Insecurity of Detector-Device-Independent Quantum Key Distribution

Abstract

Detector-device-independent quantum key distribution (DDI-QKD) held the promise of being robust to detector side channels, a major security loophole in quantum key distribution (QKD) implementations. In contrast to what has been claimed, however, we demonstrate that the security of DDI-QKD is not based on postselected entanglement, and we introduce various eavesdropping strategies that show that DDI-QKD is in fact insecure against detector side-channel attacks as well as against other attacks that exploit devices' imperfections of the receiver. Our attacks are valid even when the QKD apparatuses are built by the legitimate users of the system themselves, and thus, free of malicious modifications, which is a key assumption in DDI-QKD. DOI: 10.1103/PhysRevLett.117.250505 Introduction.-Quantum key distribution (QKD), a technique to distribute a secret random bit string between two separated parties (Alice and Bob), needs to close the gap between theory and practice [1]. In theory, QKD provides information-theoretic security. In practice, however, it does not because QKD implementation devices do not typically conform to the theoretical models considered in the security proofs. As a result, any unaccounted device imperfection might constitute a side channel, which could be used by an eavesdropper (Eve) to learn the secret key without being detected [2][3][4][5][6][7][8][9][10][11][12].To bridge this gap, various approaches have been proposed recently [13][14][15][16][17], with measurement-deviceindependent QKD (MDI-QKD) [17] probably being the most promising one in terms of feasibility and performance. Its security is based on postselected entanglement, and it can remove all detector side channels from QKD implementations, which is arguably their major security loophole [3][4][5][6][7][8][9][10]12]. Also, its practicality has been already confirmed both in laboratories and via field trials [18][19][20][21][22][23][24]. A drawback of MDI-QKD is, however, that it requires high-visibility two-photon interference between independent sources, which makes its implementation more demanding than that of conventional QKD schemes. In addition, current finite-key security bounds against general attacks [25] require larger postprocessing data block sizes than those of standard QKD, though recent proposals [26] significantly improve the performance of MDI-QKD in the finitekey regime.To overcome these limitations, a novel approach, socalled detector-device-independent QKD (DDI-QKD), has

Practical challenges in quantum key distribution

“…Notes added in proof After a completion of a preliminary version of this paper, a recent preprint 181 has been posted on the arXiv that demonstrates the insecurity of DDI-QKD protocol. In addition, it has come to our attention that DI-QKD remains vulnerable to covert channels such as memory attack.…”

Efficient High-Dimensional Quantum Key Distribution with Hybrid Encoding

“…The third and final assumptions are different from the scenario of MDI-QKD. They are necessary to prevent particular classes of side channel attacks [ 28 , 29 ]. The third assumption can be considered not impractical, since d -QKD with hybrid encoding has the similar experimental situation to prepare-and-measure QKD protocols like original BB84.…”

“…Detector blinding attack with various blinding power [ 13 ] can threaten d -QKD with hybrid encoding as well as the original DDI-QKD [ 29 ]. However, since the attack requires a prior knowledge about the detectors, it is not compatible with assumption (iv).…”

“…As its scheme is similar to the process of BSM used in MDI-QKD, it was conjectured that DDI-QKD guarantees the same security level with MDI-QKD. However, it has been shown that not all the side channel attacks are protected with DDI-QKD [ 28 , 29 ], and an assumption of the trusted measurement setup is necessary for ensuring its security.…”

“…We note that our protocol is more secure than the original BB84 protocol against a side channel attack (but less secure than MDI-QKD). For example, it can detect the basic detector blinding attack [ 12 ] from double clicks of detectors [ 28 , 29 ]. On the other hand, the attained key rate with our protocol is comparable with BB84 protocol, while MDI-QKD has a half of signal sifting rate of BB84 protocol due to the 50% limit of the success probability of the BSM.…”