Quantum key distribution (QKD) is a method for generating and distributing symmetric cryptographic keys with information-theoretic security based on quantum information theory [ETS18].

A QKD protocol establishes a secret key between two parties — let us call them 👩 Alice and 🧔 Bob as per tradition — connected by 1️⃣ an insecure quantum channel and 2️⃣ an authenticated classical channel [Gra21, Sec. 3.1].

• The established key can be however long as required so that it can serve as the key in a one-time pad.
• “Authenticated” does not imply “confidential” and does not necessarily require the use of cryptography. Alice and Bob can physically meet and verify each other’s identity.
• In practice, the authenticated classical channel can be established using 1️⃣ a pre-shared symmetric key, or 2️⃣ public-key cryptography [PAB+20, Sec. F].

A QKD protocol typically proceeds in two phases [Wol21, Ch. 4]:

1. the quantum transmission phase, in which 👩 Alice and 🧔 Bob send and/or measure quantum states;
2. the classical post-processing phase, where the bitstrings generated in the previous phase are converted into a pair of secret keys.

The security of QKD hinges on the principles of quantum mechanics, rather than the hardness of any computational problem, and hence does not get threatened by advances in computing technologies.

• During the quantum transmission phase, any adversary — let us call it 😈 Eve as per tradition — eavesdropping on the quantum channel inherently disturbs the channel and interrupts the key establishment process.
• Eve cannot make a copy of any transmitted state (that contributes to the key to be established) thanks to the no-cloning theorem.

The earliest QKD protocol is due to Bennett and Brassad [BB84] and is called BB84, named after the authors and the year it was proposed.

QKD leverages physical mechanisms, so unavoidably we need to discuss the physical mechanisms that underlie/enable BB84, which are based primarily on the polarisation of photons [Wol21, Sec. 1.3.1].

Polarisation

The polarisation of photons specifies the geometrical orientation of the oscillation of its electromagnetic field.

• Polarisation is linear if the field only oscillates in one direction.
• Polarisation is circular if the field rotates in a plane as the wave propagates.

We only consider linear polarisation here. For linear polarisation, we distinguish between two bases:

• rectilinear basis, which includes horizontal and vertical orientations; and
• diagonal basis, which is essentially the rectilinear basis rotated by $+45^\circ$; as shown in Fig. 1.

Consider the effect of polarisation filters depicted in Fig. 1:

• When a ↕ vertically polarised photon passes through a rectilinear polarisation filter, it is deflected to the right (➡).
• When a ↔ horizontally polarised photon passes through a rectilinear polarisation filter, it is deflected to the left (⬅).
• When a diagonally polarised photon passes through a rectilinear polarisation filter, it is equally likely to be deflected to the left and right.

Thus, measuring a diagonally polarised photon in the rectilinear basis, and similarly measuring a vertically/horizontally polarised photon in the diagonal basis, give a random result.

• We call the rectilinear and diagonal bases mutually conjugate (see Definition 1).

  Definition 1: Conjugate bases

  Two bases are mutually conjugate [BB84; FGG+97] or unbiased [Wol21, p. 9] if each vector of one basis has equal-length projections onto all vectors of the other basis.

• The Heisenberg uncertainty principle ensures that when making two sequential measurements using conjugate bases, the system is disturbed in such a way that the uncertainty of the measurement outcome is maximised [Woj22, p. 42].

With knowledge of polarisation in mind, let us now discuss the quantum transmission phase of BB84, which involves encoding of classical bits into quantum states, communication over a quantum channel, and decoding of quantum states into classical bits.

Quantum transmission phase

This phase of the protocol involving 👩 Alice and 🧔 Bob goes like this [Wol21, Sec. 1.3.2]:

1. 👩 Alice chooses a string of $N$ random classical bits: $X_1,\ldots,X_N$.
2. 👩 Alice chooses a random sequence of rectilinear (Z) bases and diagonal (X) bases; these are called the canonical bases [Dua14, p. 295].

3. 👩 Alice encodes her bitstring into a collection of photons with basis-dependent polarisation.

   In the rectilinear basis, 0 and 1 are encoded as → and ↑ respectively.

   In the diagonal basis, 0 and 1 are encoded as ↗ and ↖ respectively.

4. When 🧔 Bob receives the photons, he randomly (and independently of Alice) decides for each photon whether to measure/decode it in the rectilinear or diagonal basis to retrieve the classical bit.
5. At the end of this quantum transmission phase, 👩 Alice and 🧔 Bob each holds a classical bit string, denoted $\vec{X}=[X_1,\ldots,X_N]$ for Alice and $\vec{Y}=[Y_1,\ldots,Y_N]$ for Bob. $\vec{X}$ and $\vec{Y}$ form the raw key pair.

An illustration of the process above can be found Fig. 1.

Since the polarisation state of each photon is a discrete variable, BB84 is an example of a discrete-variable quantum key distribution (DV-QKD) scheme.

BB84 is also an example of a prepare-and-measure protocol, because of the preparation action of 👩 Alice and the measurement action of 🧔 Bob.

Classical post-processing phase

This phase of the protocol involves 👩 Alice and 🧔 Bob exchanging a sequence of classical information in the classical channel to transform their raw key pair into a shared secret key [Wol21, Sec. 1.3.3]:

1. This is the sifting step (steps 4-5 in Fig. 1):
   • 🧔 Bob publicly announces the bases he has chosen to measure the photons Alice has sent.
   • 👩 Alice compares Bob’s bases to the ones she used and confirms which bases Bob has chosen correctly.
   • 👩 Alice and 🧔 Bob discard all the bits for which the encoding and measurement bases are not the same.
2. This is the parameter estimation step:
   • 👩 Alice and 🧔 Bob want to compute an estimate of the quantum bit error rate (QBER) in the quantum channel, i.e., the fraction of bits where $\vec{X}$ and $\vec{Y}$ differ in the Z and X bases [Gra21, p. 38].
   • For this, 🧔 Bob reveals a random subset of his key bits.
   • In case of no eavesdropping, these bits should be the same as Alice’s bits and 👩 she confirms them.
   • If the QBER is too high, 👩 Alice and 🧔 Bob suspect eavesdropping and abort the protocol.
   • The bits that have been revealed during this step are discarded as their information is now public to eavesdroppers.
3. Computation of the final key if the error rate is not too high:
   • 👩 Alice and 🧔 Bob perform steps, which were later additions to the original BB84 [BBR88], to correct errors in their keys and increase the secrecy of their key.

   • The first step is error correction (also called information reconciliation), where they erase all errors in their bit strings. After this step, they hold identical strings.

     Direct vs reverse reconciliation [GG02; Djo19, p. 7; PAB+20, Sec. B]

     ▶ Direct reconciliation: 👩 Alice sends correction information and 🧔 Bob corrects his key elements to have the same values as Alice’s.

     • For example, 👩 Alice performs low-density parity check (LDPC) encoding and sends the parity bits to 🧔 Bob, who in turn performs LDPC decoding.
     • Error correction fails when quantum channel loss exceeds 50%.

     ◀ Reverse reconciliation: 🧔 Bob sends correction information and 👩 Alice corrects her key elements to have the same values as Bob’s.

     • For example, 🧔 Bob performs LDPC encoding and sends the parity bits to 👩 Alice, who in turn performs LDPC decoding.
     • Preferred option to direct reconciliation.
     • Provides a usable key when the mutual information of Alice ($A$) and Bob ($B$) exceeds the mutual information of Bob and Eve ($E$), i.e., $I(A;B)>I(B;E)$; the difference between these two terms gives the asymptotic secret key rate.
   • The second step is privacy amplification, which is a procedure that minimises Eve’s knowledge of the key.

Table 1 shows an example of an exchange between 👩 Alice and 🧔 Bob in the absence of eavesdropping.

For discussion of physical realisations of BB84, follow this knowledge base entry.

Performance and security evaluation

In terms of performance, a basic figure of merit of every QKD protocol is the secret key rate, i.e. the fraction of secure key bits produced per protocol round.

For security, follow this overview of QKD security.