Quantum Cryptography

Classical public-key security rests on computational assumptions; information-theoretic security holds against an adversary with unbounded computing power, provided the key is truly random, as long as the message, and never reused. The one-time pad is the canonical example, and its practical difficulty is key distribution — which is exactly what QKD attempts to solve.

The no-cloning theorem states that no unitary can copy an unknown quantum state. An eavesdropper cannot faithfully copy a photon in an unknown basis, so any attempt to gain information introduces disturbance that the legitimate parties can detect through their error rate. This is the security intuition behind prepare-and-measure protocols; the formal proofs are considerably more involved.

BB84 encodes bits in two mutually unbiased bases. Alice sends one of four states; Bob measures in a randomly chosen basis; they publicly compare bases and keep matching positions, producing a sifted key of roughly half the transmitted bits. An eavesdropper measuring in the wrong basis disturbs the state, raising the quantum bit error rate.

A simulation must model all of it: basis choice, channel loss, dark counts, detector efficiency and interceptor behaviour. The valuable outcome is a curve of secure key rate against distance and error rate, plus a demonstration that interception above a threshold causes the protocol to abort. Anything less is a diagram, not an implementation.

E91 distributes entangled pairs and derives security from the observed violation of a Bell inequality. If the measured correlations exceed the classical bound, the assumption that the devices share a local hidden-variable description fails, and an eavesdropper who learned the outcomes would have destroyed the violation.

Entanglement-based schemes enable device-independent security in principle, since trust in the devices is replaced by statistical tests. In practice the loopholes — detection, locality, freedom of choice — must all be closed, which demands demanding experimental infrastructure and long measurement times.

After sifting, Alice and Bob hold correlated but not identical strings. Error correction (reconciliation) makes them agree while leaking information; privacy amplification compresses the key so that an adversary's partial knowledge is reduced exponentially, at the cost of key length. Both stages consume key material and must be accounted for in the final rate.

Practical attacks target devices rather than protocols: detector efficiency mismatch enables blinding, bright illumination enables Trojan-horse probing, and source flaws leak basis information. Measurement-device-independent designs remove detector side channels at the cost of network complexity. Every deployed link should be assessed against the published attack literature, not only the protocol proof.

QKD guarantees that an eavesdropper's information about a distributed key is bounded by physics rather than by computational assumptions. It does not authenticate the parties by itself, it does not protect data at rest, and it does not make an insecure network secure. Every deployment therefore depends on a classical authentication layer, and the security of the whole system is bounded by that layer.

The guarantee is also conditional: on the detector model, on the source characterisation, on the correctness of the classical post-processing, and on the implementation matching the proof. Deviations from the model are exactly where practical attacks have succeeded — detector blinding, photon-number splitting against weak coherent sources, and side channels in the classical channel. Understanding these attacks is more valuable than memorising protocol names.

Operational discipline matters as much as the cryptography. Keys need rotation, storage, audit and revocation; a QKD link producing keys nobody rotates is a compliance ornament. When evaluating a deployment, ask how key material enters and leaves the system, not only what the security proof says.

BB84 with weak coherent pulses is the most deployed approach because it works with standard telecom components. Its limitations are practical: multi-photon emissions weaken the guarantee, and decoy-state methods are needed to bound them. Measurement-device-independent QKD removes detector side channels by having a central relay perform the measurement, at the cost of lower key rates and additional hardware. Continuous-variable QKD uses coherent detection compatible with existing optical infrastructure but has tighter loss and excess-noise requirements.

Comparing protocols is a system-design exercise. Rate depends on distance, loss, detector efficiency and the fraction of signals surviving post-selection. Range depends on error rate crossing the security threshold. Hardware maturity determines whether you can operate it unattended. A protocol that is theoretically stronger but requires cryogenic detectors may be the wrong choice for a field deployment with a repair cycle measured in weeks.

Entanglement-based schemes are the natural fit for future quantum networks and repeaters but are furthest from operational simplicity. Treat them as a research trajectory rather than a procurement option unless the deployment is explicitly a testbed.

Practical attacks target implementations, not mathematics. Detector blinding makes a detector respond deterministically to bright light, so an attacker learns the basis without disturbing the state. Photon-number splitting exploits multi-photon pulses from attenuated lasers, taking one photon and passing the rest. Trojan-horse probing sends light back into the source to read modulator state. Time-shift attacks exploit detector efficiency mismatch.

Each has a countermeasure that must be verified, not assumed: measurement-device-independent designs, decoy states, optical isolators, and detector calibration monitoring. The recurring lesson is that the security proof covers an idealised device, and the deployment contains a real one whose behaviour drifts with temperature, age and calibration.

Monitoring is part of the defence. Track error rate, detection statistics and detector efficiency over time; a sudden improvement in one parameter is as suspicious as a degradation. Many attacks work by making the system behave better than it should, which is easy to miss if you only alarm on bad numbers.

A QKD link provides key material; a network needs key management. The integration work is a key-delivery interface that feeds session keys to encryptors or applications, with defined rates, buffer behaviour under outage and fallback policy. If the fallback silently reverts to a classical key exchange, the security claim must say so explicitly, because operators will assume the stronger guarantee is always active.

Site requirements are frequently underestimated: dark fibre with acceptable loss, controlled access to equipment, stable temperature for detectors, and a monitoring path that does not itself depend on the link being protected. A link that cannot be supervised is a link that will be bypassed by the operations team within a quarter.

Plan the migration as a portfolio. QKD for high-value fixed links, post-quantum cryptography for everything that cannot have dedicated fibre, and classical cryptography for the rest with a documented deprecation path. The three coexist for years, and the architecture must make the boundary between them explicit rather than accidental.

Demonstrate that interception raises the error rate detectably.

Simulate BB84 with a noiseless channel, then with an intercept-resend eavesdropper, and compare QBER and secure key output.

Compute secure key rate against distance.

Model fibre loss, detector efficiency and dark counts, then plot secure key rate from 10 to 100 km.

Show why QKD fails without an authenticated channel.

Simulate a man-in-the-middle against an unauthenticated classical channel and demonstrate key mismatch or complete compromise.

Context: Protecting settlement links against future decryption.

Method: Pilot QKD between data centres plus parallel PQC migration.

Findings and status: QKD limited by distance and cost; PQC adopted for the broader estate.

Transferable lesson: QKD complements rather than replaces post-quantum migration.

Context: Key delivery to many endpoints.

Method: QKD-derived keys fed into key management with classical fallback.

Findings and status: Operational complexity dominated total cost.

Transferable lesson: Integration cost, not protocol performance, decides viability.

Context: Published QKD systems broken through detector side channels.

Method: MDI-QKD designs and hardware monitoring.

Findings and status: Attack classes mitigated at increased implementation complexity.

Transferable lesson: Device security is not implied by protocol security.

Context: Intercontinental key distribution beyond fibre reach.

Method: Free-space links with trusted ground stations.

Findings and status: Demonstrations complete; availability limited by weather and passes.

Transferable lesson: Physics constrains availability, which must enter the service design.

Context: The pilot reported key rate but not key-management integration, and the encryptors continued to source keys classically during outages without logging it.

Method: Instrumented the key-delivery interface, defined an explicit fallback policy with alerting, and ran deliberate link-interruption tests.

Findings and status: Operators could state at any moment which key source was in use, which made the assurance claim auditable.

Transferable lesson: A security claim is only as good as its ability to say which mechanism is active right now.

Context: Detector efficiency drifted with temperature, raising the error rate without any attack present.

Method: Added continuous detector characterisation and a recalibration schedule, plus alarms on anomalous improvements as well as degradations.

Findings and status: Link availability improved and the monitoring regime was adopted as the operational baseline.

Transferable lesson: Physical drift and attack are indistinguishable without characterisation data over time.

Work through these in order — each builds evidence the capstone requires. Record assumptions, code versions, shots or sample counts, and validation results; the reasoning is assessed, not only the answer.

An organisation is offered a QKD link between two data centres and needs an independent technical assessment.

Problem: Model the link, compute achievable secure key rate, identify trust assumptions, and compare it with a post-quantum migration for the same requirement.

Objectives: Produce an evidence-based recommendation covering technical performance, security assurance and cost.

Deliverables: Simulation, key-rate analysis, attack-surface review, cost comparison and recommendation.

Assessment: Technical modelling 30%, security analysis 30%, cost comparison 20%, recommendation 20%.