BB84: The Protocol That Made Eavesdropping a Physics Problem

In the summer of 1984, Charles Bennett and Gilles Brassard published a four-page paper proposing a method for distributing cryptographic keys whose security was guaranteed not by the difficulty of a mathematical problem, but by the laws of physics. The paper described what became known as BB84 — the first quantum key distribution protocol — and it rested on a single, profound observation: any attempt to intercept a quantum communication must disturb it, and that disturbance is detectable.

Forty years later, BB84 remains the most widely implemented QKD protocol in the world. Understanding it in detail reveals not just how quantum cryptography works, but why it works — and what the honest limits of that guarantee are.

How BB84 Works

BB84 uses single photons as its information carriers. A photon’s polarisation — the orientation of its oscillating electric field — can be prepared in four states across two measurement bases:

• Rectilinear basis (⊕): horizontal (0°) encodes bit 0; vertical (90°) encodes bit 1
• Diagonal basis (⊗): 45° encodes bit 0; 135° encodes bit 1

Alice, the sender, generates a random stream of bits. For each bit, she also randomly selects a basis — rectilinear or diagonal — and sends a photon polarised accordingly. Bob, the receiver, randomly and independently selects a basis for each photon he measures. When his basis matches Alice’s, his result is deterministic and correct. When they differ, quantum mechanics dictates that his result is completely random — a coin flip with no correlation to Alice’s original bit.

After transmission, Alice and Bob compare their chosen bases over a public (but authenticated) classical channel — they reveal which basis they used for each bit, but not the bit values themselves. Bits where their bases matched are kept; the rest are discarded. This sifted key is the raw shared secret. On average, bases agree half the time, so roughly half the transmitted bits survive sifting.

Why an Eavesdropper Cannot Hide

This is where quantum mechanics becomes the security mechanism.

Suppose Eve intercepts each photon as Alice sends it. To learn the bit value, she must measure the photon. But she does not know which basis Alice used. If she guesses correctly, she measures correctly and re-sends an identical photon to Bob. If she guesses wrong — which happens 50% of the time — she measures in the wrong basis and gets a random result. She then re-encodes and sends a photon in her (wrong) basis to Bob.

When Bob subsequently measures that photon in Alice’s original (correct) basis, there is now a 50% chance his result disagrees with Alice’s original bit. The net effect: for every intercepted bit, there is a 25% probability of introducing an error in the sifted key. An eavesdropper covering the entire channel introduces a Quantum Bit Error Rate (QBER) of approximately 25%.

After sifting, Alice and Bob sacrifice a random subset of their key bits — comparing them publicly to measure the QBER. If the error rate is below an agreed threshold (typically 11% for standard BB84), they conclude the channel is sufficiently secure. If it exceeds that threshold, they abort and try again.

The QBER: Measuring the Presence of an Eavesdropper

After Sifting: Privacy Amplification and Error Correction

A QBER below the security threshold does not mean the key is immediately usable. Two further steps are required.

Error correction reconciles the small number of discrepancies between Alice’s and Bob’s sifted keys caused by channel noise — detector inefficiency, optical imperfections, background photons — rather than eavesdropping. Classical error-correcting codes are applied over a public channel. This necessarily reveals some information about the key to any eavesdropper who might be listening.

Privacy amplification compensates by shortening the key using a hash function agreed in advance. By compressing the key to a fraction of its sifted length, Alice and Bob can reduce Eve’s information about the final key to an arbitrarily small quantity — at the cost of producing fewer key bits. The final key is shorter but provably secure: information-theoretically secure, meaning no adversary, regardless of computational power, can recover it from the intercepted signals.

Real-World Constraints

BB84’s security is unconditional in theory. In practice, several constraints limit its deployment.

Distance. Single photons attenuate in fibre exponentially with distance. A direct fibre link for QKD is practical up to roughly 300–400 kilometres before the key rate becomes too low to be useful. Classical amplification is not possible — you cannot copy a quantum state — so extending range requires trusted relay nodes or satellites.

Trusted nodes are the current solution for terrestrial networks. A QKD link is established from Alice to an intermediate node, where the key is stored in classical memory and re-encrypted for the next hop. This works, but the intermediate node is a security assumption: if it is compromised, the key security is compromised. China’s Beijing–Shanghai QKD network uses 32 such trusted relay nodes.

Satellite QKD removes the trusted-node limitation for long distances. Photons travel through vacuum rather than fibre, reducing loss. China’s Micius satellite established QKD with ground stations at distances up to 1,200 km in a single satellite pass, and completed an intercontinental key exchange with Austria in 2021 using the satellite as a trusted node.

BB84 turned forty in 2024. The protocol that Bennett and Brassard described in four pages has been implemented in fibre, free space, and across 7,600 kilometres of atmosphere via satellite. Its security proof has been extended, strengthened, and subjected to forty years of cryptanalytic scrutiny. No fundamental break has been found.

The reason is not that the engineering is perfect — it is not. Trusted nodes are attack surfaces; detector inefficiencies have enabled side-channel attacks; photon sources are imperfect. The reason BB84 survives is that its core security claim — eavesdropping disturbs the quantum channel, and disturbance is measurable — is a consequence of quantum mechanics itself. And quantum mechanics, so far, remains unbroken.

← All articles