On Security Issues of QKD

This document is devoted mainly to solve confusions anddoubts about the security of Quantum Key Distribution(QKD), and we also give some case studies where the useof QKD deserves to be considered.

1

Excerpt from a recent conversation between Alice, Bob and Eve

Alice: You know what Bob, I saw on TV that absolutely secure cryptography hascome into play.
play It says “quantum
quantum something….
something ”
Bob: Oh yeah, you mean quantum cryptography. But a recent newspaper article
said something
g different.
Eve: Yeah, it was broken.
Alice Really?
Alice:
Reall ? Which one is true?
tr e?
Bob: Look, I have also found something on the Web. What’s this?
Alice: Wow, here is also a document on practical security.
Eve: Probably another desperate effort to claim that QKD is absolutely secure.
I am already late for a meeting and should go!
Bob: No, wait, this summary looks quite different and interesting. It says …

2

What does this document explain and address?
1, Quick introduction of QKD and this document (page 4-9).
2, Can QKD work all by itself? (page 10)
3, What is a QKD protocol? What do we mean by “unconditionally secure”?
(
(page
11
11-13)
13)
4, What is a QKD implementation? Is it different from a QKD protocol?
(page14 and page 15)
5, What is a side channel? Does it exist only in QKD? What kinds ofside-channels exist? (page15-18)
6, Answers to some criticisms or questions from non-quantum crypto
communities and open questions (page 19
communities,
19-22)
22).
7, On some potential applications of QKD (page 23).
8, We have some appendices for further readings (from page 24).
3

One--time pad
OneAmong allAll theth methods
th d off encryption
ti ever devised,d i d only
l one hash beenb
provento be information-theoretically secure, i.e. secure against an eavesdropper who
has unbounded ability, often also referred to as unconditionally secure.
It is the one
one-timetime pad (OTP)(OTP). The key should be used only once and be as longas the message to be sent. The efficient distribution of such long keys remains
an issue.

O ti
One-timepaddPlain text⊕

Secret key

Cipher text⊕

Plain text

Secret key

So far trusted courier is only the method of delivering secret key.

4

QKD offers the function of key exchange
Quantum key distribution (QKD) provides a means to distribute unconditionallysecure key for OTP, using photons over an optical network. Key exchange(or key distribution) is at the heart of cryptography. Secure key by QKD canbe used for many applications including secure communications and message
authentication (MA) over any standard communication channels.

O ti
One-timepaddPlain text⊕

Cipher text

Secret key⊕

Plain text

Secret key

Use theU
h key
k to encode
d andd decodeddthe plain text.

Photons

Quantum key distribution (QKD)

5QKD offers the function of key exchange
Message authentication
Scheme to ensure that data are genuine and have not been altered.

Text

Text

Tag
Tag

Verification

Use the key to choose a hashfunction to generate the tag.

Photons

Quantum key distribution (QKD)
QKD can be used for any application that requires the key! 6

Towards a wider acceptance of QKD
For the past ten years,
years QKD research has been engaged in field network
demonstration. In 2007, ID Quantique made the first use case of QKD for theelection in Geneva. In 2008, the EU project, SECOQC, demonstrated a QKD
network,
et o , which
c cou
could
d encrypt
e c ypt voiceo ce transmissiont a s ss o by OTPOovero e a 30km
30ddistance.
sta ceIn 2010, the Tokyo QKD network demonstrated secure TV conferencing with
OTP over a 45km distance.
User domain

Opticalppath
pnetwork

1
100k

~45km

Improved performanceand reduced cost
~30km

1k

Secu
ure key ra
ate [bps]

1M
1

10M

User domain

Stable operation andsecurity assurance
over a long span of time.

Secu e link with
Securet Q
QKD
for election in Geneva

2005

2010

2015

2020 7

Thus QKD technology edges ever-closer to practical use. The near-term use
case is likely
y to be high-end
gsecurity
y applications
pp
that have been relying
y g upp to
now on trusted couriers for key exchange. To become a practical solution, longterm reliability of QKD needs to be guaranteed. This includes not only stablepbut also security
y assurance over a longg spanp of time. The latter isoperation
especially a non-trivial and much involved issue, and hence is a motivation ofthis document.
Implementation of QKD in a closer form of ideal theory is not an easy task atall. It still comes at a price. But once realized with cheaper cost in the future,
QKD technology would have a big impact on key exchange infrastructure,enhancing the security significantly
significantly. QKD technology will then be installed into
IP over optical network infrastructure. One could download an ultimately secure
key to use it in many applications, including OTP and message authentication(MA), with high security. Encryption and decryption in OTP and MA are quite
simple, just addition of the key to a plain text. Hence no latency occurs. It would
get rid of our reluctance to introduce cryptography in daily life, which often
g down the processingpg speed.
pcauses inconvenience in our PC,, slowing
This may be the major impetus to pursue the improvement of QKD technology
and future QKD network research. However, we should first clarify the issue of
security assurance of practical QKD systems in which imperfections areinevitable to some extent .
8

The main issues in this document
A catchy statement that QKD can ensure the unconditional security oftencauses confusion, and even doubt sometimes. In this document, we would liketo explain the difference between QKD protocol and its implementation,
addressingadd
ess g issues
ssues oon sside-channels,de c a e s, a
and
dg
give
eac
clear
ea pe
perspective
spect e oof Q
QKD.
We also discuss an issue of QKD versus key delivery by courier.

(1) QKD protocol and its implementation
Unconditionally secure
QKD protocol

QKD implementation

S i tifi security
Scientific
it prooff
Sequence of data processing- Error Correction method- Privacy amplification function- Security parameters

Sequence of data processing- Error Correction method- Privacy amplification function- Security parameters

Model of the devices

Real devices
They do not necessarily operate exactly as themathematical models require.

Side-channels- Quantum mechanics description- Quantum & classical device
parameters(2) Discussion on key distribution by a courier

9Can QKD work all by itself?

A QKD protocol cannot work only by itself,
itself and it needs to authenticate theclassical messages that are exchanged between Alice and Bob. Typically, we
use the Wegman-Carter type authentication protocol, which is
unconditionally secure at the expense of consuming a small portion of the
key.
The use of the Wegman
Wegman-Carter
Carter type authentication protocol requires theinitial key for the very first run of a QKD protocol. Note that since this key isused only for the authentication, it needs to be secure only until the end of
the authentication. For the next rounds of the QKD protocol, we can use thekey generated in the previous rounds. Due to the consumption of the key, a
QKD protocol is sometimes called a “key growing” or “key expansionpprotocol”.

10Unconditional security of QKD protocol
QKD protocol (abstract)
EVE
Alice
010110101
Key

Quantum channel

Bob

A th ti t d classicalAuthenticatedli l channelhl010110101
Key

Eve has full access to this part.
User devices operate as the users require.
Eve has no access to and control over these devices.
A QKD protocol is an abstract mathematical procedure.
“Unconditional security” means “information theoretical security”.
Namely, no conditions are set on computational power or resources available to Eve,but on the other hand we do need conditions on users’ devices, which have tooperatet as theth users requirei andd never allowll
Eve’s
E ’ access.
The key in future remains always as secure as at the time of creation(forward security).

11

Ingredients of a QKD protocol
EVE
Alice

Quantum channel

Bob010110101
Key

Authenticated classical channel

010110101
Key

A QKD protocol
the following
twoparts:tl consists
i t off th
f ll itt(I) Quantum communication (no need for authentication)
Alice and Bob communicate by quantum signals to achieve strong enoughcorrelation for the key distillation.

(II) Post-processing (needs authentication): This communication is done
over an authenticated classical channel. This communication includes:(1) Sacrifice some data as test bits to estimate how much information/correlation
about Alice and Bob’s data Eve has.
(2) Error correction to agree on the key: The error correction protocol can be either
one-way (e.g. LDPC) or two-way (e.g. Cascade code).
(3) Privacy amplification: distill the key from the correlation.
12

Security definition of a QKD protocol
The security criteria are chosen on the basis of the following conditions(composable security):
The imperfection should not increase even if the generated key is used forany applications in a larger cryptographic protocol, and the imperfection of
the larger protocol is given by the summation of the imperfections of thecomponent protocols.
It is known that this condition can be satisfied by the security definition being only withrespect to the ideal situation, whose intuition is given below.
In terms of mathematics, this security definition asks how much an eavesdropper or a“distinguisher”
distinguisher can discriminate between the real situation and ideal situation
situation. In the realsituation, Eve or the distinguisher is in the possession of her own system, which may becorrelated with the generated key, and moreover the generated key itself is given. On theother hand in the ideal situation, she is in the possession of the perfect key and somesystem independent of the perfect key. To measure the quality of the generated key, themaximum distinguishing probability is employed. See the appendix (page 25) for more
explanation.
We emphasize that this distinguishing probability in terms of the ideal situation is the
security measure we adopt, and we do not use any other information measures such as
mutual information.
13

A QKD implementation
I l
Implementationt ti
off a QKD protocol
EVE
Alice
010110101
Key

Quantum channel

Bob

Authenticated classical channel

010110101
Key

Eve has full access to this part.
Eve has partial access to the devices, and they may not operate
as the users require (these imperfection is called a side-channel)
side-channel).
In a real implementation of a QKD protocol, Eve could have some accessto the devices,
devices or they could not operate as the users expect.
expect Theseimperfections are called “side-channels”.
Since the QKD protocol is unconditionally secure, we need to worry about
only side-channels in the implementation. For all the modern
cryptographic methods, both protocols and their implementations are indanger. This is an advantage of QKD over modern cryptographic methods. 14

On a QKD protocol and its implementation
BasedB
d on ththe model
d l off devices
d i
we can givei a scientifici tifi (mathematical( thti l andd physical)
h i l)
security proof of the QKD protocol, and in reality QKD implementation is based on real
devices. Like all security systems, how to confirm/achieve the model is a different story.

Unconditionally secure
QKD protocol

QKD implementation

Scientific security proof
Sequence of data processing- Error Correction method- Privacy amplification function- Security parameters

Sequence of data processing- Error Correction method- Privacy amplification function- Security parameters

Model of the devices

Real devices
They do not necessarily operate exactly
as the mathematical models require.

Side channels
Side-channels- Quantum mechanics description- Quantum & classical device
parameters

A gap exists between the model of the devices for the security proof and its actual implementation.
It can be made small by technological development and theoretical advancement, but never vanishes.

Since information is always carried, detected, and processed by a physical system,
the same gap exists for all security systems, including modern cryptosystems.

15

On side channels of QKD implementations (1)Some side channels of QKD implementations are the same as those in nonquantum communications (Modern cryptography).

Side channels in common with standard communications.
communications
Information leakage from classical data processors (for authentication,
sampling, error correction, privacy amplification, key management, etc)
andd classicalli l informationi f
ti storages
t
due
d to
t unwantedt d emissioni i off
electromagnetic wave, which is the so-called tempest attack, and theleakage due to implementation errors (software bugs etc).
Examples of these side channels include emissions from devices, e.g.
by means of electromagnetic, mechanical, and/or acoustical signals.

Side channels that may or may not bein common with standard communications
Response of the quantum devices to Eve’s probe signals, e.g.,
the use of imperfect random number generators, etc.
For instance, Eve may shine a bright probe light into Alice’s device through an optical fiberand monitor the reflective light to see which phase modulations Alice applies. See also
Appendix for countermeasures.

16

On side channels of QKD implementations (2)Purely quantum side channels
Side channel due to imperfections
pof devices
which manipulate/detect quantum signals
Examples include mismatch in quantum efficiencies of the photon detectors andiimperfectf t signal
il modulations,d l tietc.
t AlsoAl see Appendix
A
di forf theth countermeasure.
t

Identifying side-channels
side channels and patching loopholes is vital for any cryptographic
system, whether it is quantum or classical.
We need to find a common level of acceptance of side
side-channels.
channels. Sharing information
on side-channels gained from modern cryptography as well as from past, current andfuture QKD activities is the key to derive a common denominator for security
certification standards.
The quantum side-channels might be removed with the development of thetheory (based on Bell inequality) and technologies. A precise description of thedevices might not be needed to provide security.
security17

Updating security certification technology
We have to continuously look for new side channels, implement countermeasures,and update security certification technology, via the following R&D cycle.

(1) Implement QKD system(2) Propose Loophole/ Hacking Method(3) Implement hacking(4) Propose countermeasure(5) Implement countermeasure(6) Battle-testing countermeasure(7) If the countermeasure works, go back to (2),and if it does not, go back to (4).

In these years, QKD may be in research on steps between (2) and (5).
S proposingSoihackingh ki isi highly
hi hl welcome.
l18

Why don’t you ask a courier to distribute the key?
Some people claim that since QKD assumes a courier to securely distribute thekey for the first run of the authentication in QKD anyway, why don’t we use thecourier all the time? To address this issue, we list up some factors of the courier
and the storage that the users use to store the key either from the courier or QKD.
QKDCourier((C1)) Can we use the courier more than once ((availability)?
y)(C2) Can we trust the courier (reliability)?

Storage of the key: (S) Is the storage perfectly protected from side-channels?
We emphasize that only if all the answers to the above questions are positive
positive, thenwe can use the courier with the storage. In all the other cases, QKD deserves to theconsideration to use as long as the communication distance is within its QKD reach.
For instance…
(1) If the answer to (C1) is “No”, then QKD has an advantage over the courier since
QKD offers a way to expand the key whenever needed. Note that this answer is“No” in the case, forf instance in earth-satellite communications or wheneverthe courier’s availability is limited by the cost or by other practical factors.
19

Why don’t you ask a courier to distribute the key?
Courier(C1) Can we use the courier more than once (availability)?
(C2) Can we trust the courier (reliability)?

Storage of the key: (S) Is the storage perfectly protected from side-channels?
(2) If the answer to (C2) is “No”, QKD can instead use modern crypto or other means
for the very first round of authentication, which are likely to be secure only until theend of the first run of authentication. It follows that if a modern cryptography
protocol can be proven to be secure for at least a small period of time,
time then QKD
protocol that calls the protocol only for the very first run is unconditionally secure.
(3) Suppose that both the answers to (C1) and (S) are “No”. In this case, the courier
have to bring a key being large enough for life-time use. Note that this is dangerous
since if the degradation of the stored key occurs in time, then all the keys
distributed by the courier are corrupted at some point. On the contrary, QKD canoffer a means to provide fresh keys whenever neededneeded. If the degradation speed isslower than the speed of key generation and we use the generated key before
degradation, then QKD clearly has advantage over the courier.

After allall, whether a QKD implementation or the unsophisticated key
delivery via courier is better depends on the underlying assumptions
and the related technologies.

20

Other questions on QKD(Q1) In OTP, the quality of random numbers is important and it is extremely difficult togenerate true random numbers. For instance, the guessing probability of all the bits of5
the perfect key is 2-10 ≈ 10-30100 (here, 105 bits is an example of key length generated per
second)d) andd thisthi probability
b bilit is
i nott achieved
hi
d in
i all
ll QKD systems.
t(A1) In QKD, we do not demand the key to have all the qualities that the perfect key has,but instead we demand that the imperfections do not increase, as imposed by the security
definition (see the slide entitled with “security definition of QKD protocol”).
Roughly speaking, we allow the guessing probability of 10-6, which is reasonable inreality, and more importantly, we can make this number smaller if we want. In other words,
105 issince
i
2-10
i a ridiculously
idi ll smallll probability
b bilit (comparable(
bl to
t a single
i l disasterdit eventt ini thethwhole life time of the universe) it would be meaningless to apply it in practice.
(Q2)) Q(QQKD needs
eeds a lot
ot of
o highg qualityqua ty random
a do numbers,
u be s, anda d how
o do wee generate
ge e ate them?
t e(A2) It is true that, to date, one of the assumptions of the QKD theory is to have highquality random numbers. However, it has not been demonstrated that without such
numbersb
QKD becomesb
insecure.
iIn
I other
th words,
d it may beb possible
ibl thatth t theth assumptiontiabout truly random number can be removed without compromising the QKD security.
Some researchers are investigating these issues. On the other hand, the development ofphysicalyrandom number g
generators are also being
g undertaken to generate
g
high
g
the p
quality randomness as fast as possible.
21Other questions on QKD(Q3)) QKD
(Q
Q
basicallyy works only
y on a p
point to pointplink,, and it is not suitable for the internet.
(A3) QKD is not a universal tool, but QKD is suitable for some specific applications. We
have to look for as much potential applications as possible, together with experts from thefi ld off modern
fielddcryptography.
th( ) Are there open
(Q4)
p questions,q, which can be addressed jointly
jy by
y the QKD community
y andthe Modern cryptography community?
(A4) Beside the issue mentioned in the previous point, another important issue is the one
concerning side-channels,
side channels which affect all the communications
communications, both classical andquantum.
Another interesting problem is how to combine QKD with existing modern
cryptosystems
yp y
to attain an improvementpin the security
y of them. For instance,, QKD could
be used to refresh the keys employed in AES. We believe there are more works to be done
together.

22

Potential applications of updated QKD
Besides encryption of messages
messages, application to key exchange for authenticationand message integrity can be realized.
The first target of QKD secure network will be government agency networks, forwhich state secrets need to be tightly protected at any cost.
Applications will extend to the protection of mission critical infrastructures
such as power plants and facilities for water and gas supply.
supply In these facilities,
facilities
surveillance and control data should be tightly protected by QKD secure network.
QKD technologies are also expected to show their strengths in sensing small
variations in the characteristics of optical fibers.
Critical infrastructures
Power plant
Gas network
Water pipeline

We remark that currently one needs to assume trusted node networks,
which will be removed in future by introducing other quantum technologies.

23

A few days later Alice, Bob and Eve meet again…
Alice: OK
OK, I got it
it. This document says that we have to be careful about the difference
between a protocol and its implementation. The implementation always comes with sidechannels. But no one will ever be able to break a QKD protocol. Only its implementation
may be broken by exploiting the side channels.
Bob: Yeah, some people mix this up, and that has made all of us very confused. I believethat if the QKD community continues to work hard on the identification of side channels
yp people
p p and communication engineers,g, the sidein collaboration with modern crypto
channel issue will be solved to a sufficient extent at some point in the near future.
Eve: Oh come on, there is always a little side channel that can be exploited, isn’t it?
Alice: That is the case for any communication technologies and we need a cutoff at somepoint anyway. At least QKD has a big potential to realize very secure communication. Butof course with some compromise in communication distances and speed.
Bob: Yes, but even if QKD becomes mature, we may still need modern crypto for many
applications since the performance of QKD has some limitations as Alice mentioned. By
the way, do you guys think that QKD can become practical for daily use?
Eve: Hackers won’t be intimidated just because it says “quantum”.
Alice: We’ll see,, but in the near future I believe QKD has a potentialpfor specialp
use cases
as mentioned here. Anyway, QKD has a new functionality, and moreover it is still a
growing area. So, it’s too early to judge now whether QKD will have a broad application.
Let’s see what QKD will bring us in the future!
24

Postscript and acknowledgement
With the increase in the number of QKD network field tests (as well as thedevelopment of the related technologies and theory), QKD has attracted moreinterest not only from the quantum information society, but also from experts
off otherth disciplines,
di i liincludingi l dimoderndcryptography
t
h and
d the
th mass media.
diFeedbacks from non-experts of QKD are very important for the success of
QKD as well as its long term adoption. Some of their arguments are critical,
and some of them are actually relevant and deserve to be discussed
discussed.
The purposes of the UQCC2010 were to offer an opportunity for it, and also
to show the status of the latest QKD technology. The UQCC2010 committees(an initiative by the Task Force) and the Tokyo QKD network project members
took this opportunity, with valuable supports from many external experts, topresent a document which gives non-experts a clear perspective of QKD,
h i thehavingth feedbackf db k (both(b th positive
iti andd negative)ti ) we havehreceived.
i d WeWsincerely appreciate all the valuable supports and comments that the external
experts have kindly made. More importantly, we sincerely acknowledge
moderndcryptographers,thincludingi l diProf.
P f Adi Shamir,
Sh i who
h havehmaded valuablel blcriticisms. This gives the QKD community a chance to consider potential
applications and ontology of QKD. It also stimulates valuable interdisciplinary
discussions We hope the QKD and non
discussions.
non-quantum
quantum communities continue tocollaborate to make cryptography society richer, both in terms of pure scienceand practical technology.
25

Acknowledgement
The UQCC2010 Task Force, Organizing Committees, and Tokyo QKD
N t
NetworkkP
Project
j t membersbexpress our sincerei
gratitude
tit d tot :N. Lütkenhaus, M. Koashi, M. Curty, H-K. Lo, B. Qi, L. Lydersen,
G Kato,G.
K t K.
K A
Azuma, M
M. L
Lucamarini,i i W.
W J.
J Munro,
M
C-H.
CH F
F. F
Fung, X.
X Ma,
M
M. Mosca, V. Makarov, P. Tombesi, T. Yamamoto, J. Skaar, N. Gisin
Some valuable slides in this document were provided by them.
Theyy also have made significantgefforts to improvep
this document.

26

UQCC2010 T
Task
kF
Force:
K. Tamaki (Chair), M. Peev, J. F. Dynes, M. Legré, A. Tajima, H. Takesue,
T Tsurumaru
T.
T
Tokyo
y QKD Network Project:jM. Sasaki, M. Fujiwara, H. Ishizuka, W. Klaus, K. Wakui, M. Takeoka,
S. Miki, T. Yamashita, Z. Wang, A. Tanaka, K. Yoshino, Y. Nambu,
S. Takahashi, A. Tajima, A. Tomita, T. Domeki, T. Hasegawa, Y. Sakai,
H. Kobayashi, T. Asai, K. Shimizu, T. Tokura, T. Tsurumaru, M. Matsui,T. Honjo,
j K. Tamaki, H. Takesue, Y. Tokura, J. F. Dynes,yA. R. Dixon,
A. W. Sharpe, Z. L. Yuan, A. J. Shields, S. Uchikoga, M. Legré, S. Robyr,
P. Trinkler, L. Monat, J.-B. Page, G. Ribordy, A. Poppe, A. Allacher,O. Maurhart, T. Länger, M. Peev,and A. Zeilinger
UQCC2010 Organizing Committee:
K. Imafuku, M. Matsui, M. Sasaki(Chair), A. Shields, Y. Tokura,
A. Tomita, A. Yamagishi

27Appendix

28

Comment on the security definition of QKD (1)Mathematically, we call the key is ε-secure if
holds,
whereis a joint quantum state of the real key and Eve’s system aftertheh eavesdropping,didenotesdtheh perfect
f
key,
k
is
i some state, anddrepresents the trace distance. In all the formal security proofs, this criteria is
adopted, and the exponent of ε is called security parameter, which can bearbitrarybit
fixed
fi d according
di to
t the
th user’s’ demands.
dd
The trace distance gives us an upper bound of the distinguishingprobability (total variation distance), which is the probability of correctly
discriminating the two situations (the ideal situation and the real situation)
being maximized over all measurement that the distinguisher can conduct intheory. An important property of the trace distance is that any physicaloperation cannot increase this distancedistance, ii.e.,e the upper bound remains thesame even if the distinguisher applies any physical operation.

29

On side channels of QKD implementations((current status of the theory
y and experiment)p) ((1))
Trojan horse attacks
Loophole:p
In 2001 [[1]] and further in 2006 [[2]] one realized that brightglasers could be used to probe the internal status of QKD implementation.
Countermeasure: Use a detector to reveal such bright lasers. This is for
instance implemented by ID Quantique. Or, one may use an opticalisolator with sufficient enough attenuation of the incoming bright light.
Detector efficiency mismatch attacks
Loophole: In 2006 one discovered that timing differences in the detectors
could be exploited [3]. In 2007, one of the attacks, the time
time-shift
shift attack [4]was demonstrated on a commercial QKD system [5].
Countermeasure: A hardware countermeasure was immediately
yp
proposed.
p
Furthermore, the loophole is now also covered by security proofs [6-9].
[1] A. Vakhitov et al., J. Mod. Opt 48, 2023-2038 (2001)[2] N. Gisin
G
et al., Phys. Rev. A 73, 022320 (2006)()[3] V. Makarov et al., Phys Rev. A 74, 022313 (2006)[4] B. Qi et al., Quant. Inf. Comp. 7, 73-82 (2007)[5] Y. Zhao et al., Phys. Rev. A 78, 042333 (2008)[6] C.-H.
C
Fung et al., Quant.
Q
Inf.
f Comp.
C9, 131-165 (2009)()[7] L. Lydersen et al., Quant. Inf. Comp. 10, 0060 (2010)[8] Ø. Marøy et al., Phys. Rev. A 82, 032337 (2010)[9] L. Lydersen et al., Phys. Rev. A 83, 032306 (2011)

On side channels of QKD implementations((current status of the theory
y and experiment)p) ((2))
Phase-remapping attack
Loophole:p
In send-return systems,y, the eavesdropper
pp can manipulatepthesource of Alice through timing the pulses from Bob [1]. The attack was
implemented on a commercial QKD system in 2010 [2].
Countermeasure: Updated security proofs for this loophole [3-5].
Blinding
g attacks
Loophole: The detectors can be blinded and controlled by bright light[6-7]. The loophole was proved for two commercial QKD systems [7].
Countermeasure: The research community has proposed several
hardware countermeasures [8, 9]. Furthermore, the QKD producers
notified this loophole
p
prior
p
to the publication,pand implementedpcountermeasures before the loophole was made public.
[1] C.-H. Fung et al., Phys. Rev. A 75, 032314 (2007)[2] F.
F Xu
X ett al.,l New
N JJ. Ph
Phys. 12,
12 113026 (2010)[3] D. Gottesman et al., Quant. Inf. Comp. 4, 325-360 (2004)[4] H. Inamori et al., Eur. Phys. J. D 41, 599-627 (2007)[5] Ø. Marøy et al., Phys. Rev. A 82, 032337 (2010)[6] V. Makarov, New J. Phys 11, 065003 (2009)[7] L.
L Lydersen
L d
ett al.,l Nat.
N t PhPhotonics
t i 4,
4 686-689
686 689 (2010)[8] Z. Yuan et al., Nat. Photonics 4, 800-801 (2010)[9] L. Lydersen et al., Phys. Rev. A 83, 032306 (2011)

Examples of use cases of QKDDARPA network (2005)
The world’s first quantum cryptography
network10 nodes in 2005.
Collaboration between
Harvard University, Boston University
and BBN Technology
Secure key rate : 500 bps
Average length :10 km
C. Eliott, arXiv:0412029v1 (2004)

32

QKD secures Elections in Geneva
Downtown Geneva

Geneva Government
Data CenterFirst Deployment:p y
September 2006 – October 2007,
with election day on October 21st
- Installation time: 30 minutes- Continuous operation during morethan 7 weeks- Encryptionyof a GigabitgEthernet link

CentralVote Counting Station

Ballots

4 km

Cerberis Solution* (QKD devices)

Mail Votes*http://www.idquantique.com/network-encryption/cerberis-layer2-encryption-and-qkd.html

SECOQC (2008)
The SECOQC project:
standardizet d di QKD technology
t h lthrough a cross-platform interface
allowing the integration on various QKD
systemssyste
s intoto oonee network
et o nameda ed
the Quantum Back Borne (QBB)
Network in 2008.
The average linkTh
li k length:lth 20~30
20 30 kmkSecure key rate: more than a dozen kbps
6 nodes connected byy eight
g Q
QKD links
Rerouting experiments andone-time pad encrypted telephone
communication demonstrated.
Wiring diagram of the SECOQC protoype.
Blue lines represent quantum channels, green lines—
classical communication
M. Peev et al., New Journal of Physics 11, 075001 (2009)

SwissQuantum(2009-2011)
•
•
•
•
•
•
•

University of Geneva is a coordinator of a dozenof partners.
Deployed for two years in Geneva
Three links – three nodes
Links based on Plug&Play QKD
Cumulated operation time: 45’000+ hours
Distributed secret bits: 2.5E12
Key distributions stable with interruptions caused by external factors (power outage, airconditioning failure, etc.)

2009

2010

http://swissquantum.idquantique.com/

South Africa (2009)
National Institute of Theoretical Physics in 2009
The Durban–QuantumCity
Durban QuantumCity project:a four-node star network
BB84 “plugplug & play
play”
Distance: 2.6~27 km
Secure key rate: 891 bps (2.6 km)
This link was used by the eThekwini
Municipality during the FIFA World Cup in 2010.

A schematic of the physical connection
b t
betweenli k in
links
i the
th Q
QuantumCity
t Cit projectj t
A. Mirza et al., JOSA B, 27, 185 (2009)

Singapore (2009)
National University of Singapore in 2009
Free space entanglement QKD systemover several full day–night cycles
Distance: 1.5 km
Secure key rate: 385 bps

M. P. Peloso et al., New Journal of Physics 11, 045007 (2009)

Projects in China (2009)
The University of Science and Technology of China in 2009
A metropolitan all
all-passpass quantum communication
network in field fiber for four nodes
The average secure key rate: a few kbps (10~60 km)
T-Y. Chen et al., OPT. EXPRESS,18, 27223 (2010)

Metropolitan all-pass quantum communication
network constitutes 4 nodes

The University of Science and Technology of China in 2010
Five nodes connected with two wavelengths (1530,(1530 1550 nm)
Every two nodes can share secure keys at the same time
Average attenuation: 10dB
Secure key rate: 2~3 kbps

S. Wang et al., OPT. Lett.,35, 2454 (2010)

Dynamically reconfigurable QKD networkin the Washington D.C. area
by Telcordia, Lab. Telecom Sciences, LANL, Naval Res. Lab
Switching and routing of quantum signals into 3 different paths
Secure keyS
k ratet ~3
3 kbpskb(QBER 3.5%)

F3 : One-way
y BB84R. J. Hughes, et al,
Proc. SPIE 5893, 589301 (2005).

T.E. Chapuran, et al. New J. Phys. 11(10), 105001 (2009).

QKD Network in Madrid
Passive optical network consisting core ring and access networks
D. Lancho, et al., arXiv:1006.1858,

Gigabit Passive Optical Network (GPON)
Link : OLT (core) ~ ONT (client)
Downstream : 1490 nm
Upstream : 1310 nm
QKD : 1550 nm
WDM technology and three reconfigurable
optical add-drop multiplexers (ROADMs).
1510nm and 1470nm wavelengths are used for classicalsignals, while 1550nm is reserved for the quantum channel.

Tokyo QKD Network (2010)
Novel GHz-clocked QKD systems,y, a QKD smart-phone,p, a reliable commercial QKD product,p, and anentanglement QKD system were interconnected via several key management agents using acommon API, and managed by a single key management server. The demonstrated applications
include secure TV conferencing using QKD-OTP and QKD smart-phone. The secure TV
conferencing
g was supportedppbyy two relayed
y QKD routes,, each of which includes one trusted relayynode, and by a rerouting function to switch froma hacked to an alternative secure link when an
eavesdropper in the system was detected.
These demonstrations suggest
ggthat practicalpapplications of QKD in a metropolitan network
may be just around the corner.

arXiv:1103.3566 [quant-ph]
UQCC2010, http://www.uqcc2010.org/