We pre-rolled 16 rounds. Alice picked random bases & random bits; for each, her λ/2 plate set a polarization and her photon flew to Bob. Bob picked random bases and recorded what his detectors read. Eve, if present, intercepted each photon, measured in her own random basis, then re-emitted toward Bob.
Right now, only Alice can see her own bits, only Bob can see his own bits, and only Eve can see hers. They have not communicated yet.
This is the first time they communicate after the quantum part. They use a public, authenticated classical channel — think: a phone call where they recognize each other's voices. Eve can listen in.
Critically: Alice and Bob announce only their basis for each round (+ or ×), never the bit values. They keep rounds where the bases matched, discard the rest. The kept bits become the sifted key.
Why is it safe to publicly announce bases? The photons are gone. Eve already had her one chance to measure them, before Alice and Bob spoke. Quantum measurement is destructive and one-shot — knowing the basis after the photons have flown doesn't let her go back and re-measure. For rounds where Eve guessed the right basis on her own, she already had the bit; for rounds where she guessed wrong, her measurement disturbed the photon (and may have given her gibberish), and no after-the-fact basis info recovers it.
Now Alice and Bob have a sifted key. In a perfectly clean channel, their two copies should be identical. They check by sacrificing a random subset — Alice publicly announces some of her bits, Bob announces his values for the same indices, and they count disagreements.
If errors are zero (or close enough to the channel's expected noise floor), the channel is clean. If errors are too high — typically Eve's intercept-and-resend attack causes ~25% errors on sifted bits — they abort and discard the whole key. Bits announced here are sacrificed: Eve heard them too.
In real BB84 over noisy channels, even a clean line has some errors (detector dark counts, slight misalignment, etc.). Alice and Bob can't tell error-from-noise from error-from-Eve, so they conservatively assume all the error is Eve, and treat the channel as if Eve has partial information.
Information reconciliation: Alice and Bob publicly run an error-correcting code (e.g., CASCADE) to make their two copies of the key bit-identical. This leaks some additional information to Eve — they account for it in the next step.
Privacy amplification: They apply a public hash function — typically a randomly-chosen function from a universal hash family — to compress the key from N bits to M bits, where M is chosen so that Eve's residual partial knowledge of the original N bits gives her negligible information about the M-bit hashed output. The shorter key is the final secret key.
A way to picture it: even if Eve knows 10% of the bits in your 100-bit string, hashing that string down to 50 bits with the right family of hashes makes Eve's knowledge of the 50-bit output exponentially small. The price is a shorter key. The benefit is that the remaining key really is secret, even accounting for everything Eve might have learned in earlier phases.
For our outreach demo, we stop at Phase C — Alice and Bob have a (small) sifted-and-checked key, and they use it directly to encrypt the message via one-time-pad XOR. Real systems do all four phases.