Quantum key distribution (QKD) is poised to be the first widespread implementation of quantum communication. In principle, it offers unconditional security: an eavesdropper introduces errors and thus cannot remain concealed from the legitimate parties. However, in practical implementations the actual security depends on a host of technological and protocol-operational components. We propose and experimentally demonstrate a hack to induce a large and deterministic temporal efficiency mismatch between the two detectors of Clavis2, a commercial QKD system from ID Quantique.
Quantum key distribution (QKD) is poised to be the first widespread implementation of quantum communication. In principle, it offers unconditional security: an eavesdropper introduces errors and thus cannot remain concealed from the legitimate parties. However, in practical implementations the actual security depends on a host of technological and protocol-operational components. We propose and experimentally demonstrate a hack to induce a large and deterministic temporal efficiency mismatch between the two detectors of Clavis2, a commercial QKD system from ID Quantique.
In theory, quantum key distribution (QKD) offers unconditional security based on the laws of physics. However, as demonstrated in recent quantum hacking theory and experimental papers, detection efficiency loophole can be fatal to the security of practical QKD systems. Here, we describe the physical origin of detection efficiency mismatch in various domains including spatial, spectral, and time domains and in various experimental set-ups. More importantly, we prove the unconditional security of QKD even with detection efficiency mismatch. We explicitly show how the key generation rate is characterized by the maximal detection efficiency ratio between the two detectors. Furthermore, we prove that by randomly switching the bit assignments of the detectors, the effect of detection efficiency mismatch can be completely eliminated.
We report several vulnerabilities found in Clavis2, the flagship quantum key distribution (QKD) system from ID Quantique. We show the hacking of a calibration sequence run by Clavis2 to synchronize the Alice and Bob devices before performing the secret key exchange. This hack induces a temporal detection efficiency mismatch in Bob that can allow Eve to break the security of the cryptosystem using faked states. We also experimentally investigate the superlinear behaviour in the single-photon detectors (SPDs) used by Bob. Due to this superlinearity, the SPDs feature an actual multi-photon detection probability which is generally higher than the theoretically-modelled value. We show how this increases the risk of detector control attacks on QKD systems (including Clavis2) employing such SPDs. Finally, we review the experimental feasibility of Trojan-horse attacks. In the case of Clavis2, the objective is to read Bob's phase modulator to acquire knowledge of his basis choice as this information suffices for constructing the raw key in the Scarani-Acin-Ribordy-Gisin 2004 (SARG04) protocol. We work in close collaboration with ID Quantique and for all these loopholes, we notified them in advance. Wherever possible, we or ID Quantique proposed countermeasures and they implemented suitable patches and upgrade their systems.
In theory, quantum key distribution (QKD) offers unconditional security based on the laws of physics. However, as demonstrated in recent quantum hacking theory and experimental papers, detection efficiency loophole can be fatal to the security of practical QKD systems. Here, we describe the physical origin of detection efficiency mismatch in various domains including spatial, spectral, and time domains and in various experimental set-ups. More importantly, we prove the unconditional security of QKD even with detection efficiency mismatch. We explicitly show how the key generation rate is characterized by the maximal detection efficiency ratio between the two detectors. Furthermore, we prove that by randomly switching the bit assignments of the detectors, the effect of detection efficiency mismatch can be completely eliminated.
The rules of quantum mechanics makes it possible to exchange a secret key at a distance. This is called quantum key distribution (QKD). In theory the key exchange can be made completely secure. Real QKD implementations however, has numerous imperfections. Luckily one has also been able to prove the security of QKD with a large variety of imperfections. The field of QKD has matured over the recent years, and it has now reached commercial applications with photons as the quantum bits, and optical fibers as the quantum channel. Today there are at least three commercial vendors of QKD-systems. We live in the times of quantum hacking. Researchers has begun the task of breaking the security of QKD-systems. Many new imperfections has been discovered, some of which might be used to break the security of QKD. This thesis is a study of the detector efficiency mismatch loophole. Most QKD-systems require two detectors, and it is virtually impossible to make two identical detectors with the exact same efficiency. What is worse, it turns out that the eavesdropper can often control the relative efficiencies of the two detectors trough some domain, for instance by controlling the timing, the frequency or the spacial mode of the photons. This can in turn be used by the eavesdropper to gain information about the secret key. Previously the best known attack would compromise security if the detector efficiency mismatch of about 1:15. Here the current attacks on systems with detector efficiency mismatch are improved to compromise security for a mismatch of about 1:4. This is less than the mismatch found in a commercial QKD-system, so the attack could in principle be used to eavesdrop on this QKD-system. One might try to close the loophole by modifying the implementation. One suggestion is the four state Bob. The problem is that this patch will in turn open other loopholes, and one of these loopholes reopen the detector efficiency mismatch loophole. One can remove Eves information about the key by doing a sufficient amount of extra privacy amplification. Here a general security bound is presented, quantifying the required amount of extra privacy amplification to remove Eve's information about the key. The proof is more general than the previous security proof, and is valid for any basis dependent, possibly lossy, linear optical imperfections in the channel and receiver/detectors. Since this is more realistic assumptions for a QKD-implementation, the proof represents a major step of closing the loophole in real devices.
In theory, quantum key distribution (QKD) offers unconditional security based on the laws of physics. However, as demonstrated in recent quantum hacking theory and experimental papers, detection efficiency loophole can be fatal to the security of practical QKD systems. Here, we describe the physical origin of detection efficiency mismatch in various domains including spatial, spectral, and time domains and in various experimental set-ups. More importantly, we prove the unconditional security of QKD even with detection efficiency mismatch. We explicitly show how the key generation rate is characterized by the maximal detection efficiency ratio between the two detectors. Furthermore, we prove that by randomly switching the bit assignments of the detectors, the effect of detection efficiency mismatch can be completely eliminated.
We demonstrate a practical countermeasure against a well-known class of attacks on quantum key distribution (QKD) systems that exploit detection efficiency mismatch, where the receiver's detectors do not exhibit identical responses to incoming photons across all degrees of freedom. This class of quantum hacking strategies is broad and significantly includes the time-shift attack, which targets an arrival-time-dependent side channel at the receiver. The four-state countermeasure, previously only proven to be secure in theory, is implemented here on a GHz-clocked prototype QKD system and evaluated for its security and performance. We show that its presence enables almost complete recovery of the system's ideal secret key rate. Our results provide strong justification for adopting this countermeasure as a standard component in future scalable and practical QKD systems.