Challenges
Datasets
Workspaces
Papers
Discussions
Leaderboard
Log inSign up
Challenges
Datasets
Workspaces
Papers
Discussions
Leaderboard
Blog
Job Board
Q3AS

© 2026 Aqora Quantum S.A.S.

TermsPrivacyLegal Notice

Physical Review A

Analysis of an injection-locking-loophole attack from an external source for quantum key distribution

Xiaoxu Zhang, Mu-Sheng Jiang, Yang Wang, Yifei Lu, Hong-Wei Li, Chun Hua Zhou, Yu Zhi Zhou, Wan‐Su Bao

Published Dec 12, 2022• 7 citations
Publisher

Abstract

Many security loopholes exist in quantum key distribution (QKD) due to the imperfections of realistic devices. On the source side, the decoy-state method can defend against the most severe photon-number-splitting (PNS) attack and improve the performance of QKD. Measurement-device-independent QKD and twin-field QKD have further closed all loopholes on the detection side. In this paper, we propose a valuable optical injection-locking loophole for the case when the internal isolator inside the laser is removed. We first introduce the effects of the injection locking with different injection intensities on the source frequency. Through the successive responses of adjacent pulses from frequency ports of the dense wavelength division multiplexer, the decoy state and the signal state can be partially distinguished. The specific injection-locking-loophole analysis of the isolatorless decoy phase-encoding Bennet-Brassard 1984 QKD and decoy phase-matching QKD protocols with external optical injection has been deeply studied. Simulation results show that, if we maintain the same observed gain statistics as normal after an external optical injection locking, the loophole cannot be exploited for a PNS attack when the QKD distance is short. As the QKD distance increases, a PNS attack at a medium distance using the optical injection-locking loophole does not threaten the security; the security is still valid. With the further increase of the QKD distance, the lower-bound secure key rate is higher than the upper-bound secure key rate given by a PNS attack at a long distance, some of the keys must be insecure, and information will be leaked.

DOI
10.1103/physreva.106.062412

Related papers

Source attack of decoy-state quantum key distribution using phase information

Yan-Lin Tang, Hua‐Lei Yin, Xiongfeng Ma +7 more

Quantum key distribution (QKD) utilizes the laws of quantum mechanics to achieve information-theoretically secure key generation. This field is now approaching the stage of commercialization, but many practical QKD systems still suffer from security loopholes due to imperfect devices. In fact, practical attacks have successfully been demonstrated. Fortunately, most of them only exploit detection-side loopholes, which are now closed by the recent idea of measurement-device-independent QKD. On the other hand, little attention is paid to the source, which may still leave QKD systems insecure. In this work, we propose and demonstrate an attack that exploits a source-side loophole existing in qubit-based QKD systems using a weak coherent state source and decoy states. Specifically, by implementing a linear-optics unambiguous state discrimination measurement, we show that the security of a system without phase randomization---which is a step assumed in conventional security analyses but sometimes neglected in practice---can be compromised. We conclude that implementing phase randomization is essential to the security of decoy-state QKD systems under current security analyses.

arXiv:1304.2541•Physical Review A•Aug 8, 2013•128 citations

Direct intensity and phase modulation for quantum key distribution transmitters

Hui Liu, Gleb Nazarikov, Idelfonso Tafur Monroy

The decoy-state method serves as a cornerstone for practical quantum key distribution (QKD) with inherent immunity to photon-number-splitting attacks. Leveraging optical injection locking, we propose a directly modulated light source with a scheme that simultaneously generates intensity- and phase-modulated signals without external modulators. Removing external modulators eliminates modulator-related side-channel vulnerabilities, fundamentally enhancing QKD security. Integrated into a high-speed phase-encoding BB84 system with optimized one-decoy protocol and finite-size analysis, our system achieves positive key rates up to 20 dB channel loss (100 km fiber) with commercial InGaAs single-photon detectors, reducing transmitter complexity while ensuring security for practical QKD applications.

Optics Express•May 15, 2026•0 citations

Hacking Quantum Key Distribution via Injection Locking

Xiao-Ling Pang, Ai-Lin Yang, Chao-Ni Zhang +4 more

Unconditionally secure communication, which has been pursued for thousands of years hasn't, however, yet been reached due to a continuous competition between encryption and hacking. Quantum key distribution (QKD), harnessing the quantum mechanical nature of superposition and noncloning, may promise unconditional security by incorporating the one-time pad algorithm rigorously proved by Claude Shannon. Massive efforts have been made in building practical and commercial QKD systems; in particular, decoy states have been employed to detect photon-number splitting attacks against a single-photon source loophole, and measurement-device-independent (MDI) QKD has further closed all loopholes on the detection side, which leads to a seemingly real-life application. Here, we propose and experimentally demonstrate a MDI-QKD hacking strategy on the trusted-source assumption by using an injection-locking technique. An eaves-dropper (Eve) injects near off-resonance photons with randomly chosen polarization into a sender's laser, where injection locking in a shifted frequency can happen only when Eve's choice matches the sender's state. By setting a shifted window and switching the frequency of photons back afterwards, Eve in principle can obtain all the keys without terminating the real-time QKD. We observe the dynamics of a semiconductor laser with injected photons, and obtain a hacking success rate reaching $60.0\mathrm{%}$ of raw keys. Our results suggest that the spear-and-shield competition of unconditional security may continue until all potential loopholes are discovered and closed ultimately.

arXiv:1902.10423•Physical Review Applied•Mar 3, 2020•55 citations

An Intensity-Stable Pulse Source Based on Optical Injection for High-Speed Quantum Key Distribution

Wenxu Zhao, Tao Wang, Xun Zhou +2 more

Quantum Key Distribution (QKD) provides Alice and Bob with a secure key to prevent third-party eavesdropping. Due to the lack of an ideal single-photon source, weak coherent light sources are widely used. The decoy state method can make up for the security loophole brought by weak coherent light sources - photon number splitting attack (PNS). The specific method of decoy state quantum key distribution is to send light pulses of different intensity levels. Taking the three-intensity decoy state method as an example, one is a signal state with an average photon number of u; one is a decoy state with an average photon number of d; and one is a vacuum state with an average photon number of v. Even if the eavesdropper is more powerful, he cannot distinguish which state the pulse comes from. Therefore, the accuracy of the light pulse intensity is crucial to the security of decoy state quantum key distribution [1] .

International Conference on Optical Communications and Networks (ICOCN)•Jul 28, 2025•0 citations

Implementation Security of Twin-Field Quantum Key Distribution using Optical Injection Locking

Sergio Juárez, A. Marcomini, Mikhail Petrov +5 more

Twin-field quantum key distribution (TF-QKD) has become a leading protocol to bring quantum communications to the national scale. The protocol requires the establishment of a shared phase and frequency reference between distant parties, which is commonly achieved by using an external reference laser in an optical injection locking (OIL) architecture. In this work, we analyze the side channels in OIL-based TF-QKD that may arise from adversarial manipulation of the various degrees of freedom of this untrusted reference beam. We experimentally demonstrate two realistic attack scenarios: fast intensity modulation of the reference laser, and additional signals embedded in the reference light exploiting wavelengths undetectable by conventional monitoring techniques. These attacks can allow a potential eavesdropper to deterministically increase the mean photon number of the sources, or circumvent the decoy-state technique, respectively. To counter these vulnerabilities, we propose practical and highly effective countermeasures that reinforce the security of TF-QKD systems without significant additional complexity or performance degradation.

arXiv:2508.21763•Physical Review A•Jan 1, 2026•2 citations

Wavelength-selected photon-number-splitting attack against plug-and-play quantum key distribution systems with decoy states

Mu-Sheng Jiang, Shi‐Hai Sun, Chunyan Li +1 more

Any imperfections in a practical quantum key distribution (QKD) system may be exploited by an eavesdropper (Eve) to collect information about the key without being discovered. For example, without the decoy-state method, Eve can perform the photon-number-splitting (PNS) attack and get full information without introducing any perturbation, since weak laser pulses are widely used in practical systems instead of single-photon sources. However, the decoy-state method against PNS attack itself may introduce another loophole while closing the loophole of multiphoton pulses. In this paper, a fatal loophole of practical decoy-state plug-and-play QKD systems has been exploited and a wavelength-selected photon-number-splitting (WSPNS) attack scheme against plug-and-play QKD systems with the decoy-state method is proposed. Theoretical analysis shows that the eavesdropper can get full information about the key generated between the legitimate parties just like the PNS attack was performed in plug-and-play QKD systems without the decoy-state method.

Physical Review A•Sep 10, 2012•31 citations
Many security loopholes exist in quantum key distribution (QKD) due to the imperfections of realistic devices. On the source side, the decoy-state method can defend against the most severe photon-number-splitting (PNS) attack and improve the performance of QKD. Measurement-device-independent QKD and twin-field QKD have further closed all loopholes on the detection side. In this paper, we propose a valuable optical injection-locking loophole for the case when the internal isolator inside the laser is removed. We first introduce the effects of the injection locking with different injection intensities on the source frequency. Through the successive responses of adjacent pulses from frequency ports of the dense wavelength division multiplexer, the decoy state and the signal state can be partially distinguished. The specific injection-locking-loophole analysis of the isolatorless decoy phase-encoding Bennet-Brassard 1984 QKD and decoy phase-matching QKD protocols with external optical injection has been deeply studied. Simulation results show that, if we maintain the same observed gain statistics as normal after an external optical injection locking, the loophole cannot be exploited for a PNS attack when the QKD distance is short. As the QKD distance increases, a PNS attack at a medium distance using the optical injection-locking loophole does not threaten the security; the security is still valid. With the further increase of the QKD distance, the lower-bound secure key rate is higher than the upper-bound secure key rate given by a PNS attack at a long distance, some of the keys must be insecure, and information will be leaked.
Quantum key distribution (QKD) utilizes the laws of quantum mechanics to achieve information-theoretically secure key generation. This field is now approaching the stage of commercialization, but many practical QKD systems still suffer from security loopholes due to imperfect devices. In fact, practical attacks have successfully been demonstrated. Fortunately, most of them only exploit detection-side loopholes, which are now closed by the recent idea of measurement-device-independent QKD. On the other hand, little attention is paid to the source, which may still leave QKD systems insecure. In this work, we propose and demonstrate an attack that exploits a source-side loophole existing in qubit-based QKD systems using a weak coherent state source and decoy states. Specifically, by implementing a linear-optics unambiguous state discrimination measurement, we show that the security of a system without phase randomization---which is a step assumed in conventional security analyses but sometimes neglected in practice---can be compromised. We conclude that implementing phase randomization is essential to the security of decoy-state QKD systems under current security analyses.
The decoy-state method serves as a cornerstone for practical quantum key distribution (QKD) with inherent immunity to photon-number-splitting attacks. Leveraging optical injection locking, we propose a directly modulated light source with a scheme that simultaneously generates intensity- and phase-modulated signals without external modulators. Removing external modulators eliminates modulator-related side-channel vulnerabilities, fundamentally enhancing QKD security. Integrated into a high-speed phase-encoding BB84 system with optimized one-decoy protocol and finite-size analysis, our system achieves positive key rates up to 20 dB channel loss (100 km fiber) with commercial InGaAs single-photon detectors, reducing transmitter complexity while ensuring security for practical QKD applications.
Unconditionally secure communication, which has been pursued for thousands of years hasn't, however, yet been reached due to a continuous competition between encryption and hacking. Quantum key distribution (QKD), harnessing the quantum mechanical nature of superposition and noncloning, may promise unconditional security by incorporating the one-time pad algorithm rigorously proved by Claude Shannon. Massive efforts have been made in building practical and commercial QKD systems; in particular, decoy states have been employed to detect photon-number splitting attacks against a single-photon source loophole, and measurement-device-independent (MDI) QKD has further closed all loopholes on the detection side, which leads to a seemingly real-life application. Here, we propose and experimentally demonstrate a MDI-QKD hacking strategy on the trusted-source assumption by using an injection-locking technique. An eaves-dropper (Eve) injects near off-resonance photons with randomly chosen polarization into a sender's laser, where injection locking in a shifted frequency can happen only when Eve's choice matches the sender's state. By setting a shifted window and switching the frequency of photons back afterwards, Eve in principle can obtain all the keys without terminating the real-time QKD. We observe the dynamics of a semiconductor laser with injected photons, and obtain a hacking success rate reaching $60.0\mathrm{%}$ of raw keys. Our results suggest that the spear-and-shield competition of unconditional security may continue until all potential loopholes are discovered and closed ultimately.
Quantum Key Distribution (QKD) provides Alice and Bob with a secure key to prevent third-party eavesdropping. Due to the lack of an ideal single-photon source, weak coherent light sources are widely used. The decoy state method can make up for the security loophole brought by weak coherent light sources - photon number splitting attack (PNS). The specific method of decoy state quantum key distribution is to send light pulses of different intensity levels. Taking the three-intensity decoy state method as an example, one is a signal state with an average photon number of u; one is a decoy state with an average photon number of d; and one is a vacuum state with an average photon number of v. Even if the eavesdropper is more powerful, he cannot distinguish which state the pulse comes from. Therefore, the accuracy of the light pulse intensity is crucial to the security of decoy state quantum key distribution [1] .
Twin-field quantum key distribution (TF-QKD) has become a leading protocol to bring quantum communications to the national scale. The protocol requires the establishment of a shared phase and frequency reference between distant parties, which is commonly achieved by using an external reference laser in an optical injection locking (OIL) architecture. In this work, we analyze the side channels in OIL-based TF-QKD that may arise from adversarial manipulation of the various degrees of freedom of this untrusted reference beam. We experimentally demonstrate two realistic attack scenarios: fast intensity modulation of the reference laser, and additional signals embedded in the reference light exploiting wavelengths undetectable by conventional monitoring techniques. These attacks can allow a potential eavesdropper to deterministically increase the mean photon number of the sources, or circumvent the decoy-state technique, respectively. To counter these vulnerabilities, we propose practical and highly effective countermeasures that reinforce the security of TF-QKD systems without significant additional complexity or performance degradation.
Any imperfections in a practical quantum key distribution (QKD) system may be exploited by an eavesdropper (Eve) to collect information about the key without being discovered. For example, without the decoy-state method, Eve can perform the photon-number-splitting (PNS) attack and get full information without introducing any perturbation, since weak laser pulses are widely used in practical systems instead of single-photon sources. However, the decoy-state method against PNS attack itself may introduce another loophole while closing the loophole of multiphoton pulses. In this paper, a fatal loophole of practical decoy-state plug-and-play QKD systems has been exploited and a wavelength-selected photon-number-splitting (WSPNS) attack scheme against plug-and-play QKD systems with the decoy-state method is proposed. Theoretical analysis shows that the eavesdropper can get full information about the key generated between the legitimate parties just like the PNS attack was performed in plug-and-play QKD systems without the decoy-state method.