Homodyne-detector-blinding attack in continuous-variable quantum key distribution

We propose an efficient strategy to attack a continuous-variable (CV) quantum key distribution (QKD) system, which we call homodyne detector blinding. This attack strategy takes advantage of a generic vulnerability of homodyne receivers: A bright light pulse sent on the signal port can lead to a saturation of the detector electronics. While detector saturation has already been proposed to attack CV QKD, the attack we study in this paper has the additional advantage of not requiring an eavesdropper to be phase locked with the homodyne receiver. We show that under certain conditions, an attacker can use a simple laser, incoherent with the homodyne receiver, to generate bright pulses and bias the excess noise to arbitrary small values, fully comprising CV QKD security. These results highlight the feasibility and the impact of the detector-blinding attack. We finally discuss how to design countermeasures in order to protect against this attack.

Figure 1

Simplified scheme of a practical homodyne detector: BS, beam splitter; VOA, variable optical attenuator; PD, photodiode; Amp, amplifier; ADC, analog-to-digital converter; solid line, optical signal; dash line, electronic signal.

Figure 2

Characterization of HD output voltage statistics, in the absence of signal, under two different balancing conditions (solid lines and dashed lines): (a) mean value $V$ versus LO power and (b) variance $V^2$ versus LO power.

Figure 3

Concept scheme of Eve's homodyne detector-blinding attack in CV QKD: Alice, preparation of the coherent state with Gaussian modulation $V_A$; Eve, heterodyne measurement $X_M,P_M$, re-preparation $X_E,P_E$, and external light state $X_{E,\text{ext}},P_{E,\text{ext}}$; Bob, homodyne detector measurement $X_B,P_B$; BS, beam splitter; LO, local oscillator; PD, pin photodiode; AMP, amplifier; ADC, analog-to-digital converter.

Figure 4

Excess noise contributions, for different blinding attack parameters, as a function of the photon number per pulse ratio $R$. Solid curves stand for the excess noise due to the blinding laser intensity fluctuation (see the text). The dashed curve stands for excess noise added by blinding laser shot noise. The upper dash-dotted line stands for the excess noise due to the IR attack and the lower dash-dotted line stands for the technical excess noises, which are independent of the external blinding laser.

Figure 5

Simulation of the impact of detector saturation on the quadratures distribution $X_B$ versus $X_A$, for two sets of parameters: (a) $R=0.11$, with no security breach as ${\widehat{\xi }}_{\text{r}}\gg {\xi }_{\text{null}}$, and (b) $R=0.1274$, with a security breach as ${\widehat{\xi }}_{\text{r}}<{\xi }_{\text{null}}$. For both cases, ${\widehat{\xi }}_{\text{i}}\gg {\xi }_{\text{null}}$. Red (dark gray) shows the $X_B$ HD detection range $[-20\sqrt{N_0},20\sqrt{N_0}]$ and green (light gray) the $X_{B_i}$ HD ideal linear case. The corresponding estimation of $\widehat{T}$ and $\widehat{\xi }$ is given in the legend for $X_B$ and $X_{Bi}$, respectively.

Figure 6

Alice and Bob's transmission estimation versus distance under Eve's homodyne detector-blinding attack. The black dashed curve (top one) corresponds to ${\widehat{T}}_{\text{i}}$, which is estimated by $X_{Bi}$ in the linear case, while the other lower curves correspond to the ${\widehat{T}}_{\text{r}}$ in the realistic case, which are estimated by $X_B$ with $R=0.1,0.11,0.12,0.13,0.14$ from top to bottom.

Figure 7

Excess noise estimation of Alice and Bob versus photon number ratio $R$, with $\eta =0.55$, $T_{\text{ext}}=0.49$, $f_{\text{ext}}=0.1\%$, and $v_{\mathrm{ele}}=0.01$, for the range of $R$ equal to (a) 0–0.14 and (b) 0.124–0.13. The five upper curves stand for the excess noise estimations ${\widehat{\xi }}_{\text{r}}$ at different distances and the two lower curves stand for the null key thresholds ${\xi }_{\text{null}}$ at 20 and 40 $\mathrm{k}\mathrm{m}$.