Gilles Brassard, BB84 and the 2025 Turing Award for quantum information

On 18 March 2026 the Association for Computing Machinery named Gilles Brassard, a computer scientist at the Université de Montréal, and Charles H. Bennett, a physicist at IBM Research, joint recipients of the 2025 A.M. Turing Award. The prize carries $1 million, with financial support from Google. The citation credits them with establishing the foundations of quantum information science and transforming secure communication and computing. It is the first Turing Award built around quantum information science. The centrepiece of the work is a 1984 protocol, BB84, which lets two parties agree on a secret key whose secrecy rests on physics rather than on the difficulty of a mathematical problem.

01From a conference swim to a protocol

Brassard's path into the field began in academic cryptography's early years. According to Université de Montréal (UdeM), he began studying there in 1968 at age 13 and later earned a Ph.D. in theoretical computer science at Cornell. UdeM says his thesis proved the theoretical existence of an "oracle" that would make public-key cryptography provably secure. He completed the doctorate at 24 and became an assistant professor at Montréal.

The decisive meeting came in 1979, at the IEEE Symposium on Foundations of Computer Science in Puerto Rico. Brassard went for a swim, and Bennett, then at IBM's Watson Research Center, swam up to tell him about a friend, Stephen Wiesner, who had shown how quantum effects could make unforgeable banknotes. Wiesner's manuscript dates from around 1969 but was only published in 1983. In 1982 the three co-authored a first-of-its-kind quantum cryptography paper.

The problem Bennett and Brassard took on was key distribution. Symmetric ciphers are fast, but both parties need a shared secret. Public-key schemes avoid pre-sharing, but their security rests on assumptions about hard computations. Brassard has said they did not do this because they expected existing cryptography to fail. He said they did not invent quantum key establishment on the belief that the cryptographic infrastructure would collapse. Peter Shor's 1994 algorithm later made that concern concrete: it would let a quantum computer quickly break the classical key-establishment schemes behind public-key infrastructure.

02How BB84 works

The 1984 paper, "Quantum Cryptography: Public Key Distribution and Coin Tossing", showed that two parties can establish a secret key with security guaranteed by physics, even against adversaries with unlimited computational power, such as a quantum computer. In the standard photon-polarisation version the steps are:

• Preparation. The sender, conventionally Alice, picks a random bit and a random basis for each photon. The four states are vertical, horizontal, 45-degree and 135-degree polarisation.
• Measurement. The receiver, Bob, chooses one of two bases, rectilinear or diagonal, to measure each photon.
• Sifting. They compare their basis choices over an authenticated classical channel. They discard results where the bases differ and keep the rest. About half the data survives.
• Error estimation. They compare a random sample of the sifted bits to get a quantum bit error rate. If it is too high they abort. Otherwise they run error correction and privacy amplification to distil the secret key.

The security comes from quantum mechanics. Alice's two bases are conjugate, so a measurement in the wrong basis gives a random result and disturbs the state. An eavesdropper does not know which basis was used for each photon. Measuring and resending therefore introduces detectable errors; in the textbook intercept-and-resend case the sifted key shows roughly a quarter of its bits wrong. One university summary puts it as any attempt at eavesdropping leaves detectable traces. Privacy amplification then shrinks the key to remove whatever partial information an attacker could have gathered below the abort threshold.

One point is easy to miss. BB84 does not remove the need for authentication. The classical channel must be authenticated, and if that uses public-key signatures, the information-theoretic guarantee holds only for keys established before those signatures are broken. In practice it uses a small pre-shared secret, which the protocol then stretches.

03From benchtop to fibre and satellite

Theory came first, and the experiment took years. The first demonstration came in 1989, five years after the proposal. A review of the field describes that setup as heavily attenuated laser pulses rather than true single photons, sent over 30 cm of open air at 10 Hz. A Communications of the ACM profile says the channel was 32 cm and the results were published in 1992. According to IBM, Bennett built the device in his office, from mirrors, polarisers and photon detectors, with software by Brassard and his students.

Distance was the early obstacle. The same review notes that free-space optical alignment limited range, and by 1993 groups had demonstrated fibre-based QKD over 10 km of telecom fibre. An early-2000s survey found that these realisations still suffered from low bit rates and a maximum span of around 100 km. It cited a secret key rate of 210 Hz over 23 km. Those figures are dated, and I did not verify current ones for this article. IBM's account says the method has since been used experimentally over up to 1,200 km between a satellite and Earth.

The constraints are structural. Photons cannot be amplified like classical signals, because a quantum repeater must preserve fragile states. Real devices also depart from the idealised model, which is why the literature includes work on secure QKD with realistic devices. Weak laser pulses, detector flaws and side channels are the usual weak points. UdeM's description of BB84 as "in theory" unhackable is best read with that caveat: the proofs cover the protocol, and engineering has to close the gap to hardware.

04Teleportation and a wider field

Brassard's contribution extends beyond key distribution. UdeM says he helped invent quantum teleportation, laying its foundations in 1992 with Claude Crépeau, now at the École de technologie supérieure. The ACM places the introduction in 1993 with other collaborators. The two dates probably reflect research versus publication timing, though I have not confirmed that. The technique combines classical communication with entanglement, which by itself has no communication capacity. Bennett's own gloss is that it is a way of moving data around inside a quantum computer, not of moving objects.

For engineers the practical point is that entanglement became a measurable resource. ACM says the pair's work also underlies quantum networks and large-scale quantum computing systems, along with entanglement distillation. CIFAR, which has counted Brassard as a member since 2002, credits the pair with bridging physics and computer science.

05What the award means, and what remains open

Brassard has framed the prize as an argument. In UdeM's release he said it would help him press his case that we must stop relying only on outdated cryptographic infrastructure that will fall once a full-power quantum computer exists. That timing is uncertain. Nobody can say when such a machine will arrive, so migration plans are risk management, not forecasts.

BB84 is also not the only response. In August 2024 NIST finalised its first post-quantum standards; FIPS 203 is based on CRYSTALS-Kyber, renamed ML-KEM. Post-quantum cryptography runs on today's hardware and networks. It still relies on computational assumptions, which is the trade-off BB84 was designed to avoid. QKD needs dedicated optical links, trusted nodes or satellites, and authenticated channels. For most deployments these are complementary tools, not substitutes.

The honours around the Turing Award mark how far the idea has travelled. Brassard and Bennett shared the 2022 Breakthrough Prize in Fundamental Physics, and Brassard also holds the Wolf Prize in Physics and is a Fellow of the Royal Society. UdeM says he is only the eighth Canadian Turing laureate. Yoshua Bengio is UdeM's other winner, from 2018. Brassard himself has said that when he and Bennett began, they never imagined a technology worth billions of dollars. For a protocol first demonstrated across about 30 centimetres of lab air, that is a considerable distance travelled.