Experimental Quantum Key Distribution Secure Against Malicious Devices

The fabrication of quantum key distribution (QKD) systems typically involves several parties, thus providing Eve with multiple opportunities to meddle with the devices. As a consequence, conventional hardware and/or software hacking attacks pose natural threats to the security of practical QKD. Fortunately, if the number of corrupted devices is limited, the security can be restored by using redundant apparatuses. Here, we report on the demonstration of a secure QKD setup with optical devices and classical postprocessing units possibly controlled by an eavesdropper. We implement a 1.25 GHz chip-based measurement-device-independent QKD system secure against malicious devices on both the measurement and the users’ sides. The secret key rate reaches 137 bps over a 24 dB channel loss. Our setup, benefiting from a high clock rate, miniaturized transmitters, and a cost-effective structure, provides a promising solution for widespread applications requiring uncompromising communication security.

Figure 1

Schematic of the setup implementing the protocol presented in the text. While Alice holds two QKD modules, $\{{\text{QKD}}_{A_j}{\}}_{j=1}^2$, and four CP units, $\{{\text{CP}}_{A_l}{\}}_{l=1}^4$, Bob holds a single module, ${\text{QKD}}_B$, and a single unit, ${\text{CP}}_B$, for simplicity. Each pair of modules, $({\text{QKD}}_{A_j},{\text{QKD}}_B)$ with $j=1,2$, is used to implement a MDI-QKD link using Charles’ central node. The two pairs of keys generated by these links are postprocessed by the CP units. Precisely, on Alice’s side, the postprocessing is performed in a multiparty setting using all four units $\{{\text{CP}}_{A_l}{\}}_{l=1}^4$, while, for simplicity, a standard single-party postprocessing is applied on Bob’s side. In this scenario, the protocol presented in the text is secure if one of Alice’s QKD modules and/or one of Alice’s CP units are corrupted at most. The quantum channels are marked with dashed blue arrows, while every other arrow in the figure is solid and represents a classical channel. All of Alice’s units are connected to each other by links that are assumed to be physically shielded and to connect only the desired units. Thus, further encryption and authentication is not required for them. The same applies to the links that connect a QKD module to a CP unit inside each lab, through which the raw key material and some protocol information is sent to the units for the postprocessing. The classical links connecting a ${\text{CP}}_{A_l}$ with ${\text{CP}}_B$ are authenticated (solid purple arrows). Finally, the central node (Charles) is untrusted and thus no assumptions are made about the classical links between this node and the QKD modules.

Figure 2

(a) Depiction of the experimental MDI-QKD setup described in the text. (b) Schematic of the Si chip. It integrates an intensity modulator (IM), a polarization modulator (POL), and a variable optical attenuator (VOA). See Sec. 3 for a detailed description of the different elements.

Figure 3

Simulation (lines) and experimental result (solid black triangle) of the secret key rate as a function of the channel loss. The achieved experimental secret key rate for a total emulated channel loss of 24 dB is $1.1\times {10}^{-7}$ bits/pulse. The solid line corresponds to a simulation of the secret key rate in the setting with dishonest devices described by the experiment. The dashed line corresponds to the standard setting where the parties assume that all their devices are honest. The secret key rate in this latter scenario roughly doubles that with dishonest devices. This is so because of the need to discard the key generated by the potentially malicious QKD pair via PA when dishonest devices are considered. Moreover, this approximate factor 2 shows that the extra authentication cost required in the experiment due to the use of redundant devices is negligible.

Figure 4

(a) Encryption and decryption with the shared secret key. Alice encrypts a $300\times 300$ pixels grayscale image of a panda, $m$, with her final key, $S_A$, and the one-time pad encryption scheme. Bob decrypts the image correctly using his final key $S_B=S_A$. (b) Illustration of Eve’s failed attempt to decrypt the encrypted picture. Despite Eve’s significant knowledge about the sifted key, $Z_A$, due to both her possible intervention in the quantum channel and the information revealed by the corrupted devices—assumed to be ${\mathrm{QKD}}_{A_1}$ and ${\mathrm{CP}}_{A_1}$ for illustration purposes here—her attempt to decrypt the intercepted picture using $S_E$ (defined in the text) yields a white noise output, fully uncorrelated to the actual picture. However, if, as in standard QKD, only one QKD module and one CP unit are used, Eve’s attempt is successful unless both of them are honest.