The BB84 Protocol

BB84, due to Bennett and Brassard (1984), is the first and still the canonical quantum key-distribution protocol. Its security rests on encoding bits in two conjugate (mutually unbiased) bases, so that an eavesdropper who does not know which basis was used cannot extract the bit without disturbing the state.

The two bases

BB84 uses single qubits in one of two bases:

• the rectilinear (computational, $Z$) basis $\{|0\rangle, |1\rangle\}$,
• the diagonal ($X$) basis $\{|+\rangle, |-\rangle\}$, where $|\pm\rangle = \tfrac{1}{\sqrt2}(|0\rangle \pm |1\rangle)$.

These two bases are mutually unbiased: any state of one basis, measured in the other, gives a perfectly random outcome. Concretely

Each bit value is encoded by a state, with the basis acting as a hidden label:

| bit | $Z$ basis | $X$ basis | |----:|:---------:|:---------:| | 0 | $|0\rangle$ | $|+\rangle$ | | 1 | $|1\rangle$ | $|-\rangle$ |

The protocol, step by step

1. Prepare (Alice). For each of $N$ rounds, Alice picks a random bit $a_i$ and a random basis $b_i \in \{Z, X\}$, prepares the corresponding state, and sends it to Bob.
2. Measure (Bob). Bob picks an independent random basis $b_i' \in \{Z, X\}$ for each qubit and measures, recording outcome $a_i'$.
3. Sift (public). Over an authenticated classical channel, Alice and Bob announce their bases (never the bits) and discard every round where $b_i \neq b_i'$. On the surviving rounds the bases matched, so in the absence of noise and eavesdropping $a_i' = a_i$.
4. Estimate error. They sacrifice a random subset of the sifted bits, compare them publicly, and estimate the quantum bit error rate (QBER). A QBER above threshold aborts the protocol.
5. Post-process. The remaining sifted bits — the raw key — are passed through information reconciliation (error correction) and privacy amplification to produce a short, identical, secret key.

The sifting rate

Because Bob chooses his basis independently and uniformly, he picks the same basis as Alice with probability $\tfrac12$. So on average half the transmitted qubits survive sifting:

Sending $N$ qubits yields about $N/2$ sifted bits before error correction and privacy amplification further shorten the key. This 50 % overhead is the price of hiding the basis.

Why a passive copy fails

Could an eavesdropper "Eve" simply duplicate each qubit, store copies, and measure them all once the bases are announced? No — the no-cloning theorem forbids copying an unknown quantum state. And a single qubit, measured in the wrong basis, yields a random bit while collapsing the state, so a measure-and-resend attack injects detectable errors. BB84's security is the marriage of these two facts: conjugate-basis encoding plus the impossibility of cloning or noiselessly intercepting an unknown state.

Try it

Alice wants to send the bit $1$ in the diagonal ($X$) basis, so she must prepare the state $|-\rangle = \tfrac{1}{\sqrt2}(|0\rangle - |1\rangle)$. Build a one-qubit circuit that prepares $|-\rangle$ starting from $|0\rangle$. (Hint: $X$ sends $|0\rangle\to|1\rangle$, and $H|1\rangle = |-\rangle$.) The grader checks the output state vector.

Sign in on the full site to ask questions and join the discussion.