Quantum key distribution

Quantum key distribution (QKD) is a family of protocols for allowing two parties to establish shared secret key material. In many implementations, quantum states such as photon polarization encode information sent over a quantum channel. Because measurement can disturb a quantum state, attempts to intercept signals can affect the observed error rate. The parties can use those measurements to decide whether to discard the exchange or continue processing it into a secret key. QKD does not itself encrypt general messages: the resulting key must be used with a separate encryption method.

A typical protocol has multiple stages. The sender prepares quantum signals and the receiver measures them; the parties then compare selected information over a classical channel to identify compatible measurements. They estimate errors, reconcile differing key bits, and apply privacy amplification to reduce any information an eavesdropper may have gained. A public classical channel is used for protocol coordination, but it must be authenticated and protected against tampering. Authentication is essential: without it, an attacker could impersonate a participant and conduct separate exchanges with each party.

BB84, introduced by Charles Bennett and Gilles Brassard in 1984, is a foundational prepare-and-measure QKD protocol. It illustrates how communicating parties can encode signals using different bases and later compare basis choices to derive candidate key bits. Other QKD families use entangled photon pairs or different measurement arrangements. Their security proofs rely on assumptions about the protocol and its physical implementation; practical systems must consider device imperfections and information that might leak through unintended side channels.

QKD systems have been demonstrated in fiber-optic and free-space links and are also commercially offered for specialized networks. Optical loss and the fragility of quantum states limit the distance over a single link. Networks may extend connections through trusted relay nodes, but such nodes must be protected because key material is exposed to them in classical form. Quantum repeaters are an active research direction for extending quantum communication without relying on the same trust model; they are not a general, readily available solution for global QKD networks.

QKD's theoretical security properties do not automatically make every deployed system secure. The NSA notes that QKD does not authenticate the source of a transmission by itself, requires dedicated equipment and links, and can be vulnerable to implementation flaws and denial of service. NIST likewise describes technological and theoretical loopholes in practical systems. QKD is therefore one component in a larger security design, not a substitute for authentication, secure hardware, operational controls or a full encryption system. Post-quantum cryptography takes a different approach, using classical computers and algorithms designed to resist attacks by future quantum computers; the choice between approaches depends on requirements and threat models.