Hadamard Get the app

BB84 Protocol Explained: How QKD Works and Where It Breaks

BB84 Protocol Explained: How QKD Works and Where It Breaks — Hadamard

The BB84 protocol is a method for two parties to agree on a shared secret key by sending individual quantum states, typically photons, and then comparing notes over a public channel. Its security rests on physics rather than hard maths: measuring a quantum state in the wrong basis disturbs it, so an eavesdropper raises the error rate in a way Alice and Bob can measure, and they can discard the key before it is ever used.

This guide explains how BB84 works step by step, why interception produces a 25% error rate, how much noise the security proofs tolerate, what the protocol quietly assumes, and which attacks have succeeded against real hardware. It ends with a framework for deciding whether quantum key distribution (QKD) or post-quantum cryptography fits a business problem.

What is the BB84 protocol and where did it come from?

BB84 was introduced by Charles H. Bennett of IBM Research and Gilles Brassard in the paper “Quantum cryptography: Public key distribution and coin tossing,” published on pages 175–179 of the proceedings of the IEEE International Conference on Computers, Systems and Signal Processing in Bangalore, India, in December 1984. The name comes from the authors’ initials and the year. The paper was reprinted open access in Theoretical Computer Science 560 (2014), as noted in a 2014 preface in Natural Computing.

The protocol built on an earlier idea by Stephen Wiesner: unforgeable quantum money. According to a historical account by Brassard, Wiesner wrote up the idea around 1969 and published it in 1983. His insight was that information encoded in conjugate quantum bases cannot be read without risking disturbance.

On March 18, 2026, the ACM named Bennett and Brassard the recipients of the 2025 ACM A.M. Turing Award for founding quantum information science. The ACM’s announcement says BB84 showed that a key could be secure “even against adversaries with unlimited computational power… such as a quantum computer.”

What problem does quantum key distribution solve?

Encryption needs a shared secret key. Today, parties usually agree on one with public-key key exchange, whose security depends on mathematical problems being hard to solve. A sufficiently capable quantum computer threatens some of those problems, which is why standards bodies are scheduling migrations; our explainer on NIST IR 8547 and the deprecation deadlines for RSA covers that timeline.

QKD takes a different route. Instead of assuming an attacker lacks computing power, it relies on the fact that observing certain quantum states changes them. If the eavesdropping is detectable, the parties can decide whether a key is safe to use.

It is worth being precise about scope. QKD only distributes keys. It does not encrypt data, sign messages, prevent fraud or secure online transactions on its own. The key it produces still has to be used with a cipher, and the surrounding system still has to be secure.

How does BB84 work, step by step?

The protocol is usually illustrated with photon polarisation. The sender, Alice, has two bases available: a rectilinear basis (horizontal and vertical) and a diagonal basis (45° and 135°). In each basis, two orthogonal states represent 0 and 1. The two bases are conjugate: measuring a diagonal photon in the rectilinear basis gives a random result and destroys the original information.

  1. Alice prepares random bits in random bases. For each photon she picks a random bit value and, independently, a random basis, then sends the corresponding state over the quantum channel.
  2. Bob measures in random bases. Bob does not know Alice’s choices, so he picks a basis at random for each incoming photon and records the result.
  3. Sifting. Over a classical channel, Alice and Bob announce which basis they used for each position, but not the bit values. They keep only the positions where the bases matched, which happens about half the time, and discard the rest. The result is the sifted key.
  4. Error estimation. They publicly compare a random sample of the sifted bits and compute the quantum bit error rate (QBER). The revealed bits are discarded. If the QBER is above a threshold, they abort.
  5. Error correction. They reconcile the remaining bits through a classical exchange so both hold identical strings. This leaks some information, which must be accounted for.
  6. Privacy amplification. They compress the corrected string into a shorter key about which an eavesdropper’s information is negligible.

Every classical message in steps 3 to 6 travels over a public channel that Eve can read. That is acceptable, as long as she cannot alter it, a point we return to below.

Why “superposition” is not the full explanation

Many popular accounts say BB84 works because a photon is “in multiple states at once.” The operative mechanism is narrower: Alice randomly switches between conjugate bases, and anyone who measures in the wrong basis gets a random outcome and sends on a disturbed state. That disturbance is what makes eavesdropping visible.

Why can eavesdropping be detected? The 25% QBER

The simplest attack is intercept-resend: Eve measures every photon in a randomly chosen basis and sends Bob a fresh photon matching her result. The analysis is short. Consider only the sifted positions, where Alice and Bob used the same basis.

Eve’s basis Probability What Bob receives Bob’s error rate
Matches Alice 50% The correct state 0%
Differs from Alice 50% A state in the wrong basis 50%
Overall 100% — 25%

Eve guesses the wrong basis half the time, and in those cases Bob’s result is wrong half the time, giving an expected QBER of 25% on the sifted key. In exchange, Eve learns about 50% of the key. An open-source simulator implementation shows the same arithmetic.

The 25% is an expected rate, not a guarantee for every finite sample. In a small sample, random fluctuations could hide Eve, which is why Alice and Bob must test a statistically large enough set of bits. A 2026 preprint replicating BB84 on IBM hardware reported a QBER of 0.261 with Eve present and 0.000 without her; that work had not been peer-reviewed at the time of writing.

Eve cannot avoid the problem by copying photons instead of measuring them. The no-cloning theorem rules out making a perfect copy of an unknown quantum state, so any attempt to learn the bit value interacts with the state itself.

How much noise is too much? QBER thresholds and security proofs

Real channels are noisy, and Alice and Bob cannot tell ordinary noise from eavesdropping. Security proofs therefore conservatively attribute every error to Eve and ask a precise question: up to what QBER can a secret key still be extracted?

Dominic Mayers’ early proof tolerated an error rate of about 7%. In 2000, Peter Shor and John Preskill gave a simpler proof (Phys. Rev. Lett. 85, 441) that tolerates about 11%; later analysis puts the figure near 11.4%. Above the threshold, no secret key can be extracted, and the protocol must abort.

Full intercept-resend, at 25%, is far above that line. An Eve who intercepts only a fraction of photons produces proportionally fewer errors, but the proofs cover that case too: whatever information the observed error rate allows her, error correction and privacy amplification are sized to remove it.

Is BB84 unbreakable? Security assumptions and real-world attacks

BB84 is provably secure only under specific assumptions. Several of them are easy to overlook:

  • An authenticated classical channel. BB84 uses a quantum channel plus an insecure classical channel, and that classical channel must be authenticated. Without authentication, Eve could impersonate Bob to Alice and Alice to Bob, running two separate key exchanges and sitting in the middle.
  • Trusted devices. The proofs model ideal sources and detectors. Real hardware can behave differently in ways an attacker can exploit.
  • True randomness. If Alice’s or Bob’s basis choices are predictable, Eve can measure in the right basis and avoid introducing errors.
  • Single photons. The original analysis assumes one photon per pulse. Practical sources do not always deliver that.

Photon-number splitting and decoy states

Practical light sources sometimes emit more than one photon in a pulse. That opens the photon-number-splitting attack: Eve can split off and keep an extra photon while letting the rest reach Bob undisturbed. Decoy-state methods, including work by X.-B. Wang (PRL 94, 230503, 2005) and by Lo, Ma and Chen (PRL 94, 230504, 2005), counter this by mixing pulses of different intensities so the parties can detect the attack statistically, as later reviews document.

Detector blinding

The most cited implementation attack came in 2010. Lydersen, Wiechers, Wittmann, Elser, Skaar and Makarov published “Hacking commercial quantum cryptography systems by tailored bright illumination” in Nature Photonics. They showed that the gated detectors of two commercially available QKD systems could be blinded with bright light and then remotely controlled, letting an attacker dictate detection results without raising the error rate in the usual way.

Why “unbreakable” is the wrong word

The protocol’s mathematics was not broken. The hardware failed to match the model the proofs assumed. That distinction matters: “provably secure under stated assumptions” is accurate, while “unbreakable” or “impossible to hack” is contradicted by published attacks on commercial equipment.

Should your business use QKD or post-quantum cryptography?

This article deliberately does not cover QKD deployments, pricing, key rates, distance records or certification, because those claims had not been independently verified when it was written. What the verified facts do support is a set of questions to ask before evaluating any product:

  • What exactly needs protecting? QKD delivers keys between endpoints connected by a quantum link. It does not by itself secure applications, payments, identities or stored data.
  • How will the classical channel be authenticated? BB84 requires it. In practice that means classical or post-quantum authentication, so QKD adds to that cryptography rather than replacing it.
  • Can you trust and audit the hardware? The 2010 blinding attack shows that security depends on devices behaving as modelled.
  • Does your threat model require security against unlimited computation? That is QKD’s distinctive theoretical property. If your requirement is resistance to quantum computers specifically, post-quantum algorithms address that in software.

For most organisations, the practical starting point is the post-quantum migration already being scheduled by standards bodies. National security agencies have also weighed in on QKD itself; we cover one prominent view in why the NSA still won’t back quantum key distribution.

A note on names: Hadamard’s own project is also called BB84, but it uses no quantum hardware. It is a hash-based, ECDSA-free Layer 2 rollup on Ethereum mainnet in which accounts are one-time addresses based on hash commitments rather than ECDSA keys. Its post-quantum design depends on hash functions, whose quantum resistance we examine in what Grover and BHT really do to SHA-256. Technical details are in the developer docs.

FAQ

Is BB84 actually unbreakable?

No. It is provably secure if its assumptions hold, including an authenticated classical channel and devices that behave as modelled. Real systems have been attacked through hardware flaws, most notably the 2010 detector-blinding attack on two commercial QKD systems.

Why can’t an eavesdropper just copy the photons?

The no-cloning theorem forbids perfect copies of unknown quantum states, and measuring in the wrong basis disturbs them. A full intercept-resend attack produces an expected 25% error rate on the sifted key, far above what the protocol accepts.

Does QKD replace post-quantum cryptography?

No. BB84 needs an authenticated classical channel, which in practice relies on classical or post-quantum authentication. QKD also only distributes keys; it does not provide signatures or protect data at rest.

What QBER makes BB84 abort?

It depends on the security proof used. Mayers’ proof tolerated about 7%; the Shor–Preskill proof tolerates about 11%, with later analysis near 11.4%. Above the applicable threshold, no secret key can be extracted.

Sources