Secure key distribution among two remote parties is impossible when both are classical, unless some unproven (and arguably unrealistic) computation-complexity assumptions are made, such as the difficulty of factorizing large numbers. On the other hand, a secure key distribution is possible when both parties are quantum. What is possible when only one party (Alice) is quantum, yet the other (Bob) has only classical capabilities? We present a protocol with this constraint, and prove its robustness against attacks: we prove that any attempt of an adversary to obtain information (and even a tiny amount of information) necessarily induces some errors that the legitimate users could notice.Introduction. Processing information using quantum twolevel systems (qubits), instead of classical two-state systems (bits), has lead to many striking results such as the teleportation of unknown quantum states and quantum algorithms that are exponentially faster than their known classical counterpart. Given a quantum computer, Shor's factoring algorithm would render many of the currently used encryption protocols completely insecure, but as a countermeasure, quantum information processing has also given quantum cryptography. Quantum key distribution was invented by Bennett and Brassard (BB84), to provide a new type of solution to one of the most important cryptographic problems: the transmission of secret messages. A key distributed via quantum cryptography techniques can be secure even against an eavesdropper with unlimited computing power, and the security is guaranteed forever.The conventional setting is as follows: Alice and Bob have labs that are perfectly secure, they use qubits for their quantum communication, and they have access to a classical communication channel which can be heard, but cannot be jammed (i.e. cannot be tampered with) by the eavesdropper. The last assumption can easily be justified if Alice and Bob can broadcast messages, or if they already share some small number of secret bits in advance, to authenticate the classical channel.In the well-known BB84 protocol as well as in all other suggested protocols, both Alice and Bob perform quantum operations on their qubits (or on their quantum systems). Here we present, for the first time, a protocol in which one party (Bob) is classical. For our purposes, any two orthogonal states of the quantum two-level system can be chosen to be the computational basis |0 and |1 . For reasons that will soon become clear, we shall now call the computational basis "classical" and we shall use the classical notations {0, 1} to describe the two quantum states {|0 , |1 } defining this basis. In the protocol we present, a quantum channel travels from Alice's lab to the outside world and back to her lab. Bob can access a segment of the channel, and whenever a qubit passes through that segment Bob can either let it go undisturbed or (1).-measure the qubit in the classical {0, 1} basis, and (2).-prepare a (fresh) qubit in the classical basis, and send it. If all parties were limited to...