Marin Ivezic
Most engineers meet quantum key distribution through BB84, and most stay there. Alice prepares single photons in randomly chosen polarization states, Bob measures them in randomly chosen bases, the two of them compare bases over a public channel, and the bits where the bases agreed become the key. It is a clean mental model and it covers the large majority of deployed systems.
Entanglement-based QKD rearranges that picture in a way that changes what you have to trust. Nobody prepares a state and sends it. A source emits pairs of entangled photons, one photon of each pair travels to Alice and the other to Bob, and the key comes out of measurements that neither party controls. Both of them get random bits. The bits happen to match.
That rearrangement is not cosmetic. It moves the source out of the trust boundary, it opens the door to security models where the hardware itself can be untrusted, and it makes the whole class of protocols the natural substrate for multi-node quantum networks. It also costs you: lower key rates, harder synchronization, and a bill of materials that is heavier at both ends of the link.
We walk through the two protocols that define the category – E91 and BBM92 – what separates them, and what an entangled-pair link actually demands of the engineer who has to run one.
Two ways to build a quantum key
Quantum key distribution is a method for two parties at different locations to arrive at the same secret bit string, using a quantum channel that anyone can listen to, with security resting on measurement physics rather than on a computational assumption. Any measurement of an unknown quantum state disturbs it, so an eavesdropper who reads the channel leaves evidence in the statistics.
In prepare-and-measure QKD – BB84 and its relatives – one party encodes bits into quantum states and transmits them. Alice decides what state each photon is in. That decision is the origin of the key material, which means Alice’s source sits inside the trust boundary. If her source emits two identical photons instead of one, an eavesdropper can keep one and forward the other, learning a bit while introducing no error. Defending against that is why decoy-state methods exist.
In an entanglement-based protocol, no one encodes anything. A source produces photon pairs in an entangled state and sends one photon to each party. An entangled state is a joint state of two particles that cannot be written as a state for the first particle combined with a state for the second – the pair has properties the individual photons do not. Alice measures her photon and gets a random result. Bob measures his and gets a random result. Neither result was decided by anybody, and yet the two results are correlated in a way that no arrangement of pre-agreed classical instructions could reproduce.
That last clause is the whole story, and it is worth being careful about it, because it is what separates entanglement-based QKD from a very good classical imitation.
The correlation that does the work
Write the polarization singlet state, one of the four Bell states, as:
|Ψ⁻⟩ = (1/√2)(|H⟩ₐ|V⟩ᵦ − |V⟩ₐ|H⟩ᵦ)
Read in words: the pair is in a superposition of “Alice’s photon horizontal, Bob’s vertical” and “Alice’s vertical, Bob’s horizontal,” with no fact of the matter about which until someone measures. When Alice and Bob both measure in the horizontal/vertical basis, they always get opposite results. Each individual outcome is uniformly random. The anti-correlation is perfect.
Perfect correlation alone is not remarkable. Two envelopes prepared in advance, one containing a 0 and one containing a 1, produce perfect anti-correlation, and an eavesdropper who prepared the envelopes knows both bits. The distinguishing feature of entanglement shows up when Alice and Bob measure along different axes.
For the singlet state, the correlation between a measurement at angle α on Alice’s side and angle β on Bob’s is:
E(α, β) = −cos[2(α − β)]
where E is defined as the probability of matching outcomes minus the probability of differing outcomes, with results treated as ±1. At α = β the expression gives −1, the perfect anti-correlation above. At a 45° offset it gives 0, no correlation at all. In between it varies smoothly with the cosine.
Those intermediate values are where the physics bites. A set of pre-agreed instructions – each photon carrying a hidden list of what to output for every possible measurement angle – cannot reproduce that cosine curve across all angle pairs. This is Bell’s theorem, and it is testable.
What a Bell test actually measures
The standard test is the CHSH inequality, named for Clauser, Horne, Shimony, and Holt. Alice picks between two measurement settings, a and a′. Bob picks between b and b′. The four resulting correlations combine into a single number:
S = E(a, b) + E(a, b′) + E(a′, b) − E(a′, b′)
Any theory in which each photon carries pre-existing values for all four settings, and in which Alice’s choice cannot influence Bob’s outcome, forces |S| ≤ 2. That bound has no free parameters and does not depend on what the hidden values are.
Quantum mechanics violates it. Choose the angles well – a 45° separation between each party’s two settings, and 22.5° between the two parties’ reference axes – and the singlet state gives S = 2√2, about 2.828. That figure is the maximum any quantum state can reach, and it is the number every Bell experiment is measured against.
For a cryptographer, the useful property is this: S is a measurement, not an inference. Alice and Bob compute it from data they collected. If S comes out above 2, no pre-arranged classical scheme can account for what they saw, which means no eavesdropper handed them correlated bits she also holds a copy of. If S comes out at or below 2, the correlations are consistent with a classical source, and the parties learn nothing about whether their bits are private.
The amount of violation carries quantitative weight too. S close to 2√2 bounds an eavesdropper’s information tightly; S barely above 2 bounds it loosely. Security proofs in this family turn the observed S into a secret-key rate, so a better violation directly buys more key.
E91: Ekert’s protocol
Artur Ekert published the first entanglement-based QKD scheme in 1991. Its distinguishing move is that the security check is a Bell test.
Pair generation. A source produces a stream of photon pairs in the singlet state and sends one photon of each pair down a channel to Alice and the other to Bob. The source may be operated by a third party. It may, in principle, be operated by the adversary.
Random measurement. Each party has three measurement settings rather than two. In Ekert’s formulation Alice chooses among 0°, 45°, and 90°; Bob among 45°, 90°, and 135°. For each incoming photon, each party selects a setting at random and records the binary outcome.
Basis announcement. Over an authenticated public channel, Alice and Bob compare which setting they used for each pair, revealing settings and withholding outcomes. Authentication matters here and is easy to skip past in a first reading: without it, an adversary can impersonate one party during the classical phase and the quantum security is irrelevant.
Splitting the data. The settings sort the events into two piles. Where Alice and Bob happened to use the same angle – 45° with 45°, or 90° with 90° – the outcomes are perfectly anti-correlated and become key material, with one party flipping their bits so the two strings agree. Every other combination of settings goes into the second pile and is never used for key.
The second pile is the security budget. Those mismatched-angle events are exactly the measurements the CHSH test needs, and the protocol spends the majority of its detected pairs on them. The sifting efficiency of E91 is therefore low by design: most pairs test the channel rather than key it.
The test. Alice and Bob compute the four correlation terms from the mismatched-setting data and evaluate S. On an undisturbed singlet channel with good optics, they expect a value approaching 2√2. If S lands above their pre-agreed threshold, they proceed. If it does not, they abort. There is no partial credit and no negotiation: a channel that fails the Bell test yields no key.
Ekert’s paper was a blueprint rather than a specification. It did not supply a full account of how much key survives a partial violation, and the security analysis that fills that gap arrived over the following two decades. What it did supply is the idea that has shaped the field since: if the observed statistics violate a Bell inequality, the conclusion holds regardless of what is inside the measurement boxes. That is the seed of device independence.
BBM92: the same job with an error check
A year later, Bennett, Brassard, and Mermin published a paper whose title states its thesis – quantum cryptography without Bell’s theorem. Their protocol keeps the entangled source and drops the Bell test, replacing it with the error-rate check that BB84 already used.
The source. Photon pairs are generated in a Bell state, commonly |Φ⁺⟩ = (1/√2)(|H⟩ₐ|H⟩ᵦ + |V⟩ₐ|V⟩ᵦ), where both photons share the same polarization rather than opposite ones. Either a central node or one of the two parties may operate the source.
Two bases, not three. Alice and Bob each choose at random between the rectilinear basis (horizontal/vertical) and the diagonal basis (45°/135°). The |Φ⁺⟩ state has a property that makes this work: it takes the same form in the diagonal basis as in the rectilinear one. Measure both photons diagonally and the outcomes match, exactly as they do rectilinearly. Two bases, correlated results in each.
Sifting. After measurement, the parties announce bases and discard every pair where the bases differed. Since each party chooses independently between two options, about half the detected pairs survive. Sifting – the discarding step – is where entanglement-based and prepare-and-measure protocols look most alike.
Raw key. For the surviving pairs, Alice’s and Bob’s outcomes agree. They apply an agreed mapping from measurement result to bit value and now hold two strings that should be identical.
The error check. Instead of computing S, they sacrifice a random sample of the sifted bits and compare them publicly. The fraction that disagree is the quantum bit error rate, or QBER. On a well-built link with no adversary, QBER comes from optics and detector noise and sits at a low single-digit percentage. An eavesdropper drives it up.
The arithmetic of the simplest attack is worth working through, because it shows where the 25% figure that circulates in QKD writing comes from. Suppose the adversary intercepts the photon heading to Bob, measures it in a basis she picks at random, and forwards a fresh photon in whatever state she found. Half the time she guesses the basis Alice and Bob will use, and her intervention leaves no trace in those events. The other half of the time she measures in the wrong basis, which collapses the state along the wrong axis and makes Bob’s subsequent result uncorrelated with Alice’s – so those events disagree half the time. Half of a half is a quarter. A full intercept-resend attack shows up as roughly 25% QBER, which no honest link produces and no post-processing can survive.
If the sampled error rate sits below the protocol’s threshold, the remaining bits go forward. If it sits above, the parties abort.
What the two protocols are actually trading
They distribute the same physical resource and extract key from it in nearly the same way. The difference is in what the security check certifies.
A Bell violation certifies that the correlations are non-classical. That is a statement about the physics of the data, and it holds whatever hardware produced it. A low QBER certifies that Alice’s and Bob’s outcomes agree. That is a weaker statement, because classically correlated bits also agree.
Consider an adversary who replaces the entangled source with a device that emits pairs of identical, classically correlated photons in a basis she chooses. In BBM92 she has a problem: she does not know in advance which basis Alice and Bob will pick, and her scheme produces errors whenever they pick the one she did not prepare. The error check catches her. But the catch depends on Alice’s and Bob’s basis choices being private and random, and on their measurement devices behaving as specified. Those are assumptions about hardware.
In E91, the Bell test can remove that dependency, provided the test is loophole-free. Classically correlated bits cannot produce S > 2 by any arrangement, so a substituted source fails a loophole-free test whatever it emits. Short of that, an implementation that leaves the detection or locality loophole open can be spoofed by devices that fake a violation, and the security argument falls back on assumptions about the hardware.
Three practical consequences follow.
Source trust. Neither protocol needs a trusted source in the way BB84 needs a trusted transmitter, and this is the concrete advantage entanglement buys. A telecom operator can sit in the middle of a link, run the entangled source as a service, and learn nothing about the resulting key. E91 makes that guarantee testable in the data. BBM92 makes it contingent on the error check plus a set of device assumptions.
Device trust. BBM92, like BB84, is a device-dependent protocol: the security analysis assumes the detectors detect what they claim to and the basis selectors select what they claim to. E91 points beyond that, and the device-independent protocols discussed below make that point rigorous.
Efficiency. BBM92 turns roughly half its detected pairs into key. E91 spends most of its pairs on the Bell test. Since detected pairs are the scarce resource on any real link, that ratio dominates throughput, and it is the main reason that most experiments described as “entanglement QKD” run BBM92 rather than a literal Bell-test protocol.
From raw bits to a usable key
Both protocols leave the parties holding correlated strings that are not yet a key. Two classical steps finish the job, and they are identical across every QKD protocol in use.
Error correction reconciles the residual mismatches between Alice’s string and Bob’s, using an exchange over the public channel. This leaks information: whatever the parties say publicly, the adversary hears.
Privacy amplification then compresses the reconciled string into a shorter one, using a hash function chosen from a suitable family, such that the adversary’s remaining knowledge is driven to a negligible level. How much compression is required is set by the observed statistics – the QBER in BBM92, the Bell parameter in E91 – and by the leakage from error correction. Better statistics mean less compression and more final key.
The point that matters operationally: the security analysis treats every observed error as if an adversary caused it, whatever its actual origin. A noisy detector and an eavesdropper are indistinguishable to the protocol, and both are paid for out of the same budget. On an entangled link, that is a demanding constraint, because entangled links have more sources of error than prepare-and-measure links do.
Where the photons come from
Almost every deployed entangled source uses spontaneous parametric down-conversion, SPDC: a pump laser illuminates a nonlinear crystal, and occasionally one pump photon converts into two lower-energy photons that are entangled in polarization, or in time, or in both. The process is spontaneous, which is the source of most of the engineering difficulty.
Emission is probabilistic. There is no way to command a pair. Raising the pump power raises the pair rate, and it also raises the probability of two pairs emerging close enough together in time to be confused for one. Multi-pair events generate accidental coincidences – detections at Alice and Bob that get paired up but did not come from the same emission – and those show up as QBER, consuming security budget. Every SPDC-based link therefore runs at a pump power that balances rate against multi-pair contamination, and that balance point moves with channel loss.
Because pairs arrive at random times, both parties must independently timestamp every detection and then agree on which of Alice’s detections belongs with which of Bob’s. Detections falling within a coincidence window – a timing gate typically on the order of hundreds of picoseconds to a few nanoseconds – are treated as one pair. Coincidence identification requires clock distribution between the two sites with sub-nanosecond stability, and it requires detectors whose timing jitter is small compared to the window. Widen the window and you catch more true pairs and also more accidental ones. Narrow it and you lose true pairs to jitter. That tradeoff is the entangled-link equivalent of choosing a decoy-state configuration.
Wavelength matters as well. Fiber loss is lowest near 1550 nm, so a source that emits directly in the telecom band avoids the losses and complexity of frequency conversion. Sources built on other platforms – quantum dots, atomic ensembles, integrated photonic ring resonators – are active research areas, with the integrated approaches aiming at pair generation on a chip rather than on an optical table.
Detection is the budget line
An entangled link needs single-photon detectors at both ends. That single fact reshapes the cost model against BB84, where a transmitter and one detector unit will do.
Two technologies dominate. Superconducting nanowire single-photon detectors reach detection efficiencies above 80% at telecom wavelengths with very low dark-count rates and excellent timing resolution, which is why they appear in nearly every distance or rate record. They also require cryogenic cooling, which means a cryostat, a power budget, and a maintenance regime at each site. InGaAs avalanche photodiodes operate with thermoelectric cooling, cost far less, and deliver considerably lower efficiency with higher dark counts and afterpulsing.
The choice propagates through everything. Coincidence rate scales with the product of the two detection efficiencies, so a link with 20% detectors at each end registers a coincidence for roughly 4% of the pairs that arrive, before channel loss is counted. Halving detector efficiency roughly quarters the key rate. Dark counts set the noise floor, and at high channel loss the dark-count rate rather than the pair rate determines the maximum usable distance, because a detection that came from thermal noise rather than from a photon is an error the security analysis must pay for.
What the distance limit really is
Standard telecom fiber attenuates around 0.2 dB per kilometer at 1550 nm. Over 100 km that is roughly 20 dB, so about one photon in a hundred survives. On an entangled link both photons have to survive, so the loss applies twice across the two arms.
Entanglement has been distributed in fiber over distances well past 200 km in laboratory conditions. Those results establish that the physics scales; they do not establish a usable link, because at that loss the coincidence rate falls to a level where accumulating enough data for a secure key takes impractically long. The working range for a fiber link that produces key at a useful rate is considerably shorter, in the metropolitan and inter-city band.
Free space behaves differently. There is no exponential absorption, only diffraction spreading, atmospheric turbulence, and background light. That changes the scaling enough to make satellite links viable. In 2017, Yin and colleagues reported in Science that the Micius satellite had distributed entangled photon pairs to two Chinese ground stations separated by roughly 1,200 km, sending one photon of each pair to each station, and that the two ground stations observed a Bell violation (Yin et al., Science 356, 1140). The total channel loss was severe – in the range of tens of decibels – and the resulting rate was correspondingly low. What the experiment established is the property that makes it interesting for network design: because the security rests on the observed Bell violation between the two ground stations, the satellite itself does not have to be trusted.
That property is the answer to a real deployment problem. Long-haul QKD networks today bridge distance with trusted nodes: intermediate stations that terminate one QKD link, decrypt the key, re-encrypt it under the next link’s key, and forward it. Each trusted node holds the key in the clear, so each one is a site that must be physically secured and organizationally trusted. A network built on entanglement distribution, with entanglement swapping at intermediate nodes and quantum memory to hold states while swaps complete, would carry the key end to end and remove that requirement. That is the quantum-repeater programme, and it is not yet available: reliable quantum memory at telecom wavelengths remains an open problem. Until it arrives, the trusted-node architecture is what long-haul networks have.
Two ways to stop trusting your hardware
E91’s device-independence idea produced two protocol families that address the practical attack surface directly.
Measurement-device-independent QKD (MDI-QKD) targets detectors, which are the component most successfully attacked in the QKD literature – detector blinding, timing side channels, and related hardware exploits have broken real deployed systems without breaking any physics. In MDI-QKD, Alice and Bob both send states to a central node, conventionally called Charlie, who performs a joint measurement on the arriving photons. A successful joint measurement is an entanglement swap: it projects Alice’s and Bob’s systems into a correlated state without revealing which correlated state’s individual outcomes are which. Charlie announces success or failure and learns nothing about the key bits. A hostile Charlie can refuse to cooperate, which is a denial of service; he cannot extract key. Every detector in the system sits outside the trust boundary. MDI-QKD has been demonstrated repeatedly and its cost is key rate, which falls faster with distance than in a direct link.
Device-independent QKD (DI-QKD) is Ekert’s original ambition made rigorous. The devices are black boxes. Alice and Bob feed in setting choices, read out results, compute S, and if the violation is strong enough they extract key – with no assumption about what the boxes contain or who built them. The requirement is a loophole-free Bell test, meaning the experiment must close the detection loophole (enough of the emitted pairs are actually detected that the observed sample cannot be unrepresentative) and the locality loophole (the two measurement events are spacelike separated). Loophole-free Bell violations were first achieved in 2015, by Hensen and colleagues at Delft (Hensen et al., Nature 526, 682), and independently that year by the Giustina group in Vienna and the Shalm group at NIST. Turning them into key generation at a useful rate requires detection efficiency and noise performance beyond what most deployments can reach, and demonstrations remain at short range and low rate.
The protocols are worth thinking of as a sequence. BB84 assumes a trusted transmitter and trusted detectors. BBM92 can run on an untrusted entangled source, and it still assumes the measurement devices behave as specified. MDI-QKD removes trust in the measurement devices, and DI-QKD removes trust in both state preparation and measurement, provided the link can sustain a loophole-free Bell test. Each step buys security assumptions and costs rate, and entanglement is the resource that makes each step possible.
What this means if you are specifying a link
A few conclusions follow directly from the above, and they are the ones worth carrying into a design review.
If the requirement is high key rate over a single point-to-point span of moderate length, prepare-and-measure QKD with decoy states is the mature answer and entanglement will not beat it. The rate gap is real and it is not closing quickly.
If the requirement involves a source you do not control – a carrier-operated node, a shared facility, a link that crosses an administrative boundary – entanglement changes the trust argument in a way that has no prepare-and-measure equivalent. The source can be untrusted, and with a loophole-free Bell test that claim is verified in the data rather than asserted in a contract.
If the requirement is a network rather than a link, entanglement is the only architecture that eventually removes trusted nodes, and it is the only one that supports multi-party key agreement from a single distributed state rather than from a chain of pairwise links.
And if you are budgeting: detectors at both ends, cryogenics if you want the efficiency, sub-nanosecond clock distribution between sites, and a coincidence-window and pump-power configuration that has to be tuned for the specific loss on your fiber. We recommend settling detector efficiency first, because coincidence rate scales with the product of the two efficiencies, and the pump power and window then get tuned around whatever that choice leaves you. None of these appear in a BB84 bill of materials. They are what the security model costs.
Entanglement-based QKD is behind prepare-and-measure QKD on rate and maturity, and it is ahead on trust model and network scalability. That has been true for a decade and both halves of it are still true. Which side of the trade matters depends entirely on what you are building.
Where to go deeper
Entanglement distribution, coincidence detection, Bell-test verification, and the trusted-node problem are the load-bearing topics in quantum network engineering, and they sit inside a larger design space that includes repeater architectures, quantum memory, network topology, and integration with classical infrastructure.
The Certified Quantum Network Engineer (CQNE) program at Quantum Academy covers that space in engineering detail: entangled source characterization, link budgeting, coincidence timing, protocol selection against a stated trust model, and the architectural decisions that determine whether a quantum network needs trusted nodes or can eventually do without them. It is built for engineers who need to specify and operate this equipment rather than read about it.
For the other half of the quantum-security problem – the post-quantum algorithms that protect data without a quantum channel – PostQuantum.com carries extended coverage. For how quantum network engineering fits into a broader career path, QuantumCareers.com covers roles across the field.