Source-linked AI summary
Quantum Hacking on Continuous-Variable Quantum Key Distribution System using a Wavelength Attack
Jing-Zheng Huang, Christian Weedbrook, Zhen-Qiang Yin, Shuang Wang, Hong-Wei Li, Wei Chen, Guang-Can Guo, Zheng-Fu Han
TL;DR
CV-QKD security proofs assume Eve cannot manipulate the local oscillator or Bob’s beam splitter, but practical wavelength-dependent components may violate these assumptions. The paper proposes a wavelength attack that controls Bob’s beam-splitter transmission through fake states with selected wavelengths. The attack can make the final key insecure even when LO intensity is monitored, while the paper recommends random wavelength-filter insertion before monitoring.
Problem
CV-QKD security proofs assume Eve cannot act on the local oscillator or control Bob’s beam splitter, although practical implementations may violate these assumptions.
Method
The paper uses wavelength- and amplitude-controlled fake coherent states to exploit wavelength-dependent transmission in Bob’s beam splitters and reproduce Eve’s measurements.
Results
The wavelength attack can render the final shared key insecure, including when Bob monitors total or LO intensity.
Takeaways & Limitations
Bob should randomly add a wavelength filter before detection to close the demonstrated loophole in practical CV-QKD systems.
Takeaways & Limitations
A wavelength filter alone is insufficient in theory because Eve can increase the input intensity; Bob should randomize whether the filter is added and compare the results.
Abstract
from arXiv · showhide
The security proofs of continuous-variable quantum key distribution are based on the assumptions that the eavesdropper can neither act on the local oscillator nor control Bob's beam splitter. These assumptions may be invalid in practice due to potential imperfections in the implementations of such protocols. In this paper, we consider the problem of transmitting the local oscillator in a public channel and propose a wavelength attack which can allow the eavesdropper to control the intensity transmission of Bob's beam splitter by switching the wavelength of the input light. Specifically we target continuous-variable quantum key distribution systems that use the heterodyne detection protocol using either direct or reverse reconciliation. Our attack is proved to be feasible and renders all of the final key shared between the legitimate parties insecure, even if they have monitored the intensity of the local oscillator. To prevent our attack on commercial systems, a simple wavelength filter should be added before performing the monitoring detection.
I. INTRODUCTION
Practical imperfections can invalidate CV-QKD security assumptions, especially when Eve may influence the local oscillator or Bob’s beam splitters. The paper proposes a wavelength attack that can evade intensity monitoring and compromise the final key.
- Practical QKD devices may not satisfy the ideal-device assumptions underlying theoretical security proofs.
- Equal-amplitude attacks can reduce Bob’s excess noise, but monitoring the total or LO intensity was proposed as a countermeasure.
- Wavelength-dependent properties in commercial fiber beam splitters can let Eve control their outputs by changing the input wavelength.
- The proposed wavelength attack targets heterodyne CV-QKD with either direct or reverse reconciliation.
- The attack can give Eve the secret key without discovery, even when Bob monitors total or LO intensity.
A. Heterodyne detection protocol
Heterodyne CV-QKD encodes Gaussian-distributed quadratures in coherent states and lets Bob measure amplitude and phase simultaneously. The detection uses a strong local oscillator, beam splitters, photocurrents, and difference measurements that include unavoidable quantum noise.
- Alice chooses zero-mean Gaussian quadratures and prepares displaced coherent states with total variance V = VA + 1.
- Bob simultaneously measures the amplitude and phase quadratures using heterodyne detection before key extraction by direct or reverse reconciliation.
- A photodetector converts photon number into photocurrent according to i = qn = qa†a.
- The strong LO satisfies |αLO| ≫ |αs|, enabling the signal and LO operators to be treated as mean amplitudes plus quantum fluctuations.
- Bob derives quadratures from differences between paired photocurrents, while vacuum noise from the unused beam-splitter port contributes to the measurement.
- If Eve cannot act on the LO, a simple intercept-resend attack requires excess noise at twice the shot-noise level.
B. Wavelength-dependent fiber beam splitter
Fused-biconical-taper fiber beam splitters are fabricated by fusing and drawing optical fibers, producing a tapered waveguide whose coupling depends on wavelength-related parameters.
- Fused-biconical-taper beam splitters are formed by fusing bare fibers at high temperature and drawing their ends to create a biconic tapered waveguide.
- The fraction of coupled power is modeled through a wavelength-dependent coupling coefficient proportional to λ^5/2 and the heat-source width.
III. WAVELENGTH ATTACK ON A CV-QKD SYSTEM USING HETERODYNE PROTOCOL
Eve intercepts Alice’s states, measures the signal, and resends wavelength- and amplitude-controlled fake coherent states. Their wavelength-dependent transmissions manipulate Bob’s beam splitters so his measurements reproduce Eve’s results while remaining below detection thresholds.
- Eve heterodyne-measures Alice’s signal to obtain quadratures XE and PE, then generates and resends fake coherent states.
- The fake signal, fake LO, and ancillary state use selected wavelengths, with the fake states’ amplitudes controlled by Eve.
- Changing the fake states’ wavelengths changes Bob’s beam-splitter transmissions, allowing Eve to control the splitter response for signal and LO.
- The attack imposes conditions on beam-splitter transmissions and fake-state amplitudes to reproduce Eve’s quadrature measurements at Bob.
- Different wavelengths prevent interference between fake signal and LO, making Bob’s outputs proportional to Eve’s measurements rather than ordinary heterodyne outputs.
- Bob’s extra noise can remain below the shot-noise alarm threshold, allowing Eve to obtain key information without discovery.
- The probability that intensity constraints prevent the attack is extremely close to zero.
IV. FEASIBILITY ANALYSIS
The feasibility analysis specifies assumptions for the wavelength attack and evaluates feasibility through conditional-variance thresholds for direct and reverse reconciliation. Under the stated model, the attack is feasible when Eve keeps these conditional variances below the security thresholds.
- Assumptions: The analysis restricts the attack to an all-fiber coherent-state CV-QKD system using heterodyne detection.
- Assumptions: Eve is assumed to know the common wavelength-dependent transmission parameters of Bob’s beam splitters and the detectors’ efficiencies.Detection efficiencies are assumed wavelength independent for simplicity; differences can be absorbed into Eve’s modulated light amplitudes.
- Assumptions: Eve is assumed able to replace the quantum channel with a noiseless fiber while using high-efficiency, negligible-noise detectors.
- Security analysis: The security analysis uses Gaussian attacks, for which transmission and excess noise characterize the channel and the key rate is determined by χ when V and η are fixed.The paper uses a Heisenberg-limited attack to upper-bound Eve’s information.
- Security analysis: Conditional variances VA|B and VB|A quantify uncertainty in the parties’ estimates and are used to estimate shot noise and modulation imperfections.VA|B applies to direct reconciliation, while VB|A applies to reverse reconciliation.
- Feasibility criterion: The wavelength attack is feasible when VA|B and VB|A remain below the corresponding maximum values allowed for positive secret-key rates.The direct- and reverse-reconciliation protocols are considered secure under the analysis when their respective conditional variances are below these thresholds.
A. Eve’s Wavelength Attack
The wavelength attack produces conditional variances below the security-test thresholds in both direct and reverse reconciliation, allowing Eve to remain undetected. For channel loss above 0.58 dB, the attack variance also falls below the normal level, so Eve should increase deviations to avoid suspicion.
- Attack model: The wavelength attack models Bob’s measured quadrature using Eve’s heterodyne noise and Bob’s detection noise, with the other quadrature treated similarly.The attack analysis writes the propagation from Alice’s quadrature to Bob’s result and identifies the vacuum-noise terms introduced by heterodyne detection.
- Direct reconciliation: In direct reconciliation, V attack A|B is not larger than 1.9 and remains below the maximum tolerable conditional variance.The comparison is plotted for V = 11 and ϵ = 0.01.
- Direct reconciliation: For channel loss above 0.58 dB, direct-reconciliation V attack A|B is lower than V normal A|B, so Eve should increase deviations to approach the normal level.This adjustment is intended to avoid suspicion while preserving the attack’s undetectability.
- Reverse reconciliation: In reverse reconciliation, V attack B|A is never larger than η + 0.13 and remains below the maximum tolerable value.The result is shown for V = 11 and ϵ = 0.01, and the attack therefore remains undiscovered by the conditional-variance test.
- Reverse reconciliation: For channel loss above 0.58 dB, reverse-reconciliation V attack B|A is lower than V normal B|A, requiring deliberate deviation increases to avoid suspicion.The cited analysis describes the same concealment strategy for reverse reconciliation.
V. DISCUSSIONS AND CONCLUSION
The wavelength attack produces conditional variances that remain below security-monitoring thresholds in relevant regimes, leaving the key insecure. The discussion also identifies practical deployment caveats and countermeasures.
- Discussion: For η < 0.88, the attack conditional variances are lower than the normal values, so Eve can add measurement noise without requiring perfect heterodyne detection.This compromises the perfect-heterodyne assumption used in the analysis.
- Discussion: V_attack B|A remains below V_max B|A, and below V_normal B|A when channel loss exceeds 0.58 dB, producing an insecure key.These comparisons are shown for experimentally realistic parameters V = 11 and ϵ = 0.01.
- Practical implications: A wavelength filter alone cannot prevent the attack in theory because Eve can increase the input intensity; Bob should randomize filter use and compare monitoring outcomes.The proposed countermeasure is to randomly add or omit the filter before monitoring detection.
- Scope: The studied attack targets heterodyne detection, while a cited commercial system uses a wavelength-dependent beam splitter with homodyne detection and therefore lies outside the analyzed regime.The paper recommends precautions for heterodyne use and calls for further study of homodyne vulnerabilities.
- Conclusion: Without the necessary precautions, the final secret key is in principle totally insecure because Eve can obtain all information about it.The wavelength attack differs from the equal-amplitude attack by giving Eve control over Bob’s beam splitter.
- Conclusion: Squeezed states can replace coherent states for fake-pulse generation, loosening the maximum fake-pulse-intensity constraint.This is an added observation concerning shot-noise suppression.
Appendix A: Achievable XE and PE
Appendix A derives the achievable range of Eve’s variables XE and PE under the fake-state constraints. For experimentally realistic variance, excursions beyond the allowed threshold have negligible probability.
- Achievable range: The achievable XE and PE range follows by combining the fake-state constraints with Eq. (4), using analytical calculations or numerical simulations.The appendix first rewrites Eq. (4) before deriving the range.
- Beam-splitter parameters: The beam-splitter transmission functions are parameterized as T(λ) = sin^2(AX) and T′(λ) = sin^2(BX), with the 50:50 reference at λ0 = 1550 nm.The 10:90 beam splitter is treated analogously.
- Attack constraints: The analysis constrains fake-state intensities to suppress shot noise and satisfy the attack conditions, using an LO pulse containing more than 10^8 photons.The stated constraint bounds the fake-state intensity relative to the LO intensity.
- Achievable range: The quantities η|XE|^2 + η|PE|^2 < 20 are always achievable under the derived conditions.This is the appendix’s central achievability claim.
- Probability estimate: For Gaussian XE and PE with variance V = 11, the probability of |XE| or |PE| exceeding 20 is 1.637 × 10^-9 ≈ 0.When the variables are out of reach, Eve can revert to intercept-resend, whose additional noise is negligible at this probability.
Appendix B: Derivation of VNB
Appendix B derives Bob’s conditional variance from Eve’s wavelength-dependent fake states as they propagate through the beam splitters and detectors. The derivation tracks the resulting quadrature measurements and bounds their noise terms.
- Fake-state generation: Eve generates fake signal and LO states from her measurement results and represents them with operators before propagation through Bob’s detection setup.The fake states are the starting point for deriving V_NB.
- Optical propagation: After the first beam splitter, vacuum-noise modes interfere with the fake signal and fake LO before the fields reach the second beam-splitter stage.The appendix labels the corresponding vacuum fluctuations δa_v1 and δa_v2.
- Wavelength-dependent splitting: Because the fake signal and LO have different wavelengths, Bob’s first beam splitter applies distinct intensity transmissions T1 and T2.The LO is then separated into modes α2 and α4.
- Notation: The quadratures of the fluctuation modes are defined from each mode operator and its adjoint before entering the measurement expressions.This definition is used for the fluctuation terms in the derivation.
- Detection: Bob’s quadrature results are obtained from detector photocurrent differences, with terms at unequal frequencies vanishing during measurement.The remaining same-frequency terms determine the measured quantities.
- Variance derivation: The measured quadratures X_B and P_B are calculated from the photocurrent results using the stated constraints and inequalities.The derivation bounds the relevant transmission-dependent factors using their maximum values and unit vacuum-noise variances.