# Secure Quantum Communication Technologies and Systems: From Labs to Markets
## 2 Quantum Key Distribution Systems and Networks
### Quantum Security and Practical Vulnerability Issues  
As the father of information theory, Claude [PERSON] proved in [23] that for a cryptosystem to be unconditionally secure, the length of the used key cannot be shorter than the data itself. Under these circumstances, the cryptogram used to achieve unconditional security with QKD is well known: it is named a one-time pad, where a simple XOR operation is performed bit-by-bit between data and key. However, given the throughput disparity between current QKD systems (which can achieve Mbit/s speed in the best case, such as in [24]) and classical data communication (which can achieve to Tbit/s speed), one-time pad is not of practical use. This is the reason why many applications use unconditionally secure quantum cryptograms only to share a secret key between partners, which is known to be the most vulnerable part of any encryption system. Once the partners share the secret key, classical symmetric cryptosystems are used to share the data, such as the advanced encryption standard (AES). Symmetrical cryptosystems are very secure and some of them have been studied for their resilience to quantum attacks [25], although it remains to be proven whether they are resistant to any kind of attack by a quantum computer [26]. Hence, the impossibility of performing one-time pad quantum encryption of all data remains a security bottleneck in real-world QKD systems, together with other technological and implementational constraints that we will discuss later in this section. QKD protocols are known to be unconditionally secure because their security is independent of the amount of information and the computational power of the attacker. However, this statement is true for an ideal system. In practice, as is shown in [27], several assumptions have to be satisfied for the system to be considered unconditionally secure. For example, due to its limited bit rate, QKD is often used in conjunction with classical encryption methods, making the actual security dependent on the technological level of the adversary at the time of the key exchange. Another example of a technological issue is the possible information leakage caused by light emitted by avalanche photodiodes during the breakdown. Moreover, QKD may be vulnerable to beam splitter and trojan horse attacks due to the non-ideality of photon sources and backscattered light, respectively, requiring proper design countermeasures. A consistent research effort has been devoted to the necessity of achieving unconditional security in practice and to engineering the known protocols for this purpose. For example, single-photon sources implemented by attenuating standalone lasers (a usual choice, due to practical feasibility issues) are vulnerable to a kind of attack called photon number splitting (PNS) [28]. Such non-ideal sources may emit multiple photons instead of exactly one, and these may be used to split the additional photons and extrapolate information without affecting the photons exchanged by \"Alice\" and \"Bob\". A solution aimed at solving source imperfections in BB84 was proposed by [PERSON] [29], where additional states, called decoy states, are properly designed to be different in power in respect to the data photons and are randomly substituted into the data to understand if someone is sniffing the channel. An unconditional security proof of decoy-state QKD is shown in [30,31]. Decoy states were exploited by [PERSON] et al. in 2004 [32] to obtain a specific protocol, called the coherent one-way (COW) protocol. Instead of using ideal single-photon sources, which are hard and costly to realize and require cryogenic temperatures, this protocol uses a continuous wave laser as the source, such as the ones used in optical telecom systems. This laser is attenuated to obtain quasi single-photon transmission. Since the optical generation of photons is a statistical process, the number of actual generated photons will be either zero, one, or several photons.