Quantum cryptography: BB84 and E91

BB84 picks one of two Hermitian operators, σ_z or σₓ, and sends the eigenstate whose eigenvalue +1 or −1 carries the bit: |0⟩ or |1⟩ in the σ_z basis, |+⟩ = (|0⟩ + |1⟩)/√2 or |−⟩ = (|0⟩ − |1⟩)/√2 in the σₓ basis. The bases are mutually unbiased — every cross overlap satisfies |⟨i|j⟩|² = 1/2 — and that is the whole design. Average over the bit Alice might have sent and the density operator is (|0⟩⟨0| + |1⟩⟨1|)/2 = I/2 in one basis and (|+⟩⟨+| + |−⟩⟨−|)/2 = I/2 in the other: the two ensembles are the same operator, so no measurement, POVM or unitary Eve applies can tell her which basis is in play. She cannot copy the photon either: a unitary that cloned both |0⟩ and |+⟩ would have to preserve their inner product, ⟨0|+⟩ = ⟨0|+⟩², which fails because ⟨0|+⟩ = 1/√2 is neither 0 nor 1. Her only move is to measure something, and measuring σₓ on a σ_z eigenstate returns ±1 with probability 1/2 each and projects the state onto |±⟩. The information she gains and the disturbance she causes are the same event.

Run N rounds. In each, Alice draws a random bit and a random basis and sends the matching state; Bob draws his own random basis and measures σ_z or σₓ. Afterwards, over a public but authenticated classical channel, both announce which basis they used — never the outcome — and keep only the rounds where the bases agree. That is the sifted key, about N/2 bits long, and on it Bob's result equals Alice's bit whenever nothing intervened. Now they publish a random subset, say a tenth of it, compare bit by bit and count disagreements: the fraction is the quantum bit error rate Q. The revealed bits are discarded. With N = 10⁶ pulses, ideal detectors and no loss, that leaves 4.5 × 10⁵ candidate bits and an estimate of Q good to about ±0.1%. Real links add detector inefficiency and fibre loss of about 0.2 dB km⁻¹, so the sifted length falls as 10^{(−0.02 L/km)} and a 100 km link delivers roughly 1% of the photons sent — distance attacks the rate, not the security.

Let Eve intercept a fraction f of the photons, measure each in a random basis and resend the eigenstate she found. Half the time she picks Alice's operator, learns the bit exactly and passes it on unchanged. Otherwise she gets ±1 at random and resends a state with overlap 1/2 against each of Alice's basis states, so Bob, in Alice's basis, errs with probability 1/2. Hence Q = f × ½ × ½ = f/4, and Eve knows a fraction f/2 of the sifted key with certainty: 25% and one half at full interception. That describes one crude attack, not a bound. Let her instead measure the Breidbart operator (σ_z + σₓ)/√2, whose eigenstates sit at Bloch angle 45° between the two bases. For an incoming |0⟩ she obtains the +1 eigenstate with probability cos²(π/8) = 0.854 and resends it; Bob then reads 0 with probability cos⁴(π/8) + sin⁴(π/8) = 3/4. Same 25% disturbance, but she now guesses every sifted bit correctly with probability 0.854 instead of 0.75. Q measures how much Eve disturbed the key, not how much she knows; a security claim needs a bound that holds for every attack.

The bound that holds for every attack is Shor and Preskill's. Picture the sifted key as if it had been made by measuring shared Bell pairs: an error in the σ_z record is a bit flip, and Eve's information about the key is bounded by the rate of phase flips, the errors the σₓ record reveals. Correcting the bit flips costs h(Q_bit) bits per sifted bit; removing the phase flips — which is what privacy amplification does — costs h(Qₚₕₐₛₑ). BB84's basis symmetry makes the two equal, so r = 1 − 2h(Q) with h(Q) = −Q log₂Q − (1 − Q) log₂(1 − Q). At Q = 2%, h = 0.141 and r = 0.717; at Q = 5%, h = 0.286 and r = 0.427; at Q = 11.0%, h = 1/2 and r = 0. Above that, one-way post-processing yields nothing and the run is aborted, even though 11% is far below the 25% of naive interception — the gap between one attack and all attacks. Real error correction leaks more than the Shannon minimum: a Cascade-type protocol costs about c = 1.1 to 1.2 times h(Q), so r = 1 − (1 + c)h(Q) and the threshold falls to about 9.5% at c = 1.2. A finite key pays a further statistical penalty for estimating Q from a sample.

Ekert's protocol starts from a source of singlets |Ψ⁻⟩ = (|01⟩ − |10⟩)/√2, with Alice measuring along 0°, 45° or 90° and Bob along 45°, 90° or 135°. For the singlet E(a, b) = ⟨Ψ⁻|(a⋅σ ⊗ b⋅σ)|Ψ⁻⟩ = −cos(a − b), so coinciding directions give perfect anticorrelation: Bob flips his outcome and the pair is a key bit. The rounds with mismatched directions are published, and those with Alice at a = 0° or a′ = 90° and Bob at b = 45° or b′ = 135° are assembled into S = E(a, b) − E(a, b′) + E(a′, b) + E(a′, b′), 2√2 in magnitude for a clean singlet and at most 2 for any local hidden-variable description, including any record Eve kept. A noisy or tampered source is a Werner state ρ = V|Ψ⁻⟩⟨Ψ⁻| + (1 − V)I/4, and since every Pauli matrix is traceless the noise term drops out: E = −V cos(a − b), |S| = 2√2 V, and the matched-basis error rate is Q = (1 − V)/2. The violation disappears at V = 1/√2, where Q = 14.6%, yet a positive key needs Q < 11%, that is V > 0.78 and |S| > 2.2: here a Bell violation is necessary for a key and not sufficient. Device independence, trusting only the observed S, gives r ≥ 1 − h(Q) − h[(1 + √(S²/4 − 1))/2], positive for depolarising noise only below Q ≈ 7.1%.

Each proof is a theorem with hypotheses. First, one photon per pulse. An attenuated laser is Poissonian: at mean μ = 0.1 the chance of two or more photons is 1 − e^(−μ)(1 + μ) ≈ μ²/2 = 0.5%, and there Eve keeps one photon, waits for the basis announcement and reads the bit undisturbed: photon-number splitting. Decoy states, pulses at randomly varied μ, expose it and restore a proof at a lower rate. Second, an authenticated classical channel. Forgeable announcements let Eve play Bob to Alice and Alice to Bob; Wegman–Carter authentication stops that but spends a pre-shared key, so QKD expands a secret rather than creating one. Third, honest devices. The proof assumes the source emits the four stated states and the detectors implement the σ_z and σₓ projectors; bright-light blinding turned real avalanche photodiodes into classical switches and stole full keys. Device independence keeps only the Bell violation, yet still assumes no leakage from the laboratory, free setting choices and correct quantum mechanics. A distilled key is only a key; encrypting the message is a separate step.