Quantum Cryptography and Information Security

Introduction and context

Quantum information theory changes the security landscape in two different ways. First, quantum mechanics enables communication protocols whose security can be linked to physical laws rather than to assumptions about an attacker’s limited computing power. Quantum key distribution (QKD) is the principal example. Second, quantum computers threaten widely deployed public-key systems, especially RSA and elliptic-curve cryptography, through Shor’s algorithm. These two developments are related but should not be confused: QKD distributes secret keys, whereas post-quantum cryptography (PQC) replaces vulnerable computational algorithms with classical algorithms designed to resist quantum attacks.

This chapter examines the BB84 protocol, entanglement-based QKD, quantum randomness generation, security models, implementation attacks and integration with post-quantum security. The emphasis is on professional judgement. A protocol can be mathematically sound and still be insecure because of poor authentication, inadequate random-number generation, detector leakage, incorrect parameter estimation or weak operational governance.

Learning objectives

By the end of this chapter, you should be able to:

1. Explain the physical principles behind BB84 and the information gained by an eavesdropper.
2. Describe entanglement-based QKD and its relationship to Bell inequalities.
3. Distinguish information-theoretic security from computational security.
4. Explain how raw quantum data become an authenticated secret key.
5. Identify major implementation attacks and appropriate countermeasures.
6. Evaluate randomness-generation methods and their security assumptions.
7. Compare QKD and PQC as components of a practical security architecture.

1. Foundations: security, information and quantum states

Cryptographic security is always defined relative to a threat model. A confidentiality claim may mean that an adversary cannot recover a message with feasible computational resources, or it may mean that the adversary’s information remains negligible even with unlimited computational power. The first is computational security; the second is information-theoretic security.

A classical bit is either 0 or 1. A qubit is described by a state vector such as |ψ⟩ = α|0⟩ + β|1⟩, where α and β are complex amplitudes satisfying:

The squared magnitudes are measurement probabilities in the computational basis. Measurement does not generally reveal the complete state and may disturb it. For example, the diagonal-basis states are |+⟩ = (|0⟩ + |1⟩)/√2 and |−⟩ = (|0⟩ − |1⟩)/√2. The computational and diagonal bases are mutually unbiased: if a state prepared in one basis is measured in the other, each result occurs with probability 1/2.

This basis dependence is the operational foundation of BB84. It is not correct to say that an unknown quantum state cannot be copied under all circumstances; known orthogonal states can be copied. The no-cloning theorem states that there is no universal physical operation that perfectly copies every unknown quantum state. More formally, linearity prevents a transformation mapping every state |ψ⟩|0⟩ to |ψ⟩|ψ⟩.

Important terminology

• Alice and Bob: conventional names for the legitimate communicating parties.
• Eve: the adversary, assumed to control the communication channel in a strong security model.
• Quantum bit error rate (QBER): the proportion of disagreements observed after compatible basis choices are compared.
• Sifting: retaining only detection events for which Alice and Bob used compatible bases.
• Error correction: reconciliation that makes their strings identical while revealing limited information.
• Privacy amplification: compression that reduces Eve’s possible information to an acceptably small level.
• Composable security: a guarantee that remains valid when the generated key is used inside a larger protocol.
• Authentication: protection of the classical discussion against impersonation or message modification.

2. The BB84 protocol

BB84 uses two bases. Alice encodes a random bit in either the computational (Z) basis or diagonal (X) basis. Bob independently chooses a random measurement basis. If their bases match, Bob’s ideal result equals Alice’s bit; if they differ, the result is random.

A simplified protocol is:

1. Alice generates random bit values and random basis choices.
2. She prepares and sends one qubit for every bit.
3. Bob independently chooses a basis for each received qubit and measures it.
4. Over an authenticated classical channel, Alice and Bob announce bases, not bit values.
5. They discard incompatible-basis positions. The remaining sequence is the sifted key.
6. They estimate QBER using a disclosed sample or an equivalent parameter-estimation method.
7. If the error rate is acceptable, they perform information reconciliation.
8. They apply privacy amplification to obtain the final secret key.
9. They verify or maintain authentication for subsequent classical communication.

Figure: Conceptual BB84 flow, including the quantum transmission and authenticated classical post-processing.

Why interception creates errors

Consider an intercept-resend attack in which Eve measures every qubit in a randomly selected basis and sends a replacement state to Bob. Eve chooses the wrong basis with probability 1/2. Conditional on that event, Bob obtains the wrong bit with probability 1/2 when his basis agrees with Alice’s. Therefore the error probability among sifted bits is:

This is an idealized result for a complete intercept-resend attack, noiseless equipment and equal basis probabilities. It is not a universal QKD threshold. Real channels have loss, detector errors, source imperfections and finite data, so security analysis must estimate the actual attack-compatible information rather than simply compare QBER with 25%.

If Eve chooses the wrong basis, her measurement outcome is random and the original state is disturbed. If she chooses the correct basis, she can obtain the bit without causing this particular disturbance. The protocol’s security arises from the statistical trade-off between information gained and disturbance introduced, not from the secrecy of the basis choices after they are announced.

From sifted bits to a key

The sifted key is not automatically secret. Alice and Bob must account for errors and leakage. In an asymptotic, idealized BB84 setting with one-way reconciliation and suitable assumptions, a common pedagogical lower-bound form is:

Here r is the secret-key fraction, Q is the relevant error rate, n is the sifted-key length, leak_EC is the number of bits revealed by error correction, and h₂(Q) is the binary entropy function:

The formula applies only under its stated security proof, source and channel model, asymptotic or appropriately corrected finite-key conditions, and reconciliation assumptions. The term leak_EC/n must include actual public leakage, not merely an ideal theoretical estimate. A negative bound means that no positive key should be extracted under that analysis.

Privacy amplification usually applies a universal hash function to the reconciled string. If the smooth min-entropy of the string conditioned on Eve is H_min^ε, then a conservative conceptual relation is:

The final length ℓ depends on the security proof, smoothing parameter ε, privacy-amplification failure parameter ε_PA and finite-size statistical bounds. Exact implementations must use a published protocol specification rather than treating this expression as a complete security proof.

Authentication is indispensable

The classical channel need not be confidential, but it must be authenticated. Without authentication, Eve can conduct a man-in-the-middle attack, establishing one key with Alice and a different key with Bob. QKD cannot authenticate its own classical communication from nothing. A practical system may use a pre-shared authentication key, a message-authentication code, or a computationally secure digital-signature infrastructure during system bootstrapping. Authentication keys can often be refreshed using part of later generated key material, but the initial trust anchor remains necessary.

3. Entanglement-based QKD

In entanglement-based protocols, a source distributes entangled pairs to Alice and Bob. A maximally entangled Bell state can be written as:

When both parties measure in the same basis, their ideal results are correlated. They publicly compare selected basis information and estimate errors. In protocols such as Ekert’s E91, measurements in several settings can test a Bell inequality. A violation indicates correlations that cannot be explained by a local hidden-variable model, provided the experiment closes relevant loopholes and the statistical analysis is sound.

The security intuition is powerful: if Alice and Bob observe sufficiently strong correlations that are incompatible with an adversary possessing a classical pre-existing explanation, Eve’s predictive power is constrained. Modern device-independent QKD develops this idea further, attempting to certify security from observed statistics with minimal trust in the internal operation of devices.

However, Bell-test security is experimentally demanding. Detection efficiency, source independence, measurement independence, locality assumptions, finite statistics and side channels must be handled. A laboratory demonstration of entanglement is not automatically a device-independent cryptographic system. Entanglement-based QKD can also be implemented with trusted devices and conventional security proofs; Bell violation is not required for every entanglement-based security claim.

4. Randomness generation

Cryptographic protocols require unpredictable random choices: BB84 basis selection, raw bit generation, sampling positions, authentication keys and privacy-amplification seeds all depend on randomness. A deterministic pseudorandom generator is secure only under assumptions about its seed and algorithm. A quantum random-number generator (QRNG) uses an irreducibly probabilistic measurement, such as a photon detection event or vacuum-fluctuation measurement, followed by conditioning and randomness extraction.

The raw output is not automatically uniform. Detector bias, afterpulsing, environmental influences and classical correlations can reduce entropy. A QRNG therefore requires:

• a defined physical entropy source;
• a calibrated and monitored measurement model;
• an entropy estimate, often based on a min-entropy lower bound;
• a randomness extractor;
• health tests that detect source failure;
• documented treatment of side information and finite samples.

For a discrete variable X, min-entropy is:

The maximum probability is the attacker’s best single-guess probability under the stated model. An extractor transforms a source with sufficient conditional min-entropy into output that is close to uniform, quantified by a chosen security distance. In practice, a cryptographic system may combine a certified or well-designed QRNG with a cryptographic deterministic random bit generator (DRBG), reseeding the DRBG from fresh entropy and monitoring both components.

5. Information-theoretic and computational security

Information-theoretic security remains meaningful against an adversary with unlimited computational power, subject to the physical and modelling assumptions of the proof. The one-time pad is the canonical example. If a key K is uniformly random, used once, independent of the message M, and has the same length as M, ciphertext C = M XOR K reveals no information about M in the ideal model.

QKD does not create a one-time pad automatically. It distributes key material; a system must still use an appropriate encryption mode, protect endpoints and manage keys correctly. QKD-generated keys can instead feed symmetric encryption such as authenticated encryption, where long-term security depends on the symmetric algorithm and its implementation.

Computational security assumes that certain problems are infeasible for the adversary. RSA relies on the difficulty of factoring large integers; elliptic-curve systems rely on discrete logarithm problems. A sufficiently capable quantum computer running Shor’s algorithm would undermine these assumptions. Symmetric cryptography is affected differently: Grover’s algorithm offers a quadratic search speed-up in idealized settings, so increasing key sizes is a principal mitigation. Quantum attacks do not make every classical algorithm useless.

6. Implementation attacks and system assurance

Security proofs generally describe an abstract source, channel, measurement and post-processing system. Real devices depart from that abstraction.

Detector and source attacks

Detector-efficiency mismatch can let Eve choose optical conditions that make one detector more likely to click than another. In a detector-control attack, carefully timed or powered pulses may force detectors into attacker-predictable behaviour. Countermeasures include measurement-device-independent QKD, independent detector characterization, optical isolation, power monitoring and protocols whose proofs explicitly model detector imperfections.

Weak or multi-photon sources create another risk. If a faint laser pulse occasionally contains several photons, Eve may exploit a photon-number-splitting strategy: retain one photon and allow another to reach Bob, learning information after basis announcement. Decoy-state methods vary the source intensity and estimate the single-photon contribution, reducing this vulnerability without requiring a perfect single-photon source.

Side channels and denial of service

Timing, wavelength, phase, electromagnetic radiation, temperature and power consumption can encode information. An adversary can also block or disrupt a quantum channel. QKD provides no inherent availability guarantee; an attacker can force the system to abort. Security engineering must therefore distinguish confidentiality from availability and include alarms, rate limits, fail-safe operation and fallback procedures.

Finite-key and statistical attacks

A protocol that processes a small number of detections cannot use asymptotic averages without correction. Confidence intervals, parameter estimation, error-correction leakage, authentication failure probability and privacy-amplification failure probability must be included in a composable security budget. Underestimating statistical uncertainty can produce an apparently long but insecure key.

Software and governance

Post-processing software must be reproducible, independently reviewed and resistant to memory, concurrency and supply-chain vulnerabilities. Operators should maintain calibrated-device records, key lifetimes, incident procedures, access controls, audit logs and secure destruction policies. Security certification can be useful, but certification does not eliminate the need to understand the system’s assumptions and operational boundaries.

7. Post-quantum integration

PQC is the most broadly deployable response to the quantum threat. It uses classical algorithms based on problems believed to resist both classical and quantum attacks, including structured lattice, hash-based and code-based constructions. A cryptographic migration should inventory where public-key algorithms are used, identify long-lived confidential data, test protocol interoperability and establish an algorithm-agility plan.

A hybrid design may combine a conventional key-establishment method with a PQC method and derive a session key from both outputs using a secure key-derivation function. The intended benefit is robustness if one component later fails, but hybrid composition must be specified carefully: concatenating keys informally is not sufficient. Authentication, downgrade prevention, transcript binding and failure handling are essential.

QKD and PQC serve different operational roles. QKD can offer a physics-based key-distribution claim over specialized links, but it requires expensive equipment, trusted endpoints or carefully validated device-independent assumptions, and authenticated classical communication. PQC is software-deployable across ordinary networks and is therefore central to broad migration. A high-assurance organization may use PQC as the default and reserve QKD for selected links where its cost, infrastructure and threat model are justified.

8. Applied case: illustrative financial-sector backbone

Background

A fictional national payment operator connects two data centres over a metropolitan optical network. It must protect transaction records for several decades and comply with strict key-management and audit requirements.

Problem

The operator initially proposes QKD as a complete replacement for public-key cryptography. Its proposal omits classical authentication, assumes ideal single-photon sources and uses an asymptotic key-rate calculation on short test runs. Security staff also discover that the QRNG is not monitored and that the detectors accept a wider wavelength range than specified.

Analysis

The proposal confuses key distribution with complete security. A man-in-the-middle attack remains possible without authenticated classical communication. The source and detector gaps create implementation attack surfaces, while short runs make statistical confidence uncertain. Long-lived records also create a harvest-now, decrypt-later concern for classical public-key exchanges.

Approach and solution

The operator adopts a layered architecture:

1. Deploy a standardized PQC key-establishment mechanism in a hybrid mode during migration.
2. Use QKD only on the highest-value inter-data-centre link, with decoy states, monitored optical components and a published finite-key analysis.
3. Authenticate all classical QKD messages with an initial protected credential and a documented key-refresh process.
4. Use a monitored entropy source, a vetted extractor and a DRBG for high-rate cryptographic operations.
5. Derive application session keys with authenticated encryption and bind keys to endpoint identities and protocol transcripts.
6. Conduct red-team tests for timing, wavelength, detector control, denial of service and downgrade attacks.
7. Maintain an incident response plan that permits secure operation if QKD is unavailable.

Outcome

The resulting design does not claim that QKD alone solves security. Instead, it assigns QKD, PQC, symmetric encryption, authentication and operational controls clearly defined roles. The operator can demonstrate which assumptions support each protection and can replace a component without redesigning the entire security architecture.

Learning points

The most important lesson is systems thinking. A quantum protocol is one component in a chain that includes entropy, hardware, classical communication, identity, software, key management and governance. Security is limited by the weakest unexamined assumption.

9. Ethical, regulatory and professional considerations

Quantum security claims should be proportionate to evidence. Marketing a system as “unbreakable” can encourage unsafe deployment and conceal assumptions. Engineers should document threat models, residual risks, test coverage and conditions under which security is invalidated.

Organizations should classify data by confidentiality lifetime, plan for algorithm transitions, and avoid retaining sensitive data merely because future decryption is uncertain. Procurement should request implementation-security evidence rather than only protocol names. Privacy regulations may also govern the data protected by QKD; stronger transport security does not remove obligations concerning collection, retention, access and lawful processing.

Responsible disclosure is important for detector, source, firmware and post-processing vulnerabilities. Independent evaluation, reproducible testing and separation of development and key-production environments support public confidence.

10. Best-practice checklist

A professional QKD or quantum-security assessment should ask:

• Is the threat model explicit, including endpoint compromise and denial of service?
• Is the classical channel authenticated from the first session?
• Are source, detector and optical side channels included in the security proof or mitigated operationally?
• Is QBER estimated with finite-key confidence bounds?
• Is actual error-correction leakage measured?
• Are authentication, privacy-amplification and abort probabilities included in a composable budget?
• Is randomness generated, conditioned and health-tested appropriately?
• Are keys used with authenticated encryption and correct lifecycle controls?
• Is there a PQC migration and algorithm-agility plan?
• Can the system fail safely when the quantum link is interrupted?

Chapter Summary

BB84 exploits the incompatibility of quantum measurements: an eavesdropper who measures unknown states in the wrong basis introduces detectable disturbance. Its sifted bits require QBER estimation, error correction, privacy amplification and authenticated classical communication before they become a usable key. Entanglement-based QKD uses correlations between entangled systems and may support security arguments based on Bell-inequality violations, although practical device-independent operation is demanding.

Information-theoretic security differs from computational security in its adversary assumptions. QKD can provide a proven key-distribution guarantee under a specified physical model, but it does not remove the need for authentication, secure endpoints, robust randomness or operational governance. QRNGs require entropy estimation, extraction and health monitoring. Real devices expose source, detector, timing, wavelength, finite-key and denial-of-service vulnerabilities.

PQC is the scalable response to quantum attacks on public-key cryptography. QKD and PQC should be evaluated as complementary technologies: QKD may be justified for selected high-value links, while PQC supports broad classical-network migration. Effective quantum information security is therefore a layered engineering and governance problem rather than a single protocol choice.

Key Terms

Quantum key distribution: A method for distributing cryptographic keys using quantum states.

BB84: A prepare-and-measure QKD protocol using two mutually unbiased bases.

Qubit: A two-level quantum information system.

Mutually unbiased bases: Bases in which measurement of a basis state in the other basis gives uniformly random outcomes.

No-cloning theorem: The principle that an unknown arbitrary quantum state cannot be perfectly copied.

QBER: The fraction of compared key bits that disagree.

Sifting: Discarding measurement events with incompatible preparation and measurement bases.

Information reconciliation: Procedures that make legitimate parties’ strings equal while limiting leakage.

Privacy amplification: Hash-based compression that reduces an adversary’s possible information.

Entanglement-based QKD: QKD using correlated or entangled quantum systems distributed to the parties.

Bell inequality: A statistical constraint obeyed by local hidden-variable theories.

Quantum random-number generator: A device deriving randomness from quantum measurement outcomes.

Min-entropy: A measure based on the probability of the most likely outcome.

Composable security: Security that remains meaningful when a resource is used in a larger protocol.

Information-theoretic security: Security that does not depend on an adversary’s computational limitations.

Computational security: Security based on the assumed difficulty of solving a mathematical problem.

Post-quantum cryptography: Classical cryptography designed to resist quantum-computer attacks.

Decoy state: A QKD pulse of varied intensity used to estimate and protect the single-photon contribution.

Measurement-device-independent QKD: A QKD design that removes key detector side-channel assumptions.

Harvest-now, decrypt-later: Collecting protected data today for attempted decryption after future technological advances.

Review Questions

Short Answer Questions

1. Why does measuring a BB84 state in the wrong basis create a security-relevant disturbance?
2. What is the purpose of basis sifting?
3. Why must the classical channel in QKD be authenticated?
4. Define QBER and explain what it measures.
5. State one difference between QKD and post-quantum cryptography.

Long Answer Questions

1. Describe all major stages of BB84 from state preparation to final-key generation.
2. Explain how intercept-resend produces errors and identify the assumptions behind the 25% idealized QBER result.
3. Compare information-theoretic and computational security, using QKD, the one-time pad and PQC as examples.
4. Explain the role of entropy estimation, extraction and health testing in a QRNG.
5. Discuss why a mathematically secure QKD protocol may still be insecure in a practical implementation.

Analytical / Application Questions

1. A QKD proposal reports a low QBER but uses unauthenticated classical communication. Analyse the attack that remains possible and recommend a correction.
2. A data centre must protect information for 30 years but cannot install specialized optical equipment at most sites. Recommend a QKD/PQC migration strategy and justify it.
3. A QKD implementation uses detectors with wavelength-dependent efficiencies and asymptotic key-rate estimates on short data runs. Identify the risks and design an assurance and testing plan.

Multiple Choice Questions with Answers

Question 1

In ideal BB84, what is the probability that an intercept-resend eavesdropper causes an error in the sifted key when she attacks every qubit?

A. 0%

B. 12.5%

C. 25%

D. 50%

Correct Answer: C. 25%

Question 2

What is the primary purpose of privacy amplification?

A. To increase the transmission distance of the quantum channel

B. To reduce an adversary’s possible information about the reconciled key

C. To authenticate the classical channel

D. To correct detector timing errors

Correct Answer: B. To reduce an adversary’s possible information about the reconciled key

Question 3

Why is authentication required in BB84?

A. To prevent a man-in-the-middle attack on the classical discussion

B. To make incompatible measurement bases identical

C. To eliminate all optical losses

D. To create entanglement between Alice and Bob

Correct Answer: A. To prevent a man-in-the-middle attack on the classical discussion

Question 4

Which expression defines the min-entropy of a discrete variable X?

A. [[MATH:H_min(X) = log₂(max_x P[X=x])] ]

B. H_min(X) = −log₂(max_x P[X=x])

C. [[MATH:H_min(X) = −max_x log₂(P[X=x])] ]

D. H_min(X) = 1 − max_x P[X=x]

Correct Answer: B. H_min(X) = −log₂(max_x P[X=x])

Question 5

What is the main purpose of decoy states in practical QKD?

A. To conceal the users’ identities from the receiver

B. To estimate and protect the single-photon contribution

C. To replace classical authentication

D. To guarantee availability during channel disruption

Correct Answer: B. To estimate and protect the single-photon contribution

Question 6

Which statement best distinguishes QKD from PQC?

A. QKD distributes keys using quantum systems, while PQC uses classical algorithms designed to resist quantum attacks

B. QKD is only a symmetric encryption algorithm, while PQC is only a random-number generator

C. QKD eliminates the need for authentication, while PQC does not

D. QKD requires no hardware, while PQC requires optical detectors

Correct Answer: A. QKD distributes keys using quantum systems, while PQC uses classical algorithms designed to resist quantum attacks

Question 7

In the ideal Bell state |Φ⁺⟩ = (|00⟩ + |11⟩)/√2, what correlation occurs when both parties measure in the computational basis?

A. Their results are always opposite

B. Their results are statistically independent

C. Their results are always identical

D. Only Alice obtains a result

Correct Answer: C. Their results are always identical

Question 8

Which attack exploits different detection efficiencies or responses for alternative detector outcomes?

A. Detector-efficiency mismatch attack

B. Chosen-plaintext attack

C. Collision attack on a hash function

D. Replay attack on a database

Correct Answer: A. Detector-efficiency mismatch attack

Question 9

What does a negative secret-key-rate bound generally indicate?

A. The channel can produce unlimited secret bits

B. No positive key should be extracted under that analysis

C. The authentication key is automatically refreshed

D. The QBER must be exactly zero

Correct Answer: B. No positive key should be extracted under that analysis

Question 10

Why is a hybrid PQC design often considered during migration?

A. It combines independent security contributions and can reduce dependence on one algorithm, if composition is specified correctly

B. It guarantees security even when authentication is omitted

C. It converts every classical channel into a quantum channel

D. It removes the need for key management

Correct Answer: A. It combines independent security contributions and can reduce dependence on one algorithm, if composition is specified correctly