Attacks on practical quantum key distribution systems (and how to prevent them)

Abstract

With the emergence of an information society, the idea of protecting sensitive data is steadily gaining importance. Conventional encryption methods may not be sufficient to guarantee data protection in the future. Quantum key distribution (QKD) is an emerging technology that exploits fundamental physical properties to guarantee perfect security in theory. However, it is not easy to ensure in practice that the implementations of QKD systems are exactly in line with the theoretical specifications. Such theory–practice deviations can open loopholes and compromise security. Several such loopholes have been discovered and investigated in the last decade. These activities have motivated the proposal and implementation of appropriate countermeasures, thereby preventing future attacks and enhancing the practical security of QKD. This article introduces the so-called field of quantum hacking by summarising a variety of attacks and their prevention mechanisms.

Keywords:

• Quantum cryptography
• quantum key distribution
• practical data security
• quantum computer
• quantum hacking
• countermeasures

Acknowledgements

We thank Kevin Günthner for proofreading the manuscript.

Notes

No potential conflict of interest was reported by the authors.

1 In fact, the proof for non-existence of such methods is related to one of the famous millennium problems.

2 A train of narrow voltage pulses applied on the diode so that it switches between the linear mode and Geiger mode are called gates. Refer Section 3.1.2 and Figure 5 for details on these modes.

3 The expected behaviour scales as $1-\text{exp}[-\mathit{\mu }·\mathit{\eta }(t)]$ with the mean photon number $\mathit{\mu }$ of a coherent state used for faking the detection outcomes; $\mathit{\eta }(t)$ is the single photon detection efficiency as a function of time. Since $\mathit{\eta }(t)<<1$ at the falling edge of the gate, $1-\text{exp}[-\mathit{\mu }·\mathit{\eta }(t)]\approx \mathit{\mu }·\mathit{\eta }(t)$. In other words, the expected behaviour must be nearly linear. The measured behaviour of the detection probabilities is however always above this linear curve, therefore the term superlinear.

4 To understand the concept of discernability in a simple way, one should be able to, for instance, simply exchange D0 and D1 without hindering or altering the operation of the QKD system. Of course, the key obtained by Bob would then be uniformly opposite to that of Alice but a simple NOT operation would suffice to reconcile their keys.