Chapter 38: Quantum Cryptography and BB84

Every application in this book so far has been a proposal. Chemistry was priced $10^8$ out of reach. QAOA lost 0–6 to an algorithm from 1994. QML tied with logistic regression.

Quantum key distribution is different. It is deployed, commercially available, and its security is proven — not conjectured, not empirically observed, but derived from the measurement postulate. You can buy a QKD system today, and China, Switzerland, and several banks have.

This chapter builds BB84, measures the eavesdropper, and derives the 11% threshold. All of it works, exactly as advertised.

Then it asks the question that decides deployments: what problem does this solve, and is that the problem anyone has?

38.1 The protocol

Alice sends single photons, each encoded in one of two bases chosen at random:

Bob measures each photon in a basis he also chooses at random. Afterwards, over a public classical channel, they announce their bases — never their bits — and keep only the positions where the bases matched. That is sifting, and it discards half the data.

qc = QuantumCircuit(1, 1)
if bit:    qc.x(0)          # encode the bit
if basis:  qc.h(0)          # rotate into the diagonal basis
# ... channel ...
if bob_basis: qc.h(0)       # rotate back
qc.measure(0, 0)

Measured over 400 photons: 196 sifted (49.0%), QBER 0.0000. Where the bases match and there is no disturbance, Bob reproduces Alice's bit exactly.

The four states, and why exactly two bases

The table above is two orthonormal bases of the same single qubit:

$$\lvert 0\rangle,\ \lvert 1\rangle \qquad\text{and}\qquad \lvert \pm\rangle = \tfrac{1}{\sqrt{2}}\big(\lvert 0\rangle \pm \lvert 1\rangle\big)$$

What makes the pair usable is not that they are different. It is that every state in one basis is maximally uncertain in the other:

$$\lvert\langle 0 \vert + \rangle\rvert^2 = \lvert\langle 0 \vert - \rangle\rvert^2 = \lvert\langle 1 \vert + \rangle\rvert^2 = \lvert\langle 1 \vert - \rangle\rvert^2 = \tfrac{1}{2}$$

Two bases with that property are mutually unbiased. Measuring a $Z$-basis state in the $X$ basis does not return a degraded copy of Alice's bit — it returns a fair coin, and the bit is gone.

That is the entire mechanism, and it is worth being precise about what it is not. It is not that the measurement is imprecise, or that the detector is imperfect, or that the photon is fragile. The $X$-basis measurement is a projection onto $\{\lvert+\rangle, \lvert-\rangle\}$, and $\lvert 0\rangle$ sits exactly halfway between them. A perfect apparatus gets a fair coin. A better apparatus gets a fairer one.

Why two and not more? Because three would work too, and that variant exists — the six-state protocol adds the $Y$ eigenbasis, which is mutually unbiased with both of the others. It tolerates a higher QBER, because Eve now guesses right only one time in three. It also drops the sifting yield from $\tfrac{1}{2}$ to $\tfrac{1}{3}$, which is the arithmetic of two parties independently picking the same basis from a set of three. BB84 uses two because two is the smallest number that works, and every extra basis is paid for out of the key rate.

Reading the five lines of circuit

The snippet above is short enough to be misread as a formality. It is not — it is the protocol.

if bit: qc.x(0) writes the bit in the $Z$ basis. if basis: qc.h(0) rotates it into the $X$ basis, mapping $\lvert 0\rangle \to \lvert +\rangle$ and $\lvert 1\rangle \to \lvert -\rangle$. Bob's if bob_basis: qc.h(0) is the same rotation applied in reverse, because $H$ is its own inverse.

So the four combinations resolve like this:

   Alice basis   Bob basis   net rotation   Bob's outcome
        Z            Z           I          Alice's bit, deterministically
        X            X          H H = I     Alice's bit, deterministically
        Z            X            H         fair coin
        X            Z            H         fair coin

Sifting keeps the first two rows and throws away the last two. It cannot be avoided by announcing the bases before Bob measures, because Bob's basis choice must be made in ignorance of Alice's — that ignorance is what forces Eve to guess as well. The 50% discard is not inefficiency. It is the price of the guarantee, paid by the honest parties in exactly the same coin it charges the eavesdropper.

The one thing the simulation cannot show you is the hardest part of a real system: QuantumCircuit(1, 1) is a perfect single photon, and §38.6 is largely about the gap between that object and a laser attenuated until it usually emits one.

38.2 Eve, measured

An eavesdropper cannot copy a photon — the no-cloning theorem forbids it. The best she can do naively is intercept-resend: measure each photon in a basis of her choosing and send on what she saw.

Half the time she guesses Alice's basis correctly and learns the bit with no trace. Half the time she guesses wrong, collapses the state into her basis, and the photon she forwards is now uncorrelated with Alice's bit — so Bob gets the wrong answer half of those.

$$\text{QBER} = \tfrac{1}{2}\times\tfrac{1}{2} = 25\%$$

Measured, same 400 photons:

   no eavesdropper          sent 400  sifted 196 (49.0%)  QBER 0.0000
   intercept-resend Eve     sent 400  sifted 196 (49.0%)  QBER 0.2398

Eve leaves a 24% error rate in a channel that is otherwise perfect. She cannot avoid it, cannot reduce it by being clever about her hardware, and cannot know which photons she got wrong.

The derivation, state by state

The $\tfrac{1}{2}\times\tfrac{1}{2}$ is worth doing properly, because the two halves are different kinds of thing and it is easy to conflate them.

Condition on a sifted position — Alice and Bob already agree on the basis, so take it to be $Z$ and take Alice's bit to be 0, meaning she sent $\lvert 0\rangle$. Eve chooses her basis at random.

Case 1: Eve picks $Z$ (probability $\tfrac{1}{2}$). She projects $\lvert 0\rangle$ onto $\{\lvert 0\rangle, \lvert 1\rangle\}$ and gets 0 with certainty. She re-prepares $\lvert 0\rangle$. Bob measures $\lvert 0\rangle$ in $Z$ and gets 0. Alice and Bob agree; Eve knows the bit; there is no trace at all.

Case 2: Eve picks $X$ (probability $\tfrac{1}{2}$). She projects onto $\{\lvert +\rangle, \lvert -\rangle\}$, and since $\lvert\langle \pm \vert 0\rangle\rvert^2 = \tfrac12$ she gets each with probability $\tfrac{1}{2}$. Whichever she gets, she re-prepares that state, so what continues down the fiber is $\lvert +\rangle$ or $\lvert -\rangle$ — not $\lvert 0\rangle$. Bob then measures it in $Z$, and $\lvert\langle 0 \vert \pm \rangle\rvert^2 = \tfrac{1}{2}$ again, so he gets Alice's bit with probability $\tfrac{1}{2}$ and the wrong one with probability $\tfrac{1}{2}$.

$$P(\text{error}) = \underbrace{\tfrac{1}{2}}_{\text{Eve guesses the wrong basis}} \times \underbrace{\tfrac{1}{2}}_{\text{Bob's outcome is then a coin}} = \tfrac{1}{4}$$

The first $\tfrac{1}{2}$ is Eve's ignorance. The second is the measurement postulate. She can remove neither: the first because Alice's basis is not announced until after the photon has passed her, and the second because it is not a property of her equipment.

Notice what she gets in exchange. In Case 1 she learns the bit; in Case 2 her outcome is uncorrelated with it. She learns $\tfrac{1}{2}$ a bit per sifted position and pays $\tfrac{1}{4}$ of a bit of error. That ratio — information gained per disturbance caused — is the quantity every security proof is really about, and §38.3 is what happens when you push it through error correction.

Why tapping fewer photons does not help her

The obvious dodge is to tap only a fraction $f$ of the photons and stay quiet on the rest. It fails, and it fails for a structural reason rather than an engineering one.

   fraction tapped     QBER caused     bits Eve learns
              1.00          0.2500                0.50
              0.50          0.1250                0.25
              0.25          0.0625                0.125
              0.10          0.0250                0.05

Both columns are linear in $f$, so the ratio between them is constant. Eve cannot buy information more cheaply by buying less of it. There is no setting of $f$ where she learns a lot for a small footprint, because her footprint is her information, scaled by $\tfrac{1}{2}$.

This is why §38.3's threshold can be a threshold on a single number. If the exchange rate between information and disturbance varied with the attack, one number could not price all of them.

⚛️ The Physics Underneath: this is the measurement postulate doing security work.

The guarantee is not that Eve's equipment is inadequate. It is that measuring an unknown quantum state in the wrong basis destroys information that was there, and no amount of engineering recovers it. Chapter 5 measured this as an inconvenience; here it is the entire product.

Note the shape: every other chapter in Part VII has run into a physical limit that cost something. This is the one place in the book where the limit is the feature.

📊 What the Numbers Say: 49.0% and 0.2398 are both exactly on target.

Two of this chapter's headline measurements are not the round numbers the theory predicts, and both are unremarkable. It is worth doing the arithmetic once, because the temptation to read a small gap as a small effect is what §38.4 is about.

Sifting. 196 of 400 is 49.0%, against a predicted 50%. The count is binomial with $n=400$, $p=\tfrac12$, so $\sigma = \sqrt{400 \times 0.25} = 10$ bits. 196 is 0.40 standard deviations below 200. There is nothing there.

QBER. $0.2398 \times 196 = 47.0008$, so the run produced exactly 47 errors in 196 sifted bits, and $47/196 = 0.239796$. At $Q = 0.25$ on 196 bits, $\sigma = \sqrt{0.25 \times 0.75/196} = 0.0309$. The measurement sits 0.33 standard errors below the prediction.

A reader inclined to write "we measured 24%, slightly below the theoretical 25%" would be describing a third of a standard error as a discrepancy. Both numbers are draws, and both landed where draws land. Chapter 27 §27.4 is the general form; the difference here is that the same arithmetic decides whether you believe you are being eavesdropped.

📉 Noise Report: a dusty connector and an eavesdropper are the same observable.

Running the same 600-photon protocol with no Eve and a depolarizing channel — a random Pauli applied with probability $p$, which is basis-symmetric where a bare $X$ flip is not — gives 320 sifted bits and:

text depolarizing p measured QBER predicted 2p/3 deviation secret fraction 0.00 0.0000 0.0000 — 1.0000 0.02 0.0156 0.0133 +0.35 SE 0.7681 0.05 0.0375 0.0333 +0.42 SE 0.5386 0.10 0.1000 0.0667 +2.39 SE 0.0620 0.20 0.1625 0.1333 +1.53 SE 0.0000

The prediction is $2p/3$ because a random Pauli flips the measured bit in two of three cases in either basis: $X$ and $Y$ in the $Z$ basis, $Y$ and $Z$ in the $X$ basis.

Two things to take from this. First, none of these rows involves an attacker, and the $p=0.20$ row is above the abort threshold anyway. A link with 16% intrinsic error is insecure by definition — not because anyone is listening, but because nobody can prove they are not. Solving $2p/3 = 0.110028$ puts that boundary at $p = 0.165$.

Second, read the $p=0.10$ row honestly: +2.39 standard errors on 320 bits, from one seed. That is a large enough deviation to be worth noticing and a small enough one that a second seed would very likely erase it. It is reported rather than smoothed because reporting it is the only way the reader can tell.

🐛 Debug This: half your sifted key cannot see your channel model.

A BB84 simulation that models channel noise as a bit flip — qc.x(0) with probability $p$ — reports a lower QBER than a basis-symmetric channel of the same rate, and the shortfall is not spread evenly. It is concentrated entirely in one basis. Running the identical 600-photon protocol with an $X$-only channel instead of a depolarizing one:

text p depolarizing QBER X-only QBER X-only in Z basis X-only in X basis 0.02 0.0156 0.0125 0.0226 (n=177) 0.0000 (n=143) 0.05 0.0375 0.0281 0.0508 (n=177) 0.0000 (n=143) 0.10 0.1000 0.0594 0.1073 (n=177) 0.0000 (n=143) 0.20 0.1625 0.1031 0.1864 (n=177) 0.0000 (n=143)

The right-hand column is exactly zero at every rate. An $X$ error commutes with an $X$-basis measurement, so half your sifted bits are structurally blind to it — this is Chapter 25 §25.3's observation arriving in a protocol where the consequence is a security parameter. The sifted average is $p/2$ against the depolarizing channel's $2p/3$, a ratio of $\tfrac{3}{4}$.

The fix is not a better error rate, it is a basis-symmetric channel. If your model can only produce errors that one of the two bases cannot see, every threshold you compute from it is optimistic — and the failure is silent, because the number that comes out still looks like a QBER.

38.3 The 11% threshold

Alice and Bob cannot tell Eve from a dusty connector, so they must assume all error is Eve. The question becomes: how much error can be tolerated before nothing secret remains?

The Shor–Preskill analysis gives the secret fraction after error correction and privacy amplification:

$$r = 1 - 2h_2(Q), \qquad h_2(x) = -x\log_2 x - (1-x)\log_2(1-x)$$

      QBER     h2(Q)   r = 1-2h2(Q)      status
      0.00    0.0000         1.0000          ok
      0.01    0.0808         0.8384          ok
      0.05    0.2864         0.4272          ok
      0.10    0.4690         0.0620          ok
      0.11    0.4999         0.0002          ok
      0.12    0.5294        -0.0588       ABORT
      0.25    0.8113        -0.6226       ABORT

The secret fraction reaches zero at QBER = 0.110028. Above it, Eve could in principle know everything Alice and Bob share, and the honest response is to throw the key away.

Intercept-resend produces 0.25 — more than twice the threshold. The naive attack is not merely detectable; it is catastrophically detectable.

📐 Math Aside: where $1 - 2h_2(Q)$ comes from, and why the threshold has no closed form.

Start with $n$ sifted bits. Alice and Bob hold strings that disagree in a fraction $Q$ of positions, and Eve holds something. The question is how many bits of shared secret survive.

The first $h_2(Q)$ is Shannon's, and it is a cost you pay to your partner. Alice and Bob's strings differ as though passed through a binary symmetric channel with crossover probability $Q$. Reconciling them requires transmitting at least $n\,h_2(Q)$ bits over the public channel — that is the noiseless-coding bound, and Cascade and LDPC codes approach it. Every one of those bits is visible to Eve, so the reconciled string is $n$ bits long but only $n(1 - h_2(Q))$ of it is unknown to her on account of the reconciliation traffic alone.

The second $h_2(Q)$ is the security bound, and it is a cost you pay to your adversary. In the Shor–Preskill picture BB84 is a CSS code run in disguise: correcting bit-flip errors is what error correction does, and correcting phase-flip errors is what privacy amplification does. The symmetry of the four-state protocol means the phase error rate is bounded by the same $Q$ you measured on the bit errors — and you never had to measure it, which is the elegant part. Removing those phase errors costs another $n\,h_2(Q)$ bits of hashing.

Two independent debts against one string:

$$r = \frac{n - n\,h_2(Q) - n\,h_2(Q)}{n} = 1 - 2h_2(Q)$$

The threshold is therefore not a security parameter anyone chose. It is the root of $2h_2(Q) = 1$, i.e. $h_2(Q) = \tfrac{1}{2}$ — the QBER at which correcting the errors and hiding them from Eve together consume the entire string.

$$-Q\log_2 Q - (1-Q)\log_2(1-Q) = \tfrac{1}{2}$$

That equation has no closed-form solution. $h_2$ is transcendental in $Q$ and not invertible in elementary functions, which is why vqelab.qkd bisects for it rather than quoting a constant: ABORT_THRESHOLD = 0.110027864, at which $h_2$ evaluates to 0.500000000. The familiar "11%" is that number rounded, and §38.4 shows a place where the rounding is not free.

The shape of the curve, and why the first percent is the expensive one

The table's middle rows are easy to skim past. They should not be — the curve between them is steeper at the left-hand end than anywhere else, and that is where real links live.

      QBER    r = 1-2h2(Q)    fraction of the key destroyed
     0.001          0.9772                             2.3%
     0.005          0.9092                             9.1%
     0.010          0.8384                            16.2%
     0.020          0.7171                            28.3%
     0.050          0.4272                            57.3%
     0.100          0.0620                            93.8%

A 1% QBER costs you 16% of your key. Not 1%, and not 2% — 16%. The reason is the derivative:

$$\frac{dr}{dQ} = -2\log_2\!\left(\frac{1-Q}{Q}\right)$$

which diverges as $Q \to 0$. At $Q = 0.001$ each additional unit of QBER destroys 19.9 units of key fraction; at $Q = 0.10$ it destroys 6.3. The penalty per unit of noise is worst when the link is cleanest, which inverts the usual engineering intuition that the last few percent of quality is where the diminishing returns live. Here the first few percent is where the money is.

Two consequences follow, and both show up in §38.6. A link at $Q = 0.01$ has already lost a sixth of its theoretical capacity before anyone has been eavesdropped. And pushing $Q$ from 0.02 to 0.01 buys back 12 percentage points of secret fraction, worth a 1.17× multiplier on the key rate.

That multiplier looks small next to what doubling the source rate would give, and near zero distance it is — the two factors are independent, since the rate is $\tfrac{1}{2}S(d)\,r(Q)$. The asymmetry appears at distance. $r$ can reach zero and $S$ cannot, so past the point where $Q$ crosses the threshold there is no source rate that produces a single secret bit. §38.6 is the story of $r$ winning that argument.

38.4 Detection is a sampling problem

Here the chapter's earlier themes arrive uninvited.

Alice and Bob estimate the QBER by publicly comparing a random subset of their sifted bits. Those bits are then discarded — announcing them makes them worthless as key. So detection is bought out of key material, and the natural instinct is to buy as little as possible.

How little is enough? Eve gives $Q = 0.25$ and the threshold is $0.11$:

   test bits   CI half-width at Q=0.25   lower bound  excludes 0.11?
           5                    0.3796       -0.1296           False
          10                    0.2684       -0.0184           False
          20                    0.1898        0.0602           False
          50                    0.1200        0.1300            True
         100                    0.0849        0.1651            True

With 20 test bits you cannot distinguish a fully compromised channel from a clean one at 95% confidence. The interval around a measured 0.25 reaches down to 0.06, comfortably below the abort threshold. The exact requirement is 37 bits — you would have seen the attack and been unable to say so.

And a partial eavesdropper is far harder. Tapping a fraction $f$ gives QBER $0.25f$ and learns $0.5f$ of the bits, so detection cost explodes as she backs off:

   fraction tapped     QBER  above threshold?  test bits to detect
              1.00   0.2500              True                   37
              0.60   0.1500              True                  307
              0.50   0.1250              True                 1875
              0.45   0.1125              True                62761
              0.30   0.0750             False                NEVER

Below $f = 0.45$ she is under the threshold and the protocol proceeds. That is not a flaw — privacy amplification is sized to remove exactly what an adversary at that QBER could know, so the key simply comes out shorter. The threshold does not mean "Eve detected"; it means "no key survives." Below it, she costs you key length.

The closed form behind the table

Both tables come out of one inequality, and having it in closed form explains the shape better than the rows do.

Alice and Bob observe $q$ on $n$ test bits. The lower end of the 95% interval is $q - z\sqrt{q(1-q)/n}$ with $z = 1.96$, and they want that above the threshold $t$:

$$q - z\sqrt{\frac{q(1-q)}{n}} > t \quad\Longrightarrow\quad n > \frac{z^2\,q(1-q)}{(q-t)^2}$$

Evaluating it against the integer search that produced the tables:

   f      Q        gap Q-t     closed form n     search n
   1.00   0.2500    0.139972          36.76           37
   0.60   0.1500    0.039972         306.55          307
   0.50   0.1250    0.014972       1,874.40        1875
   0.45   0.1125    0.002472      62,760.80        62761

They agree to the ceiling, which is what you want from a closed form: the search was never doing anything the formula does not.

Now read the denominator. The numerator $q(1-q)$ is bounded by $\tfrac14$ and barely moves — it falls only from 0.1875 to 0.0998 across the whole table, a factor of 1.9. The denominator is the square of the distance from the threshold, and that distance collapses from 0.140 to 0.0025, a factor of 56.6.

$$\frac{n_{0.45}}{n_{1.00}} \approx 56.6^2 \times \frac{0.0998}{0.1875} = 1{,}707$$

against the exact ratio $62{,}760.80 / 36.76 = 1{,}707$. The 1,696-fold explosion between 37 bits and 62,761 is not a fact about eavesdropping. It is $1/(q-t)^2$, the same inverse-square blow-up that makes any hypothesis test expensive near its null, and it would be there if the quantity being measured were a vaccine effect or a click-through rate.

And when $q \le t$ the inequality has no solution at any $n$, which is why test_bits_required(0.075) returns None rather than a large number. There is no sample size that resolves a difference which is not there.

What a test bit costs, in key

The reason nobody just uses 62,761 test bits is that every one is announced publicly and thrown away. Detection is bought out of the product.

   block of sifted bits   37 test bits    80 test bits   62,761 test bits
                    196          18.9%           40.8%         impossible
                    800           4.6%           10.0%         impossible
                 10,000           0.4%            0.8%         impossible
                200,000          0.02%           0.04%              31.4%

The chapter's own 400-photon run produced 196 sifted bits, so it had enough — spending 37 leaves 159, and the 95% interval around the measured 0.2398 on the full 196 is $[0.1800, 0.2996]$, which clears the 0.110028 threshold with room. A run half that size would not have.

The uncomfortable row is the last one. Excluding a 45% tapper at 95% confidence requires a block of at least 62,761 sifted bits entirely spent on testing, and to spend under a third of the block on it you need 200,000. Systems that produce blocks that large exist; systems in the 800-bit regime of Case Study 38.2 do not, and their real security claim is the one privacy amplification gives them rather than the one their test bits do.

🧪 Run It: swap the derived threshold for the rounded one.

vqelab.qkd bisects for ABORT_THRESHOLD = 0.110027864 instead of hard-coding 0.11. The difference is 28 parts per million and it looks like pedantry. Substitute the rounded value into test_bits_required and see what it does:

text f Q t = 0.11 t = 0.110028 difference 1.00 0.2500 37 37 0 0.60 0.1500 307 307 0 0.50 0.1250 1868 1875 +7 0.45 0.1125 61370 62761 +1,391

The rounding is invisible at $f=1.00$ and moves the answer by 1,391 bits at $f=0.45$ — because $n$ depends on $(q-t)^{-2}$, and at $f=0.45$ the gap is 0.0025, so a 0.000028 shift in $t$ is a 1.1% shift in the gap and a 2.3% shift in $n$.

A rounded constant is safe exactly where you do not need it and dangerous where you do. Then run $f = 0.4401$, i.e. $Q = 0.110025$. The rounded threshold puts it above the abort line and reports that $6.02 \times 10^{8}$ test bits would resolve it; the derived threshold puts it below and returns None, because no sample size ever will. The exact boundary is $f = 0.440111$ — the largest fraction Eve can tap and stay invisible in principle — and rounding the threshold down moves that boundary in the direction that flatters the defender.

⚠️ Common Pitfall: the security proof is asymptotic and your key is not.

The 11% threshold assumes infinitely many bits. Real systems have finite-key effects — the statistical uncertainty in the QBER estimate must be subtracted from the extractable key. Modelling only that uncertainty, a $10^3$-bit block at $Q = 0.02$ loses 13% of its key against the asymptotic rate.

And that model understates the effect. A proper finite-key analysis corrects the smooth min-entropy rather than the QBER point estimate, and carries an explicit security failure probability; those terms dominate at small block sizes and can drive the extractable key to zero where the simple arithmetic still shows 0.62. Do not size a real system from the simple version — §38.3's threshold assumes away a correction that is not small.

This is Chapter 27 §27.4's shot-noise floor and Chapter 37 §37.4's eight seeds, arriving in a security context where the consequence of guessing is not a wrong table but a compromised key.

38.5 The parts nobody diagrams

Textbook BB84 diagrams stop at sifting. Deployed BB84 has four more stages, and the last is where the interesting problem lives.

Error correction. Alice and Bob's sifted keys disagree at the QBER rate. They reconcile over the public channel — Cascade, or modern LDPC codes — which leaks information to Eve that must be accounted for. This is the first $h_2(Q)$.

Privacy amplification. They compress the reconciled key through a universal hash, shrinking it to the length Eve provably cannot know. This is the second $h_2(Q)$.

Authentication. And this one is not a stage. It is a precondition.

Every classical message above — basis announcements, test bits, reconciliation traffic — must be authenticated. If it is not, Eve does not need to touch a single photon:

She runs BB84 with Alice, pretending to be Bob. She runs BB84 separately with Bob, pretending to be Alice. Both links are physically pristine. Both parties measure a clean QBER and conclude the channel is secure. Eve holds both keys and relays traffic between them.

The no-cloning theorem has nothing to say about this attack, because nothing was cloned.

The man-in-the-middle, run

The attack needs no new code. It is two ordinary BB84 sessions, and running the chapter's own clean protocol twice with different seeds is a faithful simulation of it:

   Alice's session (she believes it is with Bob)     sent 400   sifted 205 (51.2%)   QBER 0.0000
   Bob's session   (he believes it is with Alice)    sent 400   sifted 214 (53.5%)   QBER 0.0000
   Alice's key vs Bob's key, first 205 bits          agreement 0.5171

Both parties see a QBER of exactly zero — cleaner than the honest 400-photon run in §38.1, which sifted 196 rather than 205. Nothing in either session is anomalous, because nothing in either session is an attack. Each half is textbook BB84 executed correctly against a real counterparty who happens not to be the one named.

The third row is the giveaway that neither party can see: their two keys agree on 51.71% of positions, which on 205 bits is 0.49 standard errors from a fair coin. They do not hold a shared key at all. They hold two unrelated keys, and Eve holds both. Traffic flows because Eve decrypts with one and re-encrypts with the other.

Walk the protocol stages and watch every one of them pass:

   stage                    what Alice sees          what Bob sees         detects Eve?
   photon transmission      normal                   normal                no photon was tapped
   basis announcement       Bob's bases arrive       Alice's bases arrive  they are Eve's
   sifting                  51.2% yield              53.5% yield           both normal
   test-bit comparison      QBER 0.0000              QBER 0.0000           nothing to see
   error correction         succeeds immediately     succeeds immediately  no errors to correct
   privacy amplification    removes h2(0) = 0 bits   removes 0 bits        correctly

Privacy amplification is the cruellest row. It is sized by the observed QBER, the observed QBER is zero, and it therefore correctly removes nothing — because at $Q = 0$ an eavesdropper on the quantum channel provably knows nothing. The mathematics is right. The premise is that the string being amplified is shared with the party you think it is shared with, and the protocol never established that.

Where the attack would have been caught

There is exactly one place: the basis announcement.

Eve cannot pass Alice's bases through untouched, because she measured in her own and needs Bob's sifting to match hers. She must substitute. If that message carries a Wegman–Carter tag computed with a key Alice and Bob already share, her substitution fails to verify and the session aborts before a single test bit is compared.

Note what that fix requires and what it does not. It does not require a quantum channel, a threshold, or a theorem about measurement. It requires Alice and Bob to already share a secret — which is the thing the whole apparatus was supposed to produce.

Authentication is paid for in key

Wegman–Carter authentication is the right tool here precisely because it is information-theoretically secure, matching the guarantee on the rest of the protocol. But that security is bought with key material: each authenticated message consumes bits, and those bits must come out of the key BB84 produced, or out of a pre-shared reserve.

So the honest accounting is a balance, not a rate:

$$\text{net key per block} = \underbrace{n\big(1 - 2h_2(Q)\big)}_{\text{produced}} - \underbrace{k_{\text{auth}}}_{\text{consumed by the next block's MACs}}$$

At the distances in §38.6's table this is not close — a 100 km link produces on the order of a million secret bits per second and a MAC key is a few hundred bits. But the produced term goes to zero continuously at 240.4 km and the consumed term does not. There is therefore a distance strictly inside the range wall at which BB84 becomes net-negative on key material: it burns more pre-shared secret authenticating itself than it manufactures.

Where exactly that distance falls depends on the MAC family, the block size, and how often the authentication key is refreshed, none of which this chapter measured. The structural point does not depend on the number. A protocol that consumes key to make key has a break-even, and the break-even is not at the same place as the security threshold.

🔬 Honest Assessment: QKD requires a pre-shared authenticated channel to bootstrap.

Alice and Bob must already share a secret — or already have a way to authenticate — before BB84 can establish anything. QKD is a key-expansion protocol, not a key-establishment protocol. It turns a short shared secret into a long one, with information-theoretic security.

That is a real and valuable service. It is not the service the marketing describes, and it is not the service most systems need — because the hard problem in practice is establishing the first shared secret between parties who have never met, and QKD cannot do that at all.

38.6 The distance wall

Photons are lost in fiber at about 0.2 dB/km, exponentially. No-cloning forbids amplification — you cannot copy a photon to boost it — so there are no repeaters without quantum memory, which does not yet exist at scale.

Modelling 0.2 dB/km, 25% detector efficiency, $10^{-6}$ dark counts, $10^9$ pulses/s, and 1% baseline optical error:

      km        signal/s     QBER  secret fraction   secret bits/s
       0   250,000,000.0   0.0100           0.8384   104,798,467.7
      50    25,000,000.0   0.0100           0.8382    10,476,924.0
     100     2,500,000.0   0.0102           0.8358     1,044,777.0
     150       250,000.0   0.0120           0.8131       101,631.6
     200        25,000.0   0.0288           0.6229         7,785.7
     250         2,500.0   0.1500           0.0000             0.0

The secret key rate reaches zero at 240.4 km.

Note why it dies. Signal falls exponentially; dark counts do not fall at all. Past 200 km the detector's own noise is a growing fraction of everything it registers, so the QBER climbs into the abort region. The wall is not gradual — the rate falls off a cliff between 200 and 250 km.

Reading the loss model

The signal column of that table is a geometric sequence, and noticing it is the fastest way to internalise what 0.2 dB/km means.

      km     signal/s        ratio to previous row
       0    250,000,000
      50     25,000,000                       1/10
     100      2,500,000                       1/10
     150        250,000                       1/10
     200         25,000                       1/10
     250          2,500                       1/10

Every 50 km costs exactly one order of magnitude, because 0.2 dB/km over 50 km is 10 dB, and 10 dB is a factor of ten. That is the entire distance story: fiber is a fixed tariff per kilometre on the logarithm of the rate.

At the wall — 240.35 km — the accumulated loss is 48.07 dB, a transmittance of $1.559\times10^{-5}$. One photon in 64,125 survives the fiber, and after the 25% detector efficiency the $10^9$ pulses per second have become 3,899 clicks per second.

The obvious escape is a brighter source, and it is worth running rather than assuming. It does not move the wall at all.

   source rate      wall
       1e9 /s    240.3514 km
       2e9 /s    240.3514 km
      1e12 /s    240.3514 km

Four decimal places, unchanged across three orders of magnitude. The reason is in the model's own parameters: the dark-count probability is per gate, so $D = \text{rate} \times 10^{-6}$ scales with the pulse rate in exactly the same proportion as the signal does. The ratio $S/D$ is invariant, the QBER at every distance is invariant, and the distance at which the secret fraction hits zero is invariant with it.

A faster source buys key rate, not key range. That is a real distinction and it is easy to lose: the table above the fold has a rate column that responds to everything and a wall that responds to almost nothing.

Why the QBER climbs: the dark-count arithmetic

The rate dying would be an inconvenience. The QBER climbing is what makes it a wall, and the mechanism is one line of the model:

$$Q(d) = \frac{e_{\text{opt}}\,S(d) + \tfrac{1}{2}D}{S(d) + D}$$

$S(d)$ is the signal rate, falling exponentially. $D$ is the dark-count rate — the detector firing with nothing incident — and it is $10^9 \times 10^{-6} = 1{,}000$ per second at every distance, because it is a property of the detector and not of the fiber.

The $\tfrac{1}{2}$ is the important coefficient. A dark count is uncorrelated with anything Alice sent, so it lands on the wrong bit half the time. The two limits follow immediately:

$$S \gg D:\ Q \to e_{\text{opt}} = 0.01 \qquad\qquad S \ll D:\ Q \to \tfrac{1}{2}$$

The QBER does not drift upward. It is dragged from the optical floor toward the value of pure noise, and the only thing setting where it sits is the ratio $S/D$.

Evaluate that at the wall:

   at 240.35 km        signal 3,898.6/s        dark counts 1,000.0/s
   error counts from optics   0.01 x 3,898.6 =    38.99 /s
   error counts from darks    0.50 x 1,000.0 =   500.00 /s
   QBER                          538.99 / 4,898.6 = 0.110028

92.8% of the errors at the wall come from the detector, not the channel. The link dies of its own instrumentation. Signal and dark counts do not even reach parity until 269.9 km, well past the point where there is any key left — the threshold is crossed while the signal is still four times the noise, because half of a dark count is worth fifty times more error than one percent of a signal count.

That also says which parameter to buy, and the model will tell you by how much. Re-running the bisection with one parameter changed at a time:

   change                                       wall     gained
   baseline                                 240.4 km          —
   optical error 1% -> 0.5%                 241.4 km    +1.1 km
   detector efficiency 0.25 -> 0.50         255.4 km   +15.1 km
   dark counts 1e-6 -> 1e-7                 290.4 km   +50.0 km
   fiber 0.2 -> 0.16 dB/km                  300.4 km   +60.1 km
   dark counts 1e-6 -> 1e-8                 340.4 km  +100.0 km

Every decade off the dark-count rate is worth exactly 50 km, and the exactness is not a coincidence: a decade of dark counts is 10 dB of headroom, and 10 dB of this fiber is 50 km. Doubling detector efficiency is 3 dB, so it buys 15 km, for the same reason.

And halving the optical error — the parameter anyone would name if asked what "link quality" means — buys 1.1 km. The knob with the obvious name is the one that does nothing. The wall is made of dark counts and fiber attenuation, which is a statement about detectors and glass, not about protocols.

Real deployments extend this with trusted nodes: a chain of relay stations that decrypt and re-encrypt. Every trusted node sees the key in the clear. A 2,000 km trusted-node network is information-theoretically secure on each hop and completely dependent on the physical security of every relay station — which is exactly the kind of assumption QKD was sold as eliminating.

Trusted nodes, priced in trust

Count them:

   total link   100 km spans   hops   trusted relays   parties holding the key in the clear
       500 km              5      5                4                                      6
     1,000 km             10     10                9                                     11
     2,000 km             20     20               19                                     21

A TLS session key is held by two parties. A 2,000 km QKD link's key is held by twenty-one, nineteen of which are rooms containing racks, in buildings, staffed by people, in jurisdictions.

The security statement changes category, and it is worth being precise about how. Per hop, the guarantee is a theorem: no adversary with any amount of computation learns the key. End to end, the guarantee is a conjunction: the key is secret if relay 1 is secure and relay 2 is secure and … nineteen times over. Assign each relay an independent compromise probability $p$ — a modelling assumption, not a measurement — and the end-to-end probability that none is compromised is $(1-p)^{19}$:

   p per relay      (1-p)^19
        0.001         0.9812
        0.010         0.8262
        0.050         0.3774

The numbers are illustrative because nobody can estimate $p$. That is the actual finding. The comparison in §38.7 is between an assumption you can argue about in a literature — is Module-LWE hard? — and an assumption you cannot: is every relay station on a 2,000 km backbone physically secure for the lifetime of the key? The second is not weaker because it is unquantified. It is harder to reason about because it is unquantified, and it was introduced by the technology sold as removing assumptions.

The single-photon assumption, and what real sources emit

QuantumCircuit(1, 1) emits one photon. A deployed transmitter is a laser attenuated until it usually does, and "usually" has a distribution.

Attenuated coherent light has Poissonian photon number with mean $\mu$. At the standard weak-pulse setting $\mu = 0.1$:

   photons in the pulse   probability   share of the non-empty pulses
                      0      0.904837                              —
                      1      0.090484                        95.083%
                     >=2     0.004679                         4.917%

About one pulse in twenty that carries anything at all carries more than one photon, and those pulses carry the same bit in the same basis twice.

That breaks no-cloning's protection, because Eve does not have to clone anything. In a photon-number-splitting attack she measures the photon number non-destructively, blocks the single-photon pulses entirely, keeps one photon from each multi-photon pulse in quantum memory until the bases are announced, and forwards the remainder down a lossless line she has installed. She then measures her stored photons in the correct basis and learns those bits with zero QBER, because the photon Bob receives is undisturbed.

The attack works whenever she can supply Bob with as many clicks as he expects, which needs $P(n \ge 2) \ge \eta\mu$, the expected detection probability. Using this chapter's own loss model:

   eta*mu at 0 km                        0.025000
   P(n >= 2) at mu = 0.1                 0.004679
   eta*mu falls below P(n >= 2) at       36.4 km

This model predicts that beyond about 36 km, every pulse Bob detects could in principle have been a multi-photon pulse Eve split. Take that as the shape of the argument rather than a deployment threshold — a real analysis carries detector, timing and finite-key terms this arithmetic omits — but the shape is the point: the range at which PNS becomes possible is far shorter than the range at which the link stops working.

The fix is decoy states, and it is elegant. Alice randomly varies $\mu$ between a signal intensity and one or two decoy intensities. Eve's attack can depend only on the photon number $n$ of the pulse in front of her, never on which intensity setting produced it — the intensities are indistinguishable to her. So the yields and error rates observed at each intensity are different linear combinations of the same per-$n$ quantities, and Alice and Bob can solve for the single-photon yield $Y_1$ and error rate $e_1$ directly instead of assuming them. Decoy states are standard in every serious deployment.

Note what happened here, because it recurs below. The BB84 security proof was never wrong. It proved a statement about single photons, the source did not supply single photons, and the gap was closed by changing the protocol rather than the theorem.

The attack that does not violate the proof

The most instructive result in the QKD literature is not a protocol. It is Lydersen, Wiechers, Wittmann, Elser, Skaar and Makarov (2010), who recovered the full secret key from two commercial, deployed, provably secure QKD systems — and did it without contradicting a line of the security proof.

The mechanism is detector blinding. A single-photon avalanche detector is normally biased above breakdown, in Geiger mode, where one photon triggers a self-sustaining avalanche. Illuminate it with bright continuous light and it drops out of Geiger mode into a linear regime, where it stops being a photon counter and becomes an ordinary photodiode: it responds only to optical pulses above a classical energy threshold.

With Bob's detectors blinded, Eve does plain intercept-resend, then re-sends her result not as a photon but as a tailored bright pulse. If Bob's basis matches hers, the whole pulse lands on one detector and exceeds the threshold, so it clicks. If his basis does not match, the pulse splits evenly between his two detectors and neither crosses the threshold, so nothing clicks at all — and a non-detection is discarded as loss, which a lossy fiber produces constantly.

Bob's clicks are therefore exactly Eve's bits, and the 25% signature never appears. The intercept-resend QBER derived in §38.2 is a consequence of a projective measurement collapsing an unknown state. Nothing was projected. Nothing was collapsed. The detector was operating classically, and a classical detector run by an eavesdropper reports whatever she chooses.

🔬 Honest Assessment: the proof is airtight and the apparatus is not the apparatus in the proof.

This chapter has argued that BB84's guarantee is real and covers the wrong component. Detector blinding is the sharper version of the same problem, one level down: the guarantee covers the right component and the hardware is not the thing the guarantee quantifies over.

Every step of §38.2's derivation assumed a measurement — a projection onto one of two bases, with the Born rule supplying the probabilities. That assumption is a physical model of a device. The device shipped in a rack, and it had an operating regime the model did not describe.

Two conclusions, both worth holding at once.

The result is not an argument against QKD. It is an argument that "information-theoretically secure" describes a proof, not a product, and that the distance between the two is engineering of a kind the proof cannot help with. The affected vendors shipped countermeasures — monitoring detector photocurrent, randomly modulating detector efficiency — and the attacks moved on.

And it is the honest answer to the strongest pro-QKD argument. §38.7 will note that ML-KEM's security is conjectured while QKD's is proven. That is true of the mathematics. In deployment, the systems whose keys have actually been recovered by a published attack are the QKD ones. The principled fix is device-independent QKD, where security follows from an observed Bell violation and the devices need not be trusted at all. Chapter 4 Case Study 4.2 built the two-term entanglement witness that is CHSH's near relative, and measured the gap between the separable bound of 1 and $\lvert\Phi^+\rangle$'s 2 — that gap is what a device-independent protocol converts into a key. Ekert's E91 is the entanglement-based ancestor. The rates are, today, impractical.

38.7 The classical baseline, measured

The threat QKD answers is a future quantum computer running Shor's algorithm against RSA and elliptic curves (Chapter 23). That threat is real and the deadline is genuine — encrypted traffic captured today can be decrypted later.

There is also a classical answer: post-quantum cryptography, standardized by NIST in 2024 as ML-KEM (FIPS 203). Its security rests on lattice problems believed hard for quantum computers.

Measured, in this session's environment, on one core:

   ML-KEM-768   public key 1,184 bytes   ciphertext 1,088 bytes   secret 32 bytes
   ML-KEM-768 full exchange:  201.7 us  =  4,958 per second
   X25519 full exchange:       76.6 us  = 13,061 per second
   ML-KEM is 0.38x the speed of classical ECDH

Post-quantum key exchange is 2.6× slower than the classical algorithm it replaces, and that is the entire cost. (Absolute timings drift a few percent between runs; the ratio is stable.) No new fiber. No distance limit. No trusted nodes. No line of sight. It runs over the network you already have, in software, between parties who have never met — which is the thing QKD cannot do.

What ML-KEM assumes, and what happened to SIKE

The honest comparison requires stating the assumption plainly, because it is genuinely weaker than QKD's.

ML-KEM's security rests on Module Learning With Errors: recovering a short secret vector from noisy linear equations over a polynomial ring is believed hard, for classical and quantum computers alike. No efficient quantum algorithm is known for it, and the hidden-subgroup structure that makes Shor's algorithm devastating against RSA and elliptic curves (Chapter 23) does not appear to be present. That is believed, is not known, and does not appear to be. Three hedges in one sentence, and they are all real.

The precedent everyone in this field cites is SIKE. Supersingular isogeny key encapsulation survived the entire NIST process as an alternate candidate, was implemented in libraries and deployed in real experiments, and was then broken in 2022 by a purely classical attack — no quantum computer required — running on a single core in hours. It was not weakened. It was destroyed, after years of public scrutiny by people trying to break it.

Two things follow, and they point in opposite directions.

Against ML-KEM: a scheme's survival of a standardization process is evidence, not proof, and the SIKE precedent puts a number on how much evidence. If Module-LWE falls the same way, every ML-KEM session key ever negotiated is retroactively readable, which is exactly the harvest-now-decrypt-later threat that motivated the migration.

For the deployed answer: this is precisely why real deployments use hybrid key exchange — X25519 and ML-KEM, with the shared secrets concatenated and fed through a KDF, so the session is secure if either holds. A classical break of the lattice leaves X25519 standing; a quantum computer leaves ML-KEM standing. Hybrid is not a transitional hedge, it is the design, and it costs one extra key exchange.

QKD cannot be hybridized in the same way, because the thing you would hybridize it with is the classical exchange it was bought to replace.

Bytes on the wire, not just microseconds

Timing is the number vendors quote. Size is the one that actually shows up in a protocol trace. Measured in the same environment:

   algorithm     public key   ciphertext   shared secret   bytes exchanged
   ML-KEM-768       1,184 B      1,088 B            32 B           2,272 B
   X25519              32 B            —            32 B              64 B

ML-KEM puts 35.5× as many bytes on the wire as X25519. That is a much larger multiple than the 2.6× in time, and it is the reason ML-KEM's adoption story is about TLS ClientHello sizes and QUIC initial packets rather than about CPU.

It is also, in practice, a small number. A key exchange happens once per connection and the session that follows carries orders of magnitude more data than 2.2 kB. The comparison that matters is not 2,272 bytes against 64 bytes; it is 2,272 bytes against everything else the connection sends — and against the tens of thousands of dollars of dedicated fiber the other column requires.

The rate comparison nobody makes

QKD is sold on a physical guarantee, so it is rarely benchmarked on throughput. Do it anyway, using only numbers already in this chapter.

ML-KEM-768 at 201.7 µs is 4,958 exchanges per second on one core, and each exchange yields a 32-byte shared secret:

$$4{,}958 \times 32 \times 8 = 1{,}269{,}212\ \text{bits/s}$$

Against §38.6's model of the QKD link:

      km   QKD secret bits/s   one CPU core of ML-KEM   which produces more key
       0       104,798,467.7                1,269,212   QKD, by 83x
      50        10,476,924.0                1,269,212   QKD, by 8.3x
     100         1,044,777.0                1,269,212   ML-KEM
     150           101,631.6                1,269,212   ML-KEM, by 12x
     200             7,785.7                1,269,212   ML-KEM, by 163x

The crossover is at 95.8 km. Past it, a single core of commodity CPU manufactures shared-secret bits faster than a dedicated dark-fiber QKD link — and it does so between arbitrary parties, over the public internet, with no line of sight.

The comparison is not fair, and saying why makes it more interesting rather than less. ML-KEM's bits are computationally secure; QKD's are information-theoretically secure. A megabit of one is not a megabit of the other, and anyone who quotes the crossover distance without that sentence is doing the thing this book warns about in Chapter 21 §21.7.

What the table does establish is that rate is not QKD's advantage past 100 km, which removes one of the two axes a buyer might have been comparing on. Everything then rests on the remaining axis — unconditional versus conditional security — and §38.8 is about whether the system needed that axis.

🗝️ Version Note: ML-KEM is not Kyber, and it is new to the library.

cryptography grew hazmat.primitives.asymmetric.mlkem in version 46; the measurements above were taken on 50.0.0. Before that you needed liboqs bindings or a separate package, which is why Example 3 falls back to the published FIPS 203 parameters when the import fails rather than aborting.

More importantly: ML-KEM-768 and Kyber768 are not the same algorithm. FIPS 203 diverged from the round-3 CRYSTALS-Kyber submission it was based on — among other changes, the derivation of the shared secret was altered — so an implementation exposing Kyber768 from before the standard was finalized in August 2024 will not interoperate with an ML-KEM-768 peer. The failure mode is a successful-looking exchange that produces two different shared secrets, which surfaces later as an unhelpful decryption error.

If you are benchmarking, check which one you have before comparing anyone's numbers to the 201.7 µs above.

💰 Cost and Queue: the key is cheap, which is not the argument anyone expected.

Case Study 38.1's vendor quotes €340,000 for two endpoints plus €45,000 a year on a 40 km bank link. Over five years that is €565,000. Price what it produces, using §38.6's model at 40 km:

text 40 km signal 39,622,330/s QBER 0.0100 secret rate 16,606,705 bits/s 16.61 Mbit/s x 5 years = 2.620e15 bits = 327.5 TB of one-time-pad key EUR 565,000 / 327.5 TB = EUR 1,725 per terabyte

€1,725 per terabyte of information-theoretically secure key is not expensive. It is cheaper than a great deal of enterprise storage, and the key is unconditionally secure forever. If the argument against QKD were cost per bit, QKD would win it.

The argument is not cost per bit. 16.6 Mbit/s is more key than almost anything can consume — enough to one-time-pad a 16 Mbit/s stream continuously, and a one-time pad is the only construction that absorbs key at that rate at all. Every other use re-keys a symmetric cipher periodically and needs a few hundred bits an hour. Past that ceiling the extra bits have nowhere to go, so the marginal value of the second terabyte is zero.

Compare what the same €565,000 is buying against: enabling hybrid ML-KEM in a TLS terminator that already supports it, at 2.6× the CPU of an exchange on hardware that is not CPU-bound, covering all six segments of the path rather than one.

The queue in this chapter is not a scheduler's. It is a procurement cycle, and the number that decides it is not on the datasheet — §38.5's authentication precondition is, and it converts an automated 90-day certificate rotation into a manual annual site visit.

38.8 What QKD actually solves

The honest case is narrow and it is not empty.

QKD provides information-theoretic key expansion between two fixed endpoints with a pre-existing trust relationship, immune to future cryptanalytic advances. If you are a government protecting a link between two known facilities for fifty years, against an adversary who is recording everything and may develop mathematics you cannot anticipate, that property is worth buying and nothing else provides it.

That is a real customer. It is a small one.

For everyone else, the arithmetic points the other way, and the reason is not that the physics fails. The physics works exactly as proven. It is that the proven property — eavesdropping on a quantum channel is detectable — protects the one part of the system that was not the weak point. Keys in transit are not how modern systems get broken. Endpoints, implementations, key management, and authentication are, and QKD improves none of them.

Where this would flip

A conclusion that cannot be reversed by any evidence is not a conclusion. Four things would change this one, and they are worth stating specifically enough to recognise if they happen.

1. Quantum repeaters that work. Entanglement swapping with real quantum memory removes the 240.4 km wall and the trusted nodes in the same move, which is why it is the largest of the four. It converts a conjunction of nineteen physical-security assumptions back into a single theorem, and it changes the range row of §38.7's table from "240 km, or trusted nodes" to "unlimited." The obstacle is quantum memory with the coherence and efficiency to hold entanglement while the next link is established — Chapter 25's machinery pointed at storage rather than computation, and not close at the moment.

2. A break in Module-LWE. The SIKE precedent, applied to lattices. Every ML-KEM session key ever negotiated becomes readable, the "conjectured" column empties, and QKD's unconditional guarantee is the only thing left on the board for fifty-year secrets. Note that this would not require a quantum computer — SIKE fell to classical mathematics — which makes it a faster failure mode than the one everyone is planning for.

3. Device-independent QKD at usable rates. Security from an observed Bell violation with untrusted devices closes the gap between theorem and apparatus that detector blinding opened. It is the principled answer to the entire implementation-attack literature, and today it is orders of magnitude too slow.

4. A requirement that genuinely needs unconditional security. Not a preference for it — a requirement, with a confidentiality horizon long enough that "believed hard through 2080" is not an acceptable statement, both endpoints under one authority, and a workable answer to §38.5's bootstrap. Case Study 38.1's bank did not have one. Some organizations do.

And what would not flip it, because these are the improvements most often offered: faster QKD hardware, cheaper QKD hardware, more deployments, a larger vendor. Every one of them moves a number §38.7 has already shown is not the binding constraint. A link that produces 16.6 Mbit/s of key for one of six segments does not become useful at 33 Mbit/s.

Better detectors are the interesting borderline case, and §38.6 priced them: each decade off the dark-count rate buys 50 km, so a detector two decades better puts the wall at 340 km. That is a real improvement and it is still a wall — it shortens the trusted-node chain rather than removing it, and a 2,000 km link would still need five relays holding the key in the clear. Only item 1 removes the category.

The one axis the comparison does not have

The table in §38.7 sets QKD and ML-KEM in adjacent columns, and one row of it is doing something the others are not. "Security basis: measurement postulate" against "lattice hardness (conjectured)" reads like two values of a variable. It is not. One is a theorem about physics; the other is an open problem in mathematics. There is no exchange rate between them, and any argument that produces one has smuggled in an assumption.

So it is worth being explicit that this chapter's verdict is not "ML-KEM is more secure." It is that ML-KEM covers the whole path and QKD covers one segment of it, and coverage is what the threat model asked about. The security bases never had to be compared at all — which is fortunate, because they cannot be.

That concession is the vendor's strongest ground and it should be granted cleanly: for a secret that must hold for fifty years, "proven" and "conjectured" are different words, and the difference is not rhetorical.

The reason it does not carry the decision is §38.5. QKD's unconditional guarantee is bounded below by the security of the authentication that bootstraps it. A link whose classical channel is authenticated by a hand-carried pre-shared key is exactly as unconditional as the courier and the safe. A link authenticated with certificates is exactly as strong as the certificate's signature algorithm — which is computationally secure, which means the property being paid for was spent before the first photon was sent.

An unconditional guarantee resting on a conditional precondition is a conditional guarantee. Work out for yourself what a system would have to look like for that not to be true; the specification is short, and the number of organizations that can satisfy it is the real answer to whether QKD is for you.

📊 What the Numbers Say. Note that this chapter's finding is structurally identical to Chapter 37 §37.7's, despite the two chapters having nothing else in common. There, QAOA lost because of what it did not produce (a certificate) rather than how it scored. Here, QKD's guarantee is airtight and covers the wrong component.

A technology is not evaluated by what it guarantees, but by whether what it guarantees is what the system needed.

What we measured

• BB84 works: 400 photons → 196 sifted (49.0%), QBER 0.0000 with no eavesdropper
• Intercept-resend Eve → QBER 0.2398, matching the $\tfrac{1}{2}\times\tfrac{1}{2}$ prediction
• The secret fraction $r = 1 - 2h_2(Q)$ reaches zero at QBER = 0.110028
• ★ 20 test bits cannot distinguish a fully compromised channel from a clean one at 95% confidence; it takes 37, and every test bit is sacrificed from the key. A partial tapper at $f=0.45$ needs 62,761, and below $f=0.30$ she is under the threshold entirely
• The protocol cannot separate Eve from channel noise and must attribute all error to Eve
• ★★ QKD needs a pre-shared authenticated channel to bootstrap — unauthenticated, a man-in-the-middle runs two clean BB84 sessions and both parties see a perfect QBER. It is key expansion, not key establishment. Run as two sessions: 205/400 and 214/400 sifted, QBER 0.0000 in both, and the two "shared" keys agree on 51.7% of positions — a coin flip
• A depolarizing channel with no eavesdropper reaches the abort threshold at $p = 0.165$; measured QBER 0.0156 / 0.0375 / 0.1000 / 0.1625 at $p = 0.02 / 0.05 / 0.10 / 0.20$ on 320 sifted bits
• An $X$-only channel produces exactly 0.0000 QBER in the $X$ basis at every rate tested — half the sifted key is structurally blind to it, and the sifted average is $p/2$ against a depolarizing channel's $2p/3$
• The test-bit counts are $n > z^2 q(1-q)/(q-t)^2$: 36.76, 306.55, 1,874.40 and 62,760.80 against the searched 37, 307, 1,875 and 62,761. The 1,696-fold explosion is $1/(q-t)^2$ and nothing else
• Secret key rate hits zero at 240.4 km; loss is exponential, no-cloning forbids repeaters, and dark counts do not decay. Trusted nodes extend range by placing the key in the clear at every hop
• ★ The wall does not move with the source rate at all — 240.3514 km at $10^9$, $2\times10^9$ and $10^{12}$ pulses/s, because per-gate dark counts scale with the signal. Each decade off the dark-count rate buys exactly 50 km; halving the optical error buys 1.1 km
• 92.8% of the errors at the wall come from the detector, not the channel: 500 error counts/s from dark counts against 38.99/s from optics, on 3,899 signal clicks/s
• ML-KEM-768 measured at 201.7 µs against X25519's 76.6 µs — 2.6× slower, 1,184-byte keys, over any existing network, no distance limit
• ★★ The physics works exactly as proven, and protects the component that was not the weak point

Next: Chapter 39 leaves the algorithms behind for the systems that run them — queues, calibration drift, pricing, and what it actually costs to get a number off a quantum computer.