Key Takeaways: Quantum Cryptography and BB84

The chapter in one paragraph

BB84 works. The protocol does exactly what it claims, the security proof is sound, an eavesdropper cannot avoid leaving a 25% error rate, and systems are commercially available today. This is the only chapter in Part VII where the technology under examination delivers its guarantee in full.

And the guarantee covers the component that was not the weak point.

What the chapter measured

The seven things to carry forward

1. The measurement postulate does real security work. Eve cannot copy a photon, so the best naive attack is intercept-resend, and it costs her a 25% error rate she cannot reduce with better hardware. Chapter 5 measured wavefunction collapse as an inconvenience. Here it is the entire product — the one place in this book where a physical limit is the feature rather than the bill.

2. The protocol cannot tell Eve from a dusty connector. Both produce error. It must therefore attribute all error to Eve, which is why a link with 12% intrinsic noise is insecure by definition — not because anyone is listening, but because nobody can prove they are not.

3. Detection is a sampling problem, paid for out of the key. Test bits are announced publicly and discarded. It takes 37 to catch a full tap at 95% confidence; with 20 the interval around a measured 0.25 reaches down to 0.06, below the abort line. You would have seen the attack and been unable to say so.

4. The threshold means "no key survives," not "Eve detected." A partial tapper below $f=0.45$ stays under it and the protocol proceeds — correctly, because privacy amplification is sized to remove exactly what an adversary at that QBER could know. Below the threshold she costs you key length, not security.

5. ★★ Authentication is a precondition, not a stage. Every classical message — bases, test bits, reconciliation — must be authenticated. Without it, Eve runs BB84 with Alice pretending to be Bob, and separately with Bob pretending to be Alice. Both links are physically pristine. Both parties measure a clean QBER. The no-cloning theorem has nothing to say about this, because nothing was cloned.

So QKD is key expansion, not key establishment. It turns a short shared secret into a long one. It cannot create the first secret between parties who have never met — which is the hard problem.

6. The theorem that provides the security imposes the range limit. Loss is exponential in fiber and no-cloning forbids amplification, so there is no repeater without quantum memory. The rate falls off a cliff at 240.4 km — and it dies because dark counts do not decay while signal does. Trusted-node networks extend range by putting the key in the clear at every relay, which is the kind of assumption QKD was sold as eliminating.

7. The classical answer costs 2.6×. ML-KEM-768 was measured at 201.7 µs against X25519's 76.6 µs. That is the entire cost: no new fiber, no distance limit, no trusted nodes, no line of sight, between parties who have never met. It is a software update, deployed at billions of endpoints against QKD's dozens of sites.

The honest case for QKD, which is not empty

Information-theoretic key expansion between two fixed endpoints with a pre-existing trust relationship, immune to future cryptanalytic advances.

If you are a government protecting a link between two known facilities for fifty years against an adversary recording everything who may develop mathematics you cannot anticipate — that property is worth buying and nothing else provides it. That is a real customer. It is a small one.

For everyone else the arithmetic points the other way, and not because the physics fails. Keys in transit are not how modern systems get broken. Endpoints, implementations, key management, and authentication are, and QKD improves none of them.

The structural echo

Note that this finding is identical in shape to Chapter 37 §37.7's, despite the two chapters having nothing else in common:

• QAOA lost on what it did not produce — a certificate — rather than on how it scored.
• QKD wins on what it produces, and produces it for the wrong component.

A technology is not evaluated by what it guarantees, but by whether what it guarantees is what the system needed.

What went into vqelab

vqelab.qkd, 23 tests passing:

• QKDLink.is_secure is False without authenticated=True, at any QBER. A pristine QBER on an unauthenticated link is exactly what a successful man-in-the-middle looks like.
• secret_key_rate() raises UnauthenticatedChannelError rather than returning a number.
• ABORT_THRESHOLD is derived by bisection, not quoted. The extra digits matter: the rounded 0.11 moves the 50%-tapper detection count by 7 bits (1,868 -> 1,875) and the 45% tapper's by 1,398.
• test_bits_required() returns None below the threshold — no sample size helps.
• secret_key_rate() ships a caveat field stating that its own finite-key model is strictly optimistic. The module documents its limits in its return value, not its docstring.
• trusted_node_chain() counts the parties holding the plaintext key: 21 for 2,000 km.

Next: Chapter 39 leaves algorithms behind for the systems that run them — queues, calibration drift, pricing, and what it actually costs to get a number off a quantum computer.