Gaps between industrial and academic solutions to implementation loopholes in QKD: testing random-detector-efficiency countermeasure in a commercial system
In the last decade, efforts have been made to reconcile theoretical security with realistic imperfect implementations of quantum key distribution (QKD). However, in the process gaps have recently emerged between academic and industrial approaches to closing loopholes created by implementation imperfections. In academic research labs, many practical security problems appear to be reliably solved, in principle, by advanced schemes and protocols. Meanwhile the industry prefers practical and easier solutions, even without security verification in some cases. In this paper, we present a concrete example of ID Quantique's random-detector-efficiency countermeasure against detector blinding attacks. As a third-party tester, we have found that the first industrial implementation of this countermeasure is effective against the original blinding attack, but not immune to a modified blinding attack. Moreover, we show experimentally that the full countermeasure as in academic proposal [C. C. W. Lim et al., IEEE J. Sel. Top. Quantum Electron. 21, 6601305 (2015)] is still vulnerable against the modified blinding attack. Our testing results show several specific disparities between the industrial practical solution and the academic perfect solutions. Our work illustrates that forming an implementation-and-testing closed loop is necessary to bridge the gaps and improve the practical security of QKD systems.
In the last decade, efforts have been made to reconcile theoretical security with realistic imperfect implementations of quantum key distribution (QKD). However, in the process gaps have recently emerged between academic and industrial approaches to closing loopholes created by implementation imperfections. In academic research labs, many practical security problems appear to be reliably solved, in principle, by advanced schemes and protocols. Meanwhile the industry prefers practical and easier solutions, even without security verification in some cases. In this paper, we present a concrete example of ID Quantique's random-detector-efficiency countermeasure against detector blinding attacks. As a third-party tester, we have found that the first industrial implementation of this countermeasure is effective against the original blinding attack, but not immune to a modified blinding attack. Moreover, we show experimentally that the full countermeasure as in academic proposal [C. C. W. Lim et al., IEEE J. Sel. Top. Quantum Electron. 21, 6601305 (2015)] is still vulnerable against the modified blinding attack. Our testing results show several specific disparities between the industrial practical solution and the academic perfect solutions. Our work illustrates that forming an implementation-and-testing closed loop is necessary to bridge the gaps and improve the practical security of QKD systems.
In the last decade, efforts have been made to reconcile theoretical security with realistic imperfect implementations of quantum key distribution (QKD). Implementable countermeasures are proposed to patch the discovered loopholes. However, certain countermeasures are not as robust as would be expected. In this paper, we present a concrete example of ID Quantique's random-detector-efficiency countermeasure against detector blinding attacks. As a third-party tester, we have found that the first industrial implementation of this countermeasure is effective against the original blinding attack, but not immune to a modified blinding attack. Then, we implement and test a later full version of this countermeasure containing a security proof [C. C. W. Lim et al., IEEE Journal of Selected Topics in Quantum Electronics, 21, 6601305 (2015)]. We find that it is still vulnerable against the modified blinding attack, because an assumption about hardware characteristics on which the proof relies fails in practice.
Quantum technologies are driving more and more interest both in academia and industry thanks to their promising performances in terms of security. In reality, practical systems suffer from imperfections compared to theoretical models which could be exploited by an eavesdropper if no protection is implemented. Bridging the gap between theory and practice is therefore one of the main challenges of this field today. During this thesis, I worked on different aspects of the practical security of quantum technologies. This ranges from the modeling of the entropy source of a quantum random number generator (QNRG) to the study of the vulnerabilities of quantum key distribution (QKD) implementations against hacking. In the first part, I focus on the modeling of a commercial QRNG chip from ID Quantique. More specifically, I present the model we developed for the quantum entropy source of the device. We estimate that this fully integrated device can provide a quantum min-entropy of 0.98 per bit. Importantly, this near-unity quantum entropy is achievable without post-processing reducing the power consumption of the chip, making it suitable for mobile devices. Moreover, we show that this high-quality entropy is robust against imperfections. On the side of QKD security, I begin by studying the behavior of negative-feedback avalanche diode (NFAD) detectors under a blinding attack. After showing their vulnerability to this attack and testing the resilience of a countermeasure based on the monitoring of the mean photocurrent, I present an improved countermeasure. This allows Bob to detect more advanced blinding strategies where Eve modulates her blinding power to reduce her impact on the mean photocurrent. In the last part of this thesis, I present a novel method to prevent the blinding attack based on statistical measurements with a multi-pixel detector. Through this approach, we can estimate an upper bound on Eve's information on the key exchanged. An analysis of the finite-key effects estimates that this countermeasure can be effective for distances up to 250km. The applicability of this countermeasure with current technology is shown with a 2-pixel superconducting detector.
In the recent decade, it has been discovered that QKD systems are extremely vulnerable to side-channel attacks. In particular, by exploiting the internal working knowledge of practical detectors, it is possible to bring them to an operating region whereby only certain target detectors are sensitive to detections. Crucially, the adversary can use this loophole to learn everything about the secret key without introducing any error to the quantum channel. In this paper, as a step toward overcoming detector blinding attacks, we focus on an experimentally convenient countermeasure, where the efficiency of the detectors is randomly varied.
The rules of quantum mechanics makes it possible to exchange a secret key at a distance. This is called quantum key distribution (QKD). In theory the key exchange can be made completely secure. Real QKD implementations however, has numerous imperfections. Luckily one has also been able to prove the security of QKD with a large variety of imperfections. The field of QKD has matured over the recent years, and it has now reached commercial applications with photons as the quantum bits, and optical fibers as the quantum channel. Today there are at least three commercial vendors of QKD-systems. We live in the times of quantum hacking. Researchers has begun the task of breaking the security of QKD-systems. Many new imperfections has been discovered, some of which might be used to break the security of QKD. This thesis is a study of the detector efficiency mismatch loophole. Most QKD-systems require two detectors, and it is virtually impossible to make two identical detectors with the exact same efficiency. What is worse, it turns out that the eavesdropper can often control the relative efficiencies of the two detectors trough some domain, for instance by controlling the timing, the frequency or the spacial mode of the photons. This can in turn be used by the eavesdropper to gain information about the secret key. Previously the best known attack would compromise security if the detector efficiency mismatch of about 1:15. Here the current attacks on systems with detector efficiency mismatch are improved to compromise security for a mismatch of about 1:4. This is less than the mismatch found in a commercial QKD-system, so the attack could in principle be used to eavesdrop on this QKD-system. One might try to close the loophole by modifying the implementation. One suggestion is the four state Bob. The problem is that this patch will in turn open other loopholes, and one of these loopholes reopen the detector efficiency mismatch loophole. One can remove Eves information about the key by doing a sufficient amount of extra privacy amplification. Here a general security bound is presented, quantifying the required amount of extra privacy amplification to remove Eve's information about the key. The proof is more general than the previous security proof, and is valid for any basis dependent, possibly lossy, linear optical imperfections in the channel and receiver/detectors. Since this is more realistic assumptions for a QKD-implementation, the proof represents a major step of closing the loophole in real devices.
Security verification for the physical implementation of a cryptography system is an important step to ensure the security level promised by theory. As has been shown many times, any physical device has characteristics and behavior that deviate from theoretical expectations. Frequently, those lead to new security loopholes. \n \nThis thesis presents three experimental studies of attacks on quantum key distribution (QKD) systems. The first is the detection efficiency mismatch on free-space systems, which takes advantage of alignment imperfections in Bob's detector to control detection efficiencies. The experiment was done on a polarization-encoding free-space receiver to find the detection efficiencies of each detector for different spatial modes of an incoming photon. Those results were put into an optimization program, which modeled an intercept-and-resend attack on a non-decoy Bennett-Brassard 1984 (BB84) protocol. The result shows that an adversary is able to gain information about the key without being detected by Alice and Bob. The second study is an experimental test of reliability of a spatial filter (a pinhole), which is proposed as a countermeasure for the previous attack. The result shows that, by sending a high-power laser beam focused on the pinhole, the pinhole can be widened without affecting other components in the receiver. Thus, the ability to perform a spatial mode detection efficiency-mismatch attack is recovered. The last experiment is a demonstration of Eve's ability to force a commercial system to distill a key from a raw key of a short length, where the asymptotic assumption of security claimed by the manufacturer might not hold. It was shown that this could be done by inducing transmission loss in the channel at an appropriate time.
In contrast to classical public-key cryptosystems, where the security of encoded messages relies on on computational assumptions, Quantum Key Distribution (QKD) enables two distant parties to establish a shared secret key that, when combined with a one-time pad, provides information-theoretically secure encryption, provided that the QKD protocol is supported by a rigorous security proof. In the last decades, security proofs robust against a wide range of eavesdropping strategies have established the theoretical soundness of several QKD protocols. However, most proofs are based on idealized models of the physical systems involved in such protocols and often include assumptions that are not satisfied in practical implementations. This mismatch creates a gap between theoretical security guarantees and actual experimental realizations, making QKD protocols vulnerable to attacks. To ensure the security of real-world QKD systems, it is therefore essential to account for imperfections in security analyses. In this article, we present an overview of recent analytical and numerical developments in QKD security proofs, which provide a versatile approach for incorporating imperfections and re-establishing the security of quantum communication protocols under realistic conditions.