The security of quantum communication using a weak coherent source requires an accurate knowledge of the source's mean photon number. Finite calibration precision or an active manipulation by an attacker may cause the actual emitted photon number to deviate from the known value. We model effects of this deviation on the security of three quantum communication protocols: the Bennett-Brassard 1984 (BB84) quantum key distribution (QKD) protocol without decoy states, Scarani-Acín-Ribordy-Gisin 2004 (SARG04) QKD protocol, and a coin-tossing protocol. For QKD, we model both a strong attack using technology possible in principle, and a realistic attack bounded by today's technology. To maintain the mean photon number in two-way systems, such as plugand-play and relativistic quantum cryptography schemes, bright pulse energy incoming from the communication channel must be monitored. Implementation of a monitoring detector has largely been ignored so far, except for ID Quantique's commercial QKD system Clavis2. We scrutinize this implementation for security problems, and show that designing a hack-proof pulse-energy-measuring detector is far from trivial. Indeed the first implementation has three serious flaws confirmed experimentally, each of which may be exploited in a cleverly constructed Trojan-horse attack. We discuss requirements for a loophole-free implementation of the monitoring detector.

Practical quantum communication (QC) protocols are assumed to be secure provided implemented devices are properly characterized and all known side channels are closed. We show that this is not always true. We demonstrate a laser-damage attack capable of modifying device behaviour ondemand. We test it on two practical QC systems for key distribution and coin-tossing, and show that newly created deviations lead to side channels. This reveals that laser damage is a potential security risk to existing QC systems, and necessitates their testing to guarantee security.Cryptography, an art of secure communication, has traditionally relied on either algorithmic or computational complexity [1]. Even the most state-of-the-art classical cryptographic schemes do not have a strict mathematical proof to ascertain their security. With the advance of quantum computing, it may be a matter of time before the security of the most widely used public-key cryptography protocols is broken [2]. Quantum communication (QC) protocols, on the other hand, have theoretical proofs of being unconditionally secure [3][4][5][6][7][8][9]. In theory, their security is based on the assumption of modeled behaviour of implemented equipment. In practice, the actual behaviour often deviates from the modeled one, leading to a compromise of security as has been seen so far in case of quantum key distribution (QKD) [10][11][12][13][14][15][16]. However, it is widely assumed that as long as these deviations are properly characterized and security proofs are updated accordingly [5,17], implementations are unconditionally secure. In this work we show that satisfying this during the initial installation only is not enough to guarantee security. Even if a system is perfectly characterized and deviations are included into the security proofs, an adversary can still create a new deviation ondemand and make the system insecure.Before going into details on how the adversary may do it, let's consider a few examples of deviations and their consequences. For example, a calibrated optical attenuator is required to set a precise value of the outgoing mean photon number µ in the implementations of ordinary QKD [18, 19] [9] protocols. An unexpected increase of this * makarov@vad1.com optical component's attenuation may cause a denial-ofservice. However, a reduction in attenuation will increase µ, leading to a compromise of security via attacks that rely on measurement of multi-photon pulses [25,26]. E.g., in QKD and secret-sharing this will allow eavesdropping of the key, and in bit commitment cheating the committed bit value. Some implementations use a detector for time synchronization [8,9,18, 19,[21][22][23][24]. Desensitizing it may result in the denial-of-service. However, several implementations require a calibrated monitoring detector for security purposes [8,9,18, 19,21,23,24]. A reduction in its sensitivity may lead to security vulnerabilities such as a Trojan-horse attack that reads the state preparation [27]. This leaks the key in QKD, increases the cheating p...

Quantum key distribution (QKD) takes advantage of fundamental properties of quantum physics to allow two distant parties to share a secret key; however, QKD is hampered by a distance limitation of a few hundred kilometers on Earth. The most immediate solution for global coverage is to use a satellite, which can receive separate QKD transmissions from two or more ground stations and act as a trusted node to link these ground stations. In this article we report on a system capable of performing QKD in the high loss regime expected in an uplink to a satellite using weak coherent pulses and decoy states. Such a scenario profits from the simplicity of its receiver payload, but has so far been considered to be infeasible due to very high transmission losses (40-50 dB). The high loss is overcome by implementing an innovative photon source and advanced timing analysis. Our system handles up to 57 dB photon loss in the infinite key limit, confirming the viability of the satellite uplink scenario. We emphasize that while this system was designed with a satellite uplink in mind, it could just as easily overcome high losses on any free space QKD link.

No abstract

No abstract