= Solution
<Quantum cryptography> includes <quantum key distribution>, which uses quantum transmissions and authenticated public discussion to establish a secret random key. In <BB84>, the sender independently chooses a random <bit> and either the computational or Hadamard basis, sending one of $|0\rangle,|1\rangle,|+\rangle,|-\rangle$. A receiver independently chooses one of those two bases. They announce bases after receipt, retain matching-basis positions and reveal a random sample of those bits to estimate noise or eavesdropping. Ideal uniform independent basis choices retain about half of the detected signals before testing and further processing.<Quantum cryptography: Public key distribution and coin tossing by Charles H. Bennett and Gilles Brassard>[1984 key-distribution protocol; original proceedings pp. 175–179]{ref}
The <no-cloning theorem> prevents an adversary from copying arbitrary unknown nonorthogonal signal states perfectly. In a simple intercept–resend attack, the adversary chooses a random protocol basis. On half of the sifted positions it is the wrong basis, and the resent state then yields an erroneous receiver bit with <probability> one half. Thus the <BB84 intercept-resend error rate> is
$$
\boxed{Q=\frac12\cdot\frac12=\frac14}
$$
if every signal is intercepted, or $Q=q/4$ when an independently selected fraction $q$ is attacked this way. This is an illustrative attack calculation, not a security proof against all possible quantum attacks.
After parameter estimation, classical error reconciliation aligns the remaining keys; <privacy amplification> compresses them to remove the adversary's bounded information, including information leaked during public reconciliation. The classical channel requires <message authentication>, otherwise an attacker could impersonate each party to the other. Real sources, losses, multiphoton pulses and detector behavior must fit the security model. A low observed error rate alone is insufficient to certify arbitrary hardware. Finally the protocol distributes a key; encrypting a later message is a separate step.
Back to article page
