Hadamard Get the app

E91 Protocol Explained: How Bell Tests Secure Quantum Keys

E91 Protocol Explained: How Bell Tests Secure Quantum Keys — Hadamard

The E91 protocol is a quantum key distribution (QKD) scheme proposed by Artur Ekert in 1991. A single source sends entangled particle pairs to two parties, who measure them in randomly chosen settings and turn the matching results into a shared secret key. What sets E91 apart is that the remaining, mismatched results feed a Bell test. If the correlations violate Bell’s inequality strongly enough, an eavesdropper cannot have learned much about the key.

This guide walks through the protocol step by step and explains why the Bell test works as an eavesdropping detector. It then compares E91 with BB84 and BBM92 and looks at what experiments between 2020 and 2026 have actually achieved.

What is the E91 protocol?

E91 comes from a single paper: Artur Ekert, “Quantum cryptography based on Bell’s theorem”, published in Physical Review Letters 67(6), 661–663, on 5 August 1991. Ekert, then at Oxford, was the sole author. According to the abstract, the scheme builds on Bohm’s version of the Einstein–Podolsky–Rosen (EPR) thought experiment and uses Bell’s theorem to test for eavesdropping.

E91 is sometimes credited to “Ekert, Zeilinger and Aspect”. That is incorrect. The confusion probably comes from the 2022 Nobel Prize in Physics, which Alain Aspect, John Clauser and Anton Zeilinger shared “for experiments with entangled photons, establishing the violation of Bell inequalities and pioneering quantum information science.” Their experiments underpin the physics E91 relies on, but the protocol is Ekert’s. For the background on entanglement and Bell’s theorem, see our explainer on the EPR paradox and the 2022 Nobel.

How the E91 protocol works, step by step

The basic flow has six stages. One detail matters from the start: Alice and Bob do not each produce their own pairs. One source produces each pair and splits it between them.

  1. Distribution. A source emits entangled photon pairs. One photon of each pair goes to Alice, the other to Bob.
  2. Random measurement. For every incoming photon, Alice and Bob each choose a measurement setting at random and independently, then record the outcome.
  3. Public announcement of settings. Over an ordinary authenticated classical channel, they reveal which setting they used in each round. They do not reveal the outcomes.
  4. Sifting. They keep the rounds in which their settings line up. In these rounds the entangled outcomes are correlated, so the results form a raw key.
  5. Bell test. They publicly compare outcomes from the rounds with mismatched settings and use them to compute a Bell (CHSH) value, S.
  6. Decision. If S shows a sufficiently strong violation, they continue with error correction and privacy amplification to distil a final key. If not, they abort.

Note what the sifting step does and does not do. Alice and Bob do not keep “bits that exhibit entanglement”, because no single bit can show entanglement on its own. They keep rounds by comparing settings. The discarded-for-key rounds are what let them statistically check that entanglement was present.

How a CHSH Bell test catches an eavesdropper

The CHSH form of Bell’s inequality combines correlations from four pairs of measurement settings into one number, S. Any local hidden-variable model, meaning any explanation in which outcomes are fixed in advance by shared classical information, gives |S| ≤ 2. Quantum mechanics allows values up to Tsirelson’s bound, 2√2 ≈ 2.828. The IBM Quantum CHSH tutorial walks through the same concept on real hardware.

Here is the intuition for eavesdropping. Suppose Eve intercepts photons, measures them and sends replacements. Her measurement destroys the entanglement between Alice’s and Bob’s photons. What reaches them now carries correlations she prepared from her own classical results, and those behave like a local hidden-variable model, so S falls to 2 or below. An interactive E91 demo on GitHub shows this: an intercept-resend attack pushes S toward 2.

The deeper reason is that strong entanglement between two particles leaves little room for either to be correlated with a third. A violation close to 2√2 is evidence that Alice’s and Bob’s photons were strongly correlated with each other and only weakly with anything Eve holds. Security proofs turn the observed S and error rate into a bound on how much information Eve could have.

Why a low S isn’t automatic proof of Eve

A weak Bell violation does not mean someone is listening. The same demo shows that ordinary imperfections lower S too:

  • Noise in the source or detectors blurs the correlations.
  • Misalignment between Alice’s and Bob’s reference frames shifts the effective measurement angles.
  • Loss in fibre or free space removes photons, and if lost rounds are handled carelessly they can open loopholes.

QKD security analysis is deliberately conservative. Because Alice and Bob cannot tell noise from an attacker, they attribute all degradation to Eve. A lower S does not prove an attack, but it does reduce the key that can safely be extracted. Below some point, the protocol aborts. Real systems never reach 2.828. The Munich experiment described below measured S = 2.578 and still produced key.

E91 vs BB84 vs BBM92: what differs and what’s equivalent

Within months of Ekert’s paper, Bennett, Brassard and Mermin published “Quantum cryptography without Bell’s theorem” (PRL 68(5), 557, dated 3 February 1992). Their abstract describes “a related but simpler EPR scheme” and proves it secure without invoking Bell’s theorem, including against a fake EPR source. It also shows the scheme is equivalent to BB84, which uses single particles rather than entangled pairs.

BB84 (1984) E91 (1991) BBM92 (1992)
Quantum resource Single prepared particles Entangled pairs from one source Entangled pairs from one source
Who prepares states Alice sends to Bob Source sends to both Source sends to both
Eavesdropping check Error rate on compared bits Bell (CHSH) violation Error rate, no Bell test
Security argument Disturbance from measurement Bell’s theorem Proven without Bell’s theorem; equivalent to BB84

So is E91 more secure than BB84? In the standard model, where honest parties trust their own devices to work as specified, the BBM92 result shows the entanglement-based and prepare-and-measure approaches are equivalent. The Bell test becomes more valuable when you stop trusting the devices, which leads to device-independent QKD. For the prepare-and-measure side, including real-world attacks on implementations, see our BB84 protocol explainer.

From E91 to device-independent QKD

In conventional QKD, security proofs assume the hardware behaves as modelled: the right states, the right measurements, no hidden side channels. Many practical attacks on QKD target exactly those assumptions. Device-independent QKD (DI-QKD) drops them. Alice’s and Bob’s devices are treated as black boxes, and security is derived only from the observed Bell violation and the input-output statistics.

This is a direct descendant of Ekert’s idea. If the measured correlations violate a Bell inequality, no pre-programmed or classically correlated device can have produced them, whoever built it. The Munich team’s 2022 paper credits Mayers and Yao with first proposing device-independent security.

The price is high. The Bell test has to be loophole-free in practice, which means high detection efficiency and high-fidelity entanglement across a distance. That is why DI-QKD was demonstrated only decades after E91.

Real experiments: Micius, the 2022 DI-QKD results and 100 km in 2026

Micius satellite, 2020

In Yin et al., Nature 582, 501–505 (15 June 2020), the Micius satellite delivered entangled photon pairs over two bidirectional downlinks to ground stations in Delingha and Nanshan, 1,120 km apart. The team reported entanglement-based QKD at a finite secret-key rate of 0.12 bits per second, “without the need for trusted relays.” The receivers were designed for fair sampling and immunity to known side channels. Phys.org noted that earlier direct ground-to-ground QKD had reached only about 100 km.

The 2022 device-independent experiments

Three DI-QKD experiments were reported in 2022. Two of them are covered here.

At Oxford, Nadlinger, Drmota and colleagues published “Experimental quantum key distribution certified by Bell’s theorem” in Nature in July 2022, explicitly following Ekert’s proposal. Using trapped strontium ions, they generated 95,628 device-independent key bits from 1.5 million Bell pairs over 8 hours. A review on arXiv lists the ions as 2 m apart and identifies this as the only full QKD run of the three, including classical post-processing. The measurements were not space-like separated.

In Munich, Zhang, van Leent, Redeker, Weinfurter and colleagues (Nature 607, 687, 28 July 2022) linked two rubidium atoms in buildings 400 m apart. They measured S = 2.578(75) and a quantum bit error rate of 0.078(9), corresponding to 0.07 secret bits per entanglement event in the asymptotic limit. The paper also described photonic DI-QKD over up to 220 m of fibre as “within reach.”

100 km of fibre, 2026

Bo-Wei Lu et al., Science 391, 592–597 (5 February 2026) reported DI-QKD between two single-atom nodes based on trapped Rydberg atoms, linked by 10 to 100 km of fibre. Heralded entanglement was created through single-photon interference. An expert comment via the Science Media Centre Spain pointed out an important caveat: both atoms were in the same lab, and the distance came from fibre spools rather than a deployed link between sites.

Limits of entanglement-based QKD today, and where it fits next to PQC

The experiments show real progress, and the numbers also show the limits:

  • Key rates are low. Micius managed 0.12 bits/s over 1,120 km. Oxford produced fewer than 100,000 key bits in 8 hours.
  • Distance is hard. The 100 km DI-QKD result used spooled fibre in one lab, not two separated sites.
  • Loopholes need care. Results differ in which assumptions they close. Oxford’s measurements, for example, were not space-like separated.
  • Hardware is specialised. Every link needs a quantum channel, entanglement sources and sensitive detectors, plus an authenticated classical channel.

These constraints explain why some security agencies remain sceptical of QKD as a general solution. Our article on why the NSA still won’t back quantum key distribution covers that position. Post-quantum cryptography (PQC) takes a different path. It runs on existing hardware and networks, and its security rests on mathematical problems believed to be hard for quantum computers, not on physics checked link by link.

A note on naming: Hadamard’s BB84 borrows its name from the 1984 QKD protocol, but it is not a QKD system. It is a hash-based, ECDSA-free Layer 2 rollup on Ethereum designed for post-quantum security, with accounts built on hash commitments instead of ECDSA keys. It sits on the PQC side of this divide: software, no quantum channel required.

FAQ

What’s the difference between E91 and BB84? Is E91 more secure?

BB84 has Alice send single prepared particles to Bob. E91 uses entangled pairs from one source and checks for eavesdropping with a Bell test. With trusted devices, BBM92 showed the entanglement-based approach is equivalent to BB84. E91’s Bell test only offers stronger guarantees in the device-independent setting.

How does a CHSH test reveal an eavesdropper, and what S value means secure?

Classical, locally determined correlations give |S| ≤ 2. Entanglement can reach 2√2 ≈ 2.828. An intercept-resend attack destroys entanglement and drives S toward 2. There is no single universal threshold: S must exceed 2, and the further above 2 it is (with a low error rate), the more secret key can be extracted.

Is E91 the same as device-independent QKD?

No. E91 introduced Bell-test-based security. DI-QKD builds on that idea and goes further, deriving security from the observed violation without trusting how the devices work internally. That requires an essentially loophole-free Bell test, which became possible only in experiments from 2022 onward.

Has entanglement-based QKD worked outside the lab, and how fast is it?

Yes, at small scale. Micius distributed entanglement-based keys between ground stations 1,120 km apart in 2020, at 0.12 bits/s. Device-independent versions have so far reached 400 m between buildings (Munich, 2022) and 100 km of spooled fibre within one lab (2026).

Sources