Source: http://aoot.osa.org/oe/abstract.cfm?uri=oe-18-26-27938
Timestamp: 2019-04-22 08:02:27+00:00

Document:
It has previously been shown that the gated detectors of two commercially available quantum key distribution (QKD) systems are blindable and controllable by an eavesdropper using continuous-wave illumination and short bright trigger pulses, manipulating voltages in the circuit [Nat. Photonics 4, 686 (2010)]. This allows for an attack eavesdropping the full raw and secret key without increasing the quantum bit error rate (QBER). Here we show how thermal effects in detectors under bright illumination can lead to the same outcome. We demonstrate that the detectors in a commercial QKD system Clavis2 can be blinded by heating the avalanche photo diodes (APDs) using bright illumination, so-called thermal blinding. Further, the detectors can be triggered using short bright pulses once they are blind. For systems with pauses between packet transmission such as the plug-and-play systems, thermal inertia enables Eve to apply the bright blinding illumination before eavesdropping, making her more difficult to catch.
C. H. Bennett and G. Brassard, “Quantum cryptography: Public key distribution and coin tossing,” in “Proceedings of IEEE International Conference on Computers, Systems, and Signal Processing,” (IEEE Press, New York, Bangalore, India, 1984), pp. 175–179.
A. K. Ekert, “Quantum cryptography based on bell theorem,” Phys. Rev. Lett. 67, 661–663 (1991).
H.-K. Lo and H. F. Chau, “Unconditional security of quantum key distribution over arbitrarily long distances,” Science 283, 2050–2056 (1999).
P. W. Shor and J. Preskill, “Simple proof of security of the BB84 quantum key distribution protocol,” Phys. Rev. Lett. 85, 441–444 (2000).
D. Stucki, N. Walenta, F. Vannel, R. T. Thew, N. Gisin, H. Zbinden, S. Gray, C. R. Towery, and S. Ten, “High rate, long-distance quantum key distribution over 250 km of ultra low loss fibres,” N. J. Phys. 11, 075003 (2009).
Commercial QKD systems are available from at least two companies: ID Quantique (Switzerland), http://www.idquantique.com ; MagiQ Technologies (USA), http://www.magiqtech.com .
D. Mayers, “Advances in cryptology,” in “Proceedings of Crypto’96,”, vol. 1109, N. Koblitz, ed. (Springer, New York, 1996), vol. 1109, pp. 343–357.
H. Inamori, N. Lütkenhaus, and D. Mayers, “Unconditional security of practical quantum key distribution,” Eur. Phys. J. D 41, 599–627 (2007).
C.-H. F. Fung, K. Tamaki, B. Qi, H.-K. Lo, and X. Ma, “Security proof of quantum key distribution with detection efficiency mismatch,” Quantum Inf. Comput. 9, 131–165 (2009).
L. Lydersen and J. Skaar, “Security of quantum key distribution with bit and basis dependent detector flaws,” Quantum Inf. Comput. 10, 0060 (2010).
Ø. Marøy, L. Lydersen, and J. Skaar, “Security of quantum key distribution with arbitrary individual imperfections,” Phys. Rev. A 82, 032337 (2010).
A. Vakhitov, V. Makarov, and D. R. Hjelme, “Large pulse attack as a method of conventional optical eavesdropping in quantum cryptography,” J. Mod. Opt. 48, 2023–2038 (2001).
N. Gisin, S. Fasel, B. Kraus, H. Zbinden, and G. Ribordy, “Trojan-horse attacks on quantum-key-distribution systems,” Phys. Rev. A 73, 022320 (2006).
V. Makarov, A. Anisimov, and J. Skaar, “Effects of detector efficiency mismatch on security of quantum cryptosystems: erratum,” 78, 019905 (2008).
V. Makarov and J. Skaar, “Faked states attack using detector efficiency mismatch on SARG04, phase-time, DPSK, and Ekert protocols,” Quantum Inf. Comput. 8, 0622 (2008).
A. Lamas-Linares and C. Kurtsiefer, “Breaking a quantum key distribution system through a timing side channel,” Opt. Express 15, 9388–9393 (2007).
S. Nauerth, M. Fürst, T. Schmitt-Manderbach, H. Weier, and H. Weinfurter, “Information leakage via side channels in freespace BB84 quantum cryptography,” N. J. Phys. 11, 065001 (2009).
C.-H. F. Fung, B. Qi, K. Tamaki, and H.-K. Lo, “Phase-remapping attack in practical quantum-key-distribution systems,” Phys. Rev. A 75, 032314 (2007).
F. Xu, B. Qi, and H.-K. Lo, “Experimental demonstration of phase-remapping attack in a practical quantum key distribution system,” N. J. Phys. 12, 113026 (2010).
Precisely, the quantum bit error rate (QBER) is the fraction given by the number of bits which differ in Alice’s and Bob’s raw key, divided by the length of the raw key.
H. F. Chau, “Practical scheme to share a secret key through a quantum channel with a 27.6% bit error rate,” Phys. Rev. A 66, 060302 (2002).
D. Gottesman and H.-K. Lo, “Proof of security of quantum key distribution with two-way classical communications,” IEEE Trans. Inf. Theory 49, 457–475 (2003).
V. Makarov, “Controlling passively quenched single photon detectors by bright light,” N. J. Phys. 11, 065003 (2009).
V. Makarov, A. Anisimov, and S. Sauge, “Quantum hacking: adding a commercial actively-quenched module to the list of single-photon detectors controllable by Eve,” e-print arXiv:0809.3408v2 [quant-ph].
L. Lydersen, C. Wiechers, C. Wittmann, D. Elser, J. Skaar, and V. Makarov, “Hacking commercial quantum cryptography systems by tailored bright illumination,” Nat. Photonics 4, 686–689 (2010).
C. Wiechers, L. Lydersen, C. Wittmann, D. Elser, J. Skaar, C. Marquardt, V. Makarov, and G. Leuchs, “After-gate attack on a quantum cryptosystem,” e-print arXiv:1009.2683 [quant-ph] .
I. Gerhardt, Q. Liu, J. Skaar, A. Lamas-Linares, C. Kurtsiefer, and V. Makarov, “Perfect eavesdropping on a quantum cryptography system,” e-print arXiv:1011.0105 [quant-ph].
I. Marcikic, A. Lamas-Linares, and C. Kurtsiefer, “Free-space quantum key distribution with entangled photons,” Appl. Phys. Lett. 89, 101122 (2006).
M. P. Peloso, I. Gerhardt, C. Ho, A. Lamas-Linares, and C. Kurtsiefer, “Daylight operation of a free space, entanglement-based quantum key distribution system,” N. J. Phys. 11, 045007 (2009).
Z. L. Yuan, J. F. Dynes, and A. J. Shields, “Avoiding the detector blinding attack on quantum cryptography,” Nat. Photonics 4, 800–801 (2010).
S. Cova, M. Ghioni, A. Lotito, I. Rech, and F. Zappa, “Evolution and prospects for single-photon avalanche diodes and quenching circuits,” J. Mod. Opt. 51, 1267–1288 (2004).
All references to the APD bias voltage are absolute valued, thus an APD biased “above” the breakdown voltage is in the Geiger mode. In practice the APDs are always reverse-biased.
V. Makarov and D. R. Hjelme, “Faked states attack on quantum cryptosystems,” J. Mod. Opt. 52, 691–705 (2005).
V. Scarani, A. Acín, G. Ribordy, and N. Gisin, “Quantum cryptography protocols robust against photon number splitting attacks for weak laser pulse implementations,” Phys. Rev. Lett. 92, 057901 (2004).
W.-Y. Hwang, “Quantum key distribution with high loss: Toward global secure communication,” Phys. Rev. Lett. 91, 057901 (2003).
S. Cova, A. Longoni, and A. Andreoni, “Towards picosecond resolution with single-photon avalanche diodes,” Rev. Sci. Instrum. 52, 408–412 (1981).
D. S. Bethune and W. P. Risk, “An autocompensating fiber-optic quantum cryptography system based on polarization splitting of light,” IEEE J. Quantum Electron. 36, 340–347 (2000).
A. Tomita and K. Nakamura, “Balanced, gated-mode photon detector for quantum-bit discrimination at 1550 nm,” Opt. Lett. 27, 1827–1829 (2002).
Z. L. Yuan, B. E. Kardynal, A. W. Sharpe, and A. J. Shields, “High speed single photon detection in the near infrared,” Appl. Phys. Lett. 91, 041114 (2007).
Osterm, PE4-115-14–15, http://osterm.ru/PAGE/MULTISTAGE.HTM , visited 3. August 2010.
When the temperature increases, the lattice vibrations in the APD increase. This increases the probability that the electron collides with the lattice, and therefore reduces the probability that the electron gains enough energy to trigger ionization of a new electron-hole pair. Therefore, to ensure that the electron gains ionization energy, the electric field must be larger, and thus the breakdown voltage is increased.
S. M. Sze and K. K. Ng, Physics of semiconductor devices (Wiley-Interscience, 2007).
Marlow, NL4012, http://www.marlow.com/media/marlow/product/downloads/nl4012t/NL4012.pdf , visited 3. August 2010.
The detectors do not have any dark counts and are assumed blind at a temperature of about −40°C at the cold plate, or when the bias voltage is decreased by 0.97V. If one assumes that the APD temperature is equal to the cold plate temperature, this means that heating the detectors by 10K is equivalent to decreasing the bias voltage by about 1V.
G. Ribordy, J.-D. Gautier, N. Gisin, O. Guinnard, and H. Zbinden, “Automated ‘plug & play’ quantum key distribution,” Electron. Lett. 34, 2116–2117 (1998).
D. Stucki, N. Gisin, O. Guinnard, G. Ribordy, and H. Zbinden, “Quantum key distribution over 67 km with a plug&play system,” N. J. Phys. 4, 41 (2002).
S. Sauge, L. Lydersen, A. Anisimov, J. Skaar, and V. Makarov. in preparation.
G. Ribordy, J.-D. Gautier, N. Gisin, O. Guinnard, and H. Zbinden, “Fast and user-friendly quantum key distribution,” J. Mod. Opt. 47, 517–531 (2000).
The system actually sends the qubits in frames of 1075 qubits each. We initially made a mistake when counting them and used 1072 qubits, which is very close and does not affect the results.
We picked the second bit to simplify synchronization in our measurement setup. The results for the first bit should be very similar to the results for the second bit.
U. L. Andersen, G. Leuchs, and C. Silberhorn, “Continuous-variable quantum information processing,” Laser Photon. Rev. 4, 337 (2010), ArXiv:1008.3468v1 [quant-ph].
Fig. 1 The last beam splitter (BS) as well as the detectors in a phase-encoded QKD system. I0 and I1 is the current running through APD 0/1, and Ith is the comparator threshold current above which the detector registers a click. Here we assume that the APDs are in the linear mode, and that Eve sends a bright pulse slightly above the optical power thresholds. a) Eve and Bob have selected matching bases. Therefore the full intensity in the pulse from Eve hits detector 0. The current caused by Eve’s pulse crosses the threshold current and causes a click. b) Eve and Bob have selected opposite bases. Therefore half the intensity of Eve’s pulse hits each detector (corresponding to 50% detection probability in either detector for single photons). This causes no click as the current is below the threshold for each detector.
Fig. 2 Equivalent detector bias and comparator circuit. Taps T1-T3 are analog taps of the APD gates (Vgate,0/1), the APD bias (Vbias,0/1) and the comparator input (Vcomp,0/1). The digital tap T4 of the detector output (Vclick,0/1) has been converted to logic levels in all oscillograms. For the experiments presented in section 4, the resistor R3 has been shorted.
Fig. 3 An example of electrical signals during two gates in detector 1 without any illumination. In the first gate thermal fluctuations or trapped carriers have caused an avalanche, and a click at the comparator output (dark count). A typical amplitude of the avalanche peak is 200mV for detector 0 and 300mV for detector 1. Normally the system removes 50 gates after a detection event, but for this oscillogram this feature has been disabled. In the second gate there is no detection event. When no current runs through the APD, it is equivalent to a capacitor, and thus approximately the derivative of the gate pulse shape propagates to the comparator input, with peak positive amplitude ≈ 35mV.
Fig. 4 Calculated heat dissipation (based on measured APD current and voltage) versus the optical illumination for each of the two detectors.
Fig. 5 The temperature of the cold plate and TEC current reported by the software, versus the total amount of heat dissipated in the APDs. It takes several minutes for the cold plate temperature to stabilize at a new value (hotter than −50°C) after the power dissipation in the APDs is changed.
Fig. 6 Click probability versus power of CW illumination applied to both detectors simultaneously.
Fig. 7 Thermal blinding of frames. The oscillograms show electrical and optical signals when frames of 1072 gates in detector 1 are thermally blinded by a 225μs blinding pulse, with 3.5mW pulse power at detector 0, and 4mW pulse power at detector 1. The blinding pulse causes a detection event outside the frame, where the system probably does not register clicks (If the click is registered, it could easily be avoided by increasing the power of the blinding pulse gradually, such that the comparator input AC-coupling keeps the voltage below the comparator threshold).
Fig. 8 Detector control during thermal blinding of frames. The oscillograms show electrical and optical signals when frames of 1072 gates in detector 1 are thermally blinded by a 225μs blinding pulse, with 3.5mW pulse power at detector 0, and 4mW pulse power at detector 1, and the detector is controlled by a 4ns long control pulse timed slightly after the second gate in the frame. In the upper and lower left sets of oscillograms, the 580μW control pulse never causes any click. In the lower right set, the control pulse is applied after the same gate in the frame, but now its increased 747μW peak power always causes a click.
Fig. 9 Sinkhole blinding. The oscillograms show electrical and optical signals when detector 1 is blinded by a 500μW, 140ns long laser pulse in between the gates. The avalanche amplitude is about 130mV and would cause a click if it were not sitting in the negative-voltage pulse. It seems that the reduction in avalanche amplitude (compare to Fig. 3) is caused by heating of the APD, which effectively rises the breakdown voltage.
Fig. 10 Detector control during sinkhole blinding. The oscillograms show electrical and optical signals when detector 1 is blinded with a 500μW, 140ns long laser pulse in between the gates, and controlled with a 3.2ns long laser pulse timed shortly after the gate. To the left, the 773μW control pulse never causes any click. To the right, the 908μW control pulse always causes a click.
Fig. 11 The setup used in the experiment. Both detectors were illuminated simultaneously by inserting a 50/50 fibre-optic coupler (not shown in the diagram) before the APDs.
Fig. 12 Quantum efficiency measured directly within the electrical gate for detector 1. The photon sensitivity drops about 1ns before the falling edge of the gate, because avalanches that start late do not have time to develop a large enough current to cross the comparator threshold.

References: V. 

V. 

V. 

V. 

V. 
 V. 
 V. 
 V. 

V. 

V. 
 V.