Challenges
Datasets
Workspaces
Papers
Discussions
Leaderboard
Log inSign up
Challenges
Datasets
Workspaces
Papers
Discussions
Leaderboard
Blog
Job Board
Q3AS

© 2026 Aqora Quantum S.A.S.

TermsPrivacyLegal Notice

arXiv:2202.06630 · Quantum Science and Technology

Improved finite-key security analysis of quantum key distribution against Trojan-horse attacks

Álvaro Navarrete, Marcos Curty

Published May 31, 2022• 33 citations
arXivHTMLPDF

Abstract

Abstract Most security proofs of quantum key distribution (QKD) disregard the effect of information leakage from the users’ devices, and, thus, do not protect against Trojan-horse attacks (THAs). In a THA, the eavesdropper injects strong light into the QKD apparatuses, and then analyzes the back-reflected light to learn information about their internal setting choices. Only a few recent works consider this security threat, but predict a rather poor performance of QKD unless the devices are strongly isolated from the channel. Here, we derive finite-key security bounds for decoy-state-based QKD schemes in the presence of THAs, which significantly outperform previous analyses. Our results constitute an important step forward to closing the existing gap between theory and practice in QKD.

DOI
10.1088/2058-9565/ac74dc

Related papers

Improved Finite-Key Security Analysis of Measurement-Device-Independent Quantum Key Distribution Against a Trojan-Horse Attack

Hua-Jian Ding, Jing-Yang Liu, Xingyu Zhou +3 more

Measurement-device-independent quantum key distribution (MDI QKD) is a promising method for remote key sharing that can eliminate all detector side-channel attacks. However, current security proofs often overlook the potential information leakages from the legitimate users' devices. In a quantum version of Trojan-horse attack (THA), a malicious eavesdropper can inject bright light into the sources of a MDI QKD system and then analyze the back-reflected light to obtain their setting choices, thereby compromising the final security. Here, we derive the finite-key security bounds of decoy-state MDI QKD in the presence of THA, which significantly outperform previous analyses in terms of the secret-key rate and transmission distance. Specifically, we analyze a symmetric three-intensity decoy-state MDI QKD protocol and an efficient four-intensity decoy-state MDI QKD protocol. Our results represent a fundamental step in guaranteeing the implementation security of quantum communication systems.

Physical Review Applied•Apr 7, 2023•13 citations

Finite-key security analysis against the Trojan-horse attack on practical reference-frame-independent measurement-device-independent quantum key distribution

Yang Zhou, Hua-Jian Ding, Jing-Yang Liu +3 more

Reference-frame-independent measurement-device-independent quantum key distribution (RFI MDI QKD) can resist side-channel attacks against detectors and slow variations of reference frames, thus presenting an advantageous approach for long-distance secure quantum communication. Nevertheless, if an eavesdropper implements a Trojan-horse attack (THA) by injecting bright light into sources, the back-reflected light may carry encoding information into the channel, thereby causing serious information leakage. In this paper, we theoretically evaluate the finite-key security of decoy-state RFI MDI QKD against a THA by employing the reference-state technique and a particular concentration inequality. Additionally, dual-parameter optimization and multibasis-estimation strategies are introduced to reduce statistical fluctuations effectively. Our work demonstrates that RFI MDI QKD can maintain a better performance even in the presence of large reference-frame drifts and a THA, representing a key advancement in strengthening the security of quantum communication in real-world implementations.

Physical Review Applied•Feb 4, 2025•3 citations

Security analysis against the Trojan horse attack on practical polarization-encoding quantum key distribution systems

Tingting Luo, Qiang Liu, Xiaoran Sun +4 more

Quantum key distribution (QKD), which theoretically provides unconditional secure communication, has developed rapidly in the past decades. However, the practical QKD systems still have vulnerabilities due to device imperfections. Polarization-encoding systems are one of the most important branches in the field of QKD. To date, a variety of polarization-encoding schemes have been proposed to meet the requirements of high speed and robust modulation, but the security analysis of these schemes is often ignored. In this paper, we experimentally and theoretically evaluated the security of three typical polarization encoders against the Trojan horse attack (THA), which is recognized as one of the critical quantum attacks. We built a system to implement the THA and collected the reflection from QKD configuration with different encoders. According to the experimental results, we further analyzed the secure key rate and the resistance against THAs of the system while BB84 or measurement-device-independent QKD was applied. Our paper plays an important guiding role in the design of polarization encoders and the construction of secure QKD systems with realistic devices.

Physical Review A•Apr 3, 2024•11 citations

Security against Trojan-horse attacks on a self-compensating all-fiber polarization modulator

Alberto De Toni, Aynur Cemre Aka, Costantino Agnesi +3 more

Quantum key distribution (QKD) leverages the principles of quantum mechanics to exchange a secret key between two parties. Unlike classical cryptographic systems, the security of QKD is not reliant on computational assumptions but is instead rooted in the fundamental laws of physics. In a QKD protocol, any attempt by an eavesdropper to intercept the key is detectable: this provides an unprecedented level of security, making QKD an attractive solution for secure communication in an era increasingly threatened by the advent of quantum computers and their potential to break classical cryptographic systems. However, QKD also faces several practical challenges such as transmission loss and noise in quantum channels, finite key size effects, and implementation flaws in QKD devices. Addressing these issues is crucial for the large-scale deployment of QKD and the realization of a global quantum Internet. A whole body of research is dedicated to the hacking of the quantum state source, for example using (THAs), where the eavesdropper injects light into the system and analyzes the back-reflected signal. In this paper, we study the vulnerabilities against THAs of the iPOGNAC encoder, first introduced in [M. Avesani , ], to propose adapted countermeasures that can mitigate such attacks.

arXiv:2510.16868•Physical Review A•Apr 22, 2026•0 citations

Trojan-horse attack on a real-world quantum key distribution system: Theoretical and experimental security analysis

Ivan S. Sushchev, Daniil S. Bulavkin, Kirill E. Bugai +2 more

This paper presents a theoretical and experimental demonstration of a security analysis of a Trojan-horse attack (THA) on a real-world quantum key distribution (QKD) system. We show that the upper bound on the information leakage depends solely on the fidelity between the states of the adversary. We find the lower bound for fidelity between THA states in both the polarization- and phase-coding BB84 protocols, considering both pure and mixed states. Our bounds depend only on the mean photon number per pulse available to an adversary. We also present an experimental analysis of a QKD system, including optical time-domain reflectometry measurements with centimeter resolution and spectral transmittance measurements for optical defense elements ranging from 1100 to 1800 nm with a noise floor lower than − 100 dB. Finally, by considering the optimal attack, we obtain the value of the mean photon number per pulse available to an adversary and calculate the key leakage that needs to be eliminated during the privacy amplification procedure. Published by the American Physical Society 2024

Physical Review Applied•Sep 12, 2024•20 citations

Practical Security Bounds Against the Trojan-Horse Attack in Quantum Key Distribution

Marco Lucamarini, I. Choi, M. B. Ward +3 more

In the quantum version of a Trojan-horse attack, photons are injected into the optical modules of a quantum key distribution system in an attempt to read information direct from the encoding devices.To stop the Trojan photons, the use of passive optical components has been suggested.However, to date, there is no quantitative bound that specifies such components in relation to the security of the system.Here, we turn the Trojan-horse attack into an information leakage problem.This allows us to quantify the system security and relate it to the specification of the optical elements.The analysis is supported by the experimental characterization, within the operation regime, of reflectivity and transmission of the optical components most relevant to security.

arXiv:1506.01989•Physical Review X•Sep 9, 2015•175 citations
Abstract Most security proofs of quantum key distribution (QKD) disregard the effect of information leakage from the users’ devices, and, thus, do not protect against Trojan-horse attacks (THAs). In a THA, the eavesdropper injects strong light into the QKD apparatuses, and then analyzes the back-reflected light to learn information about their internal setting choices. Only a few recent works consider this security threat, but predict a rather poor performance of QKD unless the devices are strongly isolated from the channel. Here, we derive finite-key security bounds for decoy-state-based QKD schemes in the presence of THAs, which significantly outperform previous analyses. Our results constitute an important step forward to closing the existing gap between theory and practice in QKD.
Measurement-device-independent quantum key distribution (MDI QKD) is a promising method for remote key sharing that can eliminate all detector side-channel attacks. However, current security proofs often overlook the potential information leakages from the legitimate users' devices. In a quantum version of Trojan-horse attack (THA), a malicious eavesdropper can inject bright light into the sources of a MDI QKD system and then analyze the back-reflected light to obtain their setting choices, thereby compromising the final security. Here, we derive the finite-key security bounds of decoy-state MDI QKD in the presence of THA, which significantly outperform previous analyses in terms of the secret-key rate and transmission distance. Specifically, we analyze a symmetric three-intensity decoy-state MDI QKD protocol and an efficient four-intensity decoy-state MDI QKD protocol. Our results represent a fundamental step in guaranteeing the implementation security of quantum communication systems.
Reference-frame-independent measurement-device-independent quantum key distribution (RFI MDI QKD) can resist side-channel attacks against detectors and slow variations of reference frames, thus presenting an advantageous approach for long-distance secure quantum communication. Nevertheless, if an eavesdropper implements a Trojan-horse attack (THA) by injecting bright light into sources, the back-reflected light may carry encoding information into the channel, thereby causing serious information leakage. In this paper, we theoretically evaluate the finite-key security of decoy-state RFI MDI QKD against a THA by employing the reference-state technique and a particular concentration inequality. Additionally, dual-parameter optimization and multibasis-estimation strategies are introduced to reduce statistical fluctuations effectively. Our work demonstrates that RFI MDI QKD can maintain a better performance even in the presence of large reference-frame drifts and a THA, representing a key advancement in strengthening the security of quantum communication in real-world implementations.
Quantum key distribution (QKD), which theoretically provides unconditional secure communication, has developed rapidly in the past decades. However, the practical QKD systems still have vulnerabilities due to device imperfections. Polarization-encoding systems are one of the most important branches in the field of QKD. To date, a variety of polarization-encoding schemes have been proposed to meet the requirements of high speed and robust modulation, but the security analysis of these schemes is often ignored. In this paper, we experimentally and theoretically evaluated the security of three typical polarization encoders against the Trojan horse attack (THA), which is recognized as one of the critical quantum attacks. We built a system to implement the THA and collected the reflection from QKD configuration with different encoders. According to the experimental results, we further analyzed the secure key rate and the resistance against THAs of the system while BB84 or measurement-device-independent QKD was applied. Our paper plays an important guiding role in the design of polarization encoders and the construction of secure QKD systems with realistic devices.
Quantum key distribution (QKD) leverages the principles of quantum mechanics to exchange a secret key between two parties. Unlike classical cryptographic systems, the security of QKD is not reliant on computational assumptions but is instead rooted in the fundamental laws of physics. In a QKD protocol, any attempt by an eavesdropper to intercept the key is detectable: this provides an unprecedented level of security, making QKD an attractive solution for secure communication in an era increasingly threatened by the advent of quantum computers and their potential to break classical cryptographic systems. However, QKD also faces several practical challenges such as transmission loss and noise in quantum channels, finite key size effects, and implementation flaws in QKD devices. Addressing these issues is crucial for the large-scale deployment of QKD and the realization of a global quantum Internet. A whole body of research is dedicated to the hacking of the quantum state source, for example using (THAs), where the eavesdropper injects light into the system and analyzes the back-reflected signal. In this paper, we study the vulnerabilities against THAs of the iPOGNAC encoder, first introduced in [M. Avesani , ], to propose adapted countermeasures that can mitigate such attacks.
This paper presents a theoretical and experimental demonstration of a security analysis of a Trojan-horse attack (THA) on a real-world quantum key distribution (QKD) system. We show that the upper bound on the information leakage depends solely on the fidelity between the states of the adversary. We find the lower bound for fidelity between THA states in both the polarization- and phase-coding BB84 protocols, considering both pure and mixed states. Our bounds depend only on the mean photon number per pulse available to an adversary. We also present an experimental analysis of a QKD system, including optical time-domain reflectometry measurements with centimeter resolution and spectral transmittance measurements for optical defense elements ranging from 1100 to 1800 nm with a noise floor lower than − 100 dB. Finally, by considering the optimal attack, we obtain the value of the mean photon number per pulse available to an adversary and calculate the key leakage that needs to be eliminated during the privacy amplification procedure. Published by the American Physical Society 2024
In the quantum version of a Trojan-horse attack, photons are injected into the optical modules of a quantum key distribution system in an attempt to read information direct from the encoding devices.To stop the Trojan photons, the use of passive optical components has been suggested.However, to date, there is no quantitative bound that specifies such components in relation to the security of the system.Here, we turn the Trojan-horse attack into an information leakage problem.This allows us to quantify the system security and relate it to the specification of the optical elements.The analysis is supported by the experimental characterization, within the operation regime, of reflectivity and transmission of the optical components most relevant to security.