Superlinear threshold detectors in quantum cryptography

We introduce the concept of a superlinear threshold detector, a detector that has a higher probability to detect multiple photons if it receives them simultaneously rather than at separate times. Highly superlinear threshold detectors in quantum key distribution systems allow eavesdropping the full secret key without being revealed. Here, we generalize the detector control attack, and analyze how it performs against quantum key distribution systems with moderately superlinear detectors. We quantify the superlinearity in superconducting single-photon detectors based on earlier published data, and gated avalanche photodiode detectors based on our own measurements. The analysis shows that quantum key distribution systems using detector(s) of either type can be vulnerable to eavesdropping. The avalanche photodiode detector becomes superlinear toward the end of the gate. For systems expecting substantial loss, or for systems not monitoring loss, this would allow eavesdropping using trigger pulses containing less than 120 photons per pulse. Such an attack would be virtually impossible to catch with an optical power meter at the receiver entrance.

Figure 1

The detection probability versus mean photon number in the trigger pulse for the SSPD in Ref. [36], at $1550\mathrm{n}\mathrm{m}$ and $I_b=0.8I_c$. Count rates were extracted from Fig. 1 in Ref. [36], and divided by the pulse repetition frequency of $82\mathrm{M}\mathrm{Hz}$ to obtain the detection probability. The red circled data points were used to calculate the QBER and the transmittance from an attack.

Figure 2

The measured detection probability for a coherent state with $\mu =20$, 40, 60, and 80, compared to the expected detection probabilities predicted by Eq. (2). Data points are $25\mathrm{p}\mathrm{s}$ apart. Data for detector 0 is shown; detector 1 behaved very similarly. When the mean photon number $\mu$ is increased, deviation between the expected detection probabilities and the actual measured detection probabilities increases, especially at the end of the gate. See also Fig. 3.

Figure 3

Detection probability at the falling edge of the gate (at the $4\mathrm{n}\mathrm{s}$ point in Fig. 2). For $\mu <40$, the shape of the actual detection probability is clearly superlinear, in contrast to the nearly linear expected detection probability.

Figure 4

The minimum QBER (solid curve) caused by trigger pulses with various mean photon numbers calculated from Eq. (4) and the corresponding transmittance (dashed curve) calculated from Eq. (6). The data contains some noise due to fluctuations in applied power and/or fluctuations in the detection efficiency.

Figure 5

Comparison of the detector control attack and the bound from the security proof [16]. The region to the left of the security bound curve (solid curve) allows extraction of a secure key. The region to the right of the detector control attack curve (dashed curve) is clearly insecure, because the attack presented in Sec. 2 can be applied. The region between the curves should be assumed insecure.

Figure 6

Pulse shape of the id300 short-pulsed laser, measured with a $45\mathrm{G}\mathrm{Hz}$ optical probe on a $12.5\mathrm{G}\mathrm{Hz}$ sampling oscilloscope at a pulse repetition rate of $100\mathrm{k}\mathrm{Hz}$.