BB84 Quantum Key Distribution
Quantum computers running Shor's algorithm will eventually break RSA and elliptic-curve cryptography, and adversaries are already harvesting encrypted traffic to decrypt later. BB84 sidesteps the math entirely: it distributes keys using quantum states, so anyone who eavesdrops physically disturbs what they touch. Run the protocol below, then let Eve loose on the channel and catch her in the act.
Why this matters now
Nearly all of today's key exchange (TLS, SSH, VPNs) rests on problems like integer factoring and discrete logarithms being hard. Shor's algorithm solves both efficiently on a large fault-tolerant quantum computer. No such machine exists yet, but traffic recorded today can be decrypted whenever one does. That "harvest now, decrypt later" threat is why long-lived secrets already need quantum-resistant protection.
There are two answers. Post-quantum cryptography (lattice-based schemes like ML-KEM) replaces the hard math problems and is the practical near-term fix. Quantum key distribution, demonstrated here, takes the other road: it doesn't rely on computational hardness at all. BB84 (Bennett & Brassard, 1984) encodes key bits in the polarization of single photons. Quantum mechanics forbids copying an unknown quantum state and makes measurement in the wrong basis destructive, so an eavesdropper can't read the key without corrupting a detectable fraction of it. The parties don't just get a key; they get evidence about whether anyone listened.
crypto.getRandomValues), which this browser doesn't provide. It will not fall
back to weaker randomness.
| # | Alice bit | Alice basis | Photon | Eve basis | Bob basis | Bob result | Sifted |
|---|
A verified key can encrypt with information-theoretic security (unbreakable regardless of computing power) as long as the key is as long as the message and never reused. Each character costs 8 key bits.
The no-cloning theorem
Quantum mechanics forbids making a perfect copy of an unknown quantum state. A classical wiretap copies bits and forwards them, invisibly. Eve can't do that here: to learn anything about a photon she must measure it, and she can't keep an untouched copy to send along. Whatever she forwards is a reconstruction based on her measurement, and when she measured in the wrong basis, that reconstruction is detectably wrong.
Why measurement disturbs the state
A photon polarized in the rectilinear basis (↑ or →) has no defined value in the diagonal basis (↗ or ↘). Measuring it diagonally forces a random outcome and re-prepares the photon in that new orientation. The original state is gone. Think of a stranger who will answer exactly one question and then forget everything: ask the question they were prepared for and you get the truth; ask the wrong one and you get a random blurt, with the truth gone for good. Information gain about one basis necessarily disturbs the other; that trade-off is a law of physics, not an engineering limitation, and it's what turns eavesdropping into a measurable event.
Why Eve causes ~25% errors
Consider only the bits that survive sifting, the ones where Alice's and Bob's bases match. Eve guesses the right basis half the time; those photons pass through unharmed. The other half, she measures in the wrong basis, gets a random result, and resends the photon in her wrong basis. Bob, measuring in Alice's original basis, now gets a coin-flip: half of those come up wrong. So the error rate is ½ × ½ = 25%, far above any natural noise floor, and impossible for Eve to avoid with this attack. And notice what she gains when she's caught: nothing. No message was ever sent; only random numbers died.
Caveats — what this is and isn't
This simulates the protocol's math, not photons. Real QKD contends with detector
noise, channel loss, and imperfect single-photon sources, so a real channel has a
nonzero baseline QBER and applies error correction and privacy amplification to
distill the final key. Security proofs put the tolerable QBER ceiling near 11%, and
the verdict here uses that bound. This model has no natural noise, so any error is
Eve's, but a small QBER sample can still let her slip past undetected by luck; the
demo flags noisy samples and admits it when she gets away. Randomness comes from the
browser's CSPRNG
(crypto.getRandomValues) standing in for genuine quantum entropy. And
BB84 always needs an authenticated classical channel for basis comparison;
without it, Eve just impersonates Bob.
Is this a quantum computer?
No, and the distinction is the whole story. Quantum computers are the attack: a large one running Shor's algorithm would break the math behind RSA and elliptic-curve encryption. What you're watching here is quantum communication, a defense, and it needs no quantum computer at all. Real BB84 hardware is lasers, optical fiber, and single-photon detectors. The two technologies share physics, not purpose: one threatens today's locks, the other builds a lock that tells you when someone has picked at it.
Common questions
Why throw away half the bits? Bob has to guess how to measure and is only usefully right half the time. The discard is the price of Alice never announcing her encoding in advance, which is exactly what keeps Eve blind too.
Couldn't Eve just impersonate Bob? Yes, if the public discussion weren't authenticated. QKD needs a tamper-proof (not secret) classical channel, which in practice means a small pre-shared secret. QKD grows keys; it doesn't create trust from nothing.
Is this what banks use? Mostly not. QKD runs in niches (Swiss election data, Chinese backbone links) but needs dedicated hardware. The mainstream quantum defense is new math: post-quantum algorithms like ML-KEM.
Eve was on, but the verdict said clean. Bug? Feature. Detection is statistical: small runs sample only a few bits, and a spy occasionally gets lucky. The demo admits it when she does. At 256 photons she is essentially always caught.
Glossary
Photon. A single particle of light.
Polarization. The orientation a light wave oscillates in; how one photon carries one bit.
Basis. Which pair of orientations encodes 0 and 1 (+ is → and ↑, × is ↗ and ↘). Every measurement must pick one.
Sifting. Discarding the positions where Alice and Bob measured in different bases.
QBER. Quantum bit error rate; the disagreement rate in the sacrificed sample. The eavesdropping alarm.
Intercept-resend. Eve's measure-and-forward attack, the one this demo simulates.
No-cloning theorem. Unknown quantum states cannot be copied. Ever.
One-time pad. XOR a message with an equally long, never-reused random key; unbreakable by any amount of computing power.
CSPRNG. The browser's cryptographically secure random number generator, standing in here for quantum entropy.
ML-KEM. The lattice-based post-quantum standard; the "new math" answer to the same threat.