Quantum hacking: Experimental demonstration of time-shift attack against practical quantum-key-distribution systems

Abstract

Quantum key distribution (QKD) systems can send signals over more than 100 km standard optical fiber and are widely believed to be secure. Here, we show experimentally for the first time a technologically feasible attack, namely the time-shift attack, against a commercial QKD system. Our result shows that, contrary to popular belief, an eavesdropper, Eve, has a non-negligible probability (∼4%) to break the security of the system. Eve's success is due to the well-known detection efficiency loophole in the experimental testing of Bell inequalities. Therefore, the detection efficiency loophole plays a key role not only in fundamental physics, but also in technological applications such as QKD.PACS numbers: 03.67.Dd Quantum key distribution (QKD) [1,2] provides a method to share a secret key between legitimate users called "Alice" (the sender) and "Bob" (the receiver). The unconditional security of QKD has ben rigorously proved based on the laws of physics [3,4]. Even imperfect practical QKD systems have also been proved secure assuming some semi-realistic models [5,6]. The decoy method [7] was proposed to dramatically improve the performance of a practical QKD system. Our group has implemented the decoy method experimentally over 15km and 60km of telecom fibers [8]. Incidentally, QKD has found real-life applications in a recent Swiss election [9].Recently, there has been a lot of theoretical interest on the connection between the security of QKD and fundamental physical principles such as the violation of Bell's inequality and the no-signaling constraint [10] on spacelike observables. An ultimate goal, which has not yet been achieved [11], is to construct a device-independent security proof. As is well-known, the experimental testing of Bell's inequality often suffers from the detection efficiency loophole. A fair sampling assumption may save the day. However, as we will demonstrate below, rather surprisingly, the low detection efficiency of practical detectors not only violates the fair sampling assumption that would be needed in security proofs based on Bellinequality violation, but also gives Eve (an eavesdropper) a powerful handle to break the security of a practical QKD system. Therefore, the detection efficiency loophole is of both conceptual and practical interest.Our work is an illustration of general physical limitations, rather than a particular technological weakness. Indeed, a practical QKD system often includes two or more detectors. It is virtually impossible to manufacture identical detectors in practice. As a result, the two detectors of the same QKD system will exhibit different detection efficiencies as functions of either one or a combination of variables in the time, frequency, polarization, and/or spatial domains. If Eve manipulates a signal in these variables, she could effectively exploit the detection efficiency loophole to break the security of a QKD system. In our experiment, we consider Eve's manipulation of the time variable. Our work demonstrates the general problem of detection efficie...

Experimental plug and play quantum coin flipping

“…In addition, errors in the state preparation performed by Alice have been considered in detail in the security analysis of our implementation (see Supplementary Note 1). Similarly, attacks exploiting the loophole introduced by detection efficiency mismatch, such as the time-shift attack [44][45][46] , are, in principle, excluded by the symmetrization procedure included in our experimental protocol. Finally, an effective countermeasure against the powerful blinding attack 47 , where the single-photon detectors are brought to a classical operation regime and can be fully controlled by the adversary, consists in randomly suppressing detector gates and emitting an alarm signal in case of registered detection events during those gates.…”

Finite-key analysis for measurement-device-independent quantum key distribution

“…Its feasibility has been promptly demonstrated both in laboratories and via field tests [24][25][26][27] . It successfully removes all (existing and yet to be discovered) detector side channels 3,5,6,[9][10][11] , which, arguably, is the most critical part of most QKD implementations. Importantly, in contrast to diQKD, this solution does not require that Alice and Bob perform a loophole-free Bell test; it is enough if they prove the presence of entanglement in a quantum state that is effectively distributed between them, just like in standard QKD schemes 28 .…”

“…In practice, however, it does not, as most practical devices behave differently from the theoretical models assumed in the security proofs. As a result, we face implementation loopholes, or so-called side channels, which may be used by adversaries without being detected, as seen in recent attacks against certain commercial QKD systems [3][4][5][6][7][8][9][10][11] .…”

After-gate attack on a quantum cryptosystem

“…Some implementations are, for example, susceptible to non-conforming light pulses that Eve sends into Alice's or Bob's devices. Eve could use reflectometry to read modulator states [12] or take control of the detectors by sending faked states [13,14], timeshifted pulses [15] or by detector blinding combined with faked states [16]. The impact of such interventions strongly depends on the particular implementation.…”