BB84 with ML-KEM Decapsulation-Failure-Based Security Parameters
With the advent of quantum computers, traditional key exchange mechanisms are under threat, necessitating the development of new methods. Recently, Module-Lattice-Based Key Encapsulation Mechanism (ML-KEM) has been standardized as a quantum-safe key exchange method. Another emerging technique is Quantum Key Distribution (QKD) and its most famous protocol, BB84, which relies on the principles of quantum physics to exchange key information. Both techniques are considered secure against attacks by quantum computers, but their security is based on different principles. However, both key exchange types include a statistical component which, if an attacker were lucky, could allow circumventing these underlying hard problems. In this paper, we suggest that as a key exchange mechanism, BB84 should be run with security parameters comparable to those of ML-KEM, and analyze performance implications if this choice is taken. We illustrate the impact by estimating the number of raw bits required to generate a 256-bit symmetric key using BB84 and assessing the resulting performance implications. We further show how the BB84 finite-size security parameter can be chosen such that the post-processing failure probability is of the same order as the cumulative decapsulation-failure probability of ML-KEM. According to our results, the security parameter in BB84 should be at most 2−75.8 if statistical failure probability comparable to the ML-KEM decapsulation-failure target is desired. These findings offer general guidelines for BB84 parameter selection, with hybrid protocol design representing one potential application context.