Quiz: Quantum Cryptography and BB84

DataField.Dev

Quiz: Quantum Cryptography and BB84

20 questions. Answers with explanations follow.

1. Sifting in BB84 discards:

(a) all photons Eve touched
(b) about half — the positions where Alice's and Bob's random bases differed
(c) the first 25%
(d) nothing

2. Measured over 400 photons with no eavesdropper, BB84 gave:

(a) 196 sifted (49.0%), QBER 0.0000
(b) 400 sifted, QBER 0.25
(c) 100 sifted, QBER 0.11
(d) 196 sifted, QBER 0.25

3. Intercept-resend produces a QBER of 25% because:

(a) Eve's detectors are 75% efficient
(b) she picks the wrong basis half the time, and Bob is then wrong half of those
(c) a quarter of photons are lost
(d) the no-cloning theorem says so directly

4. Eve can reduce the disturbance she causes by:

(a) using better detectors
(b) choosing bases more cleverly
(c) tapping fewer photons — which reduces her information in the same proportion
(d) cloning the photons first

5. BB84 can distinguish an eavesdropper from a dusty connector:

(a) yes, by the error pattern
(b) yes, by timing
(c) no — it must attribute all error to Eve
(d) only above 11%

6. The secret fraction after error correction and privacy amplification is:

(a) $1 - h_2(Q)$
(b) $1 - 2h_2(Q)$
(c) $h_2(Q)$
(d) $1 - Q$

7. ★ That fraction reaches zero at QBER:

(a) 0.25
(b) 0.5
(c) 0.110028
(d) 0.01

8. ★ Test bits needed to place a full intercept-resend attack above threshold at 95% confidence:

(a) 4
(b) 37
(c) 1,000
(d) 62,761

9. ★★ With 20 test bits, a fully compromised channel:

(a) is obviously detected
(b) has a 95% lower bound of about 0.06 — below the abort threshold
(c) shows QBER 0.5
(d) cannot be measured at all

10. ★★ Test bits needed to detect an eavesdropper tapping 45% of photons:

(a) 37
(b) 307
(c) 62,761
(d) impossible

11. ★★ An eavesdropper tapping 30% of photons:

(a) is detected with 100 test bits
(b) is below the abort threshold — no sample size detects her, and the protocol correctly proceeds
(c) causes QBER 0.25
(d) breaks the protocol

12. ★★★ Crossing the abort threshold means:

(a) Eve has been detected
(b) no secret key survives after privacy amplification
(c) the fiber is broken
(d) the key must be reused

13. ★★ The 11% threshold assumes:

(a) finite keys
(b) infinitely many bits — real systems need a finite-key correction that is not small
(c) a specific vendor
(d) no channel loss

14. ★★★ Unauthenticated BB84 falls to:

(a) photon-number-splitting
(b) a man-in-the-middle running separate BB84 sessions with each party, both showing a clean QBER
(c) cloning
(d) nothing — physics prevents it

15. ★★★ Therefore QKD is properly described as:

(a) key establishment from nothing
(b) key expansion — it turns a short shared secret into a long one
(c) an authentication protocol
(d) a replacement for TLS

16. ★★ The reason there are no QKD repeaters is:

(a) cost
(b) no-cloning forbids amplifying a photon, and quantum memory does not exist at scale
(c) regulatory
(d) there are — they are standard

17. ★★ The secret key rate in §38.6's model reaches zero at:

(a) 40 km
(b) 240.4 km
(c) 1,000 km
(d) never

18. ★★ It dies at that distance because:

(a) the fiber physically ends
(b) signal decays exponentially while dark counts do not decay at all, so QBER climbs
(c) the laser overheats
(d) sifting fails

19. ★★ A 2,000 km trusted-node network at 100 km spans has:

(a) no trusted nodes
(b) 19 relays, each seeing the key in the clear — 21 parties total
(c) 1 relay
(d) end-to-end information-theoretic security

20. ★★★ ML-KEM-768 measured against X25519:

(a) 2.6× slower, 1,184-byte keys, over any existing network
(b) 100× slower
(c) faster
(d) requires dedicated fiber

Answers

1. (b). Alice and Bob choose bases independently at random, so they match half the time. They announce bases, never bits, and keep the matches.

2. (a). Where the bases match and nothing disturbed the photon, Bob reproduces Alice's bit exactly.

3. (b). Half the time Eve guesses Alice's basis and learns the bit with no trace. Half the time she guesses wrong, collapses the state into her basis, and the photon she forwards is uncorrelated with Alice's bit — so Bob is wrong half of those. $\tfrac12\times\tfrac12 = 25\%$. Measured: 0.2398.

4. (c). And that is the point: tapping fraction $f$ gives QBER $0.25f$ and learns $0.5f$ of the bits. There is no setting where she learns a lot cheaply. Better hardware does not help, because the guarantee is not about her equipment — it is that measuring an unknown state in the wrong basis destroys information that was there.

5. (c) no. Both produce error and the protocol cannot separate them, so it must assume the worst. A link with 12% intrinsic noise is insecure by definition — not because anyone is listening, but because nobody can prove they are not.

6. (b) $1 - 2h_2(Q)$. One $h_2$ for information leaked during error correction, one for what privacy amplification must remove.

7. (c) 0.110028, derived by bisection rather than quoted. The extra digits matter: rounding to 0.11 shifts the 50%-tapper detection count by 7 bits, and the 45% tapper's by 1,398.

8. (b) 37.

9. (b). The interval around a measured 0.25 reaches down to 0.0602. You would have seen the attack and been unable to say so — which is Case Study 38.2's situation, where a group chose 32.

10. (c) 62,761. The gap between her QBER (0.1125) and the threshold (0.1100) is 0.0025, and resolving that at 95% takes a very large sample.

11. (b). And this is not a flaw. Privacy amplification is sized to remove exactly what an adversary at that QBER could know, so the key simply comes out shorter.

12. (b) no secret key survives. The threshold is not a detector. Below it, Eve costs you key length; above it, nothing provably secret remains.

13. (b) infinitely many bits. Modelling only QBER-estimate uncertainty, a $10^3$-bit block loses 13% of its key — and that model is optimistic. A proper finite-key analysis corrects the smooth min-entropy and carries an explicit failure probability. Do not size a real system from the asymptotic formula.

14. (b). Eve runs BB84 with Alice pretending to be Bob, and separately with Bob pretending to be Alice. Both links are physically pristine and both parties measure a clean QBER. The no-cloning theorem has nothing to say about it, because nothing was cloned.

15. (b) key expansion. Alice and Bob must already be able to authenticate before BB84 can establish anything, so QKD consumes authentication rather than producing it. It cannot create the first shared secret between parties who have never met — which is the hard problem in practice.

16. (b). And note the structure: the same theorem that provides the security imposes the range limit.

17. (b) 240.4 km.

18. (b). Past 200 km the detector's own noise is a growing fraction of everything it registers. The rate falls off a cliff rather than tapering.

19. (b). Information-theoretically secure on each hop, and completely dependent on the physical security of every relay — which is exactly the kind of assumption QKD was sold as eliminating.

20. (a). That is the entire cost: no new fiber, no distance limit, no trusted nodes, no line of sight, between parties who have never met. A software update, deployed at billions of endpoints against QKD's dozens of sites.

The chapter's conclusion is not that the physics fails — it works exactly as proven. It is that the proven property protects the one part of the system that was not the weak point. Keys in transit are not how modern systems get broken; endpoints, implementations, key management, and authentication are, and QKD improves none of them. A technology is not evaluated by what it guarantees, but by whether what it guarantees is what the system needed.