TheBB84 protocol, named after its inventorsCharles Bennett andGilles Brassard in 1984, is a prepare-and-measureQuantum key distribution (QKD) protocol, in which, one party (e.g. Alice) performs the encoding by preparing the quantum states, and the other party (e.g., Bob) measures them.^[1] The BB84 QKD scheme is the firstquantum cryptographyprotocol, and has become one of the most well-studied QKD protocols.^[2] The protocol isprovably secure assuming a perfect implementation, relying on two conditions: (1) the quantum property that information gain is only possible at the expense of disturbing the signal if the two states one is trying to distinguish are not orthogonal (seeno-cloning theorem); and (2) the existence of anauthenticated public classical channel.^[3] As such, the security of the BB84 protocol is fundamentally based on the principle that two non-orthogonal quantum states cannot be perfectly distinguished. This inherent limitation means that the states cannot be reliably copied, thereby ensuring a robust framework for secure quantum communication. The BB84 QKD protocol is usually explained as a method of securely communicating aprivate key from one party to another for use inone-time pad encryption.^[4]The proof of BB84 QKD scheme depends on a perfect implementation. Side channel attacks exist, taking advantage of non-quantum sources of information. Since this information is non-quantum, it can be intercepted without measuring or cloning quantum particles.^[5] The BB84 protocol provides a significant advancement in the field of quantum cryptography and represents a pioneering step toward achieving secure communication in the quantum era.^[6]

BB84 QKD system transmits individual photons through a fiber optic cable, with each photon representing a bit of data (zero or one). Polarizing filters on the sender's side set each photon's orientation, while the receiver uses beam splitters to read it. The sender and receiver then compare their photon orientations, with the matching set becoming the cryptographic key.^[7] However, encoding with other degrees of freedom, e.g., phase, is also possible, and the procedures are similar.^[8]

In the BB84 scheme,Alice wishes to send a private key toBob. She begins with two strings ofbits,${\displaystyle a}$ and${\displaystyle b}$, each${\displaystyle n}$ bits long. She then prepares an${\displaystyle n}$-qubit state written as:

${\displaystyle |\psi ⟩=\underset{i=1}{\overset{n}{⨂}}|{\psi }_{a_i{b}_i}⟩,}$

where${\displaystyle a_i}$ and${\displaystyle b_i}$ are the${\displaystyle i}$-th bits of${\displaystyle a}$ and${\displaystyle b}$ respectively. Together,${\displaystyle a_i{b}_i}$ give us an index into the following four qubit states:

${\displaystyle |{\psi }_{00}⟩=|0⟩,}$

${\displaystyle |{\psi }_{10}⟩=|1⟩,}$

${\displaystyle |{\psi }_{01}⟩=|+⟩=\frac{1}{\sqrt{2}}|0⟩+\frac{1}{\sqrt{2}}|1⟩,}$

${\displaystyle |{\psi }_{11}⟩=|-⟩=\frac{1}{\sqrt{2}}|0⟩-\frac{1}{\sqrt{2}}|1⟩.}$

Note that the bit${\displaystyle b_i}$ is what decides which basis${\displaystyle a_i}$ is encoded in (either in the computational basis or the Hadamard basis). The qubits are now in states that are not mutually orthogonal, and thus it is impossible to distinguish all of them with certainty without knowing${\displaystyle b}$.

Alice sends${\displaystyle |\psi ⟩}$ over a public and authenticatedquantum channel${\displaystyle \mathcal{E}}$ to Bob. Bob receives a state${\displaystyle \mathcal{E}(\rho )=\mathcal{E}(|\psi ⟩⟨\psi |)}$, where${\displaystyle \mathcal{E}}$ represents both the effects of noise in the channel and eavesdropping by a third party we'll call Eve. After Bob receives the string of qubits, both Bob and Eve have their own states. However, since only Alice knows${\displaystyle b}$, it makes it virtually impossible for either Bob or Eve to distinguish the states of the qubits. Also, after Bob has received the qubits, we know that Eve cannot be in possession of a copy of the qubits sent to Bob, by theno-cloning theorem, unless she has made measurements. Her measurements, however, risk disturbing a particular qubit with probability⁠1/2⁠ if she guesses the wrong basis.

Bob proceeds to generate a string of random bits${\displaystyle b^{\prime }}$ of the same length as${\displaystyle b}$ and then measures the qubits he has received from Alice, obtaining a bit string${\displaystyle a^{\prime }}$. At this point, Bob announces publicly that he has received Alice's transmission. Alice then knows she can now safely announce${\displaystyle b}$, i.e., the bases in which the qubits were prepared. Bob communicates over a public channel with Alice to determine which${\displaystyle b_i}$ and${\displaystyle b_i^{\prime }}$ are not equal. Both Alice and Bob now discard the bits in${\displaystyle a}$ and${\displaystyle a^{\prime }}$ where${\displaystyle b}$ and${\displaystyle b^{\prime }}$ do not match.

From the remaining${\displaystyle k}$ bits where both Alice and Bob measured in the same basis, Alice randomly chooses${\displaystyle k/2}$ bits and discloses her choices over the public channel. Both Alice and Bob announce these bits publicly and run a check to see whether more than a certain number of them agree. If this check passes, Alice and Bob proceed to useinformation reconciliation and privacy amplification techniques to create some number of shared secret keys. Otherwise, they cancel and start over.

• SARG04
• E91 –quantum cryptographic communication protocol

• Cryptographic algorithms
• Quantum information science
• Quantum cryptography
• Quantum cryptography protocols

• Articles with short description
• Short description matches Wikidata