I Built Quantum Cryptography in Python — And Caught an Eavesdropper in the Act
A hands-on project in quantum key distribution — from Qiskit simulation to real IBM hardware.
Every time you log into your bank, buy something online, or send a WhatsApp message, your data is protected by a cryptographic method invented in the 1970s. It relies on a simple fact: certain mathematical problems are very hard to solve.
There’s just one problem. A sufficiently powerful quantum computer will solve them anyway. In 1994, mathematician Peter Shor showed that a quantum computer could break RSA — the encryption behind basically every secure transaction on the internet — in hours.
Banks, governments, and security researchers are already preparing for this. One of the most promising solutions isn’t a new algorithm. It’s a new physics.
It’s called Quantum Key Distribution, and I spent the last few months building a full simulation of it in Python.
The Idea
QKD doesn’t rely on math being hard. It relies on a law of nature: you cannot copy an unknown quantum state without disturbing it.
Two parties — let’s call them Alice (a bank HQ) and Bob (a branch office) — want to agree on a secret key they’ll use to encrypt messages. They send each other single photons of light, each one encoding a 0 or a 1. An eavesdropper (Eve) who tries to intercept a photon has to measure it — which destroys it. Alice and Bob can then look for the disturbance and know they’re being spied on.
The protocol is called BB84, after its inventors Charles Bennett and Gilles Brassard, who published it in 1984.
What I Built
I built a full BB84 simulator in Python using Qiskit, IBM’s quantum computing library. Here’s what it does:
Get Kossay AL Nasser’s stories in your inbox
Join Medium for free to get updates from this writer.
1. Alice generates random bits and random bases (think of a basis as a “way of looking” at a qubit — like looking at a coin flat vs. from the side).
2. She encodes each bit into a qubit and sends it.
3. Bob measures each qubit in a randomly chosen basis.
4. They publicly compare bases (never bits). Where the bases match, they keep the bit. Where they don’t, they throw it away.
5. What’s left is the sifted key.
The Moment It Clicked
Here’s the exciting part. I added an eavesdropper — Eve — who intercepts each qubit, measures it, and sends a new one to Bob based on what she saw.
The result on screen:
QBER with no eavesdropper: 0.00%
QBER with eavesdropper: 25.08%
Twenty-five percent. That number isn’t arbitrary. It’s the exact theoretical prediction. Eve has to guess the basis. She guesses wrong half the time, and when she guesses wrong, Bob’s measurement comes out random half the time. 0.5 × 0.5 = 0.25.
So Alice and Bob don’t need to know who Eve is or what she’s doing. They just look at their error rate. Above ~11%? Someone’s listening. Throw the key away.
That’s what quantum physics gives you: provable security. Not “trust us, the math is hard.” Not “we think no one has broken this yet.” Physics itself.
Going Further
I didn’t stop at the basic protocol. I added:
· Channel noise simulation — real fiber optic cables introduce ~1–5% errors even with no Eve.
· Cascade error correction — how Alice and Bob fix residual errors without revealing the key.
· Privacy amplification — how they compress the key using SHA-256 so Eve’s knowledge becomes useless.
· The PNS attack and decoy-state defense — a subtle attack where Eve steals photons from multi-photon pulses without causing errors, and the real-world fix used by commercial QKD systems.
Then I ran the core physics on real IBM quantum hardware — the 156-qubit ibm_fez processor. Same-basis measurements came back with 97–98% accuracy (the missing 2–3% is genuine quantum decoherence, exactly the noise real QKD systems must handle). Different-basis measurements were random, as the theory predicts.
Why This Matters
Today’s encryption is a promise: “trust us, it’s too hard to break.” Quantum cryptography is a different kind of promise: “it is physically impossible to break without being detected.”
The project lives at github.com/Kusai-quantum/bb84-qkd. It has 12 unit tests, a GitHub Actions CI pipeline, an animated visualization, and public hardware validation on IBM Quantum.
What surprised me most was how simple the core idea turned out to be. Alice sends a qubit, Bob measures it, and physics does the rest. The math is elegant, but the guarantee is physical — and that’s a completely different kind of security than anything I’d learned about before.
