Part IV. Protocols and Algorithms · Chapter 26

Quantum Key Distribution

Two parties can use the physics of measurement itself to notice an eavesdropper while they build a shared key. This chapter separates what quantum key distribution genuinely guarantees from the much larger security stack it leaves untouched.

Steven GellerPublished July 25, 2026Revised August 14, 2026

Lab

In this chapter 9 sections

Reader question. What security property does BB84 provide, under which assumptions, and how does it differ from post-quantum cryptography?

BB84 lets parties establish correlated key material while estimating disturbance caused by interception under an authenticated classical channel and implementation assumptions; it addresses key distribution, whereas post-quantum cryptography uses classical algorithms for broader cryptographic functions.

Scope and non-goals.

This chapter does not promise unconditional security for imperfect devices or replace authentication, signatures, certificates, and key management.
It does not make current procurement recommendations without a dated standards and threat review.

Figure 26.1. Notice where the security enters: not in the key itself, but in the error rate. An observer who measures the qubits mid-flight changes some of them, and the sampled comparison makes that change visible.

Threat model before protocol steps

Name adversary capabilities, authentication, and device assumptions.

Quantum key distribution and post-quantum cryptography get mentioned in the same breath because they answer the same fear: an adversary with a future quantum computer. The similarity ends there.

QKD is a physical key-establishment scheme. Two parties exchange quantum states over a dedicated channel, coordinate over an authenticated classical channel, and end up with shared key material; plus a statistical bound on how much an eavesdropper could have learned. It needs specialized hardware at both ends and care about distance, topology, and trusted relays.

Post-quantum cryptography, or PQC, is a set of classical algorithms designed so that even a quantum attacker gets no useful shortcut. It ships as software. It runs on the machines and networks you already have. One of these is an infrastructure project; the other is a migration project. Treating them as interchangeable products is the first and most expensive mistake in this space.

Evidence boundary. BB84 uses nonorthogonal quantum states and basis comparison to detect interception statistically. [Charles H. Bennett] [Michael A. Nielsen]

Four states across two bases

Build the prepare-and-measure table.

BB84 encodes a random bit in either Z using |0>,|1> or X using |+>,|->. The receiver chooses a basis independently. Matching-basis rounds produce the sender's bit in the ideal model; mismatched rounds are discarded because they are random. Security reasoning begins only after public basis reconciliation, parameter estimation, error correction, and privacy amplification are accounted for.

Evidence boundary. Practical QKD security depends on authentication, implementation, error estimation, reconciliation, and privacy amplification. [Charles H. Bennett] [John Preskill]

Sifting produces candidate key bits

Trace basis disclosure without revealing bit values.

In the BB84-style pattern, Alice encodes each bit in a randomly chosen basis and Bob measures each arriving qubit in a randomly chosen basis. When their bases agree, their outcomes agree and the bit enters the candidate key. When the bases disagree, the outcome is discarded. The sifted bits that survive become the key; after one more step that carries the entire security argument.

That step exists because of the Born rule:

\Pr(i)=\lvert\langle i\vert\psi\rangle\rvert^2

An eavesdropper who measures a qubit in the wrong basis does not just fail to learn the bit; she disturbs the state, and Bob's later measurement inherits that disturbance as an elevated error rate. Alice and Bob sacrifice a public sample of their sifted bits, estimate the error rate, and only keep the key if the rate is low enough to bound what Eve could know.

The estimate is statistics, not certainty. With $S$ sampled bits, the sampling error of the measured rate is roughly:

\operatorname{SE}(\hat p)\approx\sqrt{p(1-p)/S}

Small samples leave wide margins, and the security proof lives inside those margins. Note also what the scheme assumes rather than provides: the classical channel must be authenticated by ordinary cryptographic means. QKD distributes keys. It does not authenticate anyone.

Evidence boundary. Post-quantum cryptography is classical cryptography standardized for resistance to quantum attacks and is distinct from QKD. [National Institute of Standards] [Dustin Moody et al.]

Alice/Bob/Eve labels; Z/X bases; QBER defined on sifted bits; distinguish raw, sifted, reconciled, and final key lengths.

Interception leaves a statistical signature

Calculate intercept-resend error probability on sifted bits.

An intercept-resend attacker guesses the sender's basis correctly half the time. On the other half, the attacker's measurement randomizes the state relative to the sender; among rounds later kept by legitimate basis agreement, that wrong-basis branch creates an error half the time. The expected sifted QBER is therefore one quarter, a statistical signature estimated from a disclosed sample rather than a per-bit alarm.

From raw key to usable key

Locate parameter estimation, reconciliation, and privacy amplification.

For a builder, this chapter is about threat modeling and systems integration, not about a single primitive. A system is not made secure by one clever component. You have to ask where keys are generated, stored, rotated, authenticated, audited, and used; and what breaks when each of those steps fails.

Any serious QKD-versus-PQC comparison should score, at minimum:

threat model and attacker capabilities
asset lifetime; how long the data must stay secret
network topology and link distances
hardware requirements at each endpoint
software migration path and interoperability
authentication assumptions on the classical channel
operational burden: key management, maintenance, staffing
verification evidence: what has been demonstrated, under what conditions

The quantum layer changes one part of this stack. The rest of the stack does not notice, and neither do your attackers.

QKD and PQC solve different systems problems

Compare scope, infrastructure, and migration boundaries.

QKD distributes fresh symmetric key material through a quantum channel and still needs authenticated classical communication, trusted endpoints, and operational key management. Post-quantum cryptography replaces vulnerable public-key primitives in ordinary networks. One does not migrate certificates, firmware, identity systems, or stored ciphertext merely by installing the other; threat model, distance, hardware, and integration determine which layer is relevant.

BB84 intercept-resend laboratory

Acceptance contract for BB84 intercept-resend laboratory
Field	Reader-visible record
Format	Seeded protocol simulator with sifting and QBER report
Verification	Tests no-eavesdrop and intercept-resend regimes, checks basis sifting, estimates the expected disturbance, and requires an authenticated classical-channel assumption.
Availability	Source-embedded acceptance record; no separate download is claimed

{
  "artifact": "BB84 intercept-resend laboratory",
  "format": "Seeded protocol simulator with sifting and QBER report",
  "acceptance_test": "Tests no-eavesdrop and intercept-resend regimes, checks basis sifting, estimates the expected disturbance, and requires an authenticated classical-channel assumption.",
  "publication_state": "source-embedded contract and worked fixture"
}

Executable reference fixture

Run with Python 3.11 or later. The final assertion is the chapter-level pass condition for this small instance.

import math
import random

SCALE = math.sqrt(0.5)

def prepare(bit, basis):
    if basis == "Z":
        return (1.0, 0j) if bit == 0 else (0j, 1.0)
    if basis == "X":
        return (SCALE, SCALE if bit == 0 else -SCALE)
    raise ValueError("basis must be X or Z")

def measure(state, basis, rng):
    zero = prepare(0, basis)
    overlap = zero[0].conjugate() * state[0] + zero[1].conjugate() * state[1]
    probability_zero = abs(overlap) ** 2
    if probability_zero > 1.0 - 1e-12:
        return 0
    if probability_zero < 1e-12:
        return 1
    return 0 if rng.random() < probability_zero else 1

def qber(pairs):
    if not pairs:
        raise ValueError("QBER is undefined for an empty sifted key")
    return sum(alice != bob for alice, bob in pairs) / len(pairs)

def simulate(alice_bits, alice_bases, bob_bases, attacked, authenticated, seed):
    if not authenticated:
        raise ValueError("BB84 requires an authenticated classical discussion")
    rng = random.Random(seed)
    sifted = []
    evidence = {"eve_wrong_basis": 0, "eve_wrong_basis_errors": 0}
    for alice_bit, alice_basis, bob_basis in zip(alice_bits, alice_bases, bob_bases):
        state = prepare(alice_bit, alice_basis)
        eve_basis = None
        if attacked:
            eve_basis = "X" if rng.randrange(2) else "Z"
            eve_bit = measure(state, eve_basis, rng)
            state = prepare(eve_bit, eve_basis)
        bob_bit = measure(state, bob_basis, rng)
        if alice_basis == bob_basis:
            sifted.append((alice_bit, bob_bit))
            if attacked and eve_basis != alice_basis:
                evidence["eve_wrong_basis"] += 1
                evidence["eve_wrong_basis_errors"] += alice_bit != bob_bit
    return sifted, evidence

schedule = random.Random(84026)
signals = 20000
alice_bits = [schedule.randrange(2) for _ in range(signals)]
alice_bases = ["X" if schedule.randrange(2) else "Z" for _ in range(signals)]
bob_bases = ["X" if schedule.randrange(2) else "Z" for _ in range(signals)]

honest_key, honest_evidence = simulate(alice_bits, alice_bases, bob_bases, False, True, 2601)
attacked_key, attacked_evidence = simulate(alice_bits, alice_bases, bob_bases, True, True, 2602)
honest_qber = qber(honest_key)
attacked_qber = qber(attacked_key)
sift_rate = len(honest_key) / signals
wrong_basis_error_rate = attacked_evidence["eve_wrong_basis_errors"] / attacked_evidence["eve_wrong_basis"]
assert len(honest_key) == len(attacked_key)
assert 0.48 < sift_rate < 0.52
assert honest_qber == 0.0
assert 0.22 < attacked_qber < 0.28
assert 0.46 < wrong_basis_error_rate < 0.54

wrongly_sifted = [(alice, measure(prepare(alice, alice_basis), bob_basis, random.Random(index)),)
                  for index, (alice, alice_basis, bob_basis) in enumerate(zip(alice_bits, alice_bases, bob_bases))
                  if alice_basis != bob_basis]
assert 0.46 < qber(wrongly_sifted) < 0.54

authentication_rejected = False
try:
    simulate([0], ["Z"], ["Z"], False, False, 1)
except ValueError:
    authentication_rejected = True
assert authentication_rejected
empty_sift_rejected = False
try:
    qber([])
except ValueError:
    empty_sift_rejected = True
assert empty_sift_rejected
print(f"PASS: 26 BB84 honest_qber={honest_qber:.3f} attacked_qber={attacked_qber:.3f} sifted={len(honest_key)} wrong_basis_error={wrong_basis_error_rate:.3f}")

Scope boundary

This chapter does not promise unconditional security for imperfect devices or replace authentication, signatures, certificates, and key management.
It does not make current procurement recommendations without a dated standards and threat review.

Depth commitment. One full transcript, one attack calculation, one simulator, and one scope comparison.

Practice problem

Simulate 10,000 BB84 transmissions with no eavesdropper and with intercept-resend on every signal; compare sift rate and QBER.

Deliverable: Run record with seed, raw/sifted sizes, QBER confidence intervals, and threat-model conclusion.
Pass condition: The reference simulator reproduces the run and checks results against binomial bands around the idealized expectations.

Verification record

Expected solution form. Protocol transcript excerpt plus statistical comparison and security-boundary rubric.

Model answer. With random independent bases, both regimes retain about one half the signals after sifting. With no noise or eavesdropper the sifted QBER is zero; intercept-resend on every signal produces an expected sifted QBER of one quarter. This calculation says nothing about attacks outside the model.

Model result and check. CI reruns both regimes with the published seed; review rejects claims extending beyond the modeled attack.

Acceptance test. The reference simulator reproduces the run and checks results against binomial bands around the idealized expectations.

Companion work

Artifacts for this chapter

These entries resolve to checked-in local source. Commands are reproduced exactly from the chapter manifest, and source-embedded fixtures are exported as direct downloads.

protocol fixture
BB84 intercept-resend laboratory
Download fixture (.py)Verification record (.json)
Reproduce or test
python3 tools/validate_briefs.py --briefs data/editorial_briefs_00_35.json --from 0 --through 35 --check-rewritten-sources --execute-artifacts

Provenance

Sources and review

Charles H. Bennett and Gilles Brassard. Quantum cryptography: Public key distribution and coin tossing. Proceedings of the IEEE International Conference on Computers, Systems and Signal Processing / IBM Research. 1984primary conference paper
Michael A. Nielsen and Isaac L. Chuang. Quantum Computation and Quantum Information. Cambridge University Press. 2010textbook
John Preskill. Lecture Notes for Physics 219: Quantum Computation. California Institute of Technology. 2018graduate lecture notes
National Institute of Standards and Technology. Post-Quantum Cryptography Standards. NIST. 2024official standardization project
Dustin Moody et al.. Transition to Post-Quantum Cryptography Standards. National Institute of Standards and Technology. 2024official transition guidance (initial public draft)

The load-bearing claims in the chapter are mapped inline to this registered source set. A citation supports only the bounded claim beside it.

External review: Open.

How review works Revision history Report or inspect errata

Book contents

Part IV. Protocols and Algorithms

Quantum Key Distribution

Threat model before protocol steps

Four states across two bases

Sifting produces candidate key bits

Interception leaves a statistical signature

From raw key to usable key

QKD and PQC solve different systems problems

BB84 intercept-resend laboratory

Artifacts for this chapter

BB84 intercept-resend laboratory

Sources and review

Cite this chapter

Threat model before protocol steps#

Four states across two bases#

Sifting produces candidate key bits#

Interception leaves a statistical signature#

From raw key to usable key#

QKD and PQC solve different systems problems#

BB84 intercept-resend laboratory#

Artifacts for this chapter

BB84 intercept-resend laboratory

Sources and review

Prerequisites for this chapter

Next concepts from this chapter

Threat model before protocol steps

Four states across two bases

Sifting produces candidate key bits

Interception leaves a statistical signature

From raw key to usable key

QKD and PQC solve different systems problems

BB84 intercept-resend laboratory