PaperlayerView exact revision on arXiv

Source-linked AI summary

Risk analysis of Trojan-horse attacks on practical quantum key distribution systems

Nitin Jain, Birgit Stiller, Imran Khan, Vadim Makarov, Christoph Marquardt, Gerd Leuchs

arXiv:1408.0492v2quant-ph

TL;DR

Trojan-horse attacks can exploit QKD safeguards to expose key information, but experimental evidence across wavelengths beyond 1550 nm has been limited. The paper measures spectral properties of QKD components and receiver detectors, finding wavelengths where attacks gain an advantage over 1550 nm and identifying risks relevant to countermeasures.

  • Problem

    Experimental feasibility and constraints of Trojan-horse attacks at wavelengths beyond the usual 1550 nm had not been explored, despite their relevance to threat analysis and countermeasure design.

    Source: §I · p. 2

  • Method

    The authors experimentally analyze spectral transmittance, reflectivity, and detection sensitivity across optical components and a QKD receiver subsystem.

    Source: §I · p. 2, A. Spectral transmittance of relevant… · p. 5, C. Spectral efficiency of a… · p. 7

  • Results

    Eve gains almost 30 dB around 1300 nm compared with 1550 nm, and total attenuation can be lower around 1300 nm or 1700 nm than at 1550 nm.

    Source: §IV · p. 8

  • Takeaways & Limitations

    A QKD system protected only by an isolator in Alice could be breached with bright pulses around 1300 nm, while Bob’s SPAD sensitivity is at least three orders of magnitude lower at 1700–1800 nm than at its peak.

    Source: §IV · p. 8

Abstract

from arXiv · show

An eavesdropper Eve may probe a quantum key distribution (QKD) system by sending a bright pulse from the quantum channel into the system and analyzing the back-reflected pulses. Such Trojan-horse attacks can breach the security of the QKD system if appropriate safeguards are not installed or if they can be fooled by Eve. We present a risk analysis of such attacks based on extensive spectral measurements, such as transmittance, reflectivity, and detection sensitivity of some critical components used in typical QKD systems. Our results indicate the existence of wavelength regimes where the attacker gains considerable advantage as compared to launching an attack at 1550 nm. We also propose countermeasures to reduce the risk of such attacks.

I. INTRODUCTION

Trojan-horse attacks exploit implementation imperfections by probing QKD hardware and analyzing back-reflections, potentially exposing key information without triggering the protocol’s expected warning signs. This paper addresses the limited experimental study of attacks at wavelengths beyond the usual 1550 nm and analyzes spectral behavior and security risks across QKD components.

I. INTRODUCTION

  • QKD aims to let Alice and Bob exchange a secret key, with excessive measured errors prompting them to abort the protocol.If errors remain limited, they can distill a shorter secret key.Source: §I · p. 1
  • In practice, hardware or firmware imperfections and insufficient security assumptions can let an eavesdropper gain partial or full key knowledge without causing many errors.Such deviations motivate quantum-hacking research on practical QKD systems.Source: §I · p. 1
  • By probing QKD hardware with bright light, an eavesdropper can analyze back-reflections to infer component properties and potentially Alice’s basis settings.The light encounters multiple reflection and scattering sites, producing returning pulses.Source: §I · p. 1, Figure 1 · p. 2
  • Experimental feasibility and constraints of Trojan-horse attacks at wavelengths beyond the usual 1550 nm had not been explored, limiting comprehensive threat analysis and countermeasure redesign.Prior attacks predominantly used wavelengths near 1550 nm.Source: §I · pp. 1–2
  • The study measures spectral behavior and Trojan-horse risks across optical devices, from individual components to a complete QKD subsystem.It examines circulators, isolators, the Clavis2 receiver, and SPAD sensitivity at 1700–1800 nm.Source: §I · p. 2

II. BASIC CONCEPTS AND IDEAS

A Trojan-horse attacker sends light into a QKD subsystem and studies returning reflections to learn information about its settings. Although isolators and watchdog detectors can protect Alice, their finite spectral performance can leave wavelengths where an attack is insufficiently blocked or detected.

II. BASIC CONCEPTS AND IDEAS

  • Eve can use back-reflected light to learn basis settings and, if the operation avoids alerting Alice and Bob, could break prepare-and-measure protocols.The returning light may be analyzed using state-discrimination methods.Source: §II · p. 2
  • An isolator blocks incoming light passively, while a watchdog detector is intended to alarm when unknown optical signals arrive at Alice.These are common practical measures against Trojan-horse attacks.Source: §II · p. 2
  • Finite isolation and detector responsivity can leave wavelengths where Eve’s pulse is only partly stopped or the monitoring system fails to trigger an alarm.High internal back-reflections at those wavelengths further escalate the attack risk.Source: §II · p. 2

A. Back-reflections and Eve’s photon budget

Eve’s photon budget depends on the double-pass attenuation set by the onward and reverse paths and the back-reflection. An isolator can sharply raise the required pulse power, but the benefit depends on its performance at the attack wavelength.

A. Back-reflections and Eve’s photon budget

  • The double-pass attenuation depends on the onward and reverse path losses and back-reflection, with at least one pulse path probing or passing through the basis selector.The onward and reverse paths need not be identical.Source: A. Back-reflections and Eve’s photon… · p. 2
  • About 4×10^6 entering photons yield the four-photon average assumed necessary to learn the basis choice in the 1550 nm example.The example assumes a −14 dB Fresnel reflection and −46 dB total round-trip insertion loss, for −60 dB total attenuation.Source: A. Back-reflections and Eve’s photon… · pp. 2–3
  • >4×10^11 photons are required when an isolator provides at least 50 dB isolation at 1550 nm, raising Eve’s budget by at least five orders of magnitude.Such pulses may be detectable or approach component damage thresholds; induced damage may help Eve, but generally renders the device or channel useless.Source: A. Back-reflections and Eve’s photon… · p. 3

B. Foiling Alice’s safeguards

Alice’s safeguards can be less effective away from components’ design wavelengths, and monitoring detectors may fail to register spectrally mismatched attack pulses. Such attacks may evade Bob’s usual indicators, leaving Eve a chance to learn the complete raw key without Alice or Bob knowing.

B. Foiling Alice’s safeguards

  • A wavelength-dependent isolator or reflectivity can leave Eve’s pulse power near the unprotected level, while a spectrally unresponsive monitor can let attack light hide in detector dark noise.The text also notes that flaws allowing Eve to manipulate monitoring-detector operation have been discovered.Source: B. Foiling Alice’s safeguards · p. 3
  • A monitor with responsivity below 10^-4 A/W yields at most 10 nA photocurrent for a 100 μW pulse, comparable to the assumed 10 nA dark noise.In this fictitious example, the response is likely to be buried in the detector’s dark noise.Source: B. Foiling Alice’s safeguards · p. 3
  • An attack exploiting inadequate isolation or monitoring is unlikely to affect Bob’s QBER or detection statistics, so Eve may learn the complete raw key without detection by Alice or Bob.The text identifies these as the other attack indicators, typically estimated by Bob during classical postprocessing.Source: B. Foiling Alice’s safeguards · p. 3

C. Avoiding discovery by Bob

Bob is not a useful Trojan-horse target in BB84 because he reveals his basis during reconciliation, but in SARG04 his basis determines the secret bit. Bright probing can trigger SPAD afterpulsing, while wavelength choices and other SPAD features may reduce the attack’s detectability.

C. Avoiding discovery by Bob

  • In BB84, Bob’s basis choice is disclosed during reconciliation, making a Trojan-horse probe of that choice useless to Eve.This contrasts with SARG04, where Bob’s basis determines the secret bit.Source: C. Avoiding discovery by Bob · p. 3
  • In SARG04, Bob’s basis is the secret bit, and inferring it with more than 90% accuracy at μEve ≈ 3 requires at least 1.5×10^6 photons after roughly −57 dB attenuation.The bright pulses can induce SPAD afterpulsing, raising dark noise and QBER; systems normally abort when QBER crosses a security threshold.Source: C. Avoiding discovery by Bob · p. 3
  • SPAD detection efficiency varies with wavelength, and the authors conjecture that lower efficiency beyond 1550 nm also means less afterpulsing.They suggest attack pulses near 1700 nm and CW light near 1950 nm as ways to reduce afterpulsing; known SPAD features such as deadtime and inability to resolve photon numbers may further enhance Eve’s gain.Source: C. Avoiding discovery by Bob · pp. 3–4
  • Above 48% correlations with Eve coexist with q1 = 0.05 and y1 = 0.79; the 47.8% privacy-amplification subtraction is slightly smaller than Eve’s knowledge.In this example, q1 remains below qabort ≈ 0.11 and δy = 0.13 remains below δymax = 0.15, so neither check raises an alarm.Source: C. Avoiding discovery by Bob · p. 4

III. SPECTRAL MEASUREMENTS

The measurements characterize broadband transmittance and reflectivity of fiber-optical components, a complete receiver system, and SPAD spectral efficiency. A supercontinuum source provides broad illumination for these tests.

III. SPECTRAL MEASUREMENTS

  • The investigation measures broadband transmittance and reflectivity of a circulator and isolators, tests the Clavis2-Bob receiver, and examines SPAD efficiency from 1700 to 1800 nm.The SPAD range is selected where afterpulsing is conjectured to be low.Source: §III · p. 4
  • Transmission measurements pass broadband light through the device under test, while reflectivity measurements connect the OSA through a balanced fiber splitter.The optical spectrum analyzer is used to assess spectral transmittance or reflectivity.Source: §III · p. 4
  • A 1064 nm-pumped photonic crystal fiber produces a supercontinuum spanning below 600 nm to above 1700 nm, with output more than 40 dB above the OSA noise floor from 1000 to 1650 nm.The reported traces focus on 1000–1750 nm; a small dip near 1400 nm is typical of glass fibers due to infrared absorption.Source: §III · p. 4

A. Spectral transmittance of relevant fiber-optic components

The measured components often provide substantially less isolation away from 1550 nm, so the double-pass attenuation relevant to a Trojan-horse probe varies by component and wavelength. The tests also found no useful isolator reflection signal for Eve.

A. Spectral transmittance of relevant fiber-optic components

  • At 1310 nm, circulator reverse transmission is about 40 dB higher than at 1550 nm, and an isolator’s reverse power is only 10 dB below its forward power near 1300 nm.At 1550 nm, the isolator’s forward-to-reverse extinction is roughly −50 dB.Source: A. Spectral transmittance of relevant… · p. 5
  • The circulator’s favored paths have insertion losses around −2 dB and −2.8 dB, whereas port 1-to-3 transmission is about −40 dB and is unlikely to aid Eve.The favored paths are from port 1 to 2 and port 2 to 3; the port 1-to-3 attenuation is reported across 1450–1700 nm.Source: A. Spectral transmittance of relevant… · p. 5
  • The tested isolators match their specified forward insertion loss above 1400 nm, but iso1’s reverse attenuation at 1310 nm is at least 30 dB lower than at 1550 nm.Reverse attenuation at 1550 nm ranges from −50 dB for iso1 to −35 dB for iso3; iso1 and iso2 have narrow attenuation dips around 1550 nm.Source: A. Spectral transmittance of relevant… · p. 5
  • The tested isolators provided no useful reflection signal to aid a Trojan-horse attack.The relevant attack quantity is net transmittance in a double pass, combining the light’s outbound and return paths with the back-reflection level.Source: A. Spectral transmittance of relevant… · p. 5
  • Around 1300 nm, double-pass attenuation is about −25 dB for the circulator; iso3 reaches −15 dB near 1400 nm, while the three isolators differ substantially.Fig. 5 reports the double-pass measurements; iso3 has the lowest attenuation near 1400 nm, while the circulator’s maximum attenuation is at the telecom wavelength.Source: Figure 5 · p. 6, A. Spectral transmittance of relevant… · p. 6

B. Reflection & transmission measurements on Clavis2-Bob

Broadband reflection and transmission measurements were used to examine Clavis2-Bob and its phase-modulator connector. The measurements distinguish a connector reflection near 1550 nm from a transmission dip attributed likely to absorption, while wavelength-dependent afterpulsing is also relevant to attack risk.

B. Reflection & transmission measurements on Clavis2-Bob

  • At 1550 nm, Eve’s round-trip attenuation in Bob is around −57 dB, and sending fewer than 2×10^6 photons per pulse is associated with a huge dark-count rate from afterpulsing.The paper notes that both component reflectivity and SPAD afterpulsing probability may depend on Eve’s wavelength.Source: B. Reflection & transmission… · p. 6
  • At around 1550 nm, opening the connector after Bob’s phase modulator raises back-reflection by about 8 dB; the transmission dip around 1170 nm has no corresponding reflection peak.The authors consider absorption at the polarizing beamsplitter cube a likely source of the dip.Source: Figure 6 · p. 6, B. Reflection & transmission… · p. 7
  • The authors measured the whole Bob subsystem with a broadband source and optical spectrum analyzer, comparing it with the phase-modulator output connector connected and disconnected.The reflection traces were normalized to the original supercontinuum output, and the transmittance measurements covered Bob’s entrance to the phase-modulator connector and through the phase modulator.Source: B. Reflection & transmission… · p. 7

C. Spectral efficiency of a single-photon avalanche diode

The section tests whether SPAD spectral sensitivity can indicate afterpulsing risk, finding much lower sensitivity at longer wavelengths while noting an unresolved loss-versus-afterpulsing tradeoff.

C. Spectral efficiency of a single-photon avalanche diode

  • Lower sensitivity beyond 1550 nm was proposed as a possible indicator of reduced afterpulsing, not as a direct measurement of afterpulsing.The proposed link is that smaller in-gate detection probabilities may mean fewer afterpulses created outside the gate.Source: C. Spectral efficiency of a… · p. 7
  • The experiment used a scanned OPO idler beam and click counts across SPAD gates to estimate detection probability and infer wavelength-dependent sensitivity.The OPO was not synchronized to the gates and was treated as quasi-CW; sensitivity was obtained by inverting the photonic detection probability relation.Source: C. Spectral efficiency of a… · p. 7
  • At 1700–1800 nm, SPAD sensitivity is at least three orders of magnitude below its peak around 1310 nm; at 1720 nm, η≈0.05 × 10^-3.The paper gives η≈0.1 as a typical value at 1550 nm.Source: Figure 7 · p. 7, C. Spectral efficiency of a… · p. 7
  • At about 1720 nm, higher fiber losses require more energetic pulses to maintain the photon budget, potentially increasing afterpulsing; this tradeoff needs further study.The actual afterpulsing response at this wavelength remains to be measured.Source: C. Spectral efficiency of a… · p. 8

IV. SUMMARY AND OUTLOOK

The measured spectral behavior identifies wavelengths where Trojan-horse attacks may gain an advantage over 1550 nm. The authors describe likely vulnerabilities in Alice and Bob and recommend proof-of-principle tests at those wavelengths.

IV. SUMMARY AND OUTLOOK

  • Eve gains almost 30 dB around 1300 nm, and round-trip attenuation around 1300 or 1700 nm can be lower than at 1550 nm.The authors report that insertion losses of most telecom components around 1300 nm do not differ much from those around 1550 nm.Source: §IV · p. 8
  • SPAD sensitivity from 1700–1800 nm is at least three orders of magnitude below its peak, potentially improving the chances that an attack on Bob remains undetected.The authors note that higher fiber attenuation around 1700 nm may be less consequential because typical QKD receivers lack long fiber links.Source: §IV · p. 8
  • A QKD transmitter protected only by an isolator could be breached with bright pulses around 1300 nm, while an attack on Bob may be harder to detect around 1700 nm.The 1310 nm isolator attack is described as applicable to both discrete- and continuous-variable QKD systems.Source: §IV · p. 8
  • The authors recommend proof-of-principle attacks around 1300 or 1700 nm to test existing and new countermeasures on practical QKD systems.They describe spectral characterization from the quantum channel as a one-time task that may distract Alice and Bob only momentarily.Source: §IV · p. 8

V. COUNTERMEASURES

The countermeasures combine spectral defenses, reduced internal reflections, and privacy amplification. The section describes how filters can complement isolation and monitoring, while leakage estimates remain necessary for setting privacy amplification.

V. COUNTERMEASURES

  • Adding a monitoring detector to Alice’s isolator makes it fairly challenging for Eve to circumvent both, and a downstream optical filter can suppress remaining wavelengths.Suggested filters include fiber Bragg gratings or Fabry-Perot cavities; commercially available filter specifications typically cover 20 nm around the central wavelength, where secondary maxima may occur.Source: §V · p. 8
  • A filter with a bandwidth of a few nanometers can remove pulses that evade the isolator and monitor before they reach the basis selector, while passing modulation sidebands.The authors also state that such a filter could benefit Bob’s security.Source: §V · p. 8
  • Angle-polished connectors, eliminating open ports, and fusing connections can reduce back-reflections independently of individual devices’ spectral responses.These are presented as practical examples for either Alice or Bob.Source: §V · p. 8
  • Privacy amplification can remove Eve’s partial information, but setting its required amount calls for subsystem-level leakage estimates incorporated into the security proof.The passage describes Eve’s information as partial but non-negligible in most instances of Trojan-horse attacks.Source: §V · p. 8
Loading 1408.0492v2…