Many quantum key distribution (QKD) schemes are based on sending and measuring qubits -- two-dimensional quantum systems. Yet, in practical realizations and experiments, the measuring devices at the receiver's (Bob) site commonly do not measure a two-dimensional system but rather a quantum space of a larger dimension. Such an enlargement sometimes results from imperfect devices. However, in various QKD protocols such enlargement exists even in the ideal scenario when all devices are assumed to be perfect. This issue is common, for instance, in QKD schemes implemented via photons, where the parties' devices are based on Mach-Zehnder interferometers, as these inherently enlarge the quantum space in use. We show how space enlargement at Bob's site exposes the implemented protocol to new kinds of attacks, attacks that have not yet been explicitly pinpointed nor rigorously analyzed. We name these the "reversed space attacks". A key insight in formalizing our attacks, is the idea of taking all states defining Bob's (large) measured space and reversing them in time in order to identify precisely the space that an eavesdropper may attack. We employ such attacks on two variants of intereferometric-based QKD recently experimented by several groups, and show how to get full information on the qubit sent by Alice, while inducing no errors at all. The technique we develop here has subsequently been used in a closely related work (Boyer, Gelles, and Mor, Physical Review A, 2014) to demonstrate a (weaker variant of) reversed-space attack on both interferometric-based and polarization-based QKD.
Many quantum key distribution (QKD) schemes are based on sending and measuring qubits -- two-dimensional quantum systems. Yet, in practical realizations and experiments, the measuring devices at the receiver's (Bob) site commonly do not measure a two-dimensional system but rather a quantum space of a larger dimension. Such an enlargement sometimes results from imperfect devices. However, in various QKD protocols such enlargement exists even in the ideal scenario when all devices are assumed to be perfect. This issue is common, for instance, in QKD schemes implemented via photons, where the parties' devices are based on Mach-Zehnder interferometers, as these inherently enlarge the quantum space in use. We show how space enlargement at Bob's site exposes the implemented protocol to new kinds of attacks, attacks that have not yet been explicitly pinpointed nor rigorously analyzed. We name these the "reversed space attacks". A key insight in formalizing our attacks, is the idea of taking all states defining Bob's (large) measured space and reversing them in time in order to identify precisely the space that an eavesdropper may attack. We employ such attacks on two variants of intereferometric-based QKD recently experimented by several groups, and show how to get full information on the qubit sent by Alice, while inducing no errors at all. The technique we develop here has subsequently been used in a closely related work (Boyer, Gelles, and Mor, Physical Review A, 2014) to demonstrate a (weaker variant of) reversed-space attack on both interferometric-based and polarization-based QKD.
Theoretical quantum key distribution (QKD) protocols commonly rely on the use of qubits (quantum bits). In reality, however, due to practical limitations, the legitimate users are forced to employ a larger quantum (Hilbert) space, say a quhexit (quantum six-dimensional) space, or even a much larger quantum Hilbert space. Various specific attacks exploit of these limitations. Although security can still be proved in some very special cases, a general framework that considers such realistic QKD protocols, as well as} attacks on such protocols, is still missing. We describe a general method of attacking realistic QKD protocols, which we call the `quantum-space attack'. The description is based on assessing the enlarged quantum space actually used by a protocol, the `quantum space of the protocol'. We demonstrate these new methods by classifying various (known) recent attacks against several QKD schemes, and by analyzing a novel attack on interferometry-based QKD.
The counter-intuitive features of quantum mechanics make it possible to solve problems and perform tasks that are beyond the abilities of non-quantum (classical) computers and communication devices. The field of quantum information processing studies how we can achieve such improvements by representing information as quantum states.One of the early achievements of quantum information processing is the development of quantum key distribution (QKD). QKD protocols allow two participants (Alice and Bob) to achieve the classically-impossible task of generating a secret shared key even if their adversary is computationally unlimited.Unfortunately, the security promises of QKD are true only in theory; practical implementations of QKD deviate from the theoretical protocols, and many of these deviations give rise to practical attacks. In this research thesis, we study the security properties of various QKD protocols in many practical settings:First, we study practical security of semiquantum key distribution (SQKD) protocols, where either Alice or Bob is non-quantum (classical). Following practical security problems in previous SQKD protocols, we suggest a new SQKD protocol (the "Mirror protocol") which can be securely implemented, and we prove it robust and secure against a wide range of attacks (the "uniform collective attacks").Then, we study "composable security" of the first QKD protocol created by Bennett and Brassard (BB84). BB84 has its unconditional security proved against adversaries performing the most general attacks in a theoretical (idealized) setting; however, some security approaches do not prove "composable security", which requires the secret key to remain secret even when Alice and Bob actually use it for cryptographic purposes. We generalize an algebraic security approach for BB84, making it prove composable security of BB84 (and many variants of BB84) against the most general attacks.Finally, we analyze an important practical attack (named "Bright Illumination"), showing how it can be modeled as a theoretical "Reversed-Space" attack.Overall, all results aim to enhance our understanding on how to bridge the gap between theory and practice in various sub-fields of QKD, and they may help solve a major open problem in the field of QKD: constructing a realistic QKD implementation that can be proved truly and unconditionally secure against any possible attack.
Security verification for the physical implementation of a cryptography system is an important step to ensure the security level promised by theory. As has been shown many times, any physical device has characteristics and behavior that deviate from theoretical expectations. Frequently, those lead to new security loopholes. \n \nThis thesis presents three experimental studies of attacks on quantum key distribution (QKD) systems. The first is the detection efficiency mismatch on free-space systems, which takes advantage of alignment imperfections in Bob's detector to control detection efficiencies. The experiment was done on a polarization-encoding free-space receiver to find the detection efficiencies of each detector for different spatial modes of an incoming photon. Those results were put into an optimization program, which modeled an intercept-and-resend attack on a non-decoy Bennett-Brassard 1984 (BB84) protocol. The result shows that an adversary is able to gain information about the key without being detected by Alice and Bob. The second study is an experimental test of reliability of a spatial filter (a pinhole), which is proposed as a countermeasure for the previous attack. The result shows that, by sending a high-power laser beam focused on the pinhole, the pinhole can be widened without affecting other components in the receiver. Thus, the ability to perform a spatial mode detection efficiency-mismatch attack is recovered. The last experiment is a demonstration of Eve's ability to force a commercial system to distill a key from a raw key of a short length, where the asymptotic assumption of security claimed by the manufacturer might not hold. It was shown that this could be done by inducing transmission loss in the channel at an appropriate time.
We present general security proof for quantum key distribution (QKD) with imperfect states in whole space including both the operational space and the other space (side-channel space). We show that in a protocol where Alice (Bob) uses two states, the secure key rate for a real protocol using imperfect (mixed) states is the same as that of a perfect protocol if the real protocol can be mapped from the perfect protocol. The calculation of the secure key rate for imperfect sources is reduced to the lower bound of projection probability to vacuum for each state. This paves the operable way to side-channel-secure QKD under more realistic conditions, including imperfections of whole-space states, mixed states, and finite data size. Taking the sending-or-not-sending encoding as an example in calculation, we obtain good key rates and long secure distance for QKD that is both measurement-device-independent and secure with imperfect whole-space source states. Published by the American Physical Society 2024
In this thesis we develop practical tools for quantum key distribution (QKD) security proofs. We apply the tools to provide security proofs for several protocols, ranging from discrete variable protocols in high dimensions, protocols with realistic implementations, measurement device independent QKD and continuous-variable QKD. The security proofs are based on the Devetak-Winter security framework [I. Devetak and A. Winter, Proc. of the Roy. Soc. of London Series A, 461, 207 (2005); B. Kraus, N. Gisin, and R. Renner, Phys. Rev. Lett., 95 080501 (2005)]. \n \nIn the key rate calculation, it is often convenient to assume that the optimal attack is symmetric. \nUnder the assumption that the parameter estimation is based on coarse-grained observations, we show that the optimal attack is symmetric, if the protocol and the postselection have sufficient symmetries. \nAs an example we calculate the key rates of protocols using 2, d and d+1 mutually unbiased bases in d-dimensional Hilbert spaces. \n \nWe investigate the connection between the optimal collective eavesdropping attack and the optimal cloning attack, in which the eavesdropper employs an optimal cloner to attack the protocol. \nWe find that, in general, it does not hold that the optimal attack is an optimal cloner. However, there are classes of protocols, for which we can identify the optimal attack by an optimal cloner. \nWe analyze protocols with mutually unbiased bases in d dimensions, and show that for the protocols with 2 and d+1 mutually unbiased bases the optimal attack is an optimal cloner, but for the protocols with d mutually unbiased bases, it is not. \n \nIn optical implementations of the phase-encoded BB84 protocol, the bit information is usually encoded in the phase of two consecutive photon pulses generated in a Mach-Zehnder interferometer. In the actual experimental realization, the loss in the arms of the Mach-Zehnder interferometer is not balanced, for example because only one arm contains a lossy phase modulator. \nSince the imbalance changes the structure of the signals states and measurements, the BB84 security analysis no longer applies in this scenario. \nWe provide a security proof for the unbalanced phase-encoded BB84. The loss does lower the key rate compared to a protocol without loss. However, for a realistic parameter regime, the same key rate is found by applying the original BB84 security analysis. \n \nRecently, the security of a measurement device-independent QKD setup with BB84 signal states was proven in Refs. [H.-K. Lo, M. Curty, and B. Qi, Phys. Rev. Lett., 108 (2012); S. L. Braunstein and S. Pirandola, Phys. Rev. Lett., 108 (2012)]. In this setup Alice and Bob send quantum states to an intermediate node, which performs the measurement, and is assumed to be controlled by Eve. \nWe analyze the security of a measurement device-independent QKD protocol with B92 signal states, and calculate the key rates numerically for a realistic implementation. \nBased on our security proof we were able to prove the security of the strong reference pulse B92 protocol. \n \nWe analyze the security of continuous-variable protocols using the entropic uncertainty relations established in Ref. [M. Berta, M. Christandl, R. Colbeck, J. M. Renes, and R. Renner, Nature Physics 6, 659 (2010)] to provide an estimate of the key rate based on the observed first and second moments. We analyze a protocol with squeezed coherent states and the 2-state protocol with two coherent states with opposite phases.
Employing the fundamental laws of quantum physics, Quantum Key Distribution (QKD) promises the unconditionally secure distribution of cryptographic keys. However, in practical realisations, a QKD protocol is only secure, when the quantum bit error rate introduced by an eavesdropper unavoidably exceeds the system error rate. This condition guarantees that an eavesdropper cannot disguise his presence by simply replacing the original transmission line with a less faulty one. Unfortunately, this condition also limits the possible distance between the communicating parties, Alice and Bob, to a few hundred kilometers. To overcome this problem, we design a QKD protocol which allows Alice and Bob to distinguish system errors from eavesdropping errors. If they are able to identify the origin of their errors, they can detect eavesdropping even when the system error rate exceeds the eavesdropping error rate. To achieve this, the proposed protocol employs an alternative encoding of information in two-dimensional photon states. Errors manifest themselves as quantum bit and as index transmission errors with a distinct correlation between them in case of intercept-resend eavesdropping. As a result, Alice and Bob can tolerate lower eavesdropping and higher system error rates without compromising their privacy.