Quantum Key Distribution is a cryptographic technique for establishing a shared secret key between authorised parties by transmitting information through a quantum channel and using an authenticated classical communication channel for coordination and post-processing. Its defining feature is that the security analysis can exploit properties of quantum states, including measurement disturbance and the inability to perfectly copy an unknown quantum state. A well-designed QKD protocol does not normally transmit the final secret key as ordinary classical data.
Instead, the parties generate correlated raw information from quantum measurements, publicly compare selected non-secret information, estimate the channel's error characteristics and then apply classical procedures to reconcile differences and reduce any information potentially available to an eavesdropper. The result is a shorter shared key whose security can be quantified under specified assumptions.
BB84 is the canonical QKD protocol and was introduced by Charles Bennett and Gilles Brassard in 1984. In its basic form, the sender encodes random bits using quantum states chosen from two incompatible bases, while the receiver independently chooses measurement bases. After transmission, the parties communicate over an authenticated classical channel to identify which measurement bases were compatible, retaining only the corresponding results as a sifted key.
A subset can be disclosed to estimate the quantum bit error rate, which provides evidence about noise and potential interception. If the error statistics satisfy the protocol's security requirements, error correction and privacy amplification are performed. The core security intuition is that an eavesdropper cannot obtain information about the encoded states without causing disturbances that can alter the observed statistics. Modern security proofs provide much more rigorous bounds than this simplified intuition alone.
QKD requires both a quantum channel and a classical authenticated channel. The quantum channel may be implemented using optical fibre or free-space optical transmission, with individual photons or weak optical pulses carrying quantum information. The classical channel does not need to be secret, but it must be authenticated so that an attacker cannot impersonate either participant. After the quantum transmission, the classical channel supports sifting, parameter estimation, information reconciliation, privacy amplification and protocol coordination.
This hybrid structure is essential because QKD itself does not automatically solve authentication. If authentication fails, an attacker can establish separate keys with each endpoint while relaying communications between them. A complete QKD deployment therefore depends on conventional security infrastructure in addition to the quantum communication system.
Practical QKD differs substantially from idealised textbook descriptions because real systems use imperfect photon sources, detectors and optical components. Single-photon sources can be difficult to implement efficiently, so many systems use attenuated laser pulses that may contain zero, one or multiple photons according to a statistical distribution. Multi-photon emissions can create vulnerabilities that require countermeasures such as decoy-state methods. Detector imperfections can produce side channels, while optical losses and environmental conditions affect transmission. Security engineering therefore requires source characterisation, detector protection, random-number generation, calibration and monitoring. Measurement-device-independent QKD was developed partly to reduce reliance on trusting detector implementations, while device-independent approaches aim for even stronger assumptions but impose substantially more demanding experimental requirements.
QKD performance is constrained by distance, loss, key generation rate, error rate and hardware quality. In optical fibre, attenuation increases with distance, reducing the number of usable quantum signals received by the destination. Free-space links introduce different constraints involving atmospheric conditions, pointing accuracy, background light and line of sight. Classical optical amplifiers cannot simply be inserted into a quantum channel to compensate for loss because arbitrary amplification of unknown quantum states is constrained by quantum mechanics and would introduce noise.
Quantum repeaters are being investigated as a route to longer-distance networks by distributing entanglement and using quantum memories, but scalable repeater networks remain technically challenging. As a result, QKD deployments often use network architectures that carefully manage trusted nodes, metropolitan distances or specialised point-to-point links.
Security processing after quantum transmission is as important as the quantum state exchange itself. Error correction, more precisely information reconciliation, allows the parties to agree on the same raw key despite noise but reveals some information over the authenticated public channel. Privacy amplification then compresses the reconciled key using a universal hashing procedure so that the remaining key has a bounded amount of information potentially accessible to an adversary.
Finite-key analysis is required in practical systems because only a finite number of quantum signals are transmitted, so estimated error rates have statistical uncertainty. Composable security definitions are particularly useful because they describe how the generated key behaves when incorporated into larger cryptographic protocols rather than treating QKD as an isolated experiment.
QKD does not make an entire network secure automatically. Endpoint compromise, malicious or vulnerable control software, poor authentication, insecure key storage, compromised random-number generators and implementation side channels can all undermine the system. Key management remains necessary because generated keys must be stored, used and eventually destroyed according to security policies. QKD also generally requires specialised optical hardware and dedicated infrastructure, creating cost and operational considerations that differ from software-only cryptography. Its security depends on explicit assumptions about devices, channels and adversaries, so claims that QKD provides unconditional security without qualification are misleading. The more precise description is that appropriately designed QKD protocols can provide strong information-theoretic security guarantees under defined physical and cryptographic assumptions.
The significance of Quantum Key Distribution is that it provides a mechanism for generating shared cryptographic keys whose security can be linked directly to quantum physical principles. It should be distinguished from post-quantum cryptography, which runs on conventional computers and networks but uses mathematical constructions designed to withstand quantum-computer attacks. QKD and post-quantum cryptography can also be used together, providing different layers of protection and addressing different threat models.
QKD is particularly relevant where organisations can justify specialised quantum communication infrastructure and require strong assumptions about long-term key confidentiality. Its future development depends on improvements in photon sources, detectors, integrated photonics, quantum memories, networking architectures, security proofs and operational standards, with the central challenge being the transition from controlled point-to-point demonstrations to robust, scalable and economically practical quantum networks.
