The **Three-stage quantum cryptography protocol**, also known as **Kak's three-stage protocol**^{[1]} is a method of data encryption that uses random polarization rotations by both Alice and Bob, the two authenticated parties, that was proposed by Subhash Kak.^{[2]} In principle, this method can be used for continuous, unbreakable encryption of data if single photons are used.^{[3]} It is different from methods of QKD (quantum key distribution) for it can be used for direct encryption of data, although it could also be used for exchanging keys.

The basic idea behind this method is that of sending secrets (or valuables) through an unreliable courier by having both Alice and Bob place their locks on the box containing the secret, which is also called double-lock cryptography. Alice locks the box with the secret in it and it is transported to Bob, who sends it back after affixing his own lock. Alice now removes her lock (after checking that it has not been tampered with) and sends it back to Bob who, similarly unlocks his lock and obtains the secret. In the braided form, only one-pass suffices but here Alice and Bob share an initial key.^{[4]}^{[5]}

This protocol has been proposed as a method for secure communication that is entirely quantum unlike quantum key distribution in which the cryptographic transformation uses classical algorithms^{[6]}

The basic polarization rotation scheme has been implemented in hardware by Pramode Verma in the quantum optics laboratory of the University of Oklahoma.^{[7]} ^{[8]}^{[9]}
In this method more than one photon can be used in the exchange between Alice and Bob and, therefore, it opens up the possibility of multi-photon quantum cryptography.^{[10]}
This works so long as the number of photons siphoned off by the eavesdropper is not sufficient to determine the polarization angles. A version that can deal with the man-in-the-middle attack has also been advanced.^{[11]}

Parakh analyzed the three-stage protocol under rotational quantum errors and proposed a modification that would correct these errors.^{[12]} One interesting feature of the modified protocol is that it is invariant to the value of rotational error and can therefore correct for arbitrary rotations.