Challenges
Datasets
Workspaces
Papers
Discussions
Leaderboard
Log inSign up
Challenges
Datasets
Workspaces
Papers
Discussions
Leaderboard
Blog
Job Board
Q3AS

© 2026 Aqora Quantum S.A.S.

TermsPrivacyLegal Notice

Optics Express

Effect of frequency side channels on the security of practical quantum key distribution

Xiao‐Lei Jiang, Yuyao Guo, Yan-Yang Zhou, Yi-Fei Lu, Yu Zhou, Yang Wang, Jia-Ji Li, Chun Hua Zhou, Hongwei Li, Linjie Zhou, Wan‐Su Bao

Published Nov 11, 2025• 1 citation
Publisher

Abstract

Quantum key distribution (QKD) provides an information-theoretic secure method for communication. Measurement-device-independent QKD (MDI-QKD) demonstrates immunity to all detection-side vulnerabilities while offering exceptional security and practicality. Nevertheless, imperfections in source-side devices may still introduce security risks that necessitate precise characterization and evaluation in practical security analyses. In this study, we demonstrate that the inherent frequency-shifting properties of the Mach-Zehnder intensity modulator can induce distinguishable features between signal and decoy states in the frequency domain, fundamentally undermining the core premise of the decoy-state protocol. Experimental characterization reveals that such spectral distinguishability exhibits strong dependence on three key parameters: modulation voltage, pulse width, and modulation scheme. Leveraging this vulnerability, we develop a frequency side channel attack framework applicable to both MDI-QKD and its variant mode-pairing QKD (MP-QKD), evaluate its impact on protocol security, and ultimately devise corresponding countermeasures.

DOI
10.1364/oe.579447

Related papers

Practical Analysis of Sending or Not-Sending Twin-Field Quantum Key Distribution with Frequency Side Channels

Yifei Lu, Mu-Sheng Jiang, Yang Wang +7 more

The twin-field quantum key distribution (TF-QKD) and its variants can overcome the fundamental rate-distance limit of QKD. However, their physical implementations with the side channels remain the subject of further research. We test the side channel of a type of external intensity modulation that applies a Mach–Zehnder-type electro-optical intensity modulator, which shows the distinguishability of the signal and decoy states in the frequency domain. Based on this security loophole, we propose a side-channel attack, named the passive frequency-shift attack, on the imperfect implementation of the sending or not-sending (SNS) TF-QKD protocol. We analyze the performance of the SNS protocol with the actively odd-parity pairing (AOPP) method under the side-channel attack by giving the formula of the upper bound of the real secret key rate and comparing it with the lower bound of the secret key rate under Alice and Bob’s estimation. The simulation results quantitatively show the effectiveness of the attack on the imperfect devices at a long distance. Our results emphasize the importance of practical security at the light source and might provide a valuable reference for device selection in the practical implementation of the SNS protocol.

Applied Sciences•Oct 14, 2021•4 citations

Practical passive decoy state measurement-device-independent quantum key distribution with unstable sources

Li Liu, Fen-Zhuo Guo, Qiaoyan Wen

Measurement-device-independent quantum key distribution (MDI-QKD) with the active decoy state method can remove all detector loopholes, and resist the imperfections of sources. But it may lead to side channel attacks and break the security of QKD system. In this paper, we apply the passive decoy state method to the MDI-QKD based on polarization encoding mode. Not only all attacks on detectors can be removed, but also the side channel attacks on sources can be overcome. We get that the MDI-QKD with our passive decoy state method can have a performance comparable to the protocol with the active decoy state method. To fit for the demand of practical application, we discuss intensity fluctuation in the security analysis of MDI-QKD protocol using passive decoy state method, and derive the key generation rate for our protocol with intensity fluctuation. It shows that intensity fluctuation has an adverse effect on the key generation rate which is non-negligible, especially in the case of small data size of total transmitting signals and long distance transmission. We give specific simulations on the relationship between intensity fluctuation and the key generation rate. Furthermore, the statistical fluctuation due to the finite length of data is also taken into account.

Scientific Reports•Sep 6, 2017•6 citations

Security of quantum key distribution with realistic sources

Xoel Sixto

Quantum Key Distribution (QKD) offers information-theoretic security grounded in the laws of quantum mechanics rather than computational assumptions. While its theoretical foundations are robust, practical implementations necessarily deviate from the idealized models assumed in security analyses, opening the door to side-channel attacks and implementation loopholes. In particular, most research to date has focused on mitigating vulnerabilities in the measurement devices, leading to the development of Measurement-Device-Independent QKD (MDI-QKD) and Twin-Field QKD (TF-QKD), which effectively close all receiver-side loopholes. By contrast, the security of the source has remained less explored, despite being critical for the overall integrity of QKD systems. The goal of this thesis is to develop security proofs that explicitly account for realistic imperfections in QKD sources. Special emphasis is placed on three main aspects: correlations between emitted pulses that violate independence assumptions, imperfect phase randomization arising from practical modulation schemes, and leakage of internal settings through passive or active side channels. By formulating rigorous methods to analyze these imperfections, the work aims to provide a framework that enables practitioners to quantify and mitigate implementation risks systematically. Additionally, this thesis seeks to clarify under which conditions the commonly used decoy-state method remains secure, and to what extent source assumptions can be relaxed without compromising performance. This thesis aims to advance the understanding of how real-world deviations impact QKD security and to contribute to the development of protocols and devices. Ultimately, this work is motivated by the ambition to help bring QKD from a theoretically promising idea to a mature technology deployable with confidence in practical scenarios.

•Nov 7, 2025•0 citations

Practical aspects of measurement-device-independent quantum key distribution

Feihu Xu, Marcos Curty, Bing Qi +1 more

A novel protocol, measurement-device-independent quantum key distribution (MDI-QKD), removes all attacks from the detection system, the most vulnerable part in QKD implementations. In this paper, we present an analysis for practical aspects of MDI-QKD. To evaluate its performance, we study various error sources by developing a general system model. We find that MDI-QKD is highly practical and thus can be easily implemented with standard optical devices. Moreover, we present a simple analytical method with only two (general) decoy states for the finite decoy-state analysis. This method can be used directly by experimentalists to demonstrate MDI-QKD. By combining the system model with the finite decoy-state method, we present a general framework for the optimal choice of the intensities of the signal and decoy states. Furthermore, we consider a common situation, namely asymmetric MDI-QKD, in which the two quantum channels have different transmittances. We investigate its properties and discuss how to optimize its performance. Our work is of interest not only to experiments demonstrating MDI-QKD but also to other non-QKD experiments involving quantum interference.

arXiv:1305.6965•New Journal of Physics•Nov 7, 2013•179 citations

Measurement-device-independent quantum key distribution with leaky sources

Weilong Wang, Kiyoshi Tamaki, Marcos Curty

Measurement-device-independent quantum key distribution (MDI-QKD) can remove all detection side-channels from quantum communication systems. The security proofs require, however, that certain assumptions on the sources are satisfied. This includes, for instance, the requirement that there is no information leakage from the transmitters of the senders, which unfortunately is very difficult to guarantee in practice. In this paper we relax this unrealistic assumption by presenting a general formalism to prove the security of MDI-QKD with leaky sources. With this formalism, we analyze the finite-key security of two prominent MDI-QKD schemes-a symmetric three-intensity decoy-state MDI-QKD protocol and a four-intensity decoy-state MDI-QKD protocol-and determine their robustness against information leakage from both the intensity modulator and the phase modulator of the transmitters. Our work shows that MDI-QKD is feasible within a reasonable time frame of signal transmission given that the sources are sufficiently isolated. Thus, it provides an essential reference for experimentalists to ensure the security of implementations of MDI-QKD in the presence of information leakage.

arXiv:2001.08086•Scientific Reports•Jan 18, 2021•44 citations

Finite-key analysis of practical decoy-state measurement-device-independent quantum key distribution with unstable sources

Yang Wang, Wan‐Su Bao, Chun Hua Zhou +2 more

Measurement-device-independent quantum key distribution (MDI-QKD) is immune to detector side channel attacks, which is a notorious security loophole problem in QKD. Importantly, both finite-key effects and intensity fluctuations of the practical photon sources are nonnegligible in a full key rate analysis of practical QKD. In this paper, for the case with finite-key effects and without intensity fluctuations, we present a way to estimate the phase error rate for MDI-QKD and compare performances of the parameter estimation based on Hoeffding’s inequality and the Chernoff bound. By using Azuma’s inequality, we also present the finite-key analysis with composable security against general attacks for a biased decoy-state MDI-QKD protocol with intensity fluctuations. Our simulation results show that the effect of our phase error rate estimation is almost the same as the results in Phys. Rev. A91, 022313 (2015)PLRAAN1050-294710.1103/PhysRevA.91.022313, and the parameter estimation using the Chernoff bound is tighter than that using Hoeffding’s inequality. In addition, the influence of intensity fluctuations is more obvious when the data size of total transmitting signals is small. Our results highlight that it is important to keep the stability of the intensity modulator and estimate accurately the emitted pulse’s intensity for practical implementations.

Journal of the Optical Society of America B•Feb 1, 2019•15 citations
Quantum key distribution (QKD) provides an information-theoretic secure method for communication. Measurement-device-independent QKD (MDI-QKD) demonstrates immunity to all detection-side vulnerabilities while offering exceptional security and practicality. Nevertheless, imperfections in source-side devices may still introduce security risks that necessitate precise characterization and evaluation in practical security analyses. In this study, we demonstrate that the inherent frequency-shifting properties of the Mach-Zehnder intensity modulator can induce distinguishable features between signal and decoy states in the frequency domain, fundamentally undermining the core premise of the decoy-state protocol. Experimental characterization reveals that such spectral distinguishability exhibits strong dependence on three key parameters: modulation voltage, pulse width, and modulation scheme. Leveraging this vulnerability, we develop a frequency side channel attack framework applicable to both MDI-QKD and its variant mode-pairing QKD (MP-QKD), evaluate its impact on protocol security, and ultimately devise corresponding countermeasures.
The twin-field quantum key distribution (TF-QKD) and its variants can overcome the fundamental rate-distance limit of QKD. However, their physical implementations with the side channels remain the subject of further research. We test the side channel of a type of external intensity modulation that applies a Mach–Zehnder-type electro-optical intensity modulator, which shows the distinguishability of the signal and decoy states in the frequency domain. Based on this security loophole, we propose a side-channel attack, named the passive frequency-shift attack, on the imperfect implementation of the sending or not-sending (SNS) TF-QKD protocol. We analyze the performance of the SNS protocol with the actively odd-parity pairing (AOPP) method under the side-channel attack by giving the formula of the upper bound of the real secret key rate and comparing it with the lower bound of the secret key rate under Alice and Bob’s estimation. The simulation results quantitatively show the effectiveness of the attack on the imperfect devices at a long distance. Our results emphasize the importance of practical security at the light source and might provide a valuable reference for device selection in the practical implementation of the SNS protocol.
Measurement-device-independent quantum key distribution (MDI-QKD) with the active decoy state method can remove all detector loopholes, and resist the imperfections of sources. But it may lead to side channel attacks and break the security of QKD system. In this paper, we apply the passive decoy state method to the MDI-QKD based on polarization encoding mode. Not only all attacks on detectors can be removed, but also the side channel attacks on sources can be overcome. We get that the MDI-QKD with our passive decoy state method can have a performance comparable to the protocol with the active decoy state method. To fit for the demand of practical application, we discuss intensity fluctuation in the security analysis of MDI-QKD protocol using passive decoy state method, and derive the key generation rate for our protocol with intensity fluctuation. It shows that intensity fluctuation has an adverse effect on the key generation rate which is non-negligible, especially in the case of small data size of total transmitting signals and long distance transmission. We give specific simulations on the relationship between intensity fluctuation and the key generation rate. Furthermore, the statistical fluctuation due to the finite length of data is also taken into account.
Quantum Key Distribution (QKD) offers information-theoretic security grounded in the laws of quantum mechanics rather than computational assumptions. While its theoretical foundations are robust, practical implementations necessarily deviate from the idealized models assumed in security analyses, opening the door to side-channel attacks and implementation loopholes. In particular, most research to date has focused on mitigating vulnerabilities in the measurement devices, leading to the development of Measurement-Device-Independent QKD (MDI-QKD) and Twin-Field QKD (TF-QKD), which effectively close all receiver-side loopholes. By contrast, the security of the source has remained less explored, despite being critical for the overall integrity of QKD systems. The goal of this thesis is to develop security proofs that explicitly account for realistic imperfections in QKD sources. Special emphasis is placed on three main aspects: correlations between emitted pulses that violate independence assumptions, imperfect phase randomization arising from practical modulation schemes, and leakage of internal settings through passive or active side channels. By formulating rigorous methods to analyze these imperfections, the work aims to provide a framework that enables practitioners to quantify and mitigate implementation risks systematically. Additionally, this thesis seeks to clarify under which conditions the commonly used decoy-state method remains secure, and to what extent source assumptions can be relaxed without compromising performance. This thesis aims to advance the understanding of how real-world deviations impact QKD security and to contribute to the development of protocols and devices. Ultimately, this work is motivated by the ambition to help bring QKD from a theoretically promising idea to a mature technology deployable with confidence in practical scenarios.
A novel protocol, measurement-device-independent quantum key distribution (MDI-QKD), removes all attacks from the detection system, the most vulnerable part in QKD implementations. In this paper, we present an analysis for practical aspects of MDI-QKD. To evaluate its performance, we study various error sources by developing a general system model. We find that MDI-QKD is highly practical and thus can be easily implemented with standard optical devices. Moreover, we present a simple analytical method with only two (general) decoy states for the finite decoy-state analysis. This method can be used directly by experimentalists to demonstrate MDI-QKD. By combining the system model with the finite decoy-state method, we present a general framework for the optimal choice of the intensities of the signal and decoy states. Furthermore, we consider a common situation, namely asymmetric MDI-QKD, in which the two quantum channels have different transmittances. We investigate its properties and discuss how to optimize its performance. Our work is of interest not only to experiments demonstrating MDI-QKD but also to other non-QKD experiments involving quantum interference.
Measurement-device-independent quantum key distribution (MDI-QKD) can remove all detection side-channels from quantum communication systems. The security proofs require, however, that certain assumptions on the sources are satisfied. This includes, for instance, the requirement that there is no information leakage from the transmitters of the senders, which unfortunately is very difficult to guarantee in practice. In this paper we relax this unrealistic assumption by presenting a general formalism to prove the security of MDI-QKD with leaky sources. With this formalism, we analyze the finite-key security of two prominent MDI-QKD schemes-a symmetric three-intensity decoy-state MDI-QKD protocol and a four-intensity decoy-state MDI-QKD protocol-and determine their robustness against information leakage from both the intensity modulator and the phase modulator of the transmitters. Our work shows that MDI-QKD is feasible within a reasonable time frame of signal transmission given that the sources are sufficiently isolated. Thus, it provides an essential reference for experimentalists to ensure the security of implementations of MDI-QKD in the presence of information leakage.
Measurement-device-independent quantum key distribution (MDI-QKD) is immune to detector side channel attacks, which is a notorious security loophole problem in QKD. Importantly, both finite-key effects and intensity fluctuations of the practical photon sources are nonnegligible in a full key rate analysis of practical QKD. In this paper, for the case with finite-key effects and without intensity fluctuations, we present a way to estimate the phase error rate for MDI-QKD and compare performances of the parameter estimation based on Hoeffding’s inequality and the Chernoff bound. By using Azuma’s inequality, we also present the finite-key analysis with composable security against general attacks for a biased decoy-state MDI-QKD protocol with intensity fluctuations. Our simulation results show that the effect of our phase error rate estimation is almost the same as the results in Phys. Rev. A91, 022313 (2015)PLRAAN1050-294710.1103/PhysRevA.91.022313, and the parameter estimation using the Chernoff bound is tighter than that using Hoeffding’s inequality. In addition, the influence of intensity fluctuations is more obvious when the data size of total transmitting signals is small. Our results highlight that it is important to keep the stability of the intensity modulator and estimate accurately the emitted pulse’s intensity for practical implementations.