Safeguarding Quantum Key Distribution Through Detection Randomization

We propose and experimentally demonstrate a scheme to render the detection apparatus of a quantum key distribution system immune to the main classes of hacking attacks in which the eavesdropper explores the back-door opened by the single-photon detectors. The countermeasure is based on the creation of modes that are not deterministically accessible to the eavesdropper. We experimentally show that the use of beamsplitters and extra single-photon detectors at the receiver station passively creates randomized spatial modes that erase any knowledge the eavesdropper might have gained when using bright-light faked states. Additionally, we experimentally show a detector-scrambling approach where the random selection of the detector used for each measurement-equivalent to an active spatial mode randomization-hashes out the side-channel open by the detection efficiency mismatch-based attacks. The proposed combined countermeasure represents a practical and readily implementable solution against the main classes of quantum hacking attacks aimed on the single-photon detector so far, without intervening on the inner working of the devices.

Related papers:

title: Faked states attack on quantum cryptosystems
abstract: A new type of attack on quantum cryptography systems is proposed. In this attack, Eve utilizes various optical imperfections in Bob's scheme and constructs light pulses so that Bob does not distinguish his detection results from normal, whereas they give Bob the basis and bit value chosen at Eve's discretion. Applying this attack to systems with passive basis choice on Bob's side is considered. Also, a general workflow of breaking into a running quantum cryptolink using this or Trojan horse attack is discussed.

title: Effects of detector efficiency mismatch on security of quantum cryptosystems
abstract: We suggest a type of attack on quantum cryptosystems that exploits variations in detector efficiency as a function of a control parameter accessible to an eavesdropper. With gated single-photon detectors, this control parameter can be the timing of the incoming pulse. When the eavesdropper sends short pulses using the appropriate timing so that the two gated detectors in Bob's setup have different efficiencies, the security of quantum key distribution can be compromised. Specifically, we show for the Bennett-Brassard 1984 (BB84) protocol that if the efficiency mismatch between 0 and 1 detectors for some value of the control parameter gets large enough (roughly 15:1 or larger), Eve can construct a successful faked-states attack causing a quantum bit error rate lower than 11%. We also derive a general security bound as a function of the detector sensitivity mismatch for the BB84 protocol. Experimental data for two different detectors are presented, and protection measures against this attack are discussed.

title: Experimental demonstration of time-shift attack against practical quantum key distribution systems
abstract: Quantum-key-distribution (QKD) systems can send quantum signals over more than $100\phantom{\rule{0.3em}{0ex}}\mathrm{km}$ standard optical fiber and are widely believed to be secure. Here, we show experimentally a technologically feasible attack\char22{}namely, the time-shift attack\char22{}against a commercial QKD system. Our result shows that, contrary to popular belief, an eavesdropper, Eve, has a non-negligible probability $(\ensuremath{\sim}4%)$ to break the security of the system. Eve's success is due to the well-known detection efficiency loophole in the experimental testing of Bell's inequalities. Therefore, the detection efficiency loophole plays a key role not only in fundamental physics, but also in technological applications such as QKD systems.

title: Controlling passively quenched single photon detectors by bright light
abstract: Single photon detectors (SPDs) based on passively quenched avalanche photodiodes can be temporarily blinded by relatively bright light, of intensity less than 1nW. A bright-light regime suitable for attacking a quantum key distribution system containing such detectors is described in this paper. In this regime, all SPDs in the receiver Bob are uniformly blinded by continuous illumination coming from the eavesdropper Eve. When Eve needs a certain detector in Bob to produce a click, she modifies the polarization (or other parameters used to encode quantum states) of the light she sends to Bob such that the target detector stops receiving light, while the other detector(s) continue to be illuminated. The target detector regains single photon sensitivity and, when Eve modifies the polarization again, produces a single click. Thus, Eve has full control of Bob and can perform a successful intercept-resend attack. To check the feasibility of the attack, three different models of passively quenched detectors have been tested. In the experiment, I have simulated the intensity diagrams the detectors would receive in a real QKD system under attack. Control parameters and side effects are considered. It appears that the attack could be practically possible.

title: Thermal blinding of gated detectors in quantum cryptography.
abstract: It has previously been shown that the gated detectors of two commercially available quantum key distribution (QKD) systems are blindable and controllable by an eavesdropper using continuous-wave illumination and short bright trigger pulses, manipulating voltages in the circuit . This allows for an attack eavesdropping the full raw and secret key without increasing the quantum bit error rate (QBER). Here we show how thermal effects in detectors under bright illumination can lead to the same outcome. We demonstrate that the detectors in a commercial QKD system Clavis2 can be blinded by heating the avalanche photo diodes (APDs) using bright illumination, so-called thermal blinding. Further, the detectors can be triggered using short bright pulses once they are blind. For systems with pauses between packet transmission such as the plug-and-play systems, thermal inertia enables Eve to apply the bright blinding illumination before eavesdropping, making her more difficult to catch.

title: After-gate attack on a quantum cryptosystem
abstract: We present a method to control the detection events in quantum key distribution systems that use gated single-photon detectors. We employ bright pulses as faked states, timed to arrive at the avalanche photodiodes outside the activation time. The attack can remain unnoticed, since the faked states do not increase the error rate per se. This allows for an intercept-resend attack, where an eavesdropper transfers her detection events to the legitimate receiver without causing any errors. As a side effect, afterpulses, originating from accumulated charge carriers in the detectors, increase the error rate. We have experimentally tested detectors of the system id3110 (Clavis2) from ID Quantique. We identify the parameter regime in which the attack is feasible despite the side effect. Furthermore, we outline how simple modifications in the implementation can make the device immune to this attack.

title: Superlinear threshold detectors in quantum cryptography
abstract: We introduce the concept of a superlinear threshold detector, a detector that has a higher probability to detect multiple photons if it receives them simultaneously rather than at separate times. Highly superlinear threshold detectors in quantum key distribution systems allow eavesdropping the full secret key without being revealed. Here, we generalize the detector control attack, and analyze how it performs against quantum key distribution systems with moderately superlinear detectors. We quantify the superlinearity in superconducting single-photon detectors based on earlier published data, and gated avalanche photodiode detectors based on our own measurements. The analysis shows that quantum key distribution systems using detector(s) of either type can be vulnerable to eavesdropping. The avalanche photodiode detector becomes superlinear toward the end of the gate. For systems expecting substantial loss, or for systems not monitoring loss, this would allow eavesdropping using trigger pulses containing less than 120 photons per pulse. Such an attack would be virtually impossible to catch with an optical power meter at the receiver entrance.

title: Quantum eavesdropping without interception: an attack exploiting the dead time of single-photon detectors
abstract: The security of quantum key distribution (QKD) can easily be obscured if the eavesdropper can utilize technical imperfections in the actual implementation. Here, we describe and experimentally demonstrate a very simple but highly effective attack that does not need to intercept the quantum channel at all. Only by exploiting the dead time effect of single-photon detectors is the eavesdropper able to gain (asymptotically) full information about the generated keys without being detected by state-of-the-art QKD protocols. In our experiment, the eavesdropper inferred up to 98.8% of the key correctly, without increasing the bit error rate between Alice and Bob significantly. However, we find an even simpler and more effective countermeasure to inhibit this and similar attacks.

title: Hacking commercial quantum cryptography systems by tailored bright illumination
abstract: By using bright pulses of light to ‘blind’ the avalanche photodiode detectors used in quantum cryptography equipment, scientists in Europe have shown that it is possible to tracelessly steal the secret encryption key generated by such systems and thus compromise their security.

title: Full-field implementation of a perfect eavesdropper on a quantum cryptography system.
abstract: Quantum key distribution (QKD) allows two remote parties to grow a shared secret key. Its security is founded on the principles of quantum mechanics, but in reality it significantly relies on the physical implementation. Technological imperfections of QKD systems have been previously explored, but no attack on an established QKD connection has been realized so far. Here we show the first full-field implementation of a complete attack on a running QKD connection. An installed eavesdropper obtains the entire 'secret' key, while none of the parameters monitored by the legitimate parties indicate a security breach. This confirms that non-idealities in physical implementations of QKD can be fully practically exploitable, and must be given increased scrutiny if quantum cryptography is to become highly secure.

title: Experimentally faking the violation of Bell's inequalities.
abstract: Entanglement witnesses such as Bell inequalities are frequently used to prove the nonclassicality of a light source and its suitability for further tasks. By demonstrating Bell inequality violations using classical light in common experimental arrangements, we highlight why strict locality and efficiency conditions are not optional, particularly in security-related scenarios.

title: A universal setup for active control of a single-photon detector.
abstract: The influence of bright light on a single-photon detector has been described in a number of recent publications. The impact on quantum key distribution (QKD) is important, and several hacking experiments have been tailored to fully control single-photon detectors. Special attention has been given to avoid introducing further errors into a QKD system. We describe the design and technical details of an apparatus which allows to attack a quantum-cryptographic connection. This device is capable of controlling free-space and fiber-based systems and of minimizing unwanted clicks in the system. With different control diagrams, we are able to achieve a different level of control. The control was initially targeted to the systems using BB84 protocol, with polarization encoding and basis switching using beamsplitters, but could be extended to other types of systems. We further outline how to characterize the quality of active control of single-photon detectors.

title: Avoiding the blinding attack in QKD
abstract: We show the detector blinding attack by Lydersen et al  will be ineffective on most single photon avalanche photodiodes (APDs) and certainly ineffective on any detectors that are operated correctly. The attack is only successful if a redundant resistor is included in series with the APD, or if the detector discrimination levels are set inappropriately.

title: Resilience of gated avalanche photodiodes against bright illumination attacks in quantum cryptography
abstract: Semiconductor avalanche photodiodes (APDs) are commonly used for single photon detection in quantum key distribution. Recently, many attacks using bright illumination have been proposed to manipulate gated InGaAs APDs. In order to devise effective counter-measures, careful analysis of these attacks must be carried out to distinguish between incorrect operation and genuine loopholes. Here, we show that correctly-operated, gated APDs are immune to continuous-wave illumination attacks, while monitoring the photocurrent for anomalously high values is a straightforward counter-measure against attacks using temporally tailored light.

title: Comment on “Resilience of gated avalanche photodiodes against bright illumination attacks in quantum cryptography” [Appl. Phys. Lett. 98, 231104 (2011)]
abstract: The peculiar properties of quantum mechanics enable possibilities not allowed by classical physics. In particular, two parties can generate a random, secret key at a distance, even though an eavesdropper can do anything permitted by the laws of physics. Measuring the quantum properties of the signals generating the key, would ultimately change them, and thus reveal the eavesdropper’s presence. This exchange of a random, secret key is known as quantum cryptography. Quantum cryptography can be, and has been proven unconditionally secure using perfect devices. However, when quantum cryptography is implemented, one must use components available with current technology. These are usually imperfect. Although the security of quantum cryptography has been proven for components with certain imperfections, the question remains: can quantum cryptography be implemented in a provable, unconditionally secure way, using components available with current technology? This thesis contains both a theoretical, and an experimental contribution to the answer of this question. On the experimental side, components used in, and complete quantum cryptography systems have been carefully examined for security loopholes. In particular, it turned out that two commercial quantum cryptography systems contained loopholes, which would allow an eavesdropper to capture the full secret key, without exposing her presence. Furthermore, this detector control attack could be implemented with current technology. The attack is applicable against a variety of quantum cryptography implementations and protocols. The theoretical contribution consists of security proofs for quantum cryptography in a very general setting. Precisely, the security is proven with arbitrary individual imperfections in the source and detectors. These proofs should make it possible to use a wide array of imperfect devices in implementations of quantum cryptography. Finally, a secure detection scheme is proposed, immune to the detector control attack and compatible with those security proofs. Therefore, if this scheme is implemented correctly, it offers provable security.

title: Measurement-device-independent quantum key distribution.
abstract: How to remove detector side channel attacks has been a notoriously hard problem in quantum cryptography. Here, we propose a simple solution to this problem--measurement-device-independent quantum key distribution (QKD). It not only removes all detector side channels, but also doubles the secure distance with conventional lasers. Our proposal can be implemented with standard optical components with low detection efficiency and highly lossy channels. In contrast to the previous solution of full device independent QKD, the realization of our idea does not require detectors of near unity detection efficiency in combination with a qubit amplifier (based on teleportation) or a quantum nondemolition measurement of the number of photons in a pulse. Furthermore, its key generation rate is many orders of magnitude higher than that based on full device independent QKD. The results show that long-distance quantum cryptography over say 200 km will remain secure even with seriously flawed detectors.

title: Side-channel-free quantum key distribution.
abstract: Quantum key distribution (QKD) offers the promise of absolutely secure communications. However, proofs of absolute security often assume perfect implementation from theory to experiment. Thus, existing systems may be prone to insidious side-channel attacks that rely on flaws in experimental implementation. Here we replace all real channels with virtual channels in a QKD protocol, making the relevant detectors and settings inside private spaces inaccessible while simultaneously acting as a Hilbert space filter to eliminate side-channel attacks. By using a quantum memory we find that we are able to bound the secret-key rate below by the entanglement-distillation rate computed over the distributed states.

title: Long-Distance Bell-State Analysis of Fully Independent Polarization Weak Coherent States
abstract: Here we report the experimental implementation of a linear-optics partial Bell-state analyzer following the propagation of single-photons through long telecommunication optical fibers. Polarization encoded weak coherent states were sent from independent remote continuous wave faint laser sources over two 8.5 km long optical fiber spools. Automatic polarization stabilization systems were used in each spool to compensate the random polarization drift. We demonstrate stable two-photon interference with a dip visibility of 47.8% over a 40 minute time-interval, close to the theoretical maximum of 50% for weak coherent states. We successfully show that it is possible to carry out remote long-distance Bell-state analysis of polarization weak coherent states in spite of random residual birefringence fluctuations in optical fibers. These results pave the way for important applications in quantum communications with polarization qubits such as measurement device-independent quantum key distribution and quantum repeaters.

title: Real-world two-photon interference and proof-of-principle quantum key distribution immune to detector attacks.
abstract: Several vulnerabilities of single-photon detectors have recently been exploited to compromise the security of quantum-key-distribution (QKD) systems. In this Letter, we report the first proof-of-principle implementation of a new quantum-key-distribution protocol that is immune to any such attack. More precisely, we demonstrated this new approach to QKD in the laboratory over more than 80 km of spooled fiber, as well as across different locations within the city of Calgary. The robustness of our fiber-based implementation, together with the enhanced level of security offered by the protocol, confirms QKD as a realistic technology for safeguarding secrets in transmission. Furthermore, our demonstration establishes the feasibility of controlled two-photon interference in a real-world environment and thereby removes a remaining obstacle to realizing future applications of quantum communication, such as quantum repeaters and, more generally, quantum networks.

title: Experimental measurement-device-independent quantum key distribution.
abstract: Quantum key distribution is proven to offer unconditional security in communication between two remote users with ideal source and detection. Unfortunately, ideal devices never exist in practice and device imperfections have become the targets of various attacks. By developing up-conversion single-photon detectors with high efficiency and low noise, we faithfully demonstrate the measurement-device-independent quantum-key-distribution protocol, which is immune to all hacking strategies on detection. Meanwhile, we employ the decoy-state method to defend attacks on a nonideal source. By assuming a trusted source scenario, our practical system, which generates more than a 25 kbit secure key over a 50 km fiber link, serves as a stepping stone in the quest for unconditionally secure communications with realistic devices.

title: Proof-of-principle demonstration of measurement-device-independent quantum key distribution using polarization qubits
abstract: We perform a proof-of-principle demonstration of the measurement-device-independent quantum key distribution (MDI-QKD) protocol using weak coherent states and polarization-encoded qubits over two optical fiber links of 8.5 km each. Each link was independently stabilized against polarization drifts using a full-polarization control system employing two wavelength-multiplexed control channels. A linear-optics-based polarization Bell-state analyzer was built into the intermediate station, Charlie, which is connected to both Alice and Bob via the optical fiber links. Using decoy-states, a lower bound for the secret-key generation rate of 1.04x10^-6 bits/pulse is computed.

title: Experimental demonstration of polarization encoding measurement-device-independent quantum key distribution.
abstract: We demonstrate the first implementation of polarization encoding measurement-device-independent quantum key distribution (MDI-QKD), which is immune to all detector side-channel attacks. Active phase randomization of each individual pulse is implemented to protect against attacks on imperfect sources. By optimizing the parameters in the decoy state protocol, we show that it is feasible to implement polarization encoding MDI-QKD with commercial off-the-shelf devices. A rigorous finite key analysis is applied to estimate the secure key rate. Our work paves the way for the realization of a MDI-QKD network, in which the users only need compact and low-cost state-preparation devices and can share complicated and expensive detectors provided by an untrusted network server.

title: Quantum Cryptography
abstract: II A beautiful idea 2 A The intuition . . . . . . . . . . . . . . . 2 B Classical cryptography . . . . . . . . . 3 1 Asymmetrical (public-key) cryptosystems . . . . . . . . . . . . . . . 3 2 Symmetrical (secret-key) cryptosystems . . . . . . . . . . . . . . . . . 4 3 The one-time-pad as “classical teleportation” . . . . . . . . . . . . . . 5 C The example of the BB84 protocol . . . 5 1 Principle . . . . . . . . . . . . . . . 5 2 No cloning theorem .  6 4 Error correction, privacy amplification and quantum secret growing . . 6 5 Advantage distillation .  E Quantum teleportation as “Quantum one-time-pad” . . . . . . . . . . . . . . 10 F Optical amplification, quantum nondemolition measurements and optimal quantum cloning . . . . . . . . . . . . .

title: Single-photon detectors for optical quantum information applications
abstract: This review highlights the recent progress which has been made towards improved single-photon detector technologies and the impact these developments will have on quantum optics and quantum information science.

title: Invited review article: Single-photon sources and detectors.
abstract: We review the current status of single-photon-source and single-photon-detector technologies operating at wavelengths from the ultraviolet to the infrared. We discuss applications of these technologies to quantum communication, a field currently driving much of the development of single-photon sources and detectors.

title: Avalanche photodiodes and quenching circuits for single-photon detection.
abstract: Avalanche photodiodes, which operate above the breakdown voltage in Geiger mode connected with avalanche-quenching circuits, can be used to detect single photons and are therefore called singlephoton avalanche diodes SPAD's. Circuit configurations suitable for this operation mode are critically analyzed and their relative merits in photon counting and timing applications are assessed. Simple passive-quenching circuits (PQC's), which are useful for SPAD device testing and selection, have fairly limited application. Suitably designed active-quenching circuits (AQC's) make it possible to exploit the best performance of SPAD's. Thick silicon SPAD's that operate at high voltages (250-450 V) have photon detection efficiency higher than 50% from 540- to 850-nm wavelength and still ~3% at 1064 nm. Thin silicon SPAD's that operate at low voltages (10-50 V) have 45% efficiency at 500 nm, declining to 10% at 830 nm and to as little as 0.1% at 1064 nm. The time resolution achieved in photon timing is 20 ps FWHM with thin SPAD's; it ranges from 350 to 150 ps FWHM with thick SPAD's. The achieved minimum counting dead time and maximum counting rate are 40 ns and 10 Mcps with thick silicon SPAD's, 10 ns and 40 Mcps with thin SPAD's. Germanium and III-V compound semiconductor SPAD's extend the range of photon-counting techniques in the near-infrared region to at least 1600-nm wavelength.

title: High speed single photon detection in the near-infrared
abstract: InGaAs avalanche photodiodes (APDs) are convenient for single photon detection in the near-infrared (NIR) including the fibre communication bands (1.31/1.55 $\mu$m). However, to suppress afterpulse noise due to trapped avalanche charge, they must be gated with MHz repetition frequencies, thereby severely limiting the count rate in NIR applications. Here we show gating frequencies for InGaAs-APDs well beyond 1 GHz. Using a self-differencing technique to sense much weaker avalanches, we reduce drastically afterpulse noise. At 1.25 GHz, we obtain a detection efficiency of 10.8% with an afterpulse probability of 6.16%. In addition, the detector features low jitter (55 ps) and a count rate of 100 MHz.

title: Ultra-Low-Noise Sinusoidally Gated Avalanche Photodiode for High-Speed Single-Photon Detection at Telecommunication Wavelengths
abstract: Authors report avalanche signal detection with an ultra-low-noise detector-circuit based on a sinusoidally gated avalanche photodiode (APD). An avalanche gain can be reduced to 104, which results in strong suppression of afterpulsing. The gate repetition frequency reached 2 GHz, which is much higher than that of the other gated APDs. In addition, the detection efficiency of 10.5% was obtained at 1550 nm with a dark count probability of 6.1 × 10-7 and an afterpulsing probability of 3.4%.

title: Risk Analysis of Trojan-Horse Attacks on Practical Quantum Key Distribution Systems
abstract: An eavesdropper Eve may probe a quantum key distribution (QKD) system by sending a bright pulse from the quantum channel into the system and analyzing the back-reflected pulses. Such Trojan-horse attacks can breach the security of the QKD system, if appropriate safeguards are not installed or if they can be fooled by the Eve. We present a risk analysis of such attacks based on extensive spectral measurements, such as transmittance, reflectivity, and detection sensitivity of some critical components used in a typical QKD systems. Our results indicate the existence of wavelength regimes, where the attacker gains considerable advantage as compared to launching an attack at 1550 nm. We also propose countermeasures to reduce the risk of such attacks.

title: Impact of Raman Scattered Noise from Multiple Telecom Channels on Fiber-Optic Quantum Key Distribution Systems
abstract: In this paper, we analyze the impact of the spontaneous Raman scattered noise generated from multiple optical classical channels on a single quantum key distribution channel, all within the telecom C-band. We experimentally measure the noise generated from up to 14 continuous-wave laser sources with different wavelengths using the dense wavelength division multiplexing (DWDM) standard, in both propagation directions in respect to the QKD channel, over different standard SMF-28 fiber lengths. We then simulate the expected secure key generation rate for a decoy-states-based system as a function of distance under the presence of simultaneous telecom traffic with different modulation techniques, and show a severe penalty growing with the number of classical channels present. Our results show that, for in-band coexistence, the telecom channels should be distributed as close as possible from the quantum channel to avoid the Raman noise peaks. Operation far from the zero dispersion wavelength of the fiber is also beneficial as it greatly reduces the generation of four-wave mixing inside the quantum channel. Furthermore, narrow spectral filtering on the quantum channels is required due to the harsh limitations of performing QKD under real telecom environments, with the quantum and several classical channels coexisting in the same ITU-T C-band.

title: The security of practical quantum key distribution
abstract: Quantum key distribution (QKD) is the first quantum information task to reach the level of mature technology, already fit for commercialization. It aims at the creation of a secret key between authorized partners connected by a quantum channel and a classical authenticated channel. The security of the key can in principle be guaranteed without putting any restriction on an eavesdropper's power. This article provides a concise up-to-date review of QKD, biased toward the practical side. Essential theoretical tools that have been developed to assess the security of the main experimental platforms are presented (discrete-variable, continuous-variable, and distributed-phase-reference protocols).

title: Field test of wavelength-saving quantum key distribution network.
abstract: We propose a wavelength-saving topology of a quantum key distribution (QKD) network based on passive optical elements, and we report on the field test of this network on commercial telecom optical fiber at the frequency of 20 MHz. In this network, five nodes are supported with two wavelengths, and every two nodes can share secure keys directly at the same time. We also characterized the insertion loss and cross talk effects on the point-to-point QKD system after introducing this QKD network.