Case Study: Catching Eve — Running BB84 with an Eavesdropper

Executive Summary

BB84's security claim is unusual: it does not prevent eavesdropping, it guarantees detection. Any attempt to learn the key perturbs it, and the perturbation is measurable.

This case study implements BB84 end to end, runs it against an intercept-resend eavesdropper, recovers the predicted 25% error rate, and then confronts the practical problem: a real channel has errors too. Distinguishing "Eve" from "noisy fibre" is the actual engineering task, and it is why the abort threshold sits where it does.

Skills applied

• Implementing BB84 encoding, sifting, and error estimation (§10.7).
• Modelling intercept-resend and deriving its 25% QBER (§10.9).
• Setting an abort threshold against a noise floor.
• Understanding what privacy amplification buys.

Phase 1: The protocol

1. Alice picks a random bit and a random basis ($Z$ or $X$) per round; encodes and sends.
2. Bob picks a random basis per round; measures.
3. Sift: they publicly compare bases (never outcomes) and keep matching rounds — about half.
4. Estimate: they publicly reveal a random subset of sifted bits and compute the QBER.
5. If QBER is below threshold, run error correction and privacy amplification. Otherwise abort.

import numpy as np
from qiskit import QuantumCircuit
from qiskit_aer import AerSimulator

rng = np.random.default_rng(7)
N = 4096
sim = AerSimulator()

alice_bits  = rng.integers(0, 2, N)
alice_bases = rng.integers(0, 2, N)      # 0 = Z, 1 = X
bob_bases   = rng.integers(0, 2, N)

def bb84_round(bit, a_basis, b_basis, eve=False, e_basis=None):
    qc = QuantumCircuit(1, 1)
    if bit: qc.x(0)
    if a_basis: qc.h(0)                   # encode in X basis
    if eve:                               # intercept-resend
        if e_basis: qc.h(0)
        qc.measure(0, 0)                  # Eve measures
        if e_basis: qc.h(0)               # and resends what she found
    if b_basis: qc.h(0)                   # Bob's basis
    qc.measure(0, 0)
    return qc

Phase 2: The clean channel

Run without Eve. Sift, then compare the sifted bits:

Sifting keeps half, as expected — Alice and Bob agree on basis half the time by chance. With no eavesdropper and no channel noise, the sifted bits agree perfectly. This is the baseline.

Phase 3: Enter Eve

Now Eve intercepts every qubit, measures in a random basis, and resends her result.

Exactly the predicted 25%. The derivation is worth doing slowly because it is the heart of the protocol:

• Eve's basis matches Alice's with probability ½. In those rounds she measures without disturbance, resends the correct state, and Bob (basis matching too) gets the right bit. Error contribution: 0.
• Eve's basis differs from Alice's with probability ½. Her measurement collapses the state into her basis — now uncorrelated with Alice's encoding. She resends it, and Bob, measuring in Alice's basis, gets a uniformly random bit: right half the time. Error contribution: ½ × ½ = ¼.

$$\text{QBER} = 0 + \tfrac14 = 25\%$$

Note what Eve gained: she learns the correct bit in exactly the half of rounds where her basis matched. She gets 50% of the key and pays with a 25% error rate that is impossible to hide.

Phase 4: The real problem — noise looks like Eve

A real channel has errors from detector dark counts, imperfect state preparation, polarization drift in fibre, and background light. A typical deployed system runs at 2–5% QBER with no eavesdropper at all.

So the protocol cannot ask "is QBER > 0?" It must ask "is QBER above the level at which a secret key can still be distilled?"

The BB84 bound for one-way postprocessing is approximately 11%. Above it, Eve's potential information exceeds what error correction and privacy amplification can remove, and no secret key exists.

The crucial and slightly uncomfortable point: the protocol makes no attempt to distinguish Eve from noise. It conservatively attributes all errors to Eve. If the channel is noisy, you simply get a shorter key — or none. That conservatism is exactly what makes the security proof work.

Consequence. An eavesdropper attacking only 20% of rounds produces a 5% QBER, sits comfortably inside the "noisy channel" band, and is never distinguished from noise. She is nonetheless defeated: privacy amplification removes her partial information at the cost of key length.

Phase 5: Key distillation arithmetic

From 2,061 sifted bits at 3% QBER:

1. Error correction reveals parity information over the public channel. Cost is at least the Shannon limit $h(\text{QBER})$ per bit; at 3%, $h(0.03) \approx 0.19$ bits, so ~390 bits leak. Practical codes (Cascade, LDPC) cost 15–20% more than the bound.
2. Privacy amplification removes Eve's information. The secret key rate is approximately

$$r \approx 1 - 2h(\text{QBER})$$

At QBER = 3%: $r \approx 1 - 2(0.19) = 0.62$. So 2,061 sifted bits → about 1,278 secret bits.

Note where $r$ hits zero: $h(\text{QBER}) = 0.5$, i.e. QBER ≈ 11%. The abort threshold is not a safety margin chosen by convention — it is the point where the key rate formula reaches zero.

Discussion Questions

1. Derive the 25% figure independently and explain why it does not depend on which basis Eve prefers.
2. The protocol attributes all errors to Eve. Argue for and against that conservatism from an engineering standpoint.
3. Eve attacking 20% of rounds is indistinguishable from a 5% noisy channel. Why is the protocol still secure?
4. The 11% threshold falls out of $r = 1 - 2h(Q)$. What would change if a better postprocessing scheme were found?

Your Turn: Extensions

• Implement the full protocol including sifting and QBER estimation; verify 0% and 25% for the two scenarios.
• Add a channel noise model at 3% and confirm the key rate formula's prediction.
• Implement partial eavesdropping (Eve attacks a fraction $f$ of rounds) and plot QBER against $f$; find the $f$ that trips the 11% threshold.
• Implement the Cascade error-correction protocol and measure how many bits it leaks in practice versus the Shannon bound.

Key Takeaways

• BB84 does not prevent eavesdropping; it makes eavesdropping detectable, because measuring in the wrong conjugate basis necessarily disturbs the state.
• Intercept-resend yields exactly 25% QBER while giving Eve only half the key — a spectacularly bad trade for her.
• Real channels run at 2–5% QBER, so the test is a threshold, not a check for zero errors.
• All errors are conservatively attributed to Eve; noisy channels therefore cost key length, and the 11% abort threshold is where the secret key rate hits zero.
• Privacy amplification defeats partial eavesdroppers without ever identifying them.