Practical security of quantum cryptography

Lars Lydersen

Published Jan 1, 2011• 4 citations

Abstract

The peculiar properties of quantum mechanics enable possibilities not allowed by classical physics. In particular, two parties can generate a random, secret key at a distance, even though an eavesdropper can do anything permitted by the laws of physics. Measuring the quantum properties of the signals generating the key, would ultimately change them, and thus reveal the eavesdropper’s presence. This exchange of a random, secret key is known as quantum cryptography.\n\nQuantum cryptography can be, and has been proven unconditionally secure using perfect devices. However, when quantum cryptography is implemented, one must use components available with current technology. These are usually imperfect. Although the security of quantum cryptography has been proven for components with certain imperfections, the question remains: can quantum cryptography be implemented in a provable, unconditionally secure way, using components available with current technology? This thesis contains both a theoretical, and an experimental contribution to the answer of this question. On the experimental side, components used in, and complete quantum cryptography systems have been carefully examined for security loopholes. In particular, it turned out that two commercial quantum cryptography systems contained loopholes, which would allow an eavesdropper to capture the full secret key, without exposing her presence. Furthermore, this detector control attack could be implemented with current technology. The attack is applicable against a variety of quantum cryptography implementations and protocols.\n\nThe theoretical contribution consists of security proofs for quantum cryptography in a very general setting. Precisely, the security is proven with arbitrary individual imperfections in the source and detectors. These proofs should make it possible to use a wide array of imperfect devices in implementations of quantum cryptography.\n\nFinally, a secure detection scheme is proposed, immune to the detector control attack and compatible with those security proofs. Therefore, if this scheme is implemented correctly, it offers provable security.

Related papers

How secure is quantum cryptography

Mario Stipčević

In 1991 scientists have for the first time demonstrated practical quantum cryptography (QC) and given a proof of its unconditional security against two most obvious attacking strategies. In the next decade several groups of scientists have made more stringent security proofs and it was soon widely accepted that quantum cryptographic protocol BB84 and its variants are the only known protocols that allow unconditionally secure key growth. Moreover, QC was able to offer unique possibility that any eavesdropping activity could be detected by legitimate parties. In 2004 Swiss spin-off IdQuantique has shown the world's first commercial quantum key distribution system Clavis, followed soon by the QPN system of American start-up Magiq. For almost 7 years nobody suspected that there might be something terribly wrong with these systems. Then, at the end of 2010, a group of Norwegian scientists experimenting with attacks on photon detectors constructed tailored attacks to both commercial systems which were so successful that the plaintext was recovered in full (100%) and moreover the legitimate parties could not detect any suspicious activity ! This raised the question: where does it leave us with quantum cryptography, is it secure or not? What about the security proofs, were they wrong? Our conclusion is that security proofs were correct except that they proved security of something else - not the machines that were cracked. At present state of the art it is not clear how or is it even possible to build a provable QC machine.

International Convention on Information and Communication Technology, Electronics and MicroelectronicsMay 21, 20120 citations

Quantum cryptography in real-life applications: assumptions and security

Yi Bing Zhao

Quantum cryptography, or quantum key distribution (QKD), provides a means of unconditionally secure communication. The security is in principle based on the fundamental laws of physics. Security proofs show that if quantum cryptography is appropriately implemented, even the most powerful eavesdropper cannot decrypt the message from a cipher. The implementations of quantum crypto-systems in real life may not fully comply with the assumptions made in the security proofs. Such discrepancy between the experiment and the theory can be fatal to the security of a QKD system. In this thesis we address a number of these discrepancies. A perfect single-photon source is often assumed in many security proofs. However, a weak coherent source is widely used in a real-life QKD implementation. Decoy state protocols have been proposed as a novel approach to dramatically improve the performance of a weak coherent source based QKD implementation without jeopardizing its security. Here, we present the first experimental demonstrations of decoy state protocols. Our experimental scheme was later adopted by most decoy state QKD implementations. In the security proof of decoy state protocols as well as many other QKD protocols, it is widely assumed that a sender generates a phase-randomized coherent state. This assumption has been enforced in few implementations. We close this gap in two steps: First, we implement and verify the phase randomization experimentally; second, we prove the security of a QKD implementation without the coherent state assumption. In many security proofs of QKD, it is assumed that all the detectors on the receiver's side have identical detection efficiencies. We show experimentally that this assumption may be violated in a commercial QKD implementation due to an eavesdropper's malicious manipulation. Moreover, we show that the eavesdropper can learn part of the final key shared by the legitimate users as a consequence of this violation of the assumptions.

Jan 1, 20093 citations

Quantum Cryptography: From Theory to Practice

Xiongfeng Ma

Quantum cryptography or quantum key distribution (QKD) applies fundamental laws of quantum physics to guarantee secure communication. The security of quantum cryptography was proven in the last decade. Many security analyses are based on the assumption that QKD system components are idealized. In practice, inevitable device imperfections may compromise security unless these imperfections are well investigated.\n\nA highly attenuated laser pulse which gives a weak coherent state is widely used in QKD experiments. A weak coherent state has multi-photon components, which opens up a security loophole to the sophisticated eavesdropper. With a small adjustment of the hardware, we will prove that the decoy state method can close this loophole and substantially improve the QKD performance. We also propose a few practical decoy state protocols, study statistical fluctuations and perform experimental demonstrations. Moreover, we will apply the methods from entanglement distillation protocols based on two-way classical communication to improve the decoy state QKD performance. Furthermore, we study the decoy state methods for other single photon sources, such as triggering parametric down-conversion (PDC) source. Note that our work, decoy state protocol, has attracted a lot of scientific and media interest. The decoy state QKD becomes a standard technique for prepare-and-measure QKD schemes.\n\nAside from single-photon-based QKD schemes, there is another type of scheme based on entangled photon sources. A PDC source is commonly used as an entangled photon source. We propose a model and post-processing scheme for the entanglement-based QKD with a PDC source. Although the model is proposed to study the entanglement-based QKD, we emphasize that our generic model may also be useful for other non-QKD experiments involving a PDC source. By simulating a real PDC experiment, we show that the entanglement-based QKD can achieve longer maximal secure distance than the single-photon-based QKD schemes.\n\nWe propose a time-shift attack that exploits the efficiency mismatch of two single photon detectors in a QKD system. This eavesdropping strategy can be realized by current technology. We will also discuss counter measures against the attack and study the security of a QKD system with efficiency mismatch detectors.

Feb 26, 200921 citations

Assumptions in Quantum Cryptography

Normand J. Beaudry

Quantum cryptography uses techniques and ideas from physics and computer science. The combination of these ideas makes the security proofs of quantum cryptography a complicated task. To prove that a quantum-cryptography protocol is secure, assumptions are made about the protocol and its devices. If these assumptions are not justified in an implementation then an eavesdropper may break the security of the protocol. Therefore, security is crucially dependent on which assumptions are made and how justified the assumptions are in an implementation of the protocol. This thesis is primarily a review that analyzes and clarifies the connection between the security proofs of quantum-cryptography protocols and their experimental implementations. In particular, we focus on quantum key distribution: the task of distributing a secret random key between two parties. We provide a comprehensive introduction to several concepts: quantum mechanics using the density operator formalism, quantum cryptography, and quantum key distribution. We define security for quantum key distribution and outline several mathematical techniques that can either be used to prove security or simplify security proofs. In addition, we analyze the assumptions made in quantum cryptography and how they may or may not be justified in implementations. Along with the review, we propose a framework that decomposes quantum-key-distribution protocols and their assumptions into several classes. Protocol classes can be used to clarify which proof techniques apply to which kinds of protocols. Assumption classes can be used to specify which assumptions are justified in implementations and which could be exploited by an eavesdropper. Two contributions of the author are discussed: the security proofs of two two-way quantum-key-distribution protocols and an intuitive proof of the data-processing inequality.

arXiv:1505.02792Jan 1, 20147 citations

Quantum cryptography

Jonathan A. Jones, Dieter Jaksch

Cryptographic protocols can be classified by the type of security against eavesdropping which they provide. There exist mathematically secure schemes whose security relies on mathematical proofs (like the Vernam cipher discussed below) or conjectures (like public key RSA encryption) about the complexity of deciphering the message without possessing the correct key. The majority of current secure public Internet connections rely on such schemes. Alternatively, a cryptographic setup may provide a physically secure method for communicating. In these setups the security is provided by the physical laws governing the communication protocol. Here we first discuss a provably secure classical communication protocol and then quantum methods for distributing the necessary keys. The BB84 protocol relies on the impossibility of perfectly distinguishing non-orthogonal quantum states from one copy of the quantum system. The scheme was invented in 1984 and is the first of its kind. In contrast, the Ekert91 protocol makes use of Bell correlations between entangled pairs of photons. These correlations are destroyed when Eve attempts to make a measurement on one of the particles but also when imperfections, such as decoherence processes, affect the scheme. As long as no such “elements of reality” are introduced, and Bell correlations violating local realism can be generated by Alice and Bob, no eavesdropper can be present. One-time pads and the Vernam cipher The Vernam cipher is a cryptographic protocol which allows the encryption and decryption protocol to be publicly known. The security of the protocol relies entirely on the key which is private and not publicly known. Alice and Bob share identical n -bit secret key strings (one-time pad).

Cambridge University Press eBooksJul 19, 20120 citations

Implementation vulnerabilities in general quantum cryptography

Anqi Huang, Stefanie Barz, Erika Andersson +1 more

Quantum cryptography is information-theoretically secure owing to its solid basis in quantum mechanics. However, generally, initial implementations with practical imperfections might open loopholes, allowing an eavesdropper to compromise the security of a quantum cryptographic system. This has been shown to happen for quantum key distribution (QKD). Here we apply experience from implementation security of QKD to several other quantum cryptographic primitives. We survey quantum digital signatures, quantum secret sharing, source-independent quantum random number generation, quantum secure direct communication, and blind quantum computing. We propose how the eavesdropper could in principle exploit the loopholes to violate assumptions in these protocols, breaking their security properties. Applicable countermeasures are also discussed. It is important to consider potential implementation security issues early in protocol design, to shorten the path to future applications.

arXiv:1805.06668New Journal of PhysicsAug 31, 201862 citations