← Back to Blog Cryptography

BB84: The First Quantum Key Distribution Protocol

12 min read

Long before Shor's algorithm threatened RSA, Charles Bennett and Gilles Brassard proposed using the laws of quantum mechanics to solve a much older problem: how can two people share a secret key over a public channel without ever meeting? Their 1984 protocol, called BB84, was the first practical quantum cryptography scheme. Forty-two years later, BB84 is still the foundational protocol of quantum key distribution (QKD), used in fielded systems from Toshiba, ID Quantique, and the Chinese Micius satellite. This piece explains how BB84 works, what it provides, where its limits lie, and why most modern security architectures rely on post-quantum cryptography rather than QKD for the foreseeable future.

Why BB84 Matters

Picture two friends who want to send each other locked diaries. They have only one shared key. If a thief intercepts the key during delivery, the security is gone. Classical key distribution always faces this problem; the laws of computation cannot make a key undetectably eavesdropper-proof. Quantum mechanics has a different answer: any measurement of a quantum system disturbs it. If an eavesdropper tries to intercept and read the key, the disturbance shows up as errors in the legitimate parties' shared bits. BB84 turns this physical fact into a key-agreement protocol.

The 1984 paper

Charles Bennett (IBM) and Gilles Brassard (Universite de Montreal) presented "Quantum Cryptography: Public Key Distribution and Coin Tossing" at the IEEE International Conference on Computers, Systems, and Signal Processing in Bangalore, December 1984. The paper has been republished in Theoretical Computer Science 560, 7-11 (2014). Its core idea: encode bits in quantum states from non-orthogonal bases, and use the no-cloning theorem to detect eavesdropping.

The Setup

Imagine two friends, Alice and Bob, who want to share a secret key. They have a public communication channel (radio, internet, fiber) and a quantum channel (a fiber optic cable carrying single photons or a free-space optical link). They also have an eavesdropper, Eve, who can listen to and even modify the quantum channel, but she cannot break the laws of physics.

The four polarization states

Alice prepares photons in one of four polarization states:

Basis	Bit value 0	Bit value 1
Rectilinear (+ basis)	Horizontal (0 deg)	Vertical (90 deg)
Diagonal (x basis)	Diagonal (+45 deg)	Anti-diagonal (-45 deg)

The two bases are non-orthogonal: a photon prepared in the rectilinear basis has a 50/50 outcome when measured in the diagonal basis, and vice versa. This is the quantum mechanical fact BB84 exploits.

How BB84 Works

A safety inspector tests parts by either weighing them or measuring their length. Some parts can only be measured one way without damage. If you choose the wrong measurement, you destroy the part and learn nothing useful. BB84 uses the same principle: Eve must guess Alice's basis to read each photon, and her guesses are detected later.

Step by step

Alice generates a random bit string and a random basis string. For each bit she encodes a photon in the chosen basis: rectilinear for horizontal/vertical, diagonal for +45/-45.
Alice sends the photons to Bob over the quantum channel.
Bob receives each photon and, for each one, chooses a random basis and measures.
After all photons are received, Alice and Bob publicly announce their basis choices for each photon (but not the bit values).
They keep only the bits where their bases matched. This typically retains about half the photons.
Alice and Bob compare a small random subset of the kept bits over the public channel. If too many disagree, they abort.
The remaining bits, with privacy amplification and error correction applied, become the shared secret key.

The protocol's security rests on the fact that any measurement Eve performs without knowing Alice's basis introduces errors. After basis announcement and partial bit comparison, errors above a threshold imply Eve was active.

The No-Cloning Theorem

A magic photocopier that perfectly duplicates any photo would be useful for spies but fortunately does not exist for arbitrary quantum states. Wootters and Zurek proved this in 1982 ("A single quantum cannot be cloned," Nature 299, 802), and the no-cloning theorem is the bedrock of BB84's security.

Implication

Eve cannot copy each photon, hold the copy until Alice's basis is revealed, and measure correctly afterward. She must measure in real time, before basis information is public. Any wrong basis choice introduces errors, and statistical analysis catches her.

Eavesdropping Detection

A locksmith can tell if a vault has been tampered with by checking the seals. BB84 uses photon error rate as the seal. Eve's intervention shifts this rate by a measurable amount.

Quantitative bound

Without Eve, the quantum bit error rate (QBER) on the kept bits should be near zero (only hardware noise contributes). If Eve performs the simplest "intercept and resend" attack, she introduces 25 percent QBER. More sophisticated attacks reduce this but cannot eliminate it. Csiszar-Korner 1978 information-theoretic analysis (combined with later work by Mayers 2001 and Shor-Preskill 2000) shows that for QBER below about 11 percent, secure key extraction is possible after privacy amplification. Above 11 percent, no secure key can be extracted.

Privacy Amplification and Error Correction

After basis comparison, Alice and Bob still have noisy bits and Eve might still know some fraction of them. Privacy amplification turns these noisy, partially-known bits into a much shorter but secure key.

The recipe

Run a classical error correction protocol (cascade, LDPC, or polar codes) over the public channel to make Alice's and Bob's bit strings agree exactly.
Run a privacy amplification protocol: hash the agreed string with a 2-universal hash function down to a length that exceeds Eve's expected information by a security parameter (typically 30-50 bits).
The output is the shared secret key.

Step 1 leaks information to Eve, which is accounted for in the privacy amplification step. The final key is information-theoretically secure under reasonable assumptions about the hardware.

Real-World Deployment

A racecar that performs in the lab is different from one that performs on a real track. BB84 systems have been deployed for decades but with practical constraints.

Distance limits

Single-photon channels lose photons exponentially with distance. Fiber optic deployments for BB84 are limited to roughly 200 km without intermediate trusted nodes. Free-space links with satellite-to-ground photons (China's Micius satellite, demonstrated by Pan Jianwei's group in 2017, Nature 549, 70-73) have achieved 1200 km channel distance, but only with line-of-sight to the satellite.

For longer distances, current QKD networks use trusted nodes: classical cryptographic relays at intermediate points. This breaks the end-to-end information-theoretic security guarantee, because the trusted nodes can read the keys.

Hardware cost

Single-photon sources, single-photon detectors, polarization controllers, and time-tagging electronics are expensive. Commercial QKD systems from Toshiba, ID Quantique, and others typically cost tens to hundreds of thousands of US dollars per node.

Throughput

Practical BB84 systems achieve key rates of kilobits per second to megabits per second over short distances, falling rapidly with distance. For comparison, standard internet links operate at gigabits per second.

Aspect	Classical PKI	QKD (BB84)
Distance	Unlimited via routing	Limited (200 km fiber, satellite for longer)
Hardware cost	Standard PC	Specialized optical hardware
Key rate	Gigabits/s	Kilobits to megabits/s
Trust model	Computational assumptions	Information-theoretic + hardware

Side Channels and Hardware Attacks

Quantum mechanical security does not protect against hardware imperfections. Real BB84 implementations have been attacked through detector blinding, photon-number-splitting, time-shift attacks, and Trojan-horse light injections. Vadim Makarov's group published several effective hardware attacks against commercial QKD systems between 2008 and 2016 (Nature Photonics 4, 686-689, 2010 among many others).

Countermeasures

Decoy-state QKD (Hwang 2003, Lo-Ma-Chen 2005) defeats photon-number-splitting attacks. Measurement-device-independent QKD (MDI-QKD, Lo-Curty-Qi 2012) eliminates detector-side attacks. Continuous-variable QKD uses a different physical encoding to defeat some hardware attacks. Each new layer of countermeasure adds engineering complexity.

Why Most Security Architectures Use Post-Quantum, Not QKD

A specialty tool can be valuable, but most users need general-purpose tools. The NSA, NIST, NCSC (UK), ANSSI (France), BSI (Germany), and most national security agencies have published guidance recommending post-quantum cryptography (PQC) over QKD for general-purpose secure communications.

Reasons cited

QKD requires specialized hardware and direct optical channels, which most enterprises do not have.
QKD does not authenticate; it requires a pre-shared classical authentication key, which itself requires PKC.
QKD networks scale poorly without trusted nodes, breaking end-to-end security.
Post-quantum cryptography (ML-KEM, ML-DSA, etc.) protects all internet traffic without new hardware.
Hardware attacks against QKD have repeatedly succeeded.

The NSA's Cybersecurity Advisory on QKD (2020, available at media.defense.gov) explicitly states that "NSA does not support the usage of QKD or QC to protect communications in National Security Systems."

This does not mean QKD is useless; specialized scenarios (high-value point-to-point links between specific facilities) may benefit. But for the vast majority of secure communications, post-quantum cryptography is the right tool.

QKD Versus QNSQY

QNSQY is post-quantum cryptography software for files: encrypt with ML-KEM, sign with ML-DSA or SLH-DSA, store the result anywhere. It does not require special hardware. It uses NIST-standardized algorithms (FIPS 203, 204, 205) in hybrid mode with X25519 and Ed25519. The threat model differs from QKD: QNSQY assumes the adversary may have a future quantum computer; QKD assumes the adversary tries to read photons in flight.

For most users (governments, enterprises, healthcare, individual professionals), QNSQY's threat model is the right one. QKD addresses a niche where the channel is a physical fiber under your control and the key-rate and distance limits are tolerable.

Frequently Asked Questions

Is BB84 unconditionally secure?

In principle yes, in idealized hardware. Real implementations have side channels and hardware imperfections that have been exploited. Decoy-state and MDI-QKD address the most prominent attacks but the implementation security is an ongoing engineering battle.

Why does QKD need authentication?

The classical channel where Alice and Bob compare basis choices and run privacy amplification must be authenticated, otherwise Eve could impersonate one of them. The standard solution is a pre-shared symmetric authentication key, but bootstrapping this key requires a separate trust mechanism, often classical public-key cryptography. NSA points to this circularity as a reason QKD does not eliminate the need for PKC.

Has QKD been broken?

The protocol itself, in idealized form, has not been broken. Real-world implementations have been attacked many times, with detector blinding, time-shift, and photon-number-splitting being the most prominent classes of attack. Each successful attack has driven new countermeasures.

Why does NSA discourage QKD?

NSA cites specialized hardware, lack of authentication, scaling problems, vulnerability to hardware attacks, and the existence of vetted post-quantum cryptography (CNSA 2.0) as reasons to prefer PQC. The CSA on QKD/QC is publicly available on media.defense.gov.

Does QNSQY use BB84 or QKD in any way?

No. QNSQY uses post-quantum cryptography (ML-KEM, ML-DSA, SLH-DSA, FN-DSA, HQC, LMS) in hybrid mode with classical X25519 and Ed25519. It is a software product running on standard hardware, with no QKD requirement. The threat model addresses Q-Day risk through algorithmic, not physical, means.

Sources

Bennett, C. H., Brassard, G. "Quantum Cryptography: Public Key Distribution and Coin Tossing." IEEE ICCSSP 1984 / Theoretical Computer Science 560, 7-11, 2014.
Wootters, W. K., Zurek, W. H. "A single quantum cannot be cloned." Nature 299, 802-803, 1982.
Shor, P. W., Preskill, J. "Simple Proof of Security of the BB84 Quantum Key Distribution Protocol." Physical Review Letters 85, 441-444, 2000.
Liao, S.-K. et al. (Pan Jianwei's group). "Satellite-to-ground quantum key distribution." Nature 549, 43-47, 2017.
NSA. "Quantum Key Distribution (QKD) and Quantum Cryptography (QC) Cybersecurity Advisory." 2020. https://media.defense.gov/2021/Aug/04/2002821837/-1/-1/1/Quantum_FAQs_20210804.PDF
NIST. FIPS 203 / 204 / 205. https://csrc.nist.gov/projects/post-quantum-cryptography

Protect Your Data Before Q-Day Arrives

QNSQY's NIST-standardized post-quantum encryption protects files against both current and quantum-era threats.

Try QNSQY