We report several vulnerabilities found in Clavis2, the flagship quantum key distribution (QKD) system from ID Quantique. We show the hacking of a calibration sequence run by Clavis2 to synchronize the Alice and Bob devices before performing the secret key exchange. This hack induces a temporal detection efficiency mismatch in Bob that can allow Eve to break the security of the cryptosystem using faked states. We also experimentally investigate the superlinear behaviour in the single-photon detectors (SPDs) used by Bob. Due to this superlinearity, the SPDs feature an actual multi-photon detection probability which is generally higher than the theoretically-modelled value. We show how this increases the risk of detector control attacks on QKD systems (including Clavis2) employing such SPDs. Finally, we review the experimental feasibility of Trojan-horse attacks. In the case of Clavis2, the objective is to read Bob's phase modulator to acquire knowledge of his basis choice as this information suffices for constructing the raw key in the Scarani-Acin-Ribordy-Gisin 2004 (SARG04) protocol. We work in close collaboration with ID Quantique and for all these loopholes, we notified them in advance. Wherever possible, we or ID Quantique proposed countermeasures and they implemented suitable patches and upgrade their systems.
We report several vulnerabilities found in Clavis2, the flagship quantum key distribution (QKD) system from ID Quantique. We show the hacking of a calibration sequence run by Clavis2 to synchronize the Alice and Bob devices before performing the secret key exchange. This hack induces a temporal detection efficiency mismatch in Bob that can allow Eve to break the security of the cryptosystem using faked states. We also experimentally investigate the superlinear behaviour in the single-photon detectors (SPDs) used by Bob. Due to this superlinearity, the SPDs feature an actual multi-photon detection probability which is generally higher than the theoretically-modelled value. We show how this increases the risk of detector control attacks on QKD systems (including Clavis2) employing such SPDs. Finally, we review the experimental feasibility of Trojan-horse attacks. In the case of Clavis2, the objective is to read Bob's phase modulator to acquire knowledge of his basis choice as this information suffices for constructing the raw key in the Scarani-Acin-Ribordy-Gisin 2004 (SARG04) protocol. We work in close collaboration with ID Quantique and for all these loopholes, we notified them in advance. Wherever possible, we or ID Quantique proposed countermeasures and they implemented suitable patches and upgrade their systems.
A quantum key distribution (QKD) system may be probed by an eavesdropper Eve by sending in bright light from the quantum channel and analyzing the back-reflections. We propose and experimentally demonstrate a setup for mounting such a Trojan-horse attack. We show it in operation against the quantum cryptosystem Clavis2 from ID Quantique, as a proof-of-principle. With just a few back-reflected photons, Eve discerns Bobʼs (secret) basis choice, and thus the raw key bit in the Scarani–Acín–Ribordy–Gisin 2004 protocol, with higher than 90% probability. This would clearly breach the security of the cryptosystem. Unfortunately, Eveʼs bright pulses have a side effect of causing a high level of afterpulsing in Bobʼs single-photon detectors, resulting in a large quantum bit error rate that effectively protects this system from our attack. However, in a Clavis2-like system equipped with detectors with less-noisy but realistic characteristics, an attack strategy with positive leakage of the key would exist. We confirm this by a numerical simulation. Both the eavesdropping setup and strategy can be generalized to attack most of the current QKD systems, especially if they lack proper safeguards. We also propose countermeasures to prevent such attacks.
We demonstrate the experimental feasibility of a Trojan-horse attack that remains nearly invisible to the single-photon detectors employed in practical quantum key distribution (QKD) systems, such as Clavis2 from ID Quantique. We perform a detailed numerical comparison of the attack performance against Scarani-Ac´ın-Ribordy-Gisin (SARG04) QKD protocol at 1924 nm versus that at 1536 nm. The attack strategy was proposed earlier but found to be unsuccessful at the latter wavelength, as reported in N. Jain et al., New J. Phys. 16, 123030 (2014). However at 1924 nm, we show experimentally that the noise response of the detectors to bright pulses is greatly reduced, and show by modeling that the same attack will succeed. The invisible nature of the attack poses a threat to the security of practical QKD if proper countermeasures are not adopted.
The security of quantum communication using a weak coherent source requires an accurate knowledge of the source's mean photon number. Finite calibration precision or an active manipulation by an attacker may cause the actual emitted photon number to deviate from the known value. We model effects of this deviation on the security of three quantum communication protocols: the Bennett-Brassard 1984 (BB84) quantum key distribution (QKD) protocol without decoy states, Scarani-Ac\'{\i}n-Ribordy-Gisin 2004 (SARG04) QKD protocol, and a coin-tossing protocol. For QKD we model both a strong attack using technology possible in principle and a realistic attack bounded by today's technology. To maintain the mean photon number in two-way systems, such as plug-and-play and relativistic quantum cryptography schemes, bright pulse energy incoming from the communication channel must be monitored. Implementation of a monitoring detector has largely been ignored so far, except for ID Quantique's commercial QKD system Clavis2. We scrutinize this implementation for security problems and show that designing a hack-proof pulse-energy-measuring detector is far from trivial. Indeed, the first implementation has three serious flaws confirmed experimentally, each of which may be exploited in a cleverly constructed Trojan-horse attack. We discuss requirements for a loophole-free implementation of the monitoring detector.
Quantum cryptography, or, more precisely, quantum key distribution (QKD) allows two distant parties, Alice and Bob, to expand a previously shared secret key by sending quantum states through a quantum channel. The goal here is for Alice and Bob to communicate securely in the presence of an eavesdropper, Eve. The most well-known QKD protocol is the Bennett-Brassard 1984 (BB84) protocol, which has been proved unconditionally secure against any attacks allowed by quantum mechanics. The main advantage of QKD over conventional cryptography is its absolute security. Thus, it is imperative to evaluate the security and performance of QKD protocols and realistic QKD systems. In this thesis, we study the security and performance aspects of QKD in four parts. In the first part, we study the Scarani-Acin-Ribordy-Gisin 2004 (SARG04) protocol. This protocol differs from the BB84 protocol only in the classical post-processing step and uses the same four quantum states as the BB84 protocol. We compared these two protocols and showed that in typical situations, the classical post-processing software for BB84 should be used in order to have a higher performance. In the second part, we prove the security of a three-state protocol. This protocol is similar to the BB84 protocol in that they share the same three qubit states. In the third part, we consider a practical Trojan horse attack on practical QKD systems implementing the BB84 protocol. The attack works by taking advantage of the finite response time of practical phase modulators to remap the states sent out by the legitimate user, Alice. We showed that if Alice and Bob are unaware of our attack, the final key shared between them can be compromised in some situations. In the fourth part, we consider another type of Trojan horse attack, which is based on mismatch between detection efficiencies of detectors. Practical detectors in QKD systems usually do not have identical efficiencies and an eavesdropper Eve may be able to exploit this efficiency mismatch to steal information about the final secret key. We analyze the security of the attack and show that it is possible for Eve to acquire some information on the final secret key if Alice and Bob are unaware of this attack.
Quantum key distribution (QKD) is poised to be the first widespread implementation of quantum communication. In principle, it offers unconditional security: an eavesdropper introduces errors and thus cannot remain concealed from the legitimate parties. However, in practical implementations the actual security depends on a host of technological and protocol-operational components. We propose and experimentally demonstrate a hack to induce a large and deterministic temporal efficiency mismatch between the two detectors of Clavis2, a commercial QKD system from ID Quantique.
The rules of quantum mechanics makes it possible to exchange a secret key at a distance. This is called quantum key distribution (QKD). In theory the key exchange can be made completely secure. Real QKD implementations however, has numerous imperfections. Luckily one has also been able to prove the security of QKD with a large variety of imperfections. The field of QKD has matured over the recent years, and it has now reached commercial applications with photons as the quantum bits, and optical fibers as the quantum channel. Today there are at least three commercial vendors of QKD-systems. We live in the times of quantum hacking. Researchers has begun the task of breaking the security of QKD-systems. Many new imperfections has been discovered, some of which might be used to break the security of QKD. This thesis is a study of the detector efficiency mismatch loophole. Most QKD-systems require two detectors, and it is virtually impossible to make two identical detectors with the exact same efficiency. What is worse, it turns out that the eavesdropper can often control the relative efficiencies of the two detectors trough some domain, for instance by controlling the timing, the frequency or the spacial mode of the photons. This can in turn be used by the eavesdropper to gain information about the secret key. Previously the best known attack would compromise security if the detector efficiency mismatch of about 1:15. Here the current attacks on systems with detector efficiency mismatch are improved to compromise security for a mismatch of about 1:4. This is less than the mismatch found in a commercial QKD-system, so the attack could in principle be used to eavesdrop on this QKD-system. One might try to close the loophole by modifying the implementation. One suggestion is the four state Bob. The problem is that this patch will in turn open other loopholes, and one of these loopholes reopen the detector efficiency mismatch loophole. One can remove Eves information about the key by doing a sufficient amount of extra privacy amplification. Here a general security bound is presented, quantifying the required amount of extra privacy amplification to remove Eve's information about the key. The proof is more general than the previous security proof, and is valid for any basis dependent, possibly lossy, linear optical imperfections in the channel and receiver/detectors. Since this is more realistic assumptions for a QKD-implementation, the proof represents a major step of closing the loophole in real devices.