Source-linked AI summary
Breaking a quantum key distribution system through a timing side channel
Antia Lamas-Linares, Christian Kurtsiefer
TL;DR
Publicly exchanged detection timing may correlate with QKD measurement results, a potential source of information about the secret key. The authors characterize detector timing responses and quantify the information available from those timing differences. They report extractable information under favorable binning and substantial access to the key for an uncompensated relative delay.
Problem
Public timing information used to identify signal photons may correlate with quantum measurement results, while physical side channels in practical QKD devices have received comparatively little study.
Source: §1 · p. 2Method
The authors characterize detector timing distributions and quantify their relationship to secret-key bits using mutual information.
Source: §2 · pp. 2–3, §3 · p. 5Results
3.8 ± 0.38% average extractable information under favorable binning; an uncompensated 500 ps relative delay gives the eavesdropper access to more than 25% of the key.
Source: §3 · p. 5Takeaways & Limitations
Characterizing, equalizing, randomizing, or reducing the precision of timing information can limit leakage, with privacy amplification available to address it as errors are addressed.
Source: §3 · p. 6In synchronous prepare-and-measure systems, a local detector timing decision does not provide the eavesdropper information from the detector side, but timing responses of distinct state-preparation devices still require characterization.
Source: §3 · p. 6
Abstract
from arXiv · showhide
The security of quantum key distribution relies on the validity of quantum mechanics as a description of nature and on the non-existence of leaky degrees of freedom in the practical implementations. We experimentally demonstrate how, in some implementations, timing information revealed during public discussion between the communicating parties can be used by an eavesdropper to undetectably access a significant portion of the ``secret'' key.
1. Introduction
QKD security proofs assume measurement results are isolated from the environment, while comparatively little work has examined physical side channels in practical devices. This paper investigates whether publicly exchanged detection timing can correlate with measurement results and reveal information about the secret key.
1. Introduction
- QKD security proofs assume measurement results are isolated from the environment, but comparatively little work has studied physical side channels in practical devices.Source: §1 · p. 2
- Publicly exchanged arrival times may correlate with quantum measurement results, creating a potential route to information about the secret key.The motivating example is an entanglement-based implementation using photon pairs with a defined timing signature.Source: §1 · p. 2
2. Time response analysis
The authors measured timing responses from four detectors and found detector-dependent timing offsets, despite less than 1 mm difference in optical path lengths. The measured response differences could expose measurement information through publicly communicated detection times.
2. Time response analysis
- The receiver directs photons through a beam splitter and polarizing beam splitters to four detectors representing two measurement bases and four outcomes.One outcome bit is public; the other is retained as raw material for the secret key.Source: §2 · p. 2, Figure 1 · p. 3
- Detector timing distributions were obtained with an oscilloscope sampling at 20 GS/s, interpolating when comparator outputs crossed 50% between logical levels, referenced to a trigger photodiode monitoring another fraction of the optical pulse train.Source: §2 · p. 2
- The four detector timing histograms have distinct centroid locations, with response-time differences between detectors 1 and 4 versus detectors 2 and 3.The solid curves in Fig. 3 fit the observed distributions with a convolution of exponential decay and a Gaussian distribution.Source: §2 · p. 3, Figure 3 · p. 4
- 240 ps: detector time offsets t0 differ by as much as this between detectors 2 and 4.The table summarizes fitted t0, τe, and τG values with statistical uncertainties; the authors attribute offsets possibly to circuit-board electrical delays and diode parasitic capacities.Source: §2 · p. 3, Table 1 · p. 4
3. Information extraction
Publicly revealed detector timing can expose information about secret-key bits, quantified by the mutual information between click times and logical values. The amount depends on detector delay and timing precision, and even a 500 ps relative delay can expose more than a quarter of the key.
3. Information extraction
- Mutual information between public click times and logical values quantifies the eavesdropper’s potential knowledge of the secret key.The prior probabilities of logical 0 and 1 are balanced at 0.5 in most protocols.Source: §3 · pp. 4–5
- 3.8 ± 0.38% average extractable information was obtained with the most favorable detector binning, while a 500 ps relative delay can expose more than 25% of the secret key.The delay comparison uses detector timing distributions with identical shapes.Source: §3 · p. 5, Figure 4 · p. 5
- Detector delays can be characterized and equalized, randomized, or coarsened, with privacy amplification applied to residual leakage.Larger time bins reduce leakage but increase background; typical precision of about 150 ps makes negligible difference from the continuous distribution, while compensating offsets reduces leakage to around 0.3%.Source: §3 · pp. 5–6
- In prepare-and-measure systems, local detector timing decisions provide no information to the eavesdropper, but distinct state-preparation devices may leak through their temporal responses.Those emitter responses need to be characterized and their potential leakage evaluated with a similar analysis.Source: §3 · p. 6
4. Conclusions
The authors show that publicly disclosed information in some reasonably mature implementations may leave a large proportion of the key insecure.
4. Conclusions
- Publicly disclosed information in some reasonably mature implementations may leave a large proportion of the key insecure.Source: §4 · p. 6