Exercises: Quantum Cryptography and BB84

Difficulty: ★ warm-up · ★★ standard · ★★★ extended · ★★★★ open-ended.

[measure] — run something and report a number. [refuse] — identify a claim that should not be made. [threat] — the exercise is about what an attacker actually does.

Example 3 needs cryptography >= 46 for the ML-KEM benchmark; it falls back to published parameters without it.

The protocol (§38.1–38.2)

38.1 ★ Why does sifting discard half the photons? Would announcing bases before Bob measures improve the yield, and what would it cost?

38.2 ★ Alice sends $\lvert+\rangle$ and Bob measures in the $Z$ basis. What does he get, and what happens to the bit during sifting?

38.3 ★★ Derive the 25% intercept-resend QBER from first principles. State both factors of $\tfrac{1}{2}$ and what each one is.

38.4 ★★ [measure] Run BB84 at 200, 400, and 1,600 photons with and without Eve. How does the measured QBER converge on 0.25, and how does that connect to §38.4?

38.5 ★★ [threat] Eve taps only 40% of the photons. What QBER does she cause and how much does she learn? Why is this not a good trade for her?

38.6 ★★★ [threat] Design an attack better than intercept-resend. (Look up the optimal individual attack, or reason about partial-information measurements.) What QBER does it cause per bit of information gained, and how does that compare to 0.25?

38.7 ★★★ [measure] Example 1 notes that a bare $X$ error is invisible in the $X$ basis, so the example uses a depolarizing channel instead. Verify this: run with an $X$-only channel and show the QBER is roughly three-quarters of what a depolarizing channel of the same rate produces ($p/2$ against $2p/3$ — derive both before you measure). Connect it to Chapter 25 §25.3.

The threshold (§38.3)

38.8 ★ Compute $h_2(0.11)$ and $1 - 2h_2(0.11)$ by hand. Why is the answer so close to zero?

38.9 ★ Why are there two factors of $h_2(Q)$ in the secret fraction? Name what each pays for.

38.10 ★★ [measure] Reproduce the bisection for the abort threshold. Report it to six decimal places and say why vqelab.qkd derives it rather than hard-coding 0.11.

38.11 ★★ A link has 12% intrinsic QBER from bad optics and provably no eavesdropper. Is it secure? Answer carefully — the answer is not "yes" and it is not "the protocol is broken."

38.12 ★★★ The Shor–Preskill bound assumes collective attacks and asymptotic keys. Look up what changes for coherent attacks and report whether the 11% survives.

Detection as sampling (§38.4)

38.13 ★ Why are test bits discarded after being compared?

38.14 ★★ [measure] Reproduce the 37-bit figure. Then compute it for 99% confidence instead of 95%, and say what that costs.

38.15 ★★ [refuse] A paper reports "QBER 0.03, no eavesdropping detected" from 25 test bits. Write the strongest claim the data supports.

38.16 ★★ Explain why test_bits_required(0.075) returns None rather than a large number.

38.17 ★★★ [measure] Plot test bits required against tapped fraction $f$ from 1.0 down to 0.46. Explain the shape from the structure of the confidence interval.

38.18 ★★★ Case Study 38.2's group used 32 test bits and needed 37. Design a protocol that adapts the test-bit budget to the observed QBER, and identify the security problem with doing that naively.

38.19 ★★★ [measure] For blocks of 500, 800, 2,000, and 10,000 sifted bits, what fraction must be spent on test bits to exclude intercept-resend at 95%? What does the shape say about small-block QKD?

Authentication (§38.5)

38.20 ★ ★★ Describe the man-in-the-middle attack on unauthenticated BB84 in three sentences. Why does no-cloning not prevent it?

38.21 ★★ Why does QKDLink.is_secure return False for an unauthenticated link with QBER 0.01? Argue that returning True with a warning would be worse.

38.22 ★★ [refuse] "QKD lets two parties establish a shared secret with security guaranteed by physics." Identify the word that is wrong and write the corrected sentence.

38.23 ★★★ QKD authenticates its classical channel with a pre-shared key and Wegman–Carter MACs. How much key does that consume per block, and is BB84 net-positive on key material? Show the arithmetic.

38.24 ★★★ [threat] Case Study 38.1's bank replaces 90-day automated certificate rotation with annual manual PSK installation. Enumerate the new attack surface, and rank the entries.

Distance and deployment (§38.6–38.7)

38.25 ★ Why can't a QKD link use an optical amplifier?

38.26 ★★ [measure] Reproduce the 240.4 km wall. Then find it for detector efficiency 0.5 and dark count $10^{-7}$. Which parameter buys more distance?

38.27 ★★ The rate "falls off a cliff" between 200 and 250 km. Explain why, in terms of which quantity decays and which does not.

38.28 ★★ [measure] How many trusted relays does a 4,600 km link need at 100 km spans? How many parties hold the key in the clear? Compare that to the number of parties who hold a TLS session key.

38.29 ★★★ [threat] You are attacking a trusted-node QKD network. Compare the cost of breaking one relay against the cost of breaking the quantum channel. What does that say about where the security actually lives?

38.30 ★★★ [measure] Benchmark ML-KEM-768 and X25519 on your machine. Do you reproduce 2.6×? Then benchmark ML-KEM-1024 and say what the extra security level costs.

38.31 ★★★ Satellite QKD (Micius) sidesteps fiber loss with free-space links. Look up the achieved key rates and compare them to §38.6's table at equivalent distances. What did the satellite buy, and what does it cost?

Integration

38.32 ★★ §38.7 says QKD's guarantee "protects the component that was not the weak point." Chapter 37 §37.7 says QAOA "returns a bitstring and nothing else." State the shared principle in one sentence.

38.33 ★★★ [refuse] Write the honest one-paragraph product description for a QKD system — the one a vendor would ship if forced to state both what it provides and what it requires.

38.34 ★★★★ [open] Find a real QKD deployment announcement. Determine, from public information: how the classical channel is authenticated, how many trusted nodes are involved, and what the end-to-end trust model actually is. Report what you could not determine — that is often the finding.

38.35 ★★★★ [open] Under what circumstances would you recommend QKD? Write the specification for a system where it is the right answer, then estimate how many organizations have that requirement.