Eavesdropping and Detection

The security of BB84 is not "Eve cannot read the qubits" — it is "Eve cannot read the qubits without leaving fingerprints." This lesson quantifies those fingerprints with the simplest concrete attack, the intercept-resend strategy, and shows that any information Eve gains forces a measurable error rate on Alice and Bob's sifted key.

The intercept-resend attack

Eve sits on the channel. For each qubit Alice sends, Eve:

picks a random basis $e_i \in \{Z, X\}$ ,
measures the intercepted qubit in that basis, recording a bit,
prepares a fresh qubit in the state corresponding to her outcome in her basis, and forwards it to Bob.

Eve cannot do better by passive copying — the no-cloning theorem forbids it — so measuring is her best simple option. The problem is that she must commit to a basis before Alice and Bob announce theirs.

Computing the disturbance

Restrict attention to sifted rounds, where Alice's and Bob's bases already agree (say both $Z$ ; the $X$ case is identical by symmetry). Condition on Eve's basis:

Eve guesses Alice's basis correctly (probability $\tfrac12$ ). She measures in $Z$ , gets Alice's exact bit, and resends the correct $Z$ state. Bob, also in $Z$ , recovers the right bit. No error.
Eve guesses wrong (probability $\tfrac12$ ). She measures Alice's $Z$ state in the $X$ basis. Her outcome is random, and she resends an $X$ -basis state. Bob measures that $X$ state in $Z$ and, by mutual unbiasedness, gets a random bit — wrong with probability $\tfrac12$ .

Combining, the probability that a sifted bit is corrupted is

\mathrm{QBER}_{\text{Eve}} = \underbrace{\tfrac12}_{\text{wrong basis}} \cdot \underbrace{\tfrac12}_{\text{wrong outcome}} = \frac14 = 25\%.

A full intercept-resend attack on every qubit injects a 25 % error rate into the sifted key. Meanwhile Eve learns the bit with certainty only on the half of rounds where she guessed right, so her information per sifted bit is bounded well below 1.

Detection: comparing a public sample

Alice and Bob detect Eve by sacrificing a random subset of sifted bits and comparing them publicly. With no Eve and an ideal channel the QBER is $0$ ; with full intercept-resend it is $\approx 25\%$ ; a realistic noisy channel sits at a few percent. They set a security threshold (for BB84, the asymptotic limit is about $11\%$ ). If the measured QBER exceeds the threshold, they abort — too much information may have leaked. Below threshold, the residual error is corrected and the residual leakage removed by the post-processing of later lessons.

Partial attacks and the general principle

Eve need not attack every qubit; she can intercept a fraction $f$ to trade information for detectability. But the tradeoff itself is unavoidable: any strategy that yields Eve mutual information $I_{AE}$ about the key forces a minimum disturbance, and full security proofs (e.g. via the entropic uncertainty relation) bound Eve's knowledge by the observed QBER alone — regardless of what attack, including collective or coherent ones, she actually used. The simple 25 % calculation is the entry point to that general statement.

Try it

Compute the sifted-key error rate (QBER) introduced by a full intercept-resend attack, from first principles, by averaging over Eve's two equally likely basis choices: a correct guess gives error $0$ , a wrong guess gives error $\tfrac12$ . Return the average. The grader checks it equals $0.25$ .

Run your code to see the quantum state.