Device Calibration Impacts Security of Quantum Key Distribution

Characterizing the physical channel and calibrating the cryptosystem hardware are prerequisites for establishing a quantum channel for quantum key distribution (QKD). Moreover, an inappropriately implemented calibration routine can open a fatal security loophole. We propose and experimentally demonstrate a method to induce a large temporal detector efficiency mismatch in a commercial QKD system by deceiving a channel length calibration routine. We then devise an optimal and realistic strategy using faked states to break the security of the cryptosystem. A fix for this loophole is also suggested.

Figure 1

Typical detection system in a Mach-Zehnder interferometer based QKD implementation. The bit and basis choices of Alice and Bob (phases ${\phi }_{\mathrm{Alice}}$ and ${\phi }_{\mathrm{Bob}}$) determine the interference result at the $50:50$ beam splitter (BS), deciding in turn which of the two detectors $D0$ or $D1$ would click. It is thus crucial that $D0$ and $D1$ are indistinguishable to the outside world (i.e., Eve). If gated mode APDs are employed, the detector control board ensures that the activation of $D0$ and $D1$ [via voltage pulses $V_0(t)$ and $V_1(t)$] happens almost simultaneously, to nullify any existing temporal efficiency mismatch.

Figure 2

Manipulation of the calibration routine. (a) Simplified version of Alice and Bob devices and Eve (in italic) gearing for the hack. FM, Faraday mirror; CD, classical photodiode; DLs, delay loops; VOA, variable optical attenuator; CR, coupler; BS, $50:50$ beam splitter; PBS, polarizing beam splitter; C, optical circulator. The hexagonal-shaped objects are phase modulators (PMs); ${\phi }_X$, where $X$ is Bob, Alice, or Eve, represents the applied modulation. (b) Timeline for a cycle of the hacked LLM. $V_{\pi }$, PM voltage for a $\pi$ phase shift.

Figure 3

Induced temporal mismatch. Efficiencies ${\eta }_0(t)$ (dotted line) and ${\eta }_1(t)$ (dashed line) from normal LLMs, on the left, and after Eve’s hack that induced a separation of 459 ps, on the right. The logarithm of their ratio, quantifying the degree of mismatch (solid line), is at least an order of magnitude higher in the flanks after Eve’s hack: the dash-dotted line indicates zero mismatch. To eavesdrop successfully, Eve times the arrival of “appropriately bright” faked states at $t=t_0$ or $t_1$ in Bob.

Figure 4

Minimum QBER versus click probabilities in $D0$ and $D1$. Eve minimizes the error with a suitable choice of the mean photon number of the faked states (for this plot, $1<{\mu }_0<100$ and $21<{\mu }_1<120$ at Bob’s detectors). The thick shaded line indicates Bob’s detection probabilities. The QBER introduced by Eve stays below 7% for $T\gtrsim 0.25$.