The BB84 protocol (Bennett-Brassard, 1984)

The first quantum key distribution protocol, BB84, was proposed in 1984 by Charles Bennett and Gilles Brassard. It is the reference protocol of QKD.

Two measurement bases

Alice encodes each bit by choosing one of two polarization bases:

• the rectilinear basis +: vertical (0) or horizontal (1);
• the diagonal basis x: 45° (0) or 135° (1).

The crucial point: if Bob measures a photon in the same basis as Alice, he recovers the correct bit for sure. If he measures in the wrong basis, his result is random (0 or 1 at random), and therefore unusable.

How the protocol unfolds

1. For each photon, Alice draws a random bit and a random basis, then sends the photon.
2. For each photon received, Bob draws a random basis and measures.
3. Basis reconciliation (sifting): over a public channel, Alice and Bob announce the bases used (never the bits).
4. They keep only the positions where the bases match. Elsewhere, Bob's measurement is unreliable: it is discarded.

The kept bits form the raw key, shared by both.

A step-by-step example

Position          1    2    3    4    5    6    7    8
Bit d'Alice       1    0    1    1    0    0    1    0
Base d'Alice      +    x    +    x    x    +    +    x
Base de Bob       +    +    x    x    x    +    x    x
Bases identiques  oui  non  non  oui  oui  oui  non  oui
Bit conservé      1    -    -    1    0    0    -    0

Out of 8 photons, the bases match 5 times: the shared key is 1 1 0 0 0. On average, since Bob guesses the correct basis one time in two, about half the bits are kept.

What an eavesdropper sees on the public channel

The public announcement reveals only the bases, not the bits. Knowing that Alice used basis + at position 1 tells nothing about the value (0 or 1) of the bit. The secret stays protected.

Why the bases must be random

The random choice of bases by Alice and by Bob is essential. If Eve wanted to read a photon in flight, she too would have to choose a basis without knowing which one Alice used. Since no one can guess in advance the basis of a given photon, an eavesdropper is forced to gamble — and is wrong half the time. It is precisely this randomness that will make her eavesdropping detectable, as the next chapter will show.

From raw key to final key

The kept bits form the raw key. It is not yet usable as is: the real channel introduces noise, and it must be verified that no eavesdropper has listened in. Two steps therefore follow basis reconciliation: estimating the error rate (next chapter), then error correction and privacy amplification, which produce the final secret key, identical for Alice and Bob.

In summary

In BB84, Alice sends photons encoded in random bases (rectilinear + or diagonal x) and Bob measures in random bases. After the public announcement of the bases alone, they keep only the positions where the bases match: this is basis reconciliation. These common bits form the shared key, roughly half of the photons sent.