Source attack of decoy-state quantum key distribution using phase information

Quantum key distribution (QKD) utilizes the laws of quantum mechanics to achieve information-theoretically secure key generation. This field is now approaching the stage of commercialization, but many practical QKD systems still suffer from security loopholes due to imperfect devices. In fact, practical attacks have successfully been demonstrated. Fortunately, most of them only exploit detection-side loopholes, which are now closed by the recent idea of measurement-device-independent QKD. On the other hand, little attention is paid to the source, which may still leave QKD systems insecure. In this work, we propose and demonstrate an attack that exploits a source-side loophole existing in qubit-based QKD systems using a weak coherent state source and decoy states. Specifically, by implementing a linear-optics unambiguous state discrimination measurement, we show that the security of a system without phase randomization—which is a step assumed in conventional security analyses but sometimes neglected in practice—can be compromised. We conclude that implementing phase randomization is essential to the security of decoy-state QKD systems under current security analyses.

Figure 1

Schematic diagram of the $\mathrm{USD}+\mathrm{PNS}$ attack on a decoy-state QKD system without phase randomization. Eve intercepts the quantum states sent by Alice and then performs a USD measurement to distinguish the signal/decoy state succeeded by a PNS attack. Conditioned on her results of signal/decoy information and photon numbers, she sets the yields smartly so that the detection statistics on Bob's side remains the same as the case without attacks.

Figure 2

Schematic of our experiment setup for USD measurement demonstration. Alice's first AMZI splits the signal pulse into two pulses: a strong one for phase stabilization and a weak one for the quantum signal modulated by the intensity modulator (IM) to be either a decoy state or a signal state. The second AMZI encodes the BB84 states with a phase modulator (PM). Then a synchronization pulse is coupled with the signal pulses into a signal fiber and sent to Bob. At Eve's site, she utilizes a polarization controller and polarizer (Pol) to compensate for the polarization change and a phase shifter (PS) to compensate for the phase drift. Then she uses the same AMZI setup as Alice's first one to make the quantum pulse interfere with the strong phase-stabilization pulse modulated by the IM. The interference result either indicates the identity of the quantum pulse (signal or decoy) or is inconclusive.

Figure 3

Bounds on the key generation rate. The lower bound, given in Eq. (1), is computed by ignoring the phase randomization problem. The simulated upper bound is evaluated by Eq. (2) and the data listed in Table . The region for which the upper bound is below the lower bound corresponds to the secret key being stolen by Eve. Also shown are two best theoretical upper bounds using ideal values $q_{\mu }=q_{\nu }=23.0\%,3.75\%$ and ${\xi }_{\mu }={\xi }_{\nu }=1$, where the dash-dotted (dashed) curve corresponds to a setup with a relative phase of $\pi$ (0) between signal and decoy pulses giving rise to $q_{\mu }=q_{\nu }=23.0\%$ ($3.75\%$). Upper bounds corresponding to other relative phases fall between these two curves. Note that in our experiment, the relative phase is 0. Our attack is successful when the lower bound is higher than the upper bound, which occurs when the transmission loss is larger than $36.3$ dB (for our experiment), $21.2$ dB (for the ideal situation with zero relative phase), and $13.3$ dB (for the ideal situation with $\pi$ relative phase).

Figure 4

Experimental results over time for the USD attack demonstration. Note that ${\xi }_{\mu }$ (${\xi }_{\nu }$) is close to 100$\%$, which indicates that we have a nearly perfect interferometer with a high visibility achieving 500:1.

Figure 5

Bounds on the key generation rate. Our attack is successful when the lower bound is higher than the upper bound, which occurs when the transmission loss is between $36.3$ and $48.1$ dB (for our experiment).