Q044 · Prepare / sift / reveal

BB84 Key Distribution

In BB84, which bits are kept for the key after the two sides compare notes in public? Only the bits where sender and receiver happened to use the same basis, minus a random sample they reveal to estimate the error rate. A high error rate can mean an eavesdropper. Error correction and privacy amplification then shorten the key further.

Send signals in four states through a channel, with or without an eavesdropper who intercepts and resends them. Keep the bits where the bases match, reveal a random subset as a test, then look at a simple parity filter and a binary hash. Every kept or discarded bit can be traced back to what was sent.

Model sifted error probability $\text{—}$

Model detected and matched fraction $\text{—}$

Make a prediction

Can an observer read every signal without changing the tested bits?

Send a batch. Press Next to sift the bits, test a public sample, then see what the simplified postprocessing costs.

Choose a prediction, compare the cases, then acquire.

Inspect the same record at each processing stage

Intercept–resend fraction

f

0

Independent detection probability

\eta

1

Public test selection fraction

r

0.25

Basis choices are independent and uniform. Changing any source or channel setting starts a new record.

Timing, errors and sampling

Independent Bob readout flip

q

0

Sent signals per batch

N

400

Simulation seed

s

1984

The protocol is simulated one qubit at a time. Each basis is chosen uniformly and independently, loss does not depend on the result, and Bob's readout can flip bits. The classical channel is assumed to be authenticated. Postprocessing shows pair-parity rejection and a public Toeplitz hash that shortens the string to an arbitrarily chosen half length; it does not establish a secure key length. All exported bits are teaching data and must never be used as real secrets.

Recorded evidence and resource cost

Simulated trials

Where the bits went

Test errors come only from the random subset that is revealed publicly. The pointwise 95% Wilson intervals describe this model’s test error probability. They are not a security bound on the remaining bits. Loss does not depend on the bit or the basis.

Public test errors / 95% range

\text{—}

Untested sifted bits

\text{—}

Sent / detected signals

\text{—}

Start with the essentials

Focus question: If the public test shows zero errors, does that guarantee the unrevealed string?
One-sentence intuition: A finite test only estimates the error rate, and only under certain assumptions. It cannot identify a particular attack, and on its own it cannot prove a secure key length.

Core mathematical model

Four signal states

|0\rangle,\ |1\rangle,\ |+\rangle=\frac{|0\rangle+|1\rangle}{\sqrt2},\ |-\rangle=\frac{|0\rangle-|1\rangle}{\sqrt2}

Each signal is a qubit. Measuring in the same basis gives a definite result; measuring in the other basis gives either outcome with equal probability.

Expected rates for the channel

P(\mathrm{sifted})=\eta/2,\qquad Q=q+(1-2q)f/4

For the intercepted fraction, Eve measures in a uniformly random basis and resends. Detection happens independently, and the readout flip is applied at Bob. The formula is a separate reference; it is never estimated from the recorded data.

Public test estimate

\widehat Q=\frac{N_{\mathrm{test,error}}}{N_{\mathrm{test}}}

Each sifted trial is randomly marked in advance as a test or not, independently of the others. Revealing the mark does not redraw it. The Wilson ranges are pointwise intervals for this independent, identically distributed probability, not finite-key security bounds.

Pair-parity rejection

p_A=a_1\oplus a_2,\quad p_B=b_1\oplus b_2

For each pair of bits, both parties publish one parity. If the parities disagree, both bits are dropped; if they agree, only the first bit is kept. Two errors in the same pair can go undetected. A final bit with no partner is discarded.

Toeplitz demonstration

y_i=\bigoplus_{j=0}^{n-1}T_{ij}x_j,\quad T_{ij}=s_{n-1-j+i}

A public, reproducible binary seed defines the matrix. Both strings are hashed down to half of their remaining length. That compression is arbitrary: it does not come from an entropy bound, so this is not certified privacy amplification.

Common difficulties

Loss versus disturbance

Typical misconceptionLosing signals automatically raises the error rate.

Better mental modelIn this model loss is independent of the signal, so it only shrinks the sample. The expected error rate among detected bits stays the same.

Detecting an attack

Typical misconceptionAny disagreement proves Eve was present.

Better mental modelReadout noise also causes errors. And in a finite sample, seeing zero errors does not rule out interception.

This is not a real key

Typical misconceptionThe final hashed string can encrypt a real message.

Better mental modelThe Lab has no cryptographic random source, no implementation of an authenticated channel, no finite-key entropy analysis and no final check that the two keys are equal. The full teaching record also exposes the private values.

Run the experiment

01
Transmit
Send a clear-channel batch and view the received signals.
What to observe: Without noise, results in the same basis agree. When the bases differ, the results are random even with no eavesdropper.
02
Sift and reveal
Advance through matching bases and public tests.
What to observe: Test bits are removed from the candidate string. Revealing a larger fraction costs more bits but gives more test data.
03
Add an eavesdropper
Intercept every signal, send a fresh batch and reveal tests.
What to observe: With no other noise, the expected error rate after sifting is one quarter; a finite sample fluctuates around it.
04
Inspect postprocessing
Advance to the last stage and export the parity/hash audit.
What to observe: Look at the published parities, the public matrix seed and both output strings. Even equal outputs are not proof of secrecy.