BB84: how quantum key distribution works

Short answer: BB84 is the oldest quantum key distribution (QKD) protocol with a name, introduced by Bennett and Brassard in 1984. Two parties, Alice and Bob, use a quantum channel to send single qubits prepared in one of two bases, plus an authenticated classical channel, so that they end up with a shared secret key. University lecture notes say any eavesdropping attempt by an eavesdropper, Eve, introduces detectable disturbances.

What problem BB84 addresses

Lecture notes from Boston University describe QKD as resolving the key distribution problem by exploiting fundamental principles of quantum mechanics. In addition to a public classical channel, Alice and Bob have a quantum channel over which quantum states can be transmitted. The same notes list what a QKD protocol achieves: Alice and Bob establish a shared secret key, any eavesdropping attempt by Eve introduces detectable disturbances, security is information-theoretic and does not rely on computational hardness, and the only classical assumption required is an authenticated classical channel.

The TU Delft notes say BB84 is the most well known, and indeed the oldest, QKD protocol with a name, named after its inventors Bennett and Brassard. They note that Wiesner had already suggested a quantum key distribution protocol in the 1970s.

Conjugate coding and the two bases

The Cambridge lecture notes build BB84 from four qubit states: the computational basis states |0> and |1>, and the diagonal states |+> and |->. These make up two orthonormal bases, the computational basis (the Pauli Z eigenbasis) and the diagonal, or conjugate, basis (the Pauli X eigenbasis). The notes call the two bases mutually unbiased: if any state of one basis is measured in the other basis, the outcomes are always equally likely.

The Boston University notes describe the same idea as conjugate coding, using four possible states that form two incompatible measurement bases. Measuring a state prepared in one basis using the other basis does not reveal the encoded bit reliably, which is the property that makes disturbance detectable.

The first steps of the protocol

The Cambridge notes give BB84 as a series of steps. In step 1, Alice generates two uniformly random binary strings. One holds the bit values she is trying to send, and the other holds her choice of quantum encoding, that is, the basis, for each bit. She prepares one qubit per position in the corresponding state and sends the qubits to Bob. Using a random choice of mutually unbiased bases for each bit is sometimes called conjugate coding. In step 2, the notes point out that when Bob receives the qubits they may no longer be in the states Alice prepared. This is the point where noise or an eavesdropper can matter. The later steps cover the comparison and processing that turn the exchange into a key, and readers should take their details from the notes directly.

What the notes say about practicality

The TU Delft notes say that for BB84 it is enough to prepare and measure single qubit quantum states. They say that, unlike quantum computing, quantum cryptography is feasible today, at least over short distances, and that it is reasonable to assume Alice and Bob can transmit qubits over an optical fiber. That is a statement from course notes about the protocol's assumptions, not a claim about any product. Real devices have flaws, and the research on implementation attacks on detectors is covered in our article on QKD implementation attacks.

What this does not tell you

This article summarises three sets of lecture notes. It does not describe any system, and it does not say QKD replaces post-quantum cryptography. The two address different problems and are discussed in our article on QKD versus PQC.

FAQ

What is BB84?

The oldest quantum key distribution protocol with a name, introduced by Bennett and Brassard in 1984, according to lecture notes from TU Delft and Boston University.

What does Alice send?

Single qubits, each prepared in one of four states from two mutually unbiased bases, chosen at random according to the Cambridge notes.

What happens if Eve listens in?

The Boston University notes say any eavesdropping attempt introduces detectable disturbances.

Does BB84 rely on computational hardness?

No. The same notes say its security is information-theoretic and does not rely on computational hardness. The only classical assumption they list is an authenticated classical channel.

Is BB84 practical?

TU Delft notes say quantum cryptography is feasible today, at least over short distances, with qubits sent over optical fiber. They do not describe products, and real implementations have their own attack surface.