Quantum Cryptography

Bennett and Brassard published BB84 in 1984, and it remains the cleanest illustration of what quantum mechanics buys you in cryptography. The goal is narrow and worth stating precisely: Alice and Bob want to end up holding the same random bit string, with a guarantee that no third party knows it. Not to send a message — to establish a shared secret key, which they will then use with ordinary classical encryption.

Step one. For each bit, Alice picks two random choices: a bit value (0 or 1) and a basis (rectilinear, {|0⟩, |1⟩}, or diagonal, {|+⟩, |−⟩}). She encodes accordingly — bit 0 in the rectilinear basis is |0⟩, bit 1 in the diagonal basis is |−⟩, and so on — and sends the photon to Bob.

Step two. Bob, who has no idea which basis Alice used, picks a basis at random for each arriving photon and measures. When his basis matches Alice's, he gets her bit with certainty. When it does not, he gets a uniformly random result, because |0⟩ measured in the diagonal basis is a fair coin. So about half his measurements are correct and half are noise, and he cannot tell which are which.

Step three, basis reconciliation. Over a public, authenticated but not secret channel, Alice and Bob announce which basis they used for each photon — never the bit values. They discard every position where the bases differed, roughly half of them. What remains is the sifted key, and in a noiseless world with no eavesdropper it is identical on both sides.

Step four, the check. They sacrifice a random subset of the sifted key by publicly comparing the actual bits. If those agree, the rest of the key is sound and gets discarded from the key material (having been made public). If they disagree at more than a small rate, something interfered, and they throw the whole thing away and start over. That subset comparison is where the security lives.