Cited by 8,299Quantum Information and CryptographyCryptography and Data SecurityWireless Communication Security Techniques

Quantum cryptography: Public key distribution and coin tossing

Open access
Bennett, Charles H., Brassard, Gilles·2014·Theoretical Computer Science

Abstract

When elementary quantum systems, such as polarized photons, are used to transmit digital information, the uncertainty principle gives rise to novel cryptographic phenomena unachievable with traditional transmission media, e.g. a communications channel on which it is impossible in principle to eavesdrop without a high probability of disturbing the transmission in such a way as to be detected. Such a quantum channel can be used in conjunction with ordinary insecure classical channels to distribute random key information between two users with the assurance that it remains unknown to anyone else, even when the users share no secret information initially. We also present a protocol for coin-tossing by exchange of quantum messages, which is secure against traditional kinds of cheating, even by an opponent with unlimited computing power, but ironically can be subverted by use of a still subtler quantum phenomenon, the Einstein-Podolsky-Rosen paradox.

AI snapshot

Written from the paper’s full text.

TL;DR

The paper introduces quantum cryptography using non-orthogonal polarized photon states to distribute a secret random key between users who initially share no secret, with eavesdropping detectable in principle. It also presents a quantum coin-tossing protocol secure against traditional cheating even with unlimited computing power, except for a theoretical EPR-based attack requiring perfect photon storage and detection.

Key findings

  • In quantum key distribution, an eavesdropper informed of a photon’s original basis only after measuring it can obtain at most 1/2 expected bits about the key bit; any measurement yielding \(b\) bits (\(b \le 1/2\)) must induce disagreement with probability at least \(b/2\) when the photon is later re-measured in its original basis. The optimum tradeoff example: measuring and retransmitting all intercepted photons rectilinearly learns the correct polarizations of half the photons and induces disagreements in 1/4 of those later re-measured in the original basis.
  • Alice and Bob can test for eavesdropping by publicly comparing a random subset—say one third—of correctly received bits; if comparisons agree, the remaining same-basis bits can be used as a one-time pad.
  • For coin tossing, Alice sends about one thousand random bits encoded in one basis; Bob guesses the basis; Alice reveals the basis and her original bit string; Bob verifies against his rectilinear and diagonal tables. The honest protocol gives each party exactly 50 per cent chance of winning.
  • Cheating by Bob would require guessing Alice’s basis with probability greater than 1/2, which would imply distinguishing randomly polarized photon trains and enable faster-than-light communication via the Einstein-Podolsky-Rosen effect. Alice can cheat using EPR photon pairs, but this requires perfect efficiency of storage and detection of photons, beyond current technology.

Methods

  • Theoretical protocol design and security analysis based on quantum mechanics of single polarized photons, Hilbert-space formalism, conjugate rectilinear and diagonal bases, the uncertainty principle, and the no-cloning theorem.
  • Quantum key distribution protocol: Alice sends random bits in randomly chosen bases; Bob measures randomly in one of the two bases; public classical discussion identifies successful same-basis bits; optional Wegman-Carter authentication can relax the need for an active-eavesdropping-immune public channel if a small secret key is shared.
  • Coin-tossing protocol: Alice sends a photon train in one basis, Bob guesses the basis, Alice reports the actual basis and certifies by revealing her original bit sequence, and Bob verifies against his two measurement tables. The paper provides illustrative examples but no empirical data.

Limitations

  • Stated: quantum transmissions are necessarily very weak and cannot be amplified in transit; quantum cryptography does not provide digital signatures, certified mail, or the ability to settle disputes before a judge.
  • Stated: the public channel must be immune to active eavesdropping unless Alice and Bob share a small secret key for Wegman-Carter authentication; an eavesdropper can still suppress communication, though users can detect suppression with high probability.
  • Stated: the EPR cheating attack is merely theoretical because it requires perfect efficiency of photon storage and detection, beyond current technology; the honestly followed protocol could be realized with current technology. Evident from the text: no experimental implementation or empirical data are reported, and the security arguments are theoretical.

Model-written summary. Check it against the paper before relying on it.

Integrity signals

Registry

Crossref · 10.1016/j.tcs.2014.05.025

Cites

6 of 6 references verified0 citation errors · 0 not checkable

Statistics

Nothing to recompute.

Claims the paper makes

0 of 6 cited sources checked · 0 supported · 0 flagged

  • Findingreasoning
    § lll. Quantum Public Key Distribution · p. 4

    Bob obtains meaningful data from only half the photons he detects-those for which he guessed the correct polarization basis.

    “Thus Bob obtains mean­ ingful data from only half the photons he detects-­ those for which he guessed the corre'ct polarization basis.”
    Quote in the paperSubstantial claim
  • Findingreasoning
    § lll. Quantum Public Key Distribution · p. 4

    Any such measurement yielding b bits of expected information (b ≤ 1/2) must induce a disagreement with probability at least b/2 if the measured photon, or an attempted forgery of it, is later re-measured in its original basis.

    “and that any such measurement yielding b bits of expected information (b s 1/2) must induce a disagreement with probability at least b/2 if the measured photon, or an attempted forgery of it, is later re-measured in its original basis.”
    Quote in the paperSubstantial claim
  • Findingreasoning
    § lll. Quantum Public Key Distribution · p. 4

    The optimum tradeoff occurs when the eavesdropper measures and retransmits all intercepted photons in the rectilinear basis, thereby learning the correct polarizations of half the photons and inducing disagreements in 1/4 of those later re-measured in the original basis.

    “when the ea­ vesdropper measures and retransmits all intercepted photons in the rectilinear basis, thereby learning the correct polarizations of half the photons and inducing disagreements in 1/4 of those that are lat­ er re-measured in the original basis.”
    Quote in the paperSubstantial claim
  • Premisecitation
    § II. Essential Properties of Polarized Photons · p. 3

    Cloning a single photon into identically polarized photons is inconsistent with the foundations of quantum mechanics.

    “such cloning can be shown to be inconsistent with the foundations of quant . um mechanics [WZ)”
    Quote in the paperSubstantial claim0 of 1 sources checked
    • cites [WZ)

      Not checked in the free run.

  • Interpretationnone given
    § I. Introduction · p. 2

    Even in the presence of active eavesdropping, two parties can still distribute key securely if they share some secret information initially, provided the eavesdropping is not so active as to suppress communications completely.

    “Even in the presence of active eavesdropping, the two parties can still distribute key securely if they share some secret information initially, provided the eavesdropping is not so active as to suppress connunications completely.”
    Quote in the paperSubstantial claim
    • The authors state this as an assumption: The public classical channel used in the protocol is susceptible to eavesdropping but not to injection or alteration of messages.
  • The quote only partly states this claim. 4
  • Classified as probably not a substantial claim. 3
  • May combine two claims. 8
  • The quote only partly states this claim.

    Interpretationreasoning
    § I. Introduction · p. 2

    Quantum coding by itself permits secure distribution of random key information between parties who share no secret information initially, provided they have access to an ordinary channel susceptible to passive but not active eavesdropping.

    “Here we show that quantum coding by itself achieves one of the main advantages of public key cryptography by per­ mitting secure distribution of random key informa­ tion between parties who share .no secret information”
    Quote in the paperSubstantial claim
    • The authors state this as an assumption: The public classical channel used in the protocol is susceptible to eavesdropping but not to injection or alteration of messages.
  • Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based). May combine two claims.

    Interpretationnone given
    § I. Introduction · p. 2

    Quantum cryptography does not provide digital signatures, or applications such as certified mail or the ability to settle disputes before a judge.

    “Moreover, quantum cryptography does not provide di­ gital signatures, or applications such as certified 11ail or the ability to settle disputes before a judge.”
    Quote in the paperNot a substantial claim
  • May combine two claims. The quote only partly states this claim.

    Interpretationreasoning
    § IV. Quantura Coin Tossing · p. 6

    This EPR cheat requires Alice to store twin photons for a considerable time and measure them with high detection efficiency, and thus would be possible only in principle, not in practice.

    “This cheat requ.i. 1:.-s that Alice be able to store the twin photons fc-r 3 considerable time and then measure them wit!, hcqh detection efficien­ cy”
    Quote in the paperSubstantial claim
  • May combine two claims.

    Interpretationreasoning
    § lll. Quantum Public Key Distribution · p. 5

    In either case, Alice and Bob will conclude with high probability that their secret communications are being suppressed, and will not be fooled into thinking their communications are secure when in fact they are not.

    “However, in either case, Alice and Bob will conclude with high proba­ bility that their secret communications are being suppressed,. and will not be fooled into thinking their communicaticns are secure when in fact they're not.”
    Quote in the paperSubstantial claim
    • The authors state this as an assumption: The public classical channel used in the protocol is susceptible to eavesdropping but not to injection or alteration of messages.
  • Probably not a substantial claim: may not pass S4 (based).

    Premisenone given
    § IV. Quantura Coin Tossing · p. 5

    In traditional coin-tossing schemes, analogous attempts to seize a lucky victory from defeat, though unlikely to succeed, are unaccompanied by any danger of detection.

    “By contrast, in traditional coin-tossing schemes, analogous attempts to seize a lucky victory frOft the jaws of defeat, though unlikely to succeeed, are unaccompanied by any danger of detection.”
    Quote in the paperNot a substantial claim
  • May combine two claims.

    Interpretationnone given
    § lll. Quantum Public Key Distribution · p. 5

    An eavesdropper can prevent communication by suppressing messages in the public channel, as he can by suppressing or excessively perturbing photons sent through the quantum channel.

    “The eavesdropper can still prevent communication by suppressing messages in the public channel, as of course he can by sup­ pressing or excessively perturbing the photons sent through the quantum channel.”
    Quote in the paperNot a substantial claim
    • The authors state this as an assumption: The public classical channel used in the protocol is susceptible to eavesdropping but not to injection or alteration of messages.
  • Classified as probably not a substantial claim.

    Interpretationreasoning
    § lll. Quantum Public Key Distribution · p. 4

    The bit positions used in this comparison should be a random subset (say one third) of the correctly received bits, so that eavesdropping on more than a few photons is unlikely to escape detection.

    “The bit positions used in this comparison should be a random subset (say one third) of the correctly received bits, so that eavesdropping on more than a few pho­ tons is unlikely to escape detection.”
    Quote in the paperSubstantial claim
  • May combine two claims. The quote only partly states this claim.

    Premisereasoning
    § IV. Quantura Coin Tossing · p. 6

    Formal quantum mechanics supports this explanation: the EPR state produced by the decay is described by the vector 0.7071(r1 r2 - r2 r1), and the EPR effect is explained by this vector having anticorrelated projections into the two photons' 2-dimensional Hilbert spaces no matter what basis is used.

    “This iaplausible-sounding explanation is supported by formal quantum mechanics, which represents the state of a pair of photons as a vector in a 4-dimensional Hilbert space obtained by taking the tensor product of two 2-dimensional Hilbert spaces.”
    Quote in the paperNot a substantial claim
  • May combine two claims.

    Interpretationreasoning
    § IV. Quantura Coin Tossing · p. 5

    In order to cheat, Bob would need to guess Alice's basis with probability greater than 1/2; this amounts to distinguishing a train of photons randomly polarized in one basis from a train randomly polarized in another basis.

    “Bob woulr: nc,,d to guess Alice's basis ·:-th i:robability greate: than 1/2.”
    Quote in the paperSubstantial claim
  • May combine two claims.

    Interpretationreasoning
    § lll. Quantum Public Key Distribution · p. 4

    If all comparisons agree, Alice and Bob can conclude that the quantum transmission has been free of significant eavesdropping, and the remaining bits sent and received with the same basis can safely be used as a one-time pad for subsequent secure communications over the public channel.

    “If all the comparisons agree, Alice and Bob can conclude that the quantum transmission has been free of signifi­ cant eavesdropping; and those of the remaining bits that were sent and received with the same basis also agree, and can safely be used as a one time pad for subsequent secure communications over the public channel.”
    Quote in the paperSubstantial claim
    • The authors state this as an assumption: The public classical channel used in the protocol is susceptible to eavesdropping but not to injection or alteration of messages.
  • The quote only partly states this claim.

    Interpretationreasoning
    § IV. Quantura Coin Tossing · p. 5

    If Alice follows step 1 honestly and finds herself losing at step 3 because Bob guessed correctly, she cannot reliably convince Bob that her photons were diagonally polarized by producing a bit sequence in perfect agreement with Bob's diagonal table, because that table results from probabilistic behavior of photons after they left her hands.

    “she would need to convince Bob that her photons were :Hagonally polarized, which she can only do by prod­ ucing a sequence of bits in perfect agreement with Bob's diagonal table.”
    Quote in the paperSubstantial claim
  • May combine two claims.

    Interpretationreasoning
    § IV. Quantura Coin Tossing · p. 6

    Any photons lost by Alice during storage or measurement would result in holes in her pretended bit sequence, which she would have to fill by guessing, and these guesses would risk detection by Bob if they failed to agree with his tables.

    “Any pholons lost by Alice during storage or measurement would result in holes in her pretended bit sequence, which she would have to fill by guessing, and these guesse3 would risk detection by Bob if they failed to agr·?c, with his tables.”
    Quote in the paperSubstantial claim
12 of 12
  • The authors state this as an assumption.

    The public classical channel used in the protocol is susceptible to eavesdropping but not to injection or alteration of messages.

    “susceptible to eavesdropping but not to the injection or alteration of messages.”
1 of 1

Claims other papers make about this one

Each is checked against this paper’s own text: does it say what the citing paper says it does?

  • QKD protocols such as BB84 and E91 have been successfully implemented since 2003.

    “QKD protocols such as BB84 and E91 have been successfully implemented since 2003.”

    From Quantum-resistance in blockchain networks (2023) · cites this paper as [31]

    The Introduction (p. 2) and Quantum Public Key Distribution section (pp. 3–4) describe a quantum key-distribution protocol, but do not report implementations of BB84 or E91. Searches for “2003 successfully implemented” and “E91 BB84 experimental implementation” found no passage supporting the claimed date or implementations. (LLM, conf=0.76)

    Experimental — accuracy not yet measured

Cites

Flagged first, then by citations

Research works printed but not linked: 1

  1. David Bohm, Quantum Theory (Prentice-Hall, Englewood Cliffs, NJ, 1951), pp. 614–619.

Cited by

Sorted by citations

Authors
Bennett, C. H., & Brassard, G.
Affiliations
IBM (United States) (US)
Corresponding author
Bennett, Charles H.
Venue
Theoretical Computer Science
Publisher
Elsevier BV
Published
2014-12
Volume
560
Pages
7-11
ISSN
0304-3975 (ISSN-L)
OpenAlex
W2015179126
Cited by
8,299
References
6
Citations by year
2026: 479 · 2025: 773 · 2024: 554 · 2023: 518 · 2022: 463 · 2021: 616 · 2020: 519 · 2019: 512 · 2018: 374 · 2017: 377 · 2016: 326 · 2015: 343 · 2014: 308 · 2013: 304 · 2012: 277
FWCI
449.98
Type
journal article
Language
en
Open access
Locations
  • Theoretical Computer Science (publishedVersion, cc-by-nc-nd)
  • arXiv (Cornell University) (submittedVersion)
  • arXiv (Cornell University)
Topics
  • Physical Sciences › Computer Science › Artificial Intelligence › Quantum Information and Cryptography
  • Physical Sciences › Computer Science › Artificial Intelligence › Cryptography and Data Security
  • Physical Sciences › Engineering › Electrical and Electronic Engineering › Wireless Communication Security Techniques
Keywords
quantum cryptography, public key distribution, quantum key distribution, polarized photons, uncertainty principle, eavesdropping detection, quantum channel security, EPR paradox

About these checks

Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.

Claims read by deepseek-v4.1-flash under definition version 3 (extract-v3) on 2026-10-10.

Classified by jev-1.13-20260917 (gold-guideline-v0.2) on 2026-10-10.

Statistics and arithmetic are recomputed, not judged.

Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.

What counts as a claim ›How we measure confidence ›How we check this ›

Are you an author, or do you see a problem with this page? Request a review