factoring and discrete logarithms are believed to be hard. Shor’s algorithm withdraws the assumption for anyone holding a large enough quantum computer.

Symmetric cryptography survives that transition in better shape, though not untouched. Grover’s algorithm gives a quadratic speedup against a symmetric key search, so a 128-bit key offers roughly 64 bits of resistance against an adversary running it. Doubling the key length answers the problem, which is why AES-256 features so heavily in migration guidance.

BB84 approaches key distribution from a different direction. In place of a hard mathematical problem, it uses two properties of quantum measurement.

Two facts about measuring photons

Measurement changes what it measures

Werner Heisenberg’s 1927 uncertainty principle sets a limit on how precisely certain pairs of properties can be known at the same time. This isn’t an instrumentation problem that better engineering will eventually solve. It is a property of the systems themselves.

For BB84, one consequence carries the whole protocol. A photon’s polarisation is prepared in a particular basis, meaning a particular pair of opposed orientations. Read it in a basis that matches, and the answer is deterministic. Read it in a basis that doesn’t match, and the answer is random, and the original polarisation is gone.

An unknown quantum state cannot be copied

James Park stated the result in 1970. William Wootters and Wojciech Zurek published it as “A single quantum cannot be cloned” in 1982, and Dennis Dieks reached the same conclusion independently that year. No device can take an arbitrary unknown quantum state and produce two identical copies of it.

Classical information carries no equivalent restriction. A bit travelling down a wire can be read and duplicated in silence, which is exactly what an optical tap does on a fibre run. That asymmetry is the whole basis of the security argument that follows.

The protocol, step by step

Alice and Bob need two channels. A quantum channel carries the photons. A classical channel, which everyone including the attacker can read, carries the reconciliation traffic.

1. Alice generates two random bit strings. The first is the raw key material. The second decides, photon by photon, whether she encodes in the rectilinear basis or the diagonal basis.
2. Alice transmits. Each bit becomes one photon, polarised according to the bit value and the chosen basis, sent one at a time.
3. Bob measures. For each arriving photon he picks a basis at random, independently of Alice. He records the basis and the result.
4. Both announce bases, and only bases. Over the classical channel, Alice and Bob compare which basis they used for each photon. Neither reveals a measurement outcome.
5. They discard the mismatches. Where the bases differed, Bob’s result is random and worthless, so the bit is dropped. Roughly half the transmission survives. What remains is the sifted key, and in the absence of interference or noise, Alice and Bob hold identical copies of it.
6. They sacrifice a subset to check. A randomly chosen portion of the sifted key is compared openly and then discarded. The disagreement rate on that sample is the quantum bit error rate, or QBER.

Everything up to this point produces a shared string. Turning it into a usable key takes two more stages that summaries of BB84 often skip. Information reconciliation corrects the residual errors between Alice’s copy and Bob’s. Privacy amplification then compresses the reconciled string, shrinking it in proportion to how much an eavesdropper could plausibly have learned. The final key is shorter than the sifted key, and how much shorter depends directly on the measured error rate.

What happens when Eve listens

Consider the simplest attack. Eve intercepts each photon, measures it in a basis of her own choosing, and forwards a fresh photon matching whatever she read. She has no way to know Alice’s bases, since those are announced only after Bob’s detectors have already fired.

Take the bits where Alice and Bob happened to agree on a basis, which are the bits that end up in the sifted key. Eve guessed the same basis half the time, and those photons reach Bob unharmed. The other half she measured in the wrong basis, so the photon she forwards is randomised relative to Bob’s setting, and Bob’s result disagrees with Alice’s half the time. Multiply the two halves and the attack writes a 25 percent error rate into the sifted key.

If you take one number from this section, take that one. It converts eavesdropping from an invisible act into a measurable signal. Compare 20 bits and the chance that every one of them agrees is 0.75 to the twentieth power, about 0.3 percent, so Alice and Bob catch a full intercept-resend attack better than 99 out of 100 times. Compare a few hundred and the attack becomes arithmetically impossible to hide.

Partial attacks leak less and disturb less, and the accounting still holds. Privacy amplification shrinks the final key by an amount tied to the observed error rate, so a quieter attacker buys a smaller share of a key that has already been compressed to compensate. Above a threshold, the exchange yields nothing at all and gets abandoned. Shor and Preskill showed in 2000 that BB84 with one-way post-processing tolerates a QBER up to roughly 11 percent.

What BB84 does not give you

We teach this protocol early in our networking material, and we spend as much time on its boundaries as on its mechanism. Four of them matter operationally.

The classical channel has to be authenticated. Nothing in BB84 stops an attacker from impersonating Bob during the basis comparison and running the protocol twice, once with each party. Preventing that needs either a pre-shared authentication secret or digital signatures. QKD reduces the key management burden rather than eliminating it, and the honest description is key growth rather than key creation.

Distance and rate are physical constraints. Photons in fibre are absorbed, and the no-cloning theorem that secures the protocol also forbids amplifying the signal. Practical fibre links run to a few hundred kilometres at key rates far below classical link speeds. Longer reach today means either trusted relay nodes, which the operator must genuinely trust, or free-space links. The Micius satellite distributed entangled photon pairs to ground stations 1,200 kilometres apart in 2017 (Yin et al., Science, June 2017).

Real hardware leaks. The security proof describes ideal single photons and ideal detectors. Deployed systems use attenuated laser pulses that sometimes contain two photons, and detectors that researchers have blinded with bright light. Decoy-state methods and measurement-device-independent variants close specific holes. Each new implementation still needs its own analysis.

Several agencies advise against it for classified traffic. The NSA’s published position is that it does not recommend QKD or quantum cryptography for securing National Security Systems (NSA, “Quantum Key Distribution (QKD) and Quantum Cryptography (QC)”, 2020, still current at the time of writing), and the UK’s NCSC reached comparable conclusions in its 2020 whitepaper on quantum security technologies. Both point to post-quantum cryptography instead, on grounds of implementation risk, cost, and the authentication dependency above. Engineers evaluating a QKD proposal should be able to state why their use case sits outside that guidance.

Why we put BB84 in the networking curriculum

BB84 is the cleanest available demonstration that a quantum network is a different engineering object from a classical one. Loss can’t be amplified away. Traffic can’t be tapped without leaving evidence. Trust boundaries land at physical nodes rather than at protocol layers. The protocol sits directly upstream of quantum repeaters, entanglement distribution and network architecture, and each of those topics assumes the constraints BB84 makes visible.

Our quantum networking certification program (CQNE) builds from this foundation through link budgets, repeater architectures and the design of production quantum network segments. You can review the curriculum and enrollment options at quantumacademy.com/.