⇄Quantum key distribution protocols

What QKD does and does not do

Quantum key distribution lets two parties, Alice and Bob, grow a shared random secret key over an insecure quantum channel plus an authenticated public classical channel. Its security comes from the laws of physics (non-orthogonal states cannot be cloned or measured without disturbance), not from computational hardness. The key is then normally used with a one-time pad or with a symmetric cipher such as AES.

Generic workflow shared by almost all protocols:

1. Quantum transmission of encoded states (or entangled pairs).
2. Sifting / basis reconciliation over the public channel.
3. Parameter estimation: sample bits to estimate the error rate (QBER).
4. Information reconciliation: classical error correction.
5. Privacy amplification: hash to a shorter, near-uniform key.

BB84 (Bennett–Brassard, 1984)

The first QKD protocol. Alice encodes each random bit in a randomly chosen basis (Z or X); Bob measures in a random basis; they keep only the positions where bases agree.

Why an eavesdropper is detected

Suppose Eve intercepts every photon, measures in a random basis and resends. In sifted positions (Alice and Bob bases equal): half the time Eve guessed the basis and causes no error; half the time she guessed wrong and Bob’s outcome is a coin flip, an error with probability $\tfrac12$. So

while honest fibre noise gives roughly 1–3%. Comparing a random subset of sifted bits therefore exposes Eve, and she also learns on average only 50% of the key bits.

Key rate and the 11% threshold

For BB84 with one-way post-processing, the asymptotic secret fraction (Shor–Preskill 2000; Lo–Chau 1999) is

with binary entropy $h$, bit error $e_{\rm bit}$, phase error $e_{\rm ph}$ and reconciliation inefficiency $f\gtrsim1$. For $f=1$ the rate vanishes at $Q\approx11\%$. The six-state protocol tolerates about 12.6%. Real systems add finite-key penalties, so practical thresholds are lower.

B92, six-state and SARG04

• B92 (Bennett 1992). Only two non-orthogonal states: $|0\rangle$ for bit 0 and $|+\rangle$ for bit 1, with $|\langle0|+\rangle|^2=\tfrac12$. Bob keeps only conclusive outcomes (about 25% of photons in the ideal case) and announces which positions were conclusive. Simple, but lossy and sensitive to loss attacks.
• Six-state (Bruß 1998). Uses all three mutually unbiased bases (Z, X, Y). More disturbance per unit of Eve’s information, higher error tolerance (≈12.6%), 1/3 sifting efficiency.
• SARG04 (Scarani, Acín, Ribordy, Gisin 2004). Same four states as BB84, but sifting announces a pair of non-orthogonal states, one of which Alice sent. More robust than BB84 against photon-number-splitting with weak coherent pulses, at lower key rate.

E91 and BBM92: entanglement-based QKD

E91 (Ekert 1991). A source distributes pairs in $|\Phi^+\rangle$. Alice measures along one of three angles (0°, 45°, 90°), Bob along (45°, 90°, 135°). Matching-angle runs give a key; the others estimate the CHSH value $S$. If $|S|$ is near $2\sqrt2$ the pairs are genuinely entangled and Eve has no information; if $|S|\le2$, abort.

BBM92 (Bennett–Brassard–Mermin 1992) drops the Bell test and uses two bases on each side, equivalent to BB84 with an entangled source. The source can sit with Alice, Bob or an untrusted middle party, which suits free-space and satellite links (see Quantum communication).

Time-bin and distributed-phase-reference: COW and DPS

For fibre, phase and time-bin encodings avoid polarization drift. Coherent one-way (COW) sends a weak pulse in the first or second of two time slots (bit 0/1) or a decoy sequence, and monitors coherence between pulses. Differential-phase-shift (DPS) encodes bits in the phase difference between consecutive pulses. Both need only a laser, an intensity or phase modulator and a simple interferometer, giving practical high-speed systems, but their security proofs are more restricted than BB84’s and some attacks exist in particular regimes.

Continuous-variable QKD (CV-QKD)

Instead of single-photon clicks, Alice modulates the quadratures of coherent states with Gaussian-distributed values (GG02; Grosshans–Grangier 2002) and Bob performs homodyne or heterodyne detection with the same components as classical coherent optical communications. Security against collective attacks, and composable finite-size proofs for coherent states, have been established. Advantages: standard telecom hardware, integration with classical channels, high rates at metropolitan distances. Limits: excess-noise sensitivity and reconciliation efficiency restrict range (typically on the order of 100 km).

Measurement-device-independent QKD (MDI-QKD)

(Lo, Curty, Qi 2012.) Alice and Bob each send states to an untrusted middle node, Charlie, who performs a Bell-state measurement and announces the result. Because key bits are inferred from correlations, all detector side channels are removed, even if Eve controls Charlie. Cost: requires two-photon interference (Hong–Ou–Mandel) at the relay, reducing rate, and still trusts the sources. See beam splitters and HOM.

Twin-field QKD (TF-QKD)

(Lucamarini et al., Nature 2018.) Alice and Bob send phase-randomised weak pulses to a midpoint where single-photon interference is detected. The key rate scales as $\sqrt\eta$ instead of $\eta$ in the total-channel transmittance, beating the repeaterless PLOB bound at long distance without quantum memories. USTC demonstrated TF-QKD over 1002 km of fibre with a secure rate of about 0.0034 bit/s (PRL 130, 210801, 2023). Phase stabilisation of the two distant lasers is the main engineering challenge.

Device-independent and semi-quantum variants

• Device-independent QKD (DI-QKD) (Mayers–Yao; Acín et al. 2007). Security from observed Bell violation only, treating devices as black boxes. Needs loophole-free Bell tests, achieved for Bell experiments in 2015. Proof-of-principle DI-QKD demonstrations followed in 2022 but at very low rates and short distance.
• Detector-device-independent / one-sided DI protocols relax assumptions between BB84 and full DI.
• Semi-quantum QKD (Boyer et al. 2007). One party is restricted to classical operations.
• Counterfactual QKD (Noh 2009). Key bits are inferred when no photon traverses the channel, via interaction-free measurement.

Protocol comparison

Summary of the main protocols.