Measurement-device-independent quantum key distribution (MDI QKD) is a promising method for remote key sharing that can eliminate all detector side-channel attacks. However, current security proofs often overlook the potential information leakages from the legitimate users' devices. In a quantum version of Trojan-horse attack (THA), a malicious eavesdropper can inject bright light into the sources of a MDI QKD system and then analyze the back-reflected light to obtain their setting choices, thereby compromising the final security. Here, we derive the finite-key security bounds of decoy-state MDI QKD in the presence of THA, which significantly outperform previous analyses in terms of the secret-key rate and transmission distance. Specifically, we analyze a symmetric three-intensity decoy-state MDI QKD protocol and an efficient four-intensity decoy-state MDI QKD protocol. Our results represent a fundamental step in guaranteeing the implementation security of quantum communication systems.
Measurement-device-independent quantum key distribution (MDI QKD) is a promising method for remote key sharing that can eliminate all detector side-channel attacks. However, current security proofs often overlook the potential information leakages from the legitimate users' devices. In a quantum version of Trojan-horse attack (THA), a malicious eavesdropper can inject bright light into the sources of a MDI QKD system and then analyze the back-reflected light to obtain their setting choices, thereby compromising the final security. Here, we derive the finite-key security bounds of decoy-state MDI QKD in the presence of THA, which significantly outperform previous analyses in terms of the secret-key rate and transmission distance. Specifically, we analyze a symmetric three-intensity decoy-state MDI QKD protocol and an efficient four-intensity decoy-state MDI QKD protocol. Our results represent a fundamental step in guaranteeing the implementation security of quantum communication systems.
Reference-frame-independent measurement-device-independent quantum key distribution (RFI MDI QKD) can resist side-channel attacks against detectors and slow variations of reference frames, thus presenting an advantageous approach for long-distance secure quantum communication. Nevertheless, if an eavesdropper implements a Trojan-horse attack (THA) by injecting bright light into sources, the back-reflected light may carry encoding information into the channel, thereby causing serious information leakage. In this paper, we theoretically evaluate the finite-key security of decoy-state RFI MDI QKD against a THA by employing the reference-state technique and a particular concentration inequality. Additionally, dual-parameter optimization and multibasis-estimation strategies are introduced to reduce statistical fluctuations effectively. Our work demonstrates that RFI MDI QKD can maintain a better performance even in the presence of large reference-frame drifts and a THA, representing a key advancement in strengthening the security of quantum communication in real-world implementations.
Abstract Most security proofs of quantum key distribution (QKD) disregard the effect of information leakage from the users’ devices, and, thus, do not protect against Trojan-horse attacks (THAs). In a THA, the eavesdropper injects strong light into the QKD apparatuses, and then analyzes the back-reflected light to learn information about their internal setting choices. Only a few recent works consider this security threat, but predict a rather poor performance of QKD unless the devices are strongly isolated from the channel. Here, we derive finite-key security bounds for decoy-state-based QKD schemes in the presence of THAs, which significantly outperform previous analyses. Our results constitute an important step forward to closing the existing gap between theory and practice in QKD.
Measurement-device-independent quantum key distribution (MDI-QKD) can remove all detection side-channels from quantum communication systems. The security proofs require, however, that certain assumptions on the sources are satisfied. This includes, for instance, the requirement that there is no information leakage from the transmitters of the senders, which unfortunately is very difficult to guarantee in practice. In this paper we relax this unrealistic assumption by presenting a general formalism to prove the security of MDI-QKD with leaky sources. With this formalism, we analyze the finite-key security of two prominent MDI-QKD schemes-a symmetric three-intensity decoy-state MDI-QKD protocol and a four-intensity decoy-state MDI-QKD protocol-and determine their robustness against information leakage from both the intensity modulator and the phase modulator of the transmitters. Our work shows that MDI-QKD is feasible within a reasonable time frame of signal transmission given that the sources are sufficiently isolated. Thus, it provides an essential reference for experimentalists to ensure the security of implementations of MDI-QKD in the presence of information leakage.
Quantum secure direct communication (QSDC) enables the direct transmission of confidential information without pre-shared keys. However, device imperfections in practical systems can lead to information leakage. The Trojan-horse attack (THA), a stealthy side-channel threat, steals information by injecting photons into encoding devices and analyzing the reflected light. This paper focuses on the single-photon-based (DL04) protocol, establishing for the first time a comprehensive THA model against it. By combining weak coherent pulse (WCP) sources with the decoy-state method, we systematically analyze the security under THA during both the first and second rounds of transmission, derive analytical expressions for the secrecy message capacity, and quantitatively evaluate the impact of attack strength on system performance through numerical simulations. Our results demonstrate that the system’s security is highly sensitive to the average number of reflected Trojan photons, μout. For a first-round attack, the secrecy message capacity remains nearly identical to the attack-free case when μout≤10−8, but drops to zero when μout increases to 10−3. In contrast, the second round of attacks had a weaker impact. Even at the strongest attack intensity (μout=10−2), the system could still maintain a certain level of secrecy message capacity. When THA simultaneously targets both the first and second rounds, the overall security of the system is predominantly governed by the more sensitive first-round attack, whose security boundary remains largely comparable to that observed in a single first-round attack scenario. Furthermore, We perform parameter optimization to achieve the optimal secrecy message capacity for each channel attenuation. Our study provides the first quantitative security bound for THA on DL04 protocol, offering practical guidance for encoder isolation requirements in future implementations.
Measurement-device-independent quantum key distribution (MDI-QKD) protocol has been demonstrated as a viable solution to detector side-channel attacks. Recently, to bridge the strong security of MDI-QKD with the high efficiency of conventional QKD, the detector-device-independent (DDI) QKD has been proposed. One crucial assumption made in DDI-QKD is that the untrusted Bell state measurement (BSM) located inside the receiver's laboratory cannot send any unwanted information to the outside. Here, we show that if the BSM is completely untrusted, a simple scheme would allow the BSM to send information to the outside. Combined with Trojan horse attacks, this scheme could allow an eavesdropper to gain information of the quantum key without being detected. To prevent the above attack, either countermeasures to Trojan horse attacks or some trustworthiness to the ``untrusted'' BSM device is required.
Measurement-device-independent quantum key distribution (MDI-QKD) is the only known QKD scheme that can completely overcome the problem of detection side-channel attacks. Yet, despite its practical importance, there is no standard approach towards proving the security of MDI-QKD. Here, we present a simple numerical method that can efficiently compute almost-tight security bounds for any discretely modulated MDI-QKD protocol. To demonstrate the broad utility of our method, we use it to analyze the security of coherent-state MDI-QKD, decoy-state MDI-QKD with leaky sources, and a variant of twin-field QKD called phase-matching QKD. In all of the numerical simulations (using realistic detection models) we find that our method gives significantly higher secret key rates than those obtained with current security proof techniques. Interestingly, we also find that phase-matching QKD using only two coherent test states is enough to overcome the fundamental rate-distance limit of QKD. Taken together, these findings suggest that our security proof method enables a versatile, fast, and possibly optimal approach towards the security validation of practical MDI-QKD systems.