Charles Bennett, The Physicist Who Made Eavesdropping Impossible To Hide

In 1984 a physicist at IBM and a computer scientist in Montreal published a protocol for sharing a secret key, at a conference in Bangalore, in proceedings that were for years genuinely difficult to obtain. It described a way for two people who had never met to agree on a string of random bits, and to know for certain whether anyone had listened in. The security did not rest on any assumption about how much computing power an eavesdropper had. It rested on the fact that measuring a quantum system disturbs it.

Forty-one years later, in 2025, that paper won Charles Bennett and Gilles Brassard the A.M. Turing Award, computing’s highest honour, for what ACM’s citation calls their essential role in establishing the foundations of quantum information science and transforming secure communication and computing. It is an unusual award, because neither man is a computer scientist in the ordinary sense and the work it recognises began as an argument about thermodynamics.

This profile traces what Charles Bennett actually did, in what order, and with whom. It is careful about the boundary between his work and Rolf Landauer’s, because the two are constantly conflated, and it separates the results that are securely his from the ones he shares with five other names on a paper.

Who Charles Bennett is

Charles Bennett is a physicist who spent his career at IBM asking what the laws of physics permit a computer to do, and who kept finding that the answers were stranger and more useful than anyone expected. He is not primarily an experimentalist and he did not build machines. His contribution was to notice that certain questions about information had physical answers, and then to work those answers out precisely enough that engineers could build on them.

Three of his results are now taught as foundations. Reversible computation established that there is no thermodynamic floor under computing itself. Quantum key distribution turned the disturbance caused by measurement from a nuisance into a security guarantee. Quantum teleportation showed that an unknown quantum state can be moved from one place to another using entanglement and two ordinary classical bits, without the state ever traversing the space between.

The short version of the career

He was born in New York City in 1943 and took a bachelor’s degree in chemistry at Brandeis in 1964, which matters more than it sounds, because it left him thinking about physical processes rather than abstract machines. He completed a doctorate in chemical physics at Harvard in 1971 under David Turnbull and Berni Alder, continued that work at Argonne National Laboratory under Aneesur Rahman, and joined IBM Research in 1973. He has been there ever since, and has been an IBM Fellow, the company’s highest technical rank, since 1995.

The shape of the career is unusual in one specific way. The work that won him the Turing Award was done in 1984, and the recognition arrived in 2025. For most of the intervening period quantum information was a small field regarded by many physicists as an entertaining sideshow, and Bennett was one of a handful of people keeping it alive.

A chemist’s habit of mind

The chemistry training shows up in the work more than the biography suggests it should. A physicist trained on abstractions tends to treat information as a mathematical object, and a chemist is used to asking what a process costs, what it produces and whether it can be run in the other direction. Those are thermodynamic questions, and they are exactly the questions Bennett brought to computing.

That framing explains why he was able to see something in Landauer’s principle that others had missed. To most people in computing at the time, the energy consumed by a machine was an engineering matter about switching transistors. To Bennett it was a question about which operations are thermodynamically necessary and which are merely how we happen to build things, and those are very different questions with very different answers.

The physics of information, and Rolf Landauer

Any account of Bennett has to begin with Rolf Landauer, his colleague at IBM, because the two are so often merged into a single figure. In 1961 Landauer published a paper in the IBM Journal of Research and Development titled Irreversibility and Heat Generation in the Computing Process, which established what is now called Landauer’s principle. Erasing a bit of information has an unavoidable thermodynamic cost, and that cost is dissipated as heat.

The slogan usually attached to this line of work, that information is physical, is Landauer’s phrase and not Bennett’s. He used it as the title of a 1991 article in Physics Today. It is worth saying plainly, because Bennett is regularly credited with it. What Bennett did was take Landauer’s principle and work out its consequences, and the consequences turned out to be considerably larger than the principle.

The demon and the erasure

The most celebrated of those consequences is a resolution of Maxwell’s demon, a thought experiment that had been unsettling physicists since 1867. The demon sorts fast molecules from slow ones, apparently creating a temperature difference from nothing and violating the second law of thermodynamics. Generations of physicists tried to locate the flaw in the demon’s measurement.

Bennett’s answer, set out in his 1982 review The thermodynamics of computation, was that the measurement is not the problem. The demon can measure and act for free, in principle. What it cannot do for free is forget. The demon’s memory fills with the results of its measurements, and clearing that memory to start again costs exactly what Landauer’s principle says it must, which is precisely enough to save the second law.

Computing without destroying anything

If erasure is what costs energy, then a computation that never erases anything should cost nothing. That is a startling claim, and Bennett proved it in a paper he published alone in 1973, Logical Reversibility of Computation, in the same journal Landauer had used twelve years earlier.

An ordinary logic gate destroys information. Feed two bits into an AND gate and one bit comes out, and from that one bit you cannot reconstruct what went in. Bennett showed that any computation can be rebuilt as a sequence of reversible steps, in which nothing is discarded and every stage can be run backwards. The trick is to keep the intermediate results rather than throwing them away, use them, and then undo the computation to clean up.

This established that there is no fundamental thermodynamic limit to computation, only a limit to computation that forgets. It is a beautiful result on its own terms, and it turned out to matter enormously for a reason nobody could have anticipated in 1973. Quantum mechanics is reversible. Every quantum gate is a reversible operation, because the underlying evolution is unitary. When quantum computing arrived, the theory of how to compute reversibly was already sitting there, worked out.

BB84, the protocol that made eavesdropping detectable

The idea did not come from nowhere. ACM credits the insights of their late collaborator Stephen Wiesner. Brassard’s history of the field records that Wiesner had noticed that quantum effects permitted things Shannon’s theory did not cover, and Brassard’s history of the field records that the manuscript was rejected on first submission and did not appear in print until 1983. Bennett and Brassard were among the few who took him seriously, and the 2006 Rank Prize for the original concept of quantum cryptography was awarded to all three.

In 1984 Bennett and Gilles Brassard of the Université de Montréal published Quantum cryptography, public key distribution and coin tossing in the proceedings of a conference in Bangalore. The paper is short and it is the origin of an industry. It is now usually cited through its 2014 reprint in Theoretical Computer Science, because the original proceedings were for a long time close to unobtainable.

The problem it solves is the oldest one in cryptography. Two people who want to exchange secret messages need a shared key, and getting that key to each other is the hard part. Classical solutions rest on mathematical problems that are believed to be hard, and belief is doing a lot of work in that sentence. BB84 rests on something else entirely.

Why measurement disturbance protects the key

Alice encodes each bit on a single photon, choosing at random between two different bases, which can be pictured as two different orientations of a polarising filter. Bob measures each photon, also choosing his basis at random, so about half the time he happens to pick the same one she did and about half the time he does not. Afterwards they compare, over an ordinary open channel, which bases they used, and discard every bit where they disagreed.

An eavesdropper faces an impossible position. She does not know which basis was used, so she must guess, and when she guesses wrong her measurement disturbs the photon. That disturbance shows up as errors in the bits Alice and Bob keep. So they sacrifice a sample of their key, compare it publicly, and measure the error rate. If it is too high, someone was listening, and they discard the key and start again.

The elegance is that eavesdropping is not prevented. It is made detectable, which is better, because it means the parties never rely on a secret that has been compromised. That inversion, treating the fragility of quantum states as the security mechanism rather than the obstacle, is the intellectual move the Turing Award recognises.

From protocol to apparatus

A protocol on paper is not a technology, and the gap took five years to close. In late October 1989 Bennett and Brassard, with John Smolin on the hardware and François Bessette and Louis Salvail on the software, established what Brassard has called history’s first secret quantum transmission, over a distance of 32.5 centimetres. There was essentially no budget. The point was never the distance; it was to establish that the thing described in 1984 could be made to happen at all.

Brassard’s account of the apparatus is worth preserving. The largest component was a power supply feeding around a thousand volts to the cells that rotated photon polarisation, and it made a different noise for each voltage. You could hear the photons as they flew, and zeroes and ones sounded different. Their prototype, as Brassard has written, was “unconditionally secure against any eavesdropper who happened to be deaf.”

What followed is one of the faster translations from theory to product in modern physics, though it did not feel fast at the time. Quantum key distribution is now sold commercially, deployed on fibre networks by several national telecoms operators, and has been demonstrated between a satellite and the ground. The underlying protocol in most of those systems is either BB84 or a direct descendant of it.

It is worth being clear-eyed about where it sits commercially. Quantum key distribution solves one problem, key exchange, and it requires dedicated hardware and a physical link. Several national security agencies have been publicly cool about it, preferring post-quantum cryptography, which needs no new infrastructure. That debate is live and Bennett’s protocol sits at the centre of it, forty years on.

Quantum teleportation

In 1993 Bennett and five colleagues published Teleporting an unknown quantum state via dual classical and Einstein-Podolsky-Rosen channels in Physical Review Letters. He is first among the six authors, alongside Gilles Brassard, Claude Crépeau, Richard Jozsa, Asher Peres and William Wootters.

The result addresses a genuine difficulty. An unknown quantum state cannot be copied, and it cannot be measured without being disturbed, so moving one from place to place looks impossible. The paper shows it can be done, provided the two parties share an entangled pair in advance and are willing to send two ordinary classical bits.

What teleportation is not

Two misconceptions are worth clearing away, because the name invites them. Nothing material is transported. The particle carrying the state stays where it is, and a different particle at the far end ends up in the state the first one had. Nor is anything transmitted faster than light, because the two classical bits have to travel by ordinary means, and without them the receiving qubit is in a state its holder cannot use or even identify.

There is also a destructive element that the popular accounts tend to skip. The original state does not survive. The joint measurement at the sending end destroys it, which is what keeps the whole procedure consistent with the impossibility of copying an unknown quantum state. Teleportation moves a state; it does not duplicate one.

Entanglement as something you can spend

The deepest thread in Bennett’s work is a shift in attitude that is easy to state and was hard to make. Entanglement had been treated since the 1930s as a philosophical problem, the thing that made Einstein uncomfortable. Bennett treated it as inventory. It comes in quantities. It can be consumed by a protocol. It can be degraded by noise, and it can be concentrated back up again.

The year before teleportation, he and Stephen Wiesner published a paper showing the converse trick, now called superdense coding. Where teleportation spends one entangled pair and two classical bits to move one qubit, superdense coding spends one entangled pair and one qubit to move two classical bits. The two results are duals of each other, and together they establish an exchange rate between quantum and classical resources.

In 1996 he was first author on three more papers that made the resource picture quantitative. One introduced entanglement purification, a procedure for taking many noisy entangled pairs and distilling from them a smaller number of good ones. A second, on mixed-state entanglement and quantum error correction, connected that distillation directly to the problem of protecting quantum information from noise.

Purification is the reason long-distance quantum communication is thinkable at all. Entanglement degrades over a fibre, and without a way to concentrate it back up, a quantum network would be limited to whatever distance the noise allowed. Every proposal for a quantum repeater descends from that 1996 paper.

The field he helped keep alive

It is difficult now to convey how marginal this subject was for most of Bennett’s career. Through the 1980s and into the 1990s, quantum information was a small community that struggled to place papers in the most prestigious journals and whose members were regularly asked, politely, what any of it was for. The word “quantum” attached to computing carried a faint whiff of the disreputable.

Two things changed that. Peter Shor’s factoring algorithm in 1994 gave the field a threat and a promise that people outside it could understand immediately. And the accumulation of results of the kind Bennett was producing, teleportation, purification, the quantitative theory of entanglement, meant that when attention finally arrived there was a substantial body of theory waiting rather than a handful of speculations.

His role in that period was partly institutional. IBM Research gave him the freedom to work on something with no product attached to it for two decades, which is a kind of patronage that has become rarer. The counterfactual is worth considering. Had he been on a three-year grant cycle with deliverables, very little of this work would exist.

The Turing Award, forty-one years later

The 2025 A.M. Turing Award, announced in March 2026, went jointly to Charles Bennett and Gilles Brassard, cited by ACM for their essential role in establishing the foundations of quantum information science and transforming secure communication and computing. It is the most prestigious prize in computing, it carries a one million dollar prize financially supported by Google, and it went to two people whose defining paper appeared at a signal processing conference four decades earlier.

The gap is the interesting part. BB84 was not ignored exactly, but for years it was a curiosity in a field that barely existed, published somewhere hard to find. The recognition tracks the field’s arrival rather than the work’s quality, which did not change in the interval.

One entry on that list is regularly got wrong, and it is worth flagging because the error is easy to make. The Technion’s own list of laureates shows its Harvey Prize going to a different Charles Bennett in 2006, the cosmologist Charles L. Bennett, for measurements of the cosmic microwave background. Charles H. Bennett, the subject of this profile, received it in 2008. Two men with nearly the same name sit two years apart on the same list.

Entropy, and the price of forgetting

Everything above rests on a single quantity, and it is worth setting it out properly, because the numbers are small enough to be surprising and precise enough to be checked. Landauer’s principle puts a floor under the energy cost of erasing one bit of information at temperature T.

That is an extraordinarily small number, four or five orders of magnitude below what a transistor actually spends switching, which is why nobody encounters this limit in practice. Its importance is not engineering but principle. It says that erasure has a cost that no cleverness can avoid, and by implication that everything else in computing has no such floor at all.

The reason a bit of erasure costs exactly this much is that it halves the number of states the memory could be in, and entropy counts states. Claude Shannon had given information a measure in 1948, and it takes the same form as thermodynamic entropy, which is not a coincidence.

The quantum version, and what Bennett proved with it

Quantum mechanics has its own entropy, written by John von Neumann in the 1920s, which replaces the list of probabilities with a density matrix describing the state. It reduces to Shannon’s expression when the state is simply a classical mixture, and departs from it when the state is not.

Here is where Bennett’s contribution becomes concrete rather than conceptual. Take an entangled pair shared between two people and look at only one half of it. That half, considered on its own, is in a mixed state, and the more entangled the pair, the more mixed each half looks. Bennett and his coworkers made this exact rather than suggestive. In a third paper of 1996, on concentrating partial entanglement by local operations, they showed that shared pure states can be concentrated and diluted at a rate set by that entropy, which is what establishes von Neumann entropy as the measure of entanglement for pure states.

The consequence is that entanglement stops being a quality and becomes a quantity. You can say how much of it two parties share, and therefore how much they have left after spending some. That is what makes the resource accounting in the previous section more than a metaphor, and it is why the two protocols can be written as an exchange rate.

The same accounting explains why purification was necessary. Noise reduces the entanglement of a shared pair below one ebit, and the protocols need full ebits to work. Distillation trades quantity for quality, taking many degraded pairs and yielding fewer good ones, and the yield is set by entropies again.

The number that gives an eavesdropper away

BB84 has an arithmetic of its own, and it is simple enough to follow without any formalism. Alice and Bob choose bases independently, so they agree about half the time, and roughly half the raw bits survive the sifting step. That is the cost of the protocol before any eavesdropper appears.

Now suppose Eve intercepts each photon, measures it and sends on what she found. She picks the right basis half the time and learns the bit. The other half she picks wrongly, and the photon she forwards is randomised, so Bob gets the wrong answer half of those occasions. The error she introduces into the sifted key is therefore one half times one half.

A quarter of the key wrong is not subtle. Alice and Bob sacrifice a sample, compare it openly, and see immediately that something is there. This is the whole of BB84’s security argument, and it appeals to no assumption about Eve’s computer, her budget or her mathematics. It appeals only to the fact that she cannot measure without disturbing.

Why Charles Bennett matters

Charles Bennett matters because he repeatedly took something that looked like an obstacle and showed it was a resource. Measurement disturbs a quantum system, which sounds like a limitation, and he made it the basis of a security guarantee. Entanglement cannot be used to signal, which sounds like a disappointment, and he made it the medium for moving states. Erasure costs energy, which sounds like bad news for computing, and he showed it means computation itself is free.

He also matters as an argument for theory pursued without an application in view. The reversible computing paper of 1973 had no use anyone could name at the time. It became load-bearing for quantum computing two decades later, because every quantum gate is reversible and the theory of reversible computation was already finished when the field needed it.

The last thing to take from him is the timescale. A protocol published in obscure proceedings in 1984 became an industry, a body of standards and finally a Turing Award, and the interval was longer than most research careers. Anyone judging the value of work in quantum information by whether it has produced a product yet should sit with that for a moment.

Frequently asked questions