BB84 Quantum Key Distribution

Overview

BB84 is the first and most widely deployed quantum key distribution protocol. It lets two parties, Alice and Bob, generate a shared secret key by exchanging single photons, in such a way that any eavesdropper unavoidably disturbs the photons and is detected. The key can then be used with a one-time pad or a symmetric cipher.

The security rests on physics rather than on computational assumptions. Unlike RSA, BB84 would remain secure even against an attacker with unlimited computing power, including a quantum computer, provided the implementation is sound and the classical communication is authenticated.

The problem it solves

Establishing a shared secret encryption key between two parties in a way that reveals any eavesdropping attempt.

History and background

Charles Bennett of IBM and Gilles Brassard of the University of Montreal presented the protocol at a conference in Bangalore, India, in December 1984. It was inspired by Stephen Wiesner's unpublished idea of quantum money from around 1970. The first working demonstration, in 1989, sent photons over about 32 centimeters of free air in a laboratory at IBM.

A formal security proof came in 2000 from Peter Shor and John Preskill, who showed BB84 is secure against any attack as long as the error rate is below about 11%. Practical weaknesses were found and fixed, notably photon-number-splitting attacks on weak laser pulses, which decoy-state methods of Hwang in 2003 and Lo, Ma, and Chen in 2005 overcame. Networks followed, including the 2,000-kilometer Beijing to Shanghai backbone and the Micius satellite in 2017, and commercial systems from ID Quantique and Toshiba.

How it works

Encodes key bits in the polarization of single photons; any attempt to intercept and measure them disturbs the quantum state in a detectable way, revealing eavesdropping.

The protocol uses the fact that measuring a quantum state in the wrong basis gives a random result and disturbs the state. Photons can be encoded in two bases, such as horizontal and vertical polarization, or diagonal polarizations at 45 degrees. Within one basis the two states are perfectly distinguishable, but states from different bases are not.

Alice sends each bit in a randomly chosen basis. Bob measures each photon in a randomly chosen basis. When the two bases happen to agree, Bob gets Alice's bit exactly, and when they differ, his result is random. They then publicly compare which bases they used, but not the bit values, and keep only the cases where the bases agree.

An eavesdropper, Eve, does not know the basis for each photon. If she measures and resends photons, she guesses the wrong basis half of the time, and when Bob later uses the correct basis, he gets the wrong bit one quarter of the time. By comparing a random sample of their key, Alice and Bob estimate the error rate and detect her presence.

Step by step

1. Alice generates a random bit string and a random sequence of bases, rectilinear or diagonal, and sends each bit as a single photon prepared accordingly.
2. Bob measures each incoming photon in a randomly chosen basis and records the results.
3. Over a public authenticated channel, Alice and Bob announce their bases for each photon, and keep only the positions where the bases match, called the sifted key.
4. They reveal a random subset of the sifted key to estimate the quantum bit error rate. If it exceeds a threshold, they abort.
5. They run an error-correction protocol, such as Cascade or low-density parity-check codes, over the public channel to make their keys identical.
6. They apply privacy amplification, a hash function that compresses the key and removes any partial information Eve may have, to obtain the final secret key.

A worked example

Alice sends eight photons with bits 1, 0, 1, 1, 0, 0, 1, 0 in bases R, D, D, R, R, D, R, D. Bob measures in bases R, R, D, D, R, D, D, D. They compare bases and find that positions 1, 3, 5, 6, and 8 match, so the sifted key is formed from Alice's bits at those positions, namely 1, 1, 0, 0, 0, and Bob has the same values if no one interfered.

Suppose Eve intercepts and measures every photon in random bases. About half of the time she chooses the wrong basis and, in those cases, Bob's matching-basis measurements are wrong half of the time. The result is a quantum bit error rate of about 25% in the sifted key, which is far above the threshold and reveals her presence.

Complexity and resources

What hardware it needs

• A source of single photons or weak laser pulses with decoy states, and modulators to prepare polarization or time-bin states.
• Single-photon detectors, such as avalanche photodiodes or superconducting nanowire detectors.
• An authenticated classical channel, which in practice uses a short pre-shared key or a signature scheme.

Applications

• Securing links between data centers, government sites, and banks.
• Long-distance links through satellites and trusted-node networks.
• Generating keys for use with symmetric encryption and one-time pads.
• Research platform for quantum networking and metrology.

Limitations and caveats

• Key rates drop sharply with distance because photons are lost and cannot be amplified, so long links need trusted nodes or repeaters.
• Implementation flaws, such as detector side channels, have been exploited in attacks on commercial devices.
• QKD authenticates the channel but not the endpoints, and it needs specialized hardware, so it is costly.
• Several national security agencies, including the US NSA and the UK NCSC, recommend post-quantum cryptography instead of QKD for most uses.

Common misconceptions

• BB84 does not stop eavesdropping, it detects it. Alice and Bob discard a compromised key.
• It does not transmit a message. It generates a shared random key that is used with a cipher.
• It is not unbreakable in practice, since real devices have imperfections that attackers can exploit.

How it compares

• E91 uses entangled pairs and Bell tests, and BBM92 shows it is equivalent to BB84 in an entanglement-based form.
• The six-state protocol adds a third basis and tolerates a higher error rate.
• Post-quantum cryptography is a software-only alternative that relies on computational hardness instead of physics.

Real-world impact

Commercially deployed today in specific high-security contexts (banking, government); the conceptual foundation for all quantum cryptography that followed.

Why it matters

BB84 launched the field of quantum cryptography and is the most mature quantum technology on the market. It shows that quantum mechanics can supply security guarantees that mathematics alone cannot.

It also illustrates the gap between theory and practice. The protocol is provably secure, while real systems must resist side-channel attacks, which is why standards bodies certify devices and why QKD is just one tool among several for the quantum era.

Frequently asked questions

Keep learning

• Related algorithm: E91 Quantum Key Distribution
• Related algorithm: Six-State Quantum Key Distribution (Bruß Protocol)
• Related algorithm: Device-Independent Quantum Key Distribution
• Related algorithm: Quantum Teleportation Protocol

This page is written for educational purposes. Complexity statements describe the best known results at the time of review (September 30, 2026), and research in this area moves quickly, so check recent papers before relying on a specific bound.

← Back to Algorithms Database