In 1992, eight years after introducing BB84 with Gilles Brassard, Charles Bennett published a streamlined quantum key distribution protocol that needed only two non-orthogonal quantum states instead of four. He called it B92. The protocol's elegance lies in its minimalism: two states, two measurements, and a security argument that follows from a simple geometric fact about non-orthogonal quantum states. B92 is less commonly deployed than BB84, but understanding it sharpens intuition for what is and is not necessary in QKD design and reveals trade-offs that matter when implementing real systems.
Why B92 Matters
Picture two friends communicating with a code that uses only two symbols. They need a way to share that code without an eavesdropper learning it. BB84 used four states across two bases. Bennett asked: do we really need four? What if we just used two non-orthogonal states, where the geometry makes them impossible to perfectly distinguish? The answer was B92, a protocol that is simpler to implement but with subtle security trade-offs.
The 1992 paper
Charles Bennett published "Quantum cryptography using any two nonorthogonal states" in Physical Review Letters 68, 3121-3124, on May 25, 1992. The paper proved that any pair of non-orthogonal quantum states can be used as the basis for a QKD protocol, and gave a concrete two-state implementation.
The Setup
Imagine two photon polarizations: one horizontal (0 degrees) and one diagonal (+45 degrees). These two states are not orthogonal; in fact, the inner product between them has magnitude 1/sqrt(2). Quantum mechanics tells us that no measurement can perfectly distinguish them. This indistinguishability is the security primitive of B92.
The two states
| Bit value | Polarization state |
|---|---|
| 0 | Horizontal (0 deg) |
| 1 | Diagonal (+45 deg) |
The angle between the two states is 45 degrees, so the overlap is cos(45 deg) = 1/sqrt(2). Any single-shot measurement gives at most 1/2 probability of distinguishing them correctly above chance.
How B92 Works
A safety inspector tries to distinguish two similar-looking parts. Each part is so close to the other that the inspector's tests sometimes fail to give a definitive answer. When the inspector does get a definitive answer, however, the answer is reliable. B92 turns this conditional reliability into a key-agreement protocol.
Step by step
- Alice generates a random bit string. For each bit, she encodes a photon in one of the two non-orthogonal states (horizontal for 0, diagonal for 1) and sends it to Bob.
- For each photon Bob receives, he randomly chooses one of two measurement bases:
- Vertical (90 deg) basis: triggers a "1" detector if the photon is diagonal, otherwise gives no result.
- Anti-diagonal (-45 deg) basis: triggers a "0" detector if the photon is horizontal, otherwise gives no result.
- About half the time, Bob's measurement gives a conclusive result. About half the time, his measurement is inconclusive (the photon falls into the orthogonal complement of his measurement state).
- Bob announces over a public authenticated channel which photons gave conclusive results, but not what those results were.
- Alice and Bob keep only those photons. The kept bits should match exactly in the absence of noise and Eve.
- They compare a small random subset of the kept bits over the public channel to estimate the error rate.
- If error rate is low, the remaining bits go through error correction and privacy amplification to produce a shared secret key. If high, abort.
The protocol's elegance: only two states, two measurements, and a single classical announcement of which measurements were conclusive.
Why B92 Is Secure
A locksmith protects a vault by using a key that cannot be perfectly copied. B92 protects against eavesdropping by using states that cannot be perfectly distinguished. If Eve tries to measure each photon, she introduces errors because her best measurement strategy still has 50 percent ambiguity.
The security argument
Suppose Eve performs the optimal measurement that minimizes her detection of "wrong" outcomes. Even with this optimal strategy, she introduces errors detectable by Alice and Bob. Specifically, if Eve uses the same measurement strategy as Bob (which is in fact provably optimal in this single-photon setting), she gains some information but increases the error rate on Bob's measurements. Privacy amplification accounts for this.
The detailed security proofs (Mayers 1996, Inamori 2005, Tamaki-Lutkenhaus 2004) handle the various attack strategies. The bottom line: for typical QBER below ~6 percent, B92 supports secure key extraction. The threshold is lower than BB84's ~11 percent.
Trade-offs vs BB84
A simpler tool with fewer parts is often easier to maintain but might lack features. B92 trades simplicity for security margin and key rate.
Comparison
| Aspect | BB84 | B92 |
|---|---|---|
| Number of states | 4 (two bases) | 2 (one orientation each) |
| Number of measurements | 2 | 2 |
| Sift rate (kept fraction) | ~50% | ~50% |
| QBER threshold for secure key | ~11% | ~6.6% |
| Hardware complexity | Higher | Lower |
| Vulnerability to PNS attack | Yes | More so |
B92 has a lower error tolerance because the geometric overlap between the two states leaves less margin for noise before Eve's information becomes too large.
Photon-number splitting
B92 is particularly vulnerable to photon-number-splitting (PNS) attacks because Eve can wait for multi-photon emissions, split off a photon to keep, and forward the rest unchanged. This attack is especially effective for B92 because the simpler state space gives Eve more information per intercepted photon. Decoy-state techniques (Hwang 2003, Lo-Ma-Chen 2005) developed primarily for BB84 also help with B92, but the protocol's security margins are tighter.
Hardware Demonstrations
A model train demonstrates basic engineering principles before a real train is built. B92 has been demonstrated on photonic quantum hardware since the early 1990s, with the original Bennett group prototypes establishing feasibility.
Notable experiments
- Bennett-Bessette-Brassard-Salvail-Smolin 1992 (the original BB84 prototype was extended to B92 implementations).
- Various photonic chip demonstrations through the 2000s.
- Modern integrated-photonics demonstrations on silicon and lithium niobate chips.
B92 is rarely deployed commercially. Most QKD vendors (Toshiba, ID Quantique, QuintessenceLabs) use BB84 or its decoy-state variants, valuing the higher error tolerance and better PNS robustness.
When B92 Is the Right Choice
A specialty tool finds its place when the trade-off matches the use case. B92 is preferred when:
- Hardware simplicity matters more than maximum key rate or robustness.
- The channel has very low intrinsic noise (so the lower QBER threshold is not a problem).
- The deployment is a research or educational demonstration rather than production.
- Integrated-photonics chips need fewer optical components.
For high-stakes commercial or government deployments, BB84 with decoy states and finite-key analysis remains the default.
B92 and Modern QKD Research
Picture an old recipe being remixed for new ingredients. B92 has inspired a family of related protocols that emphasize minimal state spaces.
Variants and extensions
- Six-state protocol (Bruss 1998): uses three bases for tighter security margins, in the opposite direction from B92's minimalism.
- Coherent one-way (COW) protocol: a B92-inspired protocol designed for fiber-optic deployments by ID Quantique.
- Differential phase shift (DPS): a phase-encoded protocol with B92-like simplicity.
- Reference-frame-independent QKD: builds on B92 ideas to remove the need for Alice and Bob to share polarization references.
These variants are deployed in specific commercial and research contexts where their particular trade-offs match the deployment.
B92 vs Post-Quantum Cryptography
The NSA Cybersecurity Advisory on QKD applies to B92, BB84, E91, and SARG04 alike: specialized hardware, distance limits, authentication requirements, hardware attack history, and network-scaling difficulties. B92's particular vulnerabilities (lower QBER tolerance, PNS sensitivity) make it less suitable for deployments where these factors matter.
For users who need quantum-resistant cryptography for files, communications, or authentication, post-quantum cryptography (PQC) is the right tool. PQC works with existing hardware, scales globally, and provides authentication. QNSQY ships ML-KEM, ML-DSA, SLH-DSA, FN-DSA, HQC, and LMS in hybrid mode with X25519 and Ed25519 to deliver this.
Why hybrid mode
Hybrid combinations protect against both classical and quantum attacks, even if either component is later broken. The NIST-standardized PQC primitives have undergone years of analysis, and hybrid composition reduces dependency on any single algorithm. This is a different security model from QKD's information-theoretic argument but is more practical for general deployment.
Frequently Asked Questions
Is B92 less secure than BB84?
B92 is information-theoretically secure under reasonable hardware assumptions, but it has a lower QBER threshold and weaker resistance to photon-number-splitting attacks. In practice this means B92 deployments need more careful hardware engineering, especially for fiber distances where channel noise is non-negligible.
Why is B92 not deployed commercially as much as BB84?
The reduced error tolerance and PNS sensitivity make B92 less suitable for fielded systems, where channel imperfections eat into the security margin. Commercial vendors prefer BB84 with decoy states for its larger margin and better PNS robustness.
Can B92 be combined with decoy states?
Yes. Decoy-state methods originally developed for BB84 generalize to B92, and recent papers have analyzed B92 with decoy states. The combination improves PNS resistance but does not fully match BB84-decoy in all metrics.
Does B92 require a single-photon source?
Like BB84, B92 ideally uses single-photon sources but in practice uses attenuated coherent laser pulses. The PNS vulnerability is more severe for B92 in this practical setting, which is why decoy states are particularly important.
Does QNSQY use B92 or any QKD primitive?
No. QNSQY is post-quantum cryptography software using NIST-standardized algorithms. It does not require quantum hardware or quantum channels. The security model differs from QKD's: QNSQY relies on computational hardness assumptions vetted by NIST and the cryptographic community, combined in hybrid mode with classical primitives.
Why use only two non-orthogonal states instead of four?
The fundamental observation behind B92 is that quantum mechanical security comes from non-orthogonality, not from the number of states. Two non-orthogonal states are sufficient to make perfect discrimination impossible, which is the heart of QKD. Bennett's 1992 paper proved that this minimal version retains secure key extraction, demonstrating the protocol's elegant minimality.
How does B92 handle measurement noise from real hardware?
B92 has a lower QBER threshold (~6.6%) than BB84 (~11%), so real-world hardware noise eats into the security margin faster. Practical B92 deployments need very low channel noise, careful calibration, and often shorter channel distances than comparable BB84 systems. This noise sensitivity is one reason commercial QKD vendors prefer BB84 with decoy states.
What did the original B92 hardware look like?
The first B92 demonstrations used attenuated laser sources and standard polarization optics. A laser pulse, attenuated to the single-photon level, passed through a polarization rotator that selected horizontal or diagonal polarization based on a random bit. Bob's receiver consisted of two single-photon detectors behind appropriately oriented polarizers. The simplicity of this setup is part of B92's appeal for compact integrated implementations.
Sources
- Bennett, C. H. "Quantum cryptography using any two nonorthogonal states." Physical Review Letters 68, 3121-3124, 1992.
- Bennett, C. H., Brassard, G. "Quantum Cryptography: Public Key Distribution and Coin Tossing." IEEE ICCSSP 1984 / Theoretical Computer Science 560, 7-11, 2014.
- Tamaki, K., Lutkenhaus, N. "Unconditional security proof of the Bennett 1992 quantum key-distribution protocol." Physical Review A 69, 032316, 2004.
- Hwang, W.-Y. "Quantum Key Distribution with High Loss: Toward Global Secure Communication." Physical Review Letters 91, 057901, 2003.
- Lo, H.-K., Ma, X., Chen, K. "Decoy State Quantum Key Distribution." Physical Review Letters 94, 230504, 2005.
- NSA. "Quantum Key Distribution (QKD) and Quantum Cryptography (QC) Cybersecurity Advisory." https://media.defense.gov/2021/Aug/04/2002821837/-1/-1/1/Quantum_FAQs_20210804.PDF
- NIST. FIPS 203 / 204 / 205. https://csrc.nist.gov/projects/post-quantum-cryptography
Related Articles
- BB84 protocol explained
- E91 protocol explained
- SARG04 protocol explained
- What is post-quantum cryptography?
- Why quantum threatens classical encryption
Protect Your Data Before Q-Day Arrives
QNSQY's NIST-standardized post-quantum encryption protects files against both current and quantum-era threats.