There’s a persistent confusion in how quantum cryptography gets discussed, and it’s worth clearing up before going any further: quantum key distribution (QKD) and post-quantum cryptography (PQC) solve two related but genuinely different problems, using completely different underlying technology. QKD uses quantum mechanics itself — photons, superposition, measurement — to distribute encryption keys with security guaranteed by physical law rather than mathematical hardness. PQC, by contrast, is ordinary classical cryptography, running on ordinary classical computers, designed using math problems believed to resist attack even from a future quantum computer. This article covers QKD and its founding protocol, BB84. I’ve written a companion piece specifically on post-quantum cryptography, so if what you actually need is guidance on migrating TLS or your PKI, that’s the one to read — but understanding QKD is genuinely useful context, both because it’s the older idea historically and because it illustrates something PQC fundamentally cannot: security backed by physics rather than computational assumptions.
The Problem QKD Solves
Classical key distribution — the process of getting a shared secret key safely into the hands of two parties who want to communicate securely — has always rested on computational hardness assumptions. RSA’s security rests on the difficulty of factoring large integers; Diffie-Hellman rests on the discrete logarithm problem. Both are secure today because no known classical algorithm solves these problems efficiently. But “no known algorithm” is not the same as “provably impossible,” and as I cover in the companion PQC article, both problems are efficiently solvable by a sufficiently large fault-tolerant quantum computer running Shor’s algorithm.
QKD takes an entirely different security foundation. Instead of relying on a math problem being hard to solve, it relies on a fact about quantum measurement: you cannot measure an unknown quantum state without disturbing it, and you cannot perfectly copy an unknown quantum state at all. These aren’t engineering limitations that better technology might overcome — they’re consequences of the structure of quantum mechanics itself, specifically the no-cloning theorem, which proves that no physical process can create an identical copy of an arbitrary unknown quantum state. If an eavesdropper tries to intercept and measure quantum-encoded key material in transit, that measurement necessarily disturbs the transmitted states in a statistically detectable way. QKD protocols are built to exploit exactly this fact: the two legitimate parties can detect the presence of an eavesdropper by checking for exactly this kind of disturbance.
BB84: The Founding Protocol
BB84, named for its inventors Charles Bennett and Gilles Brassard and the year of publication, 1984, is the original and still most widely implemented QKD protocol. It’s worth walking through step by step, because the elegance of the scheme really only becomes clear once you see the whole sequence.
Step 1: Alice prepares qubits in randomly chosen bases. Alice (the conventional name for the sender in cryptography) wants to send Bob a string of random bits that will become their shared secret key. For each bit, she randomly chooses one of two conjugate measurement bases — typically the rectilinear basis (${|0\rangle, |1\rangle}$, representing horizontal/vertical photon polarization) or the diagonal basis (${|+\rangle, |-\rangle}$, representing diagonal polarization at 45°/135°), where:
$$|+\rangle = \frac{1}{\sqrt{2}}(|0\rangle + |1\rangle), \quad |-\rangle = \frac{1}{\sqrt{2}}(|0\rangle – |1\rangle)$$
For each bit she wants to send, Alice randomly picks a basis and a bit value, encodes that bit as a photon polarized accordingly, and sends it to Bob. So a single photon might encode a “0” in the rectilinear basis (horizontal polarization), or a “1” in the diagonal basis (135° polarization), and so on, with the basis choice made independently and randomly for each bit.
Step 2: Bob measures in randomly chosen bases. Bob doesn’t know which basis Alice used for any given photon, so for each incoming photon, he also independently and randomly chooses to measure in either the rectilinear or diagonal basis. This is the crux of the protocol’s security. If Bob happens to measure in the same basis Alice used to encode, he’ll recover the correct bit with certainty (in the idealized, noiseless case). If he measures in the wrong, conjugate basis, quantum mechanics guarantees he gets a completely random result, uncorrelated with what Alice sent — this is a direct consequence of the Heisenberg uncertainty principle applied to conjugate observables: measuring in the wrong basis provides zero information about a state prepared in the other basis, and irrevocably disturbs the state in the process.
Step 3: Basis reconciliation (sifting). After all photons have been sent and measured, Alice and Bob communicate over an ordinary public classical channel — this channel doesn’t need to be secret, only authenticated, meaning both sides need confidence they’re really talking to each other and not to an impersonator. They each announce, bit by bit, which basis they used for each photon — but not the actual bit values. Wherever their bases matched, they keep the corresponding bit; wherever they didn’t match, they discard that bit. On average, their bases will agree about half the time by pure chance, so roughly half the transmitted bits survive this step. The surviving bits are called the sifted key.
Step 4: Eavesdropper detection. This is where the no-cloning theorem does its work. Suppose an eavesdropper, conventionally named Eve, intercepts photons in transit, measures them (necessarily guessing at a basis, since she doesn’t know which one Alice used any more than Bob does), and then forwards a newly prepared photon on to Bob to avoid detection. Whenever Eve guesses the wrong basis — which happens, on average, half the time — her measurement collapses the photon’s state into her guessed basis, and the photon she then forwards to Bob no longer carries the same encoded information Alice originally sent. Even if Bob happens to measure in the correct basis (matching Alice’s original choice) in this scenario, he’ll now get the wrong bit value roughly half the time, because Eve’s intervening measurement corrupted the state. Alice and Bob detect this by publicly comparing a randomly chosen subset of their sifted key bits (sacrificing those bits, since they’re now public) and checking the error rate. In the absence of eavesdropping, over an ideal channel, this error rate should be zero (or, on real hardware, some small baseline value attributable to channel noise and detector imperfections). Eve’s interference introduces additional detectable errors — roughly a 25% error rate on the compared bits, in the simplest analysis, for an eavesdropper measuring every photon in a randomly chosen basis. If the measured error rate exceeds an expected threshold, Alice and Bob know the channel isn’t secure and discard the key entirely, trying again (or investigating the source of the disturbance).
Step 5: Privacy amplification and error correction. Even without an eavesdropper, real-world channels are noisy, so the surviving sifted key typically still contains some errors and some information that may have partially leaked. Classical post-processing techniques — error-correcting codes to reconcile any remaining discrepancies between Alice’s and Bob’s keys, and privacy amplification (a form of universal hashing) to shrink the key in a way that provably eliminates any partial information an eavesdropper might have gained — produce a final, shorter key that both parties can be confident is both identical and secret.
The output of this whole process is a shared secret bit string, generated with security guaranteed by the laws of quantum mechanics rather than by the assumed hardness of a math problem. That final key is then typically used with a conventional symmetric cipher like AES for actually encrypting the communication, since QKD is a key distribution scheme, not a full encryption protocol on its own.
E91 and Other Protocol Variants
BB84 isn’t the only QKD protocol, though it’s the most widely deployed. E91, proposed by Artur Ekert in 1991, takes a different theoretical approach, using entangled photon pairs and Bell inequality violations to certify security — instead of relying on the no-cloning argument directly, E91’s security proof rests on the fact that any eavesdropping necessarily reduces the degree of quantum entanglement (and thus the strength of Bell inequality violation) between Alice’s and Bob’s photons, which is independently verifiable. Other variants like B92 simplify BB84 by using only two non-orthogonal states rather than four, trading some efficiency for implementation simplicity. Continuous-variable QKD protocols encode information in continuous properties of light (like the quadratures of a coherent state) rather than discrete photon polarization states, which can offer compatibility advantages with existing telecom infrastructure and standard photodetectors rather than requiring specialized single-photon detectors.
Real-World Implementation and Deployment
QKD is not a theoretical proposal — it’s deployed, commercially available technology, though at a genuinely more limited scale than internet-scale classical cryptography. Companies including ID Quantique, Toshiba, and others sell commercial QKD hardware. China has built the most extensive QKD infrastructure demonstrated to date, including the Beijing-Shanghai fiber backbone spanning roughly 2,000 kilometers with trusted-node relays, and the Micius satellite, launched in 2016, which has demonstrated satellite-to-ground QKD and even intercontinental QKD-secured communication via satellite relay between China and Europe.
That said, real-world QKD deployment faces meaningful practical constraints worth understanding clearly:
Distance limitations. Photons get absorbed and scattered in optical fiber, and unlike classical optical signals, quantum states carrying key information cannot be simply amplified partway through a fiber run — amplification requires measuring and copying the signal, which the no-cloning theorem forbids for quantum states, and which would defeat the entire security purpose of the scheme in any case. Practical single-span fiber QKD is generally limited to somewhere on the order of 100–200 kilometers before signal loss makes the protocol’s key generation rate impractically low, though ongoing photonics research continues to push this boundary.
Trusted-node relay architecture. To extend QKD beyond these distance limits, existing large-scale deployments like China’s backbone use intermediate “trusted nodes” — relay points that decrypt and re-encrypt the key material in the clear. This is a genuine security weakness in practice: it means every trusted node along the path is a point where the security model reverts from “physics-guaranteed” back to “as trustworthy as classical infrastructure security,” which is exactly the kind of assumption QKD was designed to avoid needing. Quantum repeaters — devices that could extend QKD range without this trusted-node weakness by using quantum error correction and entanglement swapping — remain an active area of research rather than mature deployed technology.
Infrastructure cost and specialized hardware. QKD requires dedicated fiber links (or free-space/satellite links) and specialized single-photon detection hardware, which is considerably more expensive and less mature as a manufacturing ecosystem than the classical networking equipment underlying the modern internet. This makes QKD, for now, primarily suited to specific high-value, point-to-point links — government communications, financial-sector backbone links between data centers — rather than a realistic drop-in replacement for how key exchange happens across the broader internet.
Authentication is still required, and it’s still classical. BB84’s security proof assumes Alice and Bob have an authenticated classical channel for the basis-reconciliation step. If an attacker can perform a man-in-the-middle attack on that classical channel, the whole protocol’s security guarantee falls apart, regardless of how well the quantum part works. In practice, this authentication is typically bootstrapped using classical pre-shared keys or classical digital signatures — which means real-world QKD deployments still have a classical cryptographic dependency, and if that classical authentication scheme were itself broken (say, by a future quantum computer, if RSA-based authentication were used), the overall system’s security could be compromised even though the quantum key exchange itself remained sound.
QKD vs. Post-Quantum Cryptography: Which Problem Does Each Solve?
This distinction is genuinely important for anyone making real security architecture decisions, so it’s worth stating plainly. QKD provides information-theoretic security for the specific task of key distribution over a direct physical link, based on the laws of physics rather than computational assumptions — a genuinely different and, in a narrow sense, stronger security guarantee than any classical scheme can offer. But it requires specialized point-to-point infrastructure, doesn’t scale to arbitrary internet-style routing the way classical public-key infrastructure does, and doesn’t address digital signatures, authentication, or the vast majority of cryptographic use cases beyond raw key exchange.
Post-quantum cryptography, covered in depth in the companion article, is a drop-in replacement approach: new classical algorithms, running on ordinary computers and ordinary networks, designed to resist quantum attack, deployable across existing internet infrastructure without any new specialized hardware. For essentially every organization worried about the “harvest now, decrypt later” threat to their data, PQC migration — not QKD deployment — is the practically relevant response, which is precisely why NIST’s standardization effort and the resulting FIPS 203/204/205 standards have become the primary focus of the industry’s near-term quantum-security planning.
Device-Independent and Measurement-Device-Independent QKD
One subtlety worth understanding, because it’s a genuine source of real-world vulnerability that pure textbook BB84 analysis often glosses over, is that the theoretical security proof of BB84 assumes perfectly ideal quantum hardware — perfect single-photon sources, perfectly characterized detectors. Real hardware never quite meets that ideal, and the gap between theory and implementation has been the source of several genuinely successful practical attacks on deployed QKD systems, none of which broke the underlying BB84 protocol itself, but which exploited specific hardware imperfections in real implementations.
The most well-known example is the detector-blinding attack, demonstrated by researchers including Vadim Makarov’s group, in which an eavesdropper shines bright continuous light at Bob’s single-photon detectors, forcing them out of their normal quantum-sensitive operating mode and into a classical, controllable regime where Eve can effectively dictate what result Bob’s detector reports, all without triggering the error-rate increase that BB84’s security proof relies on for eavesdropper detection. This is a genuinely important cautionary example: it’s an attack on the implementation, not the protocol, but from a practical security standpoint, that distinction matters little to the end user whose key material got compromised.
The field’s response to this class of vulnerability has been measurement-device-independent QKD (MDI-QKD) and, more ambitiously, device-independent QKD (DI-QKD). MDI-QKD restructures the protocol so that both Alice’s and Bob’s photons are sent to a possibly untrusted third party (who might even be Eve) for a joint Bell-state measurement, in a way that provably removes detector-side vulnerabilities from the security analysis entirely, since neither Alice nor Bob’s own detectors are ever directly exposed to whatever hardware is doing the final measurement. Fully device-independent QKD goes further still, aiming to certify security based purely on the observed statistics of a Bell inequality violation, without trusting the internal workings of either the source or the detection hardware — a theoretically very strong guarantee, though current DI-QKD demonstrations remain considerably more experimentally demanding and lower in key rate than standard BB84 implementations, keeping them, for now, more a research frontier than a widely deployed commercial technology.
Quantum Random Number Generation: A Related but Distinct Technology
It’s worth briefly distinguishing QKD from a related quantum technology that sometimes gets bundled into the same conversation: quantum random number generation (QRNG). QRNG uses quantum measurement processes — the arrival time of individual photons at a beamsplitter, for instance, where the outcome is fundamentally random according to quantum mechanics rather than merely difficult to predict — to generate genuinely random bit strings, useful as a high-quality entropy source for cryptographic key generation, Monte Carlo simulation, and other applications requiring true randomness rather than the deterministic pseudo-randomness produced by classical algorithmic random number generators. QRNG devices are commercially available today, considerably simpler and cheaper to deploy than full QKD systems (since they don’t require a matched sender-receiver pair or a dedicated communication link at all), and several are already integrated into commercial hardware security modules and even some consumer devices. It’s a useful example of a quantum technology delivering genuine, deployed, low-controversy practical value today, in contrast to the more infrastructure-heavy and more debated deployment picture for full QKD.
The Honest Assessment
QKD is real, deployed, physically elegant technology that solves a genuinely hard problem — detecting eavesdropping on a key exchange using the structure of quantum mechanics itself — in a way no classical scheme ever could. But it’s a specialized point-to-point tool, not internet infrastructure, and its practical deployments today still lean on classical trust assumptions at exactly the points (trusted-node relays, classical authentication bootstrapping) where the theoretical security guarantee would otherwise be strongest. Understanding both what BB84 actually proves and where its real-world deployments quietly reintroduce classical trust assumptions is the difference between citing QKD as a marketing buzzword and understanding it as an engineer or security professional actually needs to.
