BT Group: Quantum Key Distribution Over Live Telecom Fiber

The Problem

BT Group operates one of the UK’s largest fiber networks. That infrastructure is protected today by RSA and elliptic-curve cryptography. A fault-tolerant quantum computer running Shor’s algorithm would break both.

The timeline pressure comes from “harvest now, decrypt later” attacks: adversaries can record encrypted traffic today and decrypt it once quantum hardware matures. Long-lived secrets are already at risk.

BT’s quantum team asked a concrete engineering question: can QKD be deployed on production fiber, alongside live classical traffic, at the distances required for a national backbone?

BB84 Protocol

BB84 is the foundational QKD protocol. Alice encodes random bits onto single photons using two conjugate bases. Bob measures in a randomly chosen basis. They compare bases over a classical channel and keep only the bits where bases matched (sifting). Any eavesdropper disturbs the quantum states in a detectable way.

import numpy as np
from enum import Enum

class Basis(Enum):
    RECTILINEAR = 0  # |0>, |1>
    DIAGONAL = 1     # |+>, |->

def alice_prepare(n_bits: int):
    """Alice generates random bits and random basis choices."""
    bits = np.random.randint(0, 2, n_bits)
    bases = np.random.choice([Basis.RECTILINEAR, Basis.DIAGONAL], n_bits)
    return bits, bases

def bob_measure(alice_bits, alice_bases, n_bits: int):
    """Bob measures in a randomly chosen basis (simulation)."""
    bob_bases = np.random.choice([Basis.RECTILINEAR, Basis.DIAGONAL], n_bits)
    bob_bits = np.zeros(n_bits, dtype=int)

    for i in range(n_bits):
        if bob_bases[i] == alice_bases[i]:
            # Matching basis: Bob measures the correct bit
            bob_bits[i] = alice_bits[i]
        else:
            # Mismatched basis: random outcome
            bob_bits[i] = np.random.randint(0, 2)

    return bob_bits, bob_bases

def sift_key(alice_bits, alice_bases, bob_bits, bob_bases):
    """Keep only positions where both parties used the same basis."""
    matching = [i for i in range(len(alice_bases))
                if alice_bases[i] == bob_bases[i]]
    alice_key = alice_bits[matching]
    bob_key = bob_bits[matching]
    return alice_key, bob_key, matching

def estimate_qber(alice_key, bob_key, sample_fraction=0.1):
    """
    Quantum Bit Error Rate: fraction of sifted bits that disagree.
    QBER > 11% indicates eavesdropping (BB84 security threshold).
    """
    n_sample = max(1, int(len(alice_key) * sample_fraction))
    indices = np.random.choice(len(alice_key), n_sample, replace=False)
    errors = np.sum(alice_key[indices] != bob_key[indices])
    qber = errors / n_sample
    return qber

# Simulate a BB84 exchange
N = 10000
alice_bits, alice_bases = alice_prepare(N)
bob_bits, bob_bases = bob_measure(alice_bits, alice_bases, N)
alice_key, bob_key, sifted_indices = sift_key(
    alice_bits, alice_bases, bob_bits, bob_bases
)
qber = estimate_qber(alice_key, bob_key)

print(f"Raw bits transmitted:  {N}")
print(f"Sifted key length:     {len(alice_key)} (~50% expected)")
print(f"QBER:                  {qber:.3f}")
print(f"Keys match:            {np.array_equal(alice_key, bob_key)}")

Twin-Field QKD for Long Distances

Standard BB84 is limited to roughly 100 km by photon loss in fiber. BT deployed Toshiba’s twin-field (TF-QKD) variant, which uses a central measurement node and photon interference from both endpoints to extend the effective distance twofold, enabling 200+ km links.

def twin_field_key_rate(distance_km, attenuation_db_per_km=0.2):
    """
    Simplified TF-QKD key rate model.
    TF-QKD scales as sqrt(channel transmittance) vs linear for BB84.
    """
    total_loss_db = attenuation_db_per_km * (distance_km / 2)  # half distance per side
    transmittance = 10 ** (-total_loss_db / 10)
    # TF-QKD key rate proportional to sqrt(eta) not eta
    key_rate_bps = 1e9 * np.sqrt(transmittance) * 0.001  # simplified model
    return key_rate_bps

for dist in [50, 100, 150, 200, 250]:
    rate = twin_field_key_rate(dist)
    aes_refreshes_per_hour = (rate * 3600) / 256  # AES-256 needs 256 bits
    print(f"{dist} km: {rate:.1f} bps, "
          f"{aes_refreshes_per_hour:.0f} AES-256 keys/hour")

Coexistence with Classical Traffic and Results

Running QKD single-photon channels alongside classical DWDM traffic on the same fiber is the key engineering challenge. Classical signals carry billions of photons per second; a stray Raman-scattered photon can overwhelm the quantum channel. BT allocated the quantum channel to the O-band (1310 nm) while classical traffic used the C-band (1550 nm), with 100+ dB isolation at the QKD receiver.

The Cambridge-to-London corridor test demonstrated:

BT’s Cambridge-to-London corridor test demonstrated:

• Secure key generation sustained at 200 km on production fiber
• QBER remained below 5% (well under the 11% security threshold) during coexistence with 10 Gbps classical traffic
• Key rates adequate to refresh AES-256 session keys every few seconds
• No service disruption to existing classical customers on the same fiber

Hybrid Security Model and National Network

QKD provides information-theoretic security for key exchange but does not encrypt data by itself. BT’s deployment used a hybrid model: QKD-generated keys seed AES-256 for bulk encryption, while CRYSTALS-Kyber handles fallback for links without QKD hardware. The system is secure if either layer remains unbroken. BT’s work feeds into the UK National Quantum Network program, aiming for a quantum-secured backbone across major UK cities on BT’s existing fiber infrastructure.

Learn more: Quantum Networking Concepts