---
title: "BB84 Key Distribution Interactive Lab | Sandbox Physics"
description: "In BB84, which bits are kept for the key after the two sides compare notes in public?"
canonical_url: "https://sandboxphysics.com/labs/bb84-key-distribution/"
language: "en"
page_type: "lab"
alternate_languages:
  zh-CN: "https://sandboxphysics.com/zh/labs/bb84-key-distribution/"
last_modified: "2026-10-27"
---

Q044 · Prepare / sift / reveal

# BB84 Key Distribution

**In BB84, which bits are kept for the key after the two sides compare notes in public?** Only the bits where sender and receiver happened to use the same basis, minus a random sample they reveal to estimate the error rate. A high error rate can mean an eavesdropper. Error correction and privacy amplification then shorten the key further.

Send signals in four states through a channel, with or without an eavesdropper who intercepts and resends them. Keep the bits where the bases match, reveal a random subset as a test, then look at a simple parity filter and a binary hash. Every kept or discarded bit can be traced back to what was sent.

> Interactive simulation: open this page in a web browser to change the parameters and run the model.

The protocol is simulated one qubit at a time. Each basis is chosen uniformly and independently, loss does not depend on the result, and Bob's readout can flip bits. The classical channel is assumed to be authenticated. Postprocessing shows pair-parity rejection and a public Toeplitz hash that shortens the string to an arbitrarily chosen half length; it does not establish a secure key length. All exported bits are teaching data and must never be used as real secrets.

Recorded evidence and resource cost

Simulated trials

## Where the bits went

Test errors come only from the random subset that is revealed publicly. The pointwise 95% Wilson intervals describe this model’s test error probability. They are not a security bound on the remaining bits. Loss does not depend on the bit or the basis.

Public test errors / 95% range

$\text{—}$

Untested sifted bits

$\text{—}$

Sent / detected signals

$\text{—}$

Physics tutorial

## Follow the public transcript

**Background** Alice picks a random bit and one of two bases. Bob picks his own basis independently. After the transmission they compare bases in public and keep only the detected events where the bases match.

**Why it matters** The public test uses up part of the sifted bits. Postprocessing has to account for everything that was made public and for the errors that remain; not every surviving bit is secret.

Start with the essentials

- **Focus question**: If the public test shows zero errors, does that guarantee the unrevealed string?
- **One-sentence intuition**: A finite test only estimates the error rate, and only under certain assumptions. It cannot identify a particular attack, and on its own it cannot prove a secure key length.

### Core mathematical model

#### Four signal states

$$
|0\rangle,\ |1\rangle,\ |+\rangle=\frac{|0\rangle+|1\rangle}{\sqrt2},\ |-\rangle=\frac{|0\rangle-|1\rangle}{\sqrt2}
$$

Each signal is a qubit. Measuring in the same basis gives a definite result; measuring in the other basis gives either outcome with equal probability.

#### Expected rates for the channel

$$
P(\mathrm{sifted})=\eta/2,\qquad Q=q+(1-2q)f/4
$$

For the intercepted fraction, Eve measures in a uniformly random basis and resends. Detection happens independently, and the readout flip is applied at Bob. The formula is a separate reference; it is never estimated from the recorded data.

#### Public test estimate

$$
\widehat Q=\frac{N_{\mathrm{test,error}}}{N_{\mathrm{test}}}
$$

Each sifted trial is randomly marked in advance as a test or not, independently of the others. Revealing the mark does not redraw it. The Wilson ranges are pointwise intervals for this independent, identically distributed probability, not finite-key security bounds.

#### Pair-parity rejection

$$
p_A=a_1\oplus a_2,\quad p_B=b_1\oplus b_2
$$

For each pair of bits, both parties publish one parity. If the parities disagree, both bits are dropped; if they agree, only the first bit is kept. Two errors in the same pair can go undetected. A final bit with no partner is discarded.

#### Toeplitz demonstration

$$
y_i=\bigoplus_{j=0}^{n-1}T_{ij}x_j,\quad T_{ij}=s_{n-1-j+i}
$$

A public, reproducible binary seed defines the matrix. Both strings are hashed down to half of their remaining length. That compression is arbitrary: it does not come from an entropy bound, so this is not certified privacy amplification.

### Common difficulties

#### Loss versus disturbance

**Typical misconception** Losing signals automatically raises the error rate.

**Better mental model** In this model loss is independent of the signal, so it only shrinks the sample. The expected error rate among detected bits stays the same.

#### Detecting an attack

**Typical misconception** Any disagreement proves Eve was present.

**Better mental model** Readout noise also causes errors. And in a finite sample, seeing zero errors does not rule out interception.

#### This is not a real key

**Typical misconception** The final hashed string can encrypt a real message.

**Better mental model** The Lab has no cryptographic random source, no implementation of an authenticated channel, no finite-key entropy analysis and no final check that the two keys are equal. The full teaching record also exposes the private values.

### Run the experiment

1. 01

   #### Transmit

   Send a clear-channel batch and view the received signals.

   **What to observe:** Without noise, results in the same basis agree. When the bases differ, the results are random even with no eavesdropper.

2. 02

   #### Sift and reveal

   Advance through matching bases and public tests.

   **What to observe:** Test bits are removed from the candidate string. Revealing a larger fraction costs more bits but gives more test data.

3. 03

   #### Add an eavesdropper

   Intercept every signal, send a fresh batch and reveal tests.

   **What to observe:** With no other noise, the expected error rate after sifting is one quarter; a finite sample fluctuates around it.

4. 04

   #### Inspect postprocessing

   Advance to the last stage and export the parity/hash audit.

   **What to observe:** Look at the published parities, the public matrix seed and both output strings. Even equal outputs are not proof of secrecy.

Physical conclusion

Every bit you keep has a cost. Authentication, error estimation, information reconciliation and privacy amplification each need their own justification.

Quantum & fields · Starter path

## Start from a single measurement

Predict an outcome, then count what the measurements actually give. The path starts with one qubit and moves on to wave packets, bound states and two-photon interference.

[Start here → **Quantum State & Born Measurement** Predict a probability, turn the analyzer, then compare your prediction with the measured frequency over many shots. Observe · 15 min](https://sandboxphysics.com/labs/qubit-state/)

1. [1 Quantum State & Born Measurement](https://sandboxphysics.com/labs/qubit-state/)
2. [2 Stern–Gerlach Sequence](https://sandboxphysics.com/labs/stern-gerlach-sequence/)
3. [3 Wave Packet & Uncertainty](https://sandboxphysics.com/labs/wave-packet-uncertainty/)
4. [4 Quantum Harmonic Oscillator](https://sandboxphysics.com/labs/quantum-harmonic-oscillator/)
5. [5 Which Path & Quantum Eraser](https://sandboxphysics.com/labs/quantum-eraser/)
6. [6 Hong–Ou–Mandel Two-Photon Interference](https://sandboxphysics.com/labs/hong-ou-mandel/)

[View the full path →](https://sandboxphysics.com/topics/quantum/#starter-path)