What the polar bias can and cannot do for cryptography: telling drift from eavesdropping in BB84, and certified quantum randomness

We ask where the qg description of a qubit, and its companions [1], is useful for cryptography. Post-quantum cryptography (lattice-based key encapsulation such as ML-KEM [2]) is classical and has no place for it. Quantum cryptography does, because its raw data are qg values. (i) In BB84 [3] over a qubit channel with relaxation, the sum of the received polar biases is a T1 witness. Natural relaxation raises it, while intercept-resend adds symmetric errors that leave it unchanged. A likelihood-ratio monitor built on it detects intercept-resend as well as the standard QBER monitor, but raises no false alarms when the memory’s T1 degrades, where the QBER monitor fires in 48–100% of windows. By construction it misses an attacker who mimics T1, which the QBER monitor catches, so the two are complementary and neither changes the secret-key rate. With finite keys [4] the diagnosis comes free from the error-corrected block: at key bits it attributes every block correctly, including a small attack hidden under drift. (ii) For a qubit random-number generator with a trusted measurement, the certified min-entropy is , independent of . The usual output-bias estimate is unsafe whenever the state is mixed: it certifies 0.97 bits per shot where 0.015 are private. A qg estimate from -rotation test rounds is safe in every run, and a readout calibration recovers 10–50% more certified bits. On IonQ trapped-ion noise models, with an environment ion that learns the output, the naive estimate stays near 1 bit while the qg estimate remains safe and captures 82–90% of the private randomness. All results are simulations, reproduced by scripts and pinned by regression tests.