Effects of detector efficiency mismatch on security of quantum cryptosystems

We suggest a type of attack on quantum cryptosystems that exploits variations in detector efficiency as a function of a control parameter accessible to an eavesdropper. With gated single-photon detectors, this control parameter can be the timing of the incoming pulse. When the eavesdropper sends short pulses using the appropriate timing so that the two gated detectors in Bob’s setup have different efficiencies, the security of quantum key distribution can be compromised. Specifically, we show for the Bennett-Brassard 1984 (BB84) protocol that if the efficiency mismatch between 0 and 1 detectors for some value of the control parameter gets large enough (roughly 15:1 or larger), Eve can construct a successful faked-states attack causing a quantum bit error rate lower than 11%. We also derive a general security bound as a function of the detector sensitivity mismatch for the BB84 protocol. Experimental data for two different detectors are presented, and protection measures against this attack are discussed.

Figure 1

Set of all possible input signals for a secure system.

Figure 2

(Color online) Bob’s part of the setup. Bob chooses the basis with the phase modulator (PM). The large detector efficiency mismatch is shown on the plot to the right.

Figure 3

The QBER, the mutual information between Alice and Bob, $H(A:B)$, and the mutual information between Alice and Eve, $H(A:E)$, as functions of the normalized efficiency of the blinded detector, $\eta$.

Figure 4

Security state of a QKD system as a function of the normalized efficiency of the blinded detector $\eta$ and the measured QBER. In the “Secure” zone, the required amount of privacy amplification is larger than without considering this attack, being determined by $\delta$ given in Eq. (14). In order to make this plot, we have allowed for some simplifications. The border between “Not proven” and “Insecure” zones is drawn assuming the special case of symmetric detector efficiency curves discussed in Sec. 3. The QBER for the “Insecure” zone is assumed to be without contribution from dark counts in Bob’s detectors.

Figure 5

Detector model 1. Sensitivity curves for the 0 (open squares) and 1 (filled squares) time slots, at low mean number of photons at the APD $(\mu ⪡1)$. Dark counts were subtracted. The curves, originally of different height, were scaled so that their peak points coincide. $t$ is the relative time of arrival of the laser pulse at the APD; $t=0$ was the actual arrival time of Alice’s pulse in the operational QKD setup before this measurement.

Figure 6

Detector model 2. Sensitivity curves for the 0 (open squares) and 1 (filled squares) time slots, at mean number of photons at the APD $\mu =0.5$. Dark counts were subtracted.

Figure 7

Detector model 2. Sensitivity curves for the 0 (open squares) and 1 (filled squares) time slots, at mean number of photons at the APD $\mu =500$. In the encircled time range $(4.65–5.30\mathrm{ns})$ the clicking probability in both detectors measured exactly zero (0 counts registered per $>{10}^5$ gates). Unfortunately the time reference in this plot is not accurately matched with that in Fig. 6, and the curves’ features cannot be directly compared between the two figures.

Figure 8

Detector model 2. Equivalent diagram of a single channel. G is a single-shot generator that forms the gate pulse for the APD. BPF is an equivalent band-pass filter representing the frequency bandwidth of the tract for the reflection signal.