We theoretically and experimentally demonstrate an attack on continuous-variable quantum key distribution. The attack exploits photorefractive-induced index changes, causing modulator bias drift, leading to overestimated secret key rates and ultimately compromising system security.
Quantum key distribution (QKD) offers information-theoretic security, but device imperfections introduce implementation vulnerabilities. Experimental evidence of the security consequences of transmitter vulnerabilities in continuous-variable QKD (CV-QKD) remains limited. Here, we experimentally investigate a reversible photorefractive attack in a local-local-oscillator CV-QKD system. Moderate blue-light illumination reduces the modulation variance of a lithium-niobate IQ modulator to a stable value without appreciably increasing estimated excess noise. The variance recovers after illumination is removed. We elucidate the underlying physical mechanisms and develop an attack that exploits recovery to compromise modulation calibration. Receiver measurements confirm that the resulting calibration mismatch leads to overestimated channel transmittance and underestimated excess noise. Key rate calculations based on measured parameters yield a positive estimated rate when the correctly calibrated rate is nonpositive. Recovery can also make the preceding manipulation harder to identify through later inspection. This work provides the first system-level experimental evidence that a reversible photorefractive response can be exploited to compromise modulation calibration in CV-QKD. These findings highlight reversible changes in quantum transmitters as a practical security concern, motivating security analyses and protection strategies that account for both optical perturbations and subsequent recovery.
Modulators based on the Mach-Zehnder interferometer (MZI) structure are widely used in continuous-variable quantum key distribution (CVQKD) systems. MZI-based variable optical attenuator (VOA) and amplitude modulator can reshape the waveform and control the intensity of the coherent state signal to realize secret key information modulation in the CVQKD system. However, these devices are not ideal; internal and external effects like non-linear effects and temperature may degrade their performance. In this paper, we analyzed the security loophole of CVQKD under the photorefractive effect (PE), which originates from the crystal characteristics of lithium niobate (LN). It is found that the refractive index change of modulators because of PE may lead to an overestimate or underestimate of the final secret key rate. This allows Eve to perform further attacks like intercept-resend to get more secret key information. To solve this problem, several countermeasures are proposed, which can effectively eliminate potential risks.
Unidimensional-modulation continuous-variable quantum key distribution has received considerable attention due to its simplified transmitter architecture, reduced random-number consumption, and low deployment cost. However, its security against source-side light-injection attacks remains unexplored. In this paper, the effects of such attacks on unidimensional-modulation continuous-variable quantum key distribution systems are systematically investigated. A theoretical model of quantum-state preparation at the transmitter under light-injection attacks is established, parameter estimation bias formulas are derived, the resulting degradation in the secret key rate is quantified, and the theoretical results are validated through numerical simulations. In addition, the security implications of light-injection attacks in the finite-size regime are examined. The results demonstrate that light-injection attacks cause overestimation of the channel transmittance and underestimation of excess noise. Under finite-size conditions, these attacks reduce the minimum data-block length required to achieve a positive secret key rate, thereby creating a false indication of security even when no secure key can actually be generated. These findings demonstrate that light-injection attacks constitute a serious threat to unidimensional-modulation continuous-variable quantum key distribution systems and provide an important theoretical foundation for future secure practical deployment.
Abstract In a practical continuous‐variable quantum key distribution (CVQKD) system, a new security loophole opened by the photorefractive effect of lithium niobate‐based (LN‐based) modulators is explored. Exploiting this loophole, a quantum hacking strategy called the induced‐photorefraction attack is proposed. This strategy utilizes the induced photorefraction on the LN‐based modulators to conceal a classical intercept‐resend attack. Specifically, the induced photorefraction biases the response curve of the LN‐based modulator, which affects the intensity of the modulated signal. Based on the investigation of channel parameter estimation and the analysis of the secret key rate of the practical CVQKD system, the simulation results show that the communication parties overestimate the secret key rate, which reveals that Eve can actively open a security loophole via the induced‐photorefraction attack to obtain secret key information. To defend against this attack, a random monitoring scheme for modulation variance is proposed to detect the attack, along with an improved optical power limiter to mitigate the irradiation beam. Additionally, a Sagnac‐based IM is suggested to stabilize the practical CVQKD system. Furthermore, the impact of this attack is analyzed on continuous‐variable measurement‐device‐independent QKD systems ((CV‐MDI‐QKD) and on local‐local‐oscillator (LLO) systems and propose countermeasures for each. Finally, the passive‐state‐preparation CVQKD protocol is proposed to fundamentally close the security loopholes originating from the modulators.
Modulators based on the Mach-Zehnder interferometer (MZI) structure are widely used in continuous-variable quantum key distribution (CVQKD) systems. MZI-based variable optical attenuator (VOA) and amplitude modulator can reshape the waveform and control the intensity of coherent state signal to realize secret key information modulation in CVQKD system. However, these devices are not ideal, internal and external effects like non-linear effect and temperature may degrade their performance. In this paper, we analyzed the security loophole of CVQKD under the photorefractive effect (PE), which originates from the crystal characteristic of lithium niobate (LN). It is found that the refractive index change of modulators because of PE may lead to an overestimate or underestimate of the final secret key rate. This allows Eve to perform further attacks like intercept-resend to get more secret key information. To solve this problem, several countermeasures are proposed, which can effectively eliminate potential risks.
Lithium niobate materials, which have the potential to fabricate lasers, modulation devices, and photodetectors, are widely used in quantum information processing due to their exceptional optical and electro-optical properties. However, the photorefractive effect in lithium niobate materials may cause the quantum device to deviate from its ideal operation model, which is an important assumption for the security of quantum key distribution. Here, we demonstrate the practical security of the continuous-variable quantum key distribution protocol under the photorefractive effect, where the eavesdropper Eve injects a 488 nm visible light into the source-side variable optical attenuator and excites the photorefractive effect phenomenon in a lithium-niobate-based dual-waveguide. In particular, we derive the photorefractive-effect-induced intensity change of a variable optical attenuator and then the corresponding parameter estimation process, showing the effectiveness of this attack for various irradiation powers and waveguide technologies (including proton-exchanged and annealed-proton-exchanged waveguides). To show its effect on practical continuous-variable quantum key distribution systems, we present the composable finite-size security of one-way continuous-variable quantum key distribution and continuous-variable measurement-device-independent quantum key distribution protocols. Numerical results show that this induced-photorefraction attack can break the security even with a low irradiation power, such as 3 [Formula: see text] (or about 0.21 [Formula: see text]). In addition, we find that Eve's optimal attack strategy against continuous-variable measurement-device-independent quantum key distribution is related to the information reconciliation process by comparing three different attack strategies. Finally, we discuss some possible countermeasures to resist induced-photorefraction attacks to enhance the security of the system.