Challenges
Datasets
Workspaces
Papers
Discussions
Leaderboard
Log inSign up
Challenges
Datasets
Workspaces
Papers
Discussions
Leaderboard
Blog
Job Board
Q3AS

© 2026 Aqora Quantum S.A.S.

TermsPrivacyLegal Notice

arXiv:quant-ph/0111073 · Quantum Information and Computation

A practical trojan horse for Bell-inequality-based quantum cryptography

Jan-Åke Larsson

Published Oct 1, 2002• 21 citations
arXivHTMLPDF

Abstract

Quantum Cryptography, or more accurately, Quantum Key Distribution (QKD) is based on using an unconditionally secure ``quantum channel'' to share a secret key among two users. A manufacturer of QKD devices could, intentionally or not, use a (semi-)classical channel instead of the quantum channel, which would remove the supposedly unconditional security. One example is the BB84 protocol, where the quantum channel can be implemented in polarization of single photons. Here, use of several photons instead of one to encode each bit of the key provides a similar but insecure system. For protocols based on violation of a Bell inequality (e.g., the Ekert protocol) the situation is somewhat different. While the possibility is mentioned by some authors, it is generally thought that an implementation of a (semi-)classical channel will differ significantly from that of a quantum channel. Here, a counterexample will be given using an identical physical setup as is used in photon-polarization Ekert QKD. Since the physical implementation is identical, a manufacturer may include this modification as a Trojan Horse in manufactured systems, to be activated at will by an eavesdropper. Thus, the old truth of cryptography still holds: you have to trust the manufacturer of your cryptographic device. Even when you do violate the Bell inequality.

DOI
10.26421/qic2.6-2

Related papers

Security and performance analyses of quantum-key-distribution systems

Chi‐Hang Fred Fung

Quantum cryptography, or, more precisely, quantum key distribution (QKD) allows two distant parties, Alice and Bob, to expand a previously shared secret key by sending quantum states through a quantum channel. The goal here is for Alice and Bob to communicate securely in the presence of an eavesdropper, Eve. The most well-known QKD protocol is the Bennett-Brassard 1984 (BB84) protocol, which has been proved unconditionally secure against any attacks allowed by quantum mechanics. The main advantage of QKD over conventional cryptography is its absolute security. Thus, it is imperative to evaluate the security and performance of QKD protocols and realistic QKD systems. In this thesis, we study the security and performance aspects of QKD in four parts. In the first part, we study the Scarani-Acin-Ribordy-Gisin 2004 (SARG04) protocol. This protocol differs from the BB84 protocol only in the classical post-processing step and uses the same four quantum states as the BB84 protocol. We compared these two protocols and showed that in typical situations, the classical post-processing software for BB84 should be used in order to have a higher performance. In the second part, we prove the security of a three-state protocol. This protocol is similar to the BB84 protocol in that they share the same three qubit states. In the third part, we consider a practical Trojan horse attack on practical QKD systems implementing the BB84 protocol. The attack works by taking advantage of the finite response time of practical phase modulators to remap the states sent out by the legitimate user, Alice. We showed that if Alice and Bob are unaware of our attack, the final key shared between them can be compromised in some situations. In the fourth part, we consider another type of Trojan horse attack, which is based on mismatch between detection efficiencies of detectors. Practical detectors in QKD systems usually do not have identical efficiencies and an eavesdropper Eve may be able to exploit this efficiency mismatch to steal information about the final secret key. We analyze the security of the attack and show that it is possible for Eve to acquire some information on the final secret key if Alice and Bob are unaware of this attack.

•Jan 1, 2008•0 citations

Quantum cryptography with malicious devices

Marcos Curty, Hoi‐Kwong Lo

The current paradigm for the security of quantum key distribution (QKD) relies on the legitimate users of the system trusting their devices, which include both the quantum communication components and the classical post-processing units. However, in view of the memory attacks recently proposed against device-independent QKD, as well as the many hardware and software Trojan Horse attacks that threaten the security of conventional cryptography today, such trust is a very strong and unjustified assumption. Here we review a recent proposal to solve this problem based on the use of verifiable secret sharing and redundancies. We show that this approach can deliver secret key rates which are comparable to those obtained in an ideal scenario with honest devices.

SPIE Quantum Information Science and Technology•Oct 8, 2018•1 citation

MODIFICATION & IMPLEMENTATION OF QUANTUM KEY DISTRIBUTION QKD(BB84) PROTOCOL

Quantum cryptography is a science that exploits quantum mechanical properties to perform cryptographic tasks.The best-known example of quantum cryptography is quantum key distribution, which offers an information-theoretically secure solution to the key exchange problem.I try to generalize the first quantum key distribution protocol called BB84 and implement the protocol in different steps.The implementation is performed in a fully theoretical manner with a general mathematical base.I propose here an algorithm that can make this protocol more secure.After implementation of the protocol, I tried to find out the result, which I illustrated with figures and tables and also proposed here as a suitable polarizer diagram model that helped me find the outcome of this concept.My proposed polarizer diagram only works to encode and decode the valuable secret key that is transferred from sender to receiver, and the secret key will not be transferred as binary bit data but as a photon particle by the photon polarizer converter.Though the protocol BB84 is the most secure of all quantum key distribution protocols, I tried to make it more secure from any third-party access.

International Research Journal of Modernization in Engineering Technology and Science•Sep 20, 2023•0 citations

Bell’s inequality, random sequence, and quantum key distribution

Won-Young Hwang

The Ekert 1991 quantum key distribution (QKD) protocol appears to be secure regardless of whatever devices legitimate users adopt for the protocol, as long as the devices give a result that violates Bell's inequality. However, this is not the case if they ignore nondetection events because Eve can make use of the detection loophole, as Larrson showed [Quantum Inf. Comput. 2, 434 (2002)]. We show that even when legitimate users take into account nondetection events Eve can successfully eavesdrop if the QKD system has been appropriately designed by the manufacturer. A loophole utilized here is that of ``free choice'' (or ``real randomness''). Local QKD devices with a pseudorandom sequence generator installed in them can apparently violate Bell's inequality.

arXiv:quant-ph/0501162•Physical Review A•May 26, 2005•6 citations

The practical issues of side-channel-secure quantum key distribution

Cong Jiang, Hu, Xiao-Long, Zong‐Wen Yu +2 more

Quantum Key Distribution (QKD) leverages the principles of quantum mechanics to provide theoretically unconditional security for cryptographic key sharing. However, practical implementations remain vulnerable due to non-ideal devices and potential security loopholes at both the source and detection sides of QKD systems. The side-channel-secure (SCS) protocol addresses these challenges by encoding bits in vacuum and non-vacuum states and introducing a third-party measurement node, thereby repelling attacks targeting the detection side as well as external lab attacks on the source side. In this work, we consider the state-dependent correlated errors and Trojan-horse attack while preserving the SCS protocol's key advantage-specifically, requiring only upper bounds on intensities characterization without needing a full description of quantum states in infinite dimensions. Numerical results demonstrate that when the reflected light intensity from Trojan-horse attacks falls below $10^{-6}$, Eve can scarcely extract additional key information from the reflections. This work makes the SCS protocol more practical.

arXiv:2508.15197•Aug 21, 2025•0 citations

Lightweight mediated semi-quantum key distribution protocol

Chia‐Wei Tsai, Chun‐Wei Yang, Narn-Yih Lee

Classical users can share a secret key with a quantum user by using a semi-quantum key distribution (SQKD) protocol. Allowing two classical users to share a secret key is the objective of the mediated semi-quantum key distribution (MSQKD) protocol. However, the existing MSQKD protocols need a quantum user to assist two classical users in distributing the secret keys, and these protocols require that the classical users be equipped with a Trojan horse photon detector. This reduces the practicability of the MSQKD protocols. Therefore, in this study we propose a lightweight MSQKD, in which the two participants and third party are classical users. Due to the usage of the one-way transmission strategy, the proposed lightweight MSQKD protocol is free from quantum Trojan horse attack. The proposed MSQKD is more practical than the existing MSQKD protocols.

Modern Physics Letters A•Aug 7, 2019•29 citations
Quantum Cryptography, or more accurately, Quantum Key Distribution (QKD) is based on using an unconditionally secure ``quantum channel'' to share a secret key among two users. A manufacturer of QKD devices could, intentionally or not, use a (semi-)classical channel instead of the quantum channel, which would remove the supposedly unconditional security. One example is the BB84 protocol, where the quantum channel can be implemented in polarization of single photons. Here, use of several photons instead of one to encode each bit of the key provides a similar but insecure system. For protocols based on violation of a Bell inequality (e.g., the Ekert protocol) the situation is somewhat different. While the possibility is mentioned by some authors, it is generally thought that an implementation of a (semi-)classical channel will differ significantly from that of a quantum channel. Here, a counterexample will be given using an identical physical setup as is used in photon-polarization Ekert QKD. Since the physical implementation is identical, a manufacturer may include this modification as a Trojan Horse in manufactured systems, to be activated at will by an eavesdropper. Thus, the old truth of cryptography still holds: you have to trust the manufacturer of your cryptographic device. Even when you do violate the Bell inequality.
Quantum cryptography, or, more precisely, quantum key distribution (QKD) allows two distant parties, Alice and Bob, to expand a previously shared secret key by sending quantum states through a quantum channel. The goal here is for Alice and Bob to communicate securely in the presence of an eavesdropper, Eve. The most well-known QKD protocol is the Bennett-Brassard 1984 (BB84) protocol, which has been proved unconditionally secure against any attacks allowed by quantum mechanics. The main advantage of QKD over conventional cryptography is its absolute security. Thus, it is imperative to evaluate the security and performance of QKD protocols and realistic QKD systems. In this thesis, we study the security and performance aspects of QKD in four parts. In the first part, we study the Scarani-Acin-Ribordy-Gisin 2004 (SARG04) protocol. This protocol differs from the BB84 protocol only in the classical post-processing step and uses the same four quantum states as the BB84 protocol. We compared these two protocols and showed that in typical situations, the classical post-processing software for BB84 should be used in order to have a higher performance. In the second part, we prove the security of a three-state protocol. This protocol is similar to the BB84 protocol in that they share the same three qubit states. In the third part, we consider a practical Trojan horse attack on practical QKD systems implementing the BB84 protocol. The attack works by taking advantage of the finite response time of practical phase modulators to remap the states sent out by the legitimate user, Alice. We showed that if Alice and Bob are unaware of our attack, the final key shared between them can be compromised in some situations. In the fourth part, we consider another type of Trojan horse attack, which is based on mismatch between detection efficiencies of detectors. Practical detectors in QKD systems usually do not have identical efficiencies and an eavesdropper Eve may be able to exploit this efficiency mismatch to steal information about the final secret key. We analyze the security of the attack and show that it is possible for Eve to acquire some information on the final secret key if Alice and Bob are unaware of this attack.
The current paradigm for the security of quantum key distribution (QKD) relies on the legitimate users of the system trusting their devices, which include both the quantum communication components and the classical post-processing units. However, in view of the memory attacks recently proposed against device-independent QKD, as well as the many hardware and software Trojan Horse attacks that threaten the security of conventional cryptography today, such trust is a very strong and unjustified assumption. Here we review a recent proposal to solve this problem based on the use of verifiable secret sharing and redundancies. We show that this approach can deliver secret key rates which are comparable to those obtained in an ideal scenario with honest devices.
Quantum cryptography is a science that exploits quantum mechanical properties to perform cryptographic tasks.The best-known example of quantum cryptography is quantum key distribution, which offers an information-theoretically secure solution to the key exchange problem.I try to generalize the first quantum key distribution protocol called BB84 and implement the protocol in different steps.The implementation is performed in a fully theoretical manner with a general mathematical base.I propose here an algorithm that can make this protocol more secure.After implementation of the protocol, I tried to find out the result, which I illustrated with figures and tables and also proposed here as a suitable polarizer diagram model that helped me find the outcome of this concept.My proposed polarizer diagram only works to encode and decode the valuable secret key that is transferred from sender to receiver, and the secret key will not be transferred as binary bit data but as a photon particle by the photon polarizer converter.Though the protocol BB84 is the most secure of all quantum key distribution protocols, I tried to make it more secure from any third-party access.
The Ekert 1991 quantum key distribution (QKD) protocol appears to be secure regardless of whatever devices legitimate users adopt for the protocol, as long as the devices give a result that violates Bell's inequality. However, this is not the case if they ignore nondetection events because Eve can make use of the detection loophole, as Larrson showed [Quantum Inf. Comput. 2, 434 (2002)]. We show that even when legitimate users take into account nondetection events Eve can successfully eavesdrop if the QKD system has been appropriately designed by the manufacturer. A loophole utilized here is that of ``free choice'' (or ``real randomness''). Local QKD devices with a pseudorandom sequence generator installed in them can apparently violate Bell's inequality.
Quantum Key Distribution (QKD) leverages the principles of quantum mechanics to provide theoretically unconditional security for cryptographic key sharing. However, practical implementations remain vulnerable due to non-ideal devices and potential security loopholes at both the source and detection sides of QKD systems. The side-channel-secure (SCS) protocol addresses these challenges by encoding bits in vacuum and non-vacuum states and introducing a third-party measurement node, thereby repelling attacks targeting the detection side as well as external lab attacks on the source side. In this work, we consider the state-dependent correlated errors and Trojan-horse attack while preserving the SCS protocol's key advantage-specifically, requiring only upper bounds on intensities characterization without needing a full description of quantum states in infinite dimensions. Numerical results demonstrate that when the reflected light intensity from Trojan-horse attacks falls below 10−610^{-6}10−6, Eve can scarcely extract additional key information from the reflections. This work makes the SCS protocol more practical.
Classical users can share a secret key with a quantum user by using a semi-quantum key distribution (SQKD) protocol. Allowing two classical users to share a secret key is the objective of the mediated semi-quantum key distribution (MSQKD) protocol. However, the existing MSQKD protocols need a quantum user to assist two classical users in distributing the secret keys, and these protocols require that the classical users be equipped with a Trojan horse photon detector. This reduces the practicability of the MSQKD protocols. Therefore, in this study we propose a lightweight MSQKD, in which the two participants and third party are classical users. Due to the usage of the one-way transmission strategy, the proposed lightweight MSQKD protocol is free from quantum Trojan horse attack. The proposed MSQKD is more practical than the existing MSQKD protocols.