## 2 The BB84 Protocol in a Nutshell  
In the BB84 QKD protocol, two legitimate parties who wish to establish a secure communication, usually named [PERSON] and [PERSON], are linked via one quantum channel and one authenticated (but not necessarily encrypted) classical channel, while an eavesdropper, [PERSON], has a physical access to both channels, as shown in Figure 1.  
It is assumed that the classical communication channel is bidirectional and authenticated via an information-theoretic approach; [PERSON] can be sure that she is talking to [PERSON] and vice versa. The messages exchanged between [PERSON] and [PERSON] over this channel need not be encrypted, which means that [PERSON] can read them but cannot change them. The quantum channel is unidirectional; [PERSON] uses it to send qubits to [PERSON]. In the first phase of the BB84 protocol, using the quantum channel, [PERSON] sends [PERSON] a random, classical bit equiprobably valued 0 or 1 and encoded in a linearly polarized qubit as follows: a bit with a value of 0 is randomly and equiprobably encoded with a polarization of either 0\({}^{\circ}\) or 45\({}^{\circ}\), while a bit with a value of 1 is randomly and equiprobably encoded with a polarization of either 90\({}^{\circ}\) or 135\({}^{\circ}\). [PERSON] typically uses an electronic quantum random number generator (QRNG) [17; 18; 19; 20; 21; 22] in order to generate a qubit. [PERSON] randomly selects one of the two orthogonal bases in which the qubit is measured: (0\({}^{\circ}\), 90\({}^{\circ}\)) or (45\({}^{\circ}\), 135\({}^{\circ}\)). With a probability of 1/2, namely, when his base happens to match the polarization of the qubit, [PERSON] obtains the exact bit value that [PERSON] sent, while in the other case, [PERSON] obtains a random bit. To figure out which is the case, [PERSON] discloses his base to [PERSON] over the authenticated classical channel. Knowing which qubit she sent, [PERSON] replies either  
Figure 1: The BB84 protocol scenario. [PERSON], the sending station, generates qubits and sends them to [PERSON] through the one-way quantum channel (originally, it was a 30 cm long air gap). [PERSON], the receiving station, receives and measures the qubits. To accomplish the generation of a secret key, an authenticated, but not necessarily secret, two-way classical communication channel between them is necessary. It is assumed that an eavesdropper, [PERSON], has a physical access to both channels and any equipment allowed by the laws of nature. \"keep\", in which case they keep the bit, or \"discard\", in which case they both discard their bits. This communication is repeated until [PERSON] and [PERSON] collect a sufficiently long raw key, for example, until the length of \(L\) bits, agreed upon beforehand, is reached. The repeated communication of qubits is performed periodically with a frequency \(f_{G}\), which technically allows [PERSON] to define a short period of time \(t_{G}\) (henceforth referred to as the _gate time_) around the expected time of arrival of the qubits and, in this manner, reduce the effect of noise (dark counts). Note that by listening to the communication over the classical channel alone, [PERSON] is not able to figure out the value of the bit that is kept. Furthermore, she cannot fake any of the communication over the classical channel because it is authenticated. All she can do is to intervene in the quantum channel and listen to the classical channel. Ideally, after this initial phase, [PERSON] and [PERSON] have the same stream of bits, namely, their secret common key. However, due to inevitable hardware imperfections such as noise (dark counts and afterpulses in single-photon detectors), losses, and base misalignments, as well as [PERSON]'s tampering with the quantum channel, there will be some differences (errors). In order to correct them, they need two further classical communication phases, namely, information reconciliation and privacy amplification, which are performed over the authenticated classical channel.