Quantum Key Distribution

Nobody listening. Eve at 0%, noise at 0%. Watch the strip: wherever Alice’s and Bob’s basis symbols match, the bits match too, every time. About half the columns are filled, and the QBER curve sits on the floor. That is the sifted key: identical on both ends, and nothing has been transmitted that reveals it.

Eve at 100%. Every photon gets a rose ring. Rose squares appear in the kept row and the curve climbs to a quarter — not to zero, not to a half. Note the “Eve holds” number: she knows about three quarters of the sifted key, and Alice and Bob will never use it, because the curve went through the amber line.

Slide Eve down. QBER is a quarter of her interception fraction, so she crosses 11% at about 44%. Sit her at 40% and she is inside the threshold — she gets a slice of the key and the protocol still delivers one. That is what privacy amplification is for: the final-key count shrinks with the QBER so that what she has is hashed away.

Noise, no Eve. Set Eve to 0% and noise to 15%. The QBER climbs to 10% and the verdict hovers at the edge. Alice and Bob cannot tell noise from an eavesdropper — the security proof does not try, and blames Eve for all of it. This is why QKD range is limited: loss and dark counts raise the QBER until nothing is left.

Eve cannot copy the photon — no-cloning — so to learn anything she has to measure it, and to measure it she has to pick a basis. Half the time she picks Alice’s basis: her measurement reads the bit exactly, and the state she forwards is the state that arrived. Bob sees nothing.

The other half, she measures |0⟩ or |1⟩ in the diagonal basis and gets |+⟩ or |−⟩ at random. She forwards that. Now when Bob measures in Alice’s basis — the only positions that survive sifting — he gets a coin flip, and disagrees with Alice half the time. Half of a half is 25%. In the strip, every rose square sits under a column where Eve’s basis symbol differs from Alice’s; the unit tests check that no error ever occurs elsewhere.

The 25% is set by the physics of measurement, not by Eve’s equipment. Any measurement that extracts information about a non-orthogonal pair of states disturbs them, and the trade-off is quantitative: less disturbance means less information. The interception slider is the only knob she has, and it trades her knowledge against her visibility one for one.

The abort threshold is not a convention. After sifting, Alice and Bob run error correction (which leaks about h(Q) bits per key bit to the public channel, where h is the binary entropy) and privacy amplification (which discards another h(Q) per bit to erase what Eve could have learned from a disturbance of size Q). The Shor–Preskill rate is

r(Q) = 1 − 2 h(Q)

secret bits per sifted bit, and it hits zero at Q ≈ 0.110. That root is the amber line. Below it, the “Final key” counter is sifted bits × r(Q); above it, there is no rate, and the honest thing to do is to throw the run away. Better classical post-processing (two-way, or with pre-processing) pushes the threshold a little higher, but the arithmetic that produced 25% for Eve does not move.

Switch to E91. Nobody prepares a bit now. A source — which could be Eve’s — emits singlet pairs, and each side measures spin along one of three axes chosen at random: Alice from 0°, 45°, 90°, Bob from 45°, 90°, 135°. Two of the nine combinations are matched axes; there the singlet’s perfect anticorrelation gives Alice the complement of Bob’s bit, and those are the key.

Four of the remaining seven are exactly the four settings of a CHSH test, which BB84 would simply discard. From them Alice and Bob compute |S|. An untouched singlet gives 2√2 ≈ 2.83; any pair carrying a pre-agreed answer is bounded by 2. That is the same bound the Bell test page races against, and here it doubles as a security check. A violation proves the pair is entangled and rules out any pre-agreed answer; it does not by itself prove the pair is maximally entangled (every entangled pure pair violates CHSH by some margin). Monogamy of entanglement is quantitative: the closer |S| is to 2√2, the closer the pair is to a pure singlet and the less correlation a third party can hold, so the key QBER is checked as well.

Turn Eve up. She measures Bob’s qubit along one of his axes and forwards the eigenstate — the pair is now a product state with only classical anticorrelation, and its CHSH value is √2 whichever axis she chose. So |S| falls linearly, √2·(2 − f), and crosses 2 when she intercepts 58.6% of the pairs. She also corrupts the key: on a matched-axis pair her measurement is invisible only when she happened to pick that same axis.

Every qubit here is a genuine one- or two-qubit statevector on the same simulator as the circuit builder: Alice’s X and H gates, Eve’s projective measurement and re-preparation, the channel’s random Pauli, Bob’s measurement. The sifting yield, the 25%, the 2√2 and the √2 are outcomes, not parameters, and lib/viz/qkd.test.tschecks each against the value derived by hand.

What is missing is everything that breaks real systems. There is no photon loss, so no multi-photon pulses and no photon-number-splitting attack, and no decoy states to counter it. Detectors here cannot be blinded. The classical channel over which bases are announced is assumed authenticated; without that assumption Eve simply runs the protocol with each side and both of them share a key with her. And the “final key” is an asymptotic rate applied to a few thousand bits — a real finite-key analysis would keep fewer. The quantum cryptography lesson covers each of these, and why the practical answer to a quantum computer is post-quantum cryptography rather than a fibre link.