BB84: how to share a quantum secret

To understand why that matters, we need to take a step back. Encryption has always been a fundamental part of human history. From ancient Rome to World War II to your phone unlocking right now, humans have always needed ways to communicate securely. This led mathematicians to find new ways to encrypt messages.

The best answer anyone found was the Vernam cipher, also called the one-time pad. This encryption scheme uses a secret key to encrypt a message so nobody can read it, and it needs both the sender and the receiver to share the same key.

But there are a few problems:

So why don't we use this everywhere? Because we still have the same original problem: how do you get the key to Bob securely in the first place?

Any key you send can be intercepted and copied without you ever knowing.

In 1984, Charles Bennett and Gilles Brassard published BB84: the first protocol that could distribute a secret key securely using quantum mechanics.

This is not quantum encryption. The message is still encrypted classically with a one-time pad. What quantum mechanics does is solve the key distribution problem. It lets Alice and Bob generate a shared random key without ever meeting, and detect anyone who tries to intercept it.

It comes down to a fundamental fact about quantum mechanics that we've already seen: you cannot measure a quantum state without disturbing it. And you cannot copy an unknown quantum state.

Classically, a spy can intercept a message and copy it perfectly and you'd never know. In the quantum world, that's impossible. Any interference leaves a trace.

Alice is going to send Bob a sequence of qubits. Bob is going to measure them. What they end up sharing isn't a message — it's a secret random key that nobody else could have seen without leaving fingerprints.

Here's exactly what Alice does. For each bit of the key, she follows the same process.

First she flips a coin. This gives her a random bit, called b. Heads is 0, tails is 1.

Then she flips again. This gives her a random basis, called p. Heads is 0 (the Z basis), tails is 1 (the X basis).

She prepares her qubit according to this table:

If her bit is 0 and her basis is Z, she sends |0⟩. If her bit is 1 and her basis is Z, she sends |1⟩. If her basis is X, she sends |+⟩ or |−⟩ instead.

Notice: if you don't know which basis Alice used, you can't reliably extract her bit. Measuring a Z-basis state in the X basis gives you a completely random result, and vice versa. The basis is the key to the key.

Alice has prepared her qubits. Now it's your turn.

You are Bob. For each round, Alice has secretly flipped her two coins and prepared a qubit. Pick a basis — Z or X — and measure it. Record your result and don't share it with anyone.

Once the 10 rounds are over, Alice publicly announces which basis she used for each round. Not her bit. Just her basis.

Compare your basis choices with Alice's. Any round where you chose different bases, throw it away — the measurement you got was random and meaningless.

What's left is your shared key. Alice has the exact same sequence of bits on her end.

Neither of you chose this key. Alice chose her bits randomly. You chose your bases randomly. The key emerged from the rounds where you happened to agree.

But what if someone was listening?

Eve intercepts each qubit before it reaches you. She has the same problem you had — she doesn't know Alice's basis. She has to guess.

When Eve guesses the wrong basis, she disturbs the qubit. She can't undo that. She has to send a new qubit to you based on what she measured, which may be completely wrong.

Run the demo again, this time with Eve in the channel. When the 10 rounds are over, Alice will publicly reveal her bits for the first 5 positions of your shared key. Compare them with yours.

Do you see errors? Those are Eve's fingerprints. When she guessed the wrong basis, she sent you a disturbed qubit, and your measurement came out wrong.

In a clean channel with no eavesdropper, your error rate should be zero. Eve's interference pushes it toward 25%.

No errors in your sample means no eavesdropper. Your key is secure. Use it with a one-time pad to encrypt your message.

Errors in your sample means someone was listening. Throw the key away and start over on a different channel.

Shannon told us the one-time pad is perfectly secure. The problem was always getting the key to Bob. BB84 solves that — not by making the key untouchable, but by making any interference detectable.