Past exam of the quantum information course of the University of Cambridge / 2013 / Paper 1 / 3 / c

Quantum cryptography includes quantum key distribution, which uses quantum transmissions and authenticated public discussion to establish a secret random key. In BB84, the sender independently chooses a random bit and either the computational or Hadamard basis, sending one of $|0⟩,|1⟩,|+⟩,|-⟩$. A receiver independently chooses one of those two bases. They announce bases after receipt, retain matching-basis positions and reveal a random sample of those bits to estimate noise or eavesdropping. Ideal uniform independent basis choices retain about half of the detected signals before testing and further processing.^[ref]

The no-cloning theorem prevents an adversary from copying arbitrary unknown nonorthogonal signal states perfectly. In a simple intercept–resend attack, the adversary chooses a random protocol basis. On half of the sifted positions it is the wrong basis, and the resent state then yields an erroneous receiver bit with probability one half. Thus the BB84 intercept-resend error rate isif every signal is intercepted, or $Q=q/4$ when an independently selected fraction $q$ is attacked this way. This is an illustrative attack calculation, not a security proof against all possible quantum attacks.

After parameter estimation, classical error reconciliation aligns the remaining keys; privacy amplification compresses them to remove the adversary's bounded information, including information leaked during public reconciliation. The classical channel requires message authentication, otherwise an attacker could impersonate each party to the other. Real sources, losses, multiphoton pulses and detector behavior must fit the security model. A low observed error rate alone is insufficient to certify arbitrary hardware. Finally the protocol distributes a key; encrypting a later message is a separate step.