## 4 A Detector-Blinding Attack on the BB84 with Semi-Active Base Selection  
In the receiving station (Bob), which was broken in Ref. [5], the random choice of detection bases is performed actively by means of a phase electro-modulator (PEM) driven by an explicit electronic QRNG, as shown in Figure 3. The state of the QRNG (0 or 1) determines the receiving base. According to the above discussion, I assume that the QRNG is private, meaning that it cannot be manipulated or predicted by [PERSON]. This base choice technique functions exactly as required by the BB84 protocol for single qubits. It also diverts all the incoming power of a strong fake state to the selected base. The version of DBA used against this setup works as follows. [PERSON] again cuts the quantum channel between [PERSON] and Bob. She simultaneously blinds all four detectors in Bob by shining a strong, continuous (CW), circularly polarized light of a carefully tailored intensity, as explained in Ref. [5]. Note that the circularly polarized light distributes evenly among the detectors regardless of the state of the PEM, and [PERSON] is thus able to simultaneously blind and keep blinded forever (or at least during the qubit exchange phase) both detectors and thus both bases. Note that while the active control of the PEM works correctly for qubits and fake states, it has no effect on the blinding light. Therefore, I refer to the setup in Figure 3 as \"semi-active\". As in the previous DBA, the blinded detectors are sensitive only to fake state pulses brighter than a threshold power \(P_{thr}\) superimposed on top of the blinding CW light, which confines the fake state power to the range between slightly above \(2P_{thr}\) and slightly below \(4P_{thr}\). The difference from the previous setup (shown in Figure 2) is that here, [PERSON] is able to copy her measurement to [PERSON] with only 50% success, namely, in those instances in which her base coincides with [PERSON]'s by chance. In the other 50% of instances, [PERSON]'s blinded detectors receive nothing, and the bit is lost. Next, by passively listening to the classical communication between [PERSON] and [PERSON] in the next phases of the BB84 protocol, [PERSON] is able to figure out which bits were lost, sift the same bits as [PERSON] and [PERSON], and recover 100% of the key. While this attack reduces the key rate by a factor of two (equivalent to a channel loss of 3 dB) with respect to when [PERSON] is not there, the security situation is not satisfactory because [PERSON] still obtains the full key and, in the presence of other losses or a strongly varying loss, she might remain undetected. In fact, [PERSON] might place herself away from [PERSON] such that the channel loss between them is at least 3 dB, in which case the loss would be compensated for because [PERSON] detects her fake states with no loss. In fact, if the channel loss between [PERSON] and [PERSON] is greater than 3 dB, [PERSON] will need to fake an additional loss so as not to raise suspicion, which is technically quite easy. Additionally, note that [PERSON] and [PERSON] have no secure means of calibrating the key rate because [PERSON] might decide to be present at all t times, introduce the 3 dB loss when not eavesdropping, and remove it when she does. This receiving station (Figure 3) architecture was also shown to be vulnerable to the weak pulse (~120 photons) attack via an early test prototype using superconducting nanowire single-photon detectors, exploiting their superlinear behavior and/or their great sensitivity to thermal effects [6]. The technical reason for this relative success of [PERSON] even with the \"semi active\" control of the bases is that regardless of the state of the PEM, the incident circularly polarized light is equally distributed among the four detectors, which enables [PERSON] to keep them blinded all at all times.