Six-State Quantum Key Distribution (Bruß Protocol)

Overview

The six-state protocol is a variant of BB84 quantum key distribution in which Alice sends photons prepared in one of six states, drawn from three mutually unbiased bases, instead of one of four states from two bases. Bob measures each photon in one of the three bases at random. Because an eavesdropper has to guess among three bases rather than two, she is more likely to disturb the key, and the protocol tolerates a higher error rate before the key becomes insecure.

The price is efficiency. Alice and Bob use the same basis only a third of the time, so they keep one third of the transmitted photons instead of one half. The six-state protocol therefore trades key rate for noise tolerance, which makes it attractive when the channel is noisy.

The problem it solves

Establishing a shared secret key between two parties with even stronger security guarantees against intercept-and-resend eavesdropping attacks than the original BB84 protocol.

History and background

Dagmar Bruß proposed the protocol in 1998 in a Physical Review Letters paper on optimal eavesdropping with six states, and Helle Bechmann-Pasquinucci and Nicolas Gisin proposed essentially the same scheme independently in 1999. Hoi-Kwong Lo gave an unconditional security proof in 2001. The name Kitaev that sometimes appears in the literature and in this database is a misnomer, and the correct credit goes to Bruß and to Bechmann-Pasquinucci and Gisin.

The six states are the eigenstates of the three Pauli operators, which form the vertices of an octahedron on the Bloch sphere. Experiments followed with entangled photons in 2002 by Enzer, Hadley, Hughes, Peterson, and Rarity, and with various encodings since. The scheme has also been generalized to higher-dimensional states, where more bases give still stronger tolerance to noise.

How it works

Adds a third measurement basis to the standard BB84 setup, increasing the chance that any eavesdropping attempt is detected, at the cost of a higher fraction of discarded key bits.

BB84 uses two bases, such as horizontal-vertical and diagonal. An eavesdropper who measures in the wrong basis randomizes the result and disturbs the state. With two bases she guesses right half the time, and with a clever strategy she can learn some information while keeping the disturbance low.

With three mutually unbiased bases, the chance of guessing right drops to one third, and the geometry of the six states is more symmetric. For a given amount of information that Eve gains, she must introduce more errors than in BB84. Alice and Bob measure those errors in a sample of their key, so they detect her more easily.

This symmetry also simplifies the security analysis. Because Eve's attack must preserve the symmetry of the octahedron to be optimal, the proof can be reduced to a few parameters. The result is that the key remains secure for quantum bit error rates up to about 12.6 percent, compared with 11 percent for BB84, in the standard one-way analysis.

Step by step

1. Alice chooses for each photon a random bit and one of three bases, for example the Z, X, or Y basis, and sends the corresponding state.
2. Bob measures each photon in a randomly chosen one of the three bases and records the result.
3. Over an authenticated public channel, they announce the bases used and keep only the positions where they match, about one third of all.
4. They reveal a random subset of the kept bits to estimate the error rate. If it exceeds the threshold, they abort.
5. They run an error-correction protocol to make their remaining bits identical.
6. They apply privacy amplification to shorten the key and remove Eve's partial information, yielding a final secret key.

A worked example

Suppose Alice sends nine photons in the bases Z, X, Y, Z, X, Y, Z, X, Y, and Bob measures in the bases Z, Z, Y, X, X, X, Z, Y, Y. The matches are at positions 1, 3, 5, 7, and 9, which is five out of nine, a bit more than one third by chance. They keep those and discard the rest.

Now suppose Eve intercepts every photon, measures it in a random basis, and resends. She picks the wrong basis two thirds of the time. When she is wrong, the resent state is random relative to Alice's basis, so Bob gets the wrong bit half the time. The resulting error rate in the kept key is two thirds times one half, or 33 percent, compared with 25 percent for the same attack on BB84, so she is easier to spot.

Complexity and resources

What hardware it needs

• A source that prepares photons in six polarization or phase states, and modulators that can choose among three bases.
• Receivers that can measure in three bases, which is more complicated than BB84's two.
• Single-photon detectors and an authenticated classical channel.

Applications

• QKD over noisy channels, including free-space and satellite links, where tolerance to error rate matters more than raw rate.
• Research on high-dimensional QKD and on security proofs with more bases.
• A teaching example for how the geometry of states affects security.

Limitations and caveats

• The key rate is lower than BB84 for the same photon rate, because of the reduced sifting efficiency.
• Hardware is more complex, since three bases must be generated and measured.
• As with BB84, real implementations face side-channel attacks and finite-key effects.

Common misconceptions

• The six-state protocol is not unconditionally better than BB84. It improves noise tolerance and reduces rate.
• It is not named after Kitaev. The correct attribution is to Bruß and to Bechmann-Pasquinucci and Gisin.
• The higher error threshold does not mean errors are acceptable. Above the threshold no secret key can be extracted.

How it compares

• BB84 uses two bases, has higher sifting efficiency, and a lower noise threshold.
• E91 and BBM92 use entangled pairs, and a six-state version exists in entanglement-based form.
• Device-independent QKD gives stronger guarantees but much lower rates.

Real-world impact

One of several BB84 variants used in research and some commercial QKD systems, illustrating the ongoing refinement of quantum cryptography protocols beyond the original 1984 proposal.

Why it matters

The six-state protocol shows how choices in the structure of the protocol affect security and rate, and it was an early step in understanding the relationship between measurement geometry and eavesdropping. It remains a useful benchmark in security analysis.

For practical systems it illustrates the trade-off between noise tolerance and key rate, which is central when designing QKD over long or lossy links.

Frequently asked questions

Keep learning

• Related algorithm: BB84 Quantum Key Distribution
• Related algorithm: E91 Quantum Key Distribution
• Related algorithm: Device-Independent Quantum Key Distribution
• Related algorithm: Quantum Digital Signatures

This page is written for educational purposes. Complexity statements describe the best known results at the time of review (September 30, 2026), and research in this area moves quickly, so check recent papers before relying on a specific bound.

← Back to Algorithms Database