Source-linked AI summary
Decoy-state quantum key distribution with a leaky source
Kiyoshi Tamaki, Marcos Curty, Marco Lucamarini
TL;DR
QKD security relies on assumptions about device behavior and the absence of unwanted information leakage, while real devices may have imperfections. This paper develops a security formalism for decoy-state QKD with leaky transmitter modulators and reports key rates approaching those of perfectly shielded systems in studied cases.
Problem
Method
The paper develops a formalism for decoy-state QKD and mdiQKD under Trojan-Horse attacks on transmitter modulators, using characterized modulator behavior without requiring knowledge of Eve’s measurement.
Source: §5 · pp. 22–23Results
In studied coherent-light Trojan-Horse examples, key rates from leaky transmitters can approach the ideal rate of a perfectly shielded system with optical isolation and active phase randomization.
Source: §6 · pp. 23–24Takeaways & Limitations
The formalism applies to decoy-state systems using intensity or phase modulators and can evaluate security against information leaked from those devices.
Source: §6 · p. 23The formalism requires detailed characterization of Alice’s modulators, which may be challenging in practice.
Source: §5 · p. 23
Abstract
from arXiv · showhide
In recent years, there has been a great effort to prove the security of quantum key distribution (QKD) with a minimum number of assumptions. Besides its intrinsic theoretical interest, this would allow for larger tolerance against device imperfections in the actual implementations. However, even in this device-independent scenario, one assumption seems unavoidable, that is, the presence of a protected space devoid of any unwanted information leakage in which the legitimate parties can privately generate, process and store their classical data. In this paper we relax this unrealistic and hardly feasible assumption and introduce a general formalism to tackle the information leakage problem in most of existing QKD systems. More specifically, we prove the security of optical QKD systems using phase and intensity modulators in their transmitters, which leak the setting information in an arbitrary manner. We apply our security proof to cases of practical interest and show key rates similar to those obtained in a perfectly shielded environment. Our work constitutes a fundamental step forward in guaranteeing implementation security of quantum communication systems.
1. Introduction
QKD security proofs must account for practical device imperfections and information leakage, despite approaches such as device-independent and measurement-device-independent QKD. The paper introduces a formalism for optical QKD transmitters with leaky phase and intensity modulators and illustrates it with a Trojan-Horse attack model.
1. Introduction
- QKD implementations may violate theoretical requirements, and unaccounted device imperfections can create side channels exploitable by Eve.Security also relies on the assumption that users' devices do not leak unwanted information outside their protected spaces, which is difficult to guarantee in practice.Source: §1 · p. 2
- Device-independent QKD has experimental complexity and poor secret-key rates with current technology, while decoy-state mdiQKD removes trust in the measurement device under a state-preparation assumption.Decoy-state mdiQKD has been demonstrated in laboratories and field trials with key rates comparable to standard QKD protocols.Source: §1 · p. 2
- Trojan-Horse attacks use injected bright light and back-reflections to seek information, and intensity modulators as well as phase modulators can leak information.An earlier phase-modulator result assumed other devices were untouched, limiting its applicability to protocols that also use an intensity modulator.Source: §1 · pp. 2–3
- The formalism addresses security when phase and intensity modulators leak setting information, including leakage in arbitrary form.It is illustrated with a feasible Trojan-Horse attack in which Eve probes the modulators and the back-reflected light consists of limited-intensity coherent states.Source: §1 · p. 3
- The formalism applies to most optical QKD systems using phase and intensity modulators, with three-intensity decoy-state BB84 as an example.The authors state it can be adapted to other numbers of settings and protocols, and that a device model can be used to calculate the resulting secret-key rate.Source: §1 · p. 3
2. Decoy-state quantum key distribution
Decoy-state QKD uses randomly selected intensity settings to prepare photon-number mixtures. Its analysis estimates photon-number yields and error rates from observed gains and error rates, relying on those quantities being independent of the intensity setting.
2. Decoy-state quantum key distribution
- Alice randomly selects intensity settings for each signal and prepares mixtures of photon-number states using practical light sources.For phase-randomized weak coherent pulses, the photon-number distribution is Poisson, with the mean photon number set by the intensity.Source: §2 · pp. 3–4
- The observed gain and quantum bit error rate for each intensity setting are related to photon-number yields and error rates.The yields and error rates are estimated by solving the resulting equations; a few settings can tightly estimate Y0, Y1, and e1.Source: §2 · p. 4
- Decoy-state analysis requires photon-number yields and error rates to be independent of Alice’s intensity choice.A Trojan-Horse attack may reveal the intensity setting to Eve, so the standard security analysis must be revised.Source: §2 · p. 4
3. Trojan horse attacks against decoy-state quantum key distribution
This section develops a formalism for decoy-state QKD under Trojan horse attacks on intensity and phase modulators, including passive leakage, and examines how leakage can reveal intensity or basis choices. It addresses bounding security quantities, including deriving the phase error rate and secure key rate from fidelity estimates for an explicit attack, as well as joint attacks exploiting correlations among intensity, bit, and basis choices.
3.1. THA against the IM
- Intensity leakage can make photon-number yields and error rates depend on Alice’s setting; the formalism bounds these differences, which vanish when no intensity information leaks.The bounds use the distinguishability of states available to Eve; without leakage, the yields for each intensity coincide, as assumed in the standard decoy-state method.Source: §3 · p. 4, §3.1 · pp. 5, 7
- The intensity-modulator behavior alone can bound Eve’s distinguishability, provided its output remains diagonal in the Fock basis.The modulator is modeled across supported optical modes; the Fock-basis condition holds if Eve’s probe does not alter the source photon distribution or phase randomization.Source: §3.1 · pp. 7–8
3.2. THA against the PM
- Phase-modulator leakage can reveal Alice’s basis choice, so the proof bounds the phase error using basis-state closeness and a lower bound on their overlap derived from modulator behavior.A quantum-coin analysis relates phase error to the observed X-basis error and the closeness of the Z- and X-basis states; the overlap can be bounded from the phase modulator’s operation.Source: §3.2 · pp. 9, 10, 12
- Estimating fidelity for an explicit Trojan horse attack enables determining the phase error rate and secure key rate of a QKD system with a leaky phase modulator.The passage identifies this as essentially the result obtained in.Source: §3.2 · p. 13
- The formalism can be adapted to joint Trojan horse attacks that exploit correlations between intensity settings and bit and basis choices.The paper addresses this case in Appendix B.Source: §3.2 · pp. 13–14
4. Simulation of the key generation rate
The simulations evaluate decoy-state BB84 secure-key rates under individual Trojan-horse attacks, from conservative bounded leakage to setting-modulated leakage and phase randomization. Across these cases, phase randomization yields the strongest rates, while leakage from the intensity modulator remains a key practical concern.
4. Simulation of the key generation rate
- The simulation estimates a decoy-state BB84 secure-key-rate lower bound after characterizing modulator leakage; it assumes a high-power CW coherent-state probe and an individual THA without entanglement between Alice and Eve.It studies three cases: setting-independent leaked intensity, intensity modulated like Alice’s pulses, and phase-randomized back-reflected light represented as a classical Fock-state mixture.Source: §4 · pp. 14–15, Figure 5 · p. 22
4.1. Individual THA - Case 1
- For conservative bounded leakage below 10^-6 photons/pulse, a secure key remains possible at every distance; at Imax = 10^-6, the rate stays positive to about 30 km.Below 10^-12, rates approach the perfectly shielded case over short and medium distances, but diverge at longer distances.Source: Figure 2 · p. 16, §4.1 · p. 17
- In the bounded-leakage model, simultaneous IM and PM attacks nearly overlap the IM-only rates, making IM protection more demanding; the isolation difference is no more than about 60 dB.The paper identifies inexpensive dual-stage optical isolators as a feasible option with current technology.Source: Figure 2 · p. 16, §4.1 · p. 17
4.2. Individual THA - Case 2
- At Imax = 10^-12, setting-modulated leakage gives a rate nearly indistinguishable from ideal through about 100 km; at 10^-6, the rate reaches about 60 km.The 10^-6 case is always better than the GLLP approach, and simultaneous PM leakage only marginally affects the rate.Source: Figure 3 · p. 18, §4.2 · p. 19
4.3. Individual THA - Case 3
- With phase-randomized leakage, rates remain positive to about 40 km at Imax = 10^-2 and are indistinguishable from ideal below 10^-6 over almost the whole distance range.At Imax = 10^-3, IM-only leakage supports more than 85 km, while simultaneous IM and PM leakage falls below 50 km.Source: Figure 4 · p. 20, §4.3 · pp. 20–21
- Phase randomization makes the IM robust against information leakage, and the simulated rates essentially cover the most general phase-randomized THA considered.The authors report that an n-photon Fock-state attack enlarges the trace distance only negligibly when optical isolators and filters are properly installed.Source: §4.3 · p. 21
5. Discussion
The discussion explains how transmitter leakage affects decoy-state security and how the formalism handles it. It also identifies modulator characterization and practical countermeasures as important conditions.
5. Discussion
- The formalism calculates secret-key rates for decoy-state QKD and mdiQKD under any Trojan-horse attack directed at transmitter modulators.It does not require knowledge of Eve’s measurement or detailed probe state, but does require detailed modulator characterization, which may be challenging in practice.Source: §5 · pp. 22–23
- Without a Trojan-horse attack, intensity assignment in the fictitious protocol is independent across detected instances; with leakage, the relevant bound depends on the instance and Azuma’s inequality is used.The no-attack case permits the Multiplicative Chernoff bound, which applies to independent trials.Source: §5 · pp. 22–23
- Active phase randomisation helps defeat attacks exploiting entanglement and enhance the key rate, but requires precise synchronisation and random inputs and does not remove the need for optical isolation.The discussion reports an approximately 60 dB difference in Imax between the compared figures, achievable with a passive dual-stage optical isolator.Source: §5 · p. 23
6. Conclusion
The paper quantifies secure key rates for decoy-state QKD with leaky transmitters and analyzes practical Trojan-horse attacks. Its examples show that key extraction can approach the perfectly shielded rate when optical isolation and phase randomisation are used.
6. Conclusion
- The framework quantifies secure key rates under the most general attacks based on information leaked by transmitter intensity or phase modulators.The analysis covers decoy-state systems using either type of modulator.Source: §6 · p. 23
- The analyzed coherent-state Trojan-horse examples permit key distillation from leaky transmitters at rates approaching the perfectly shielded system.The proposed countermeasures are adequate optical isolation and active phase randomisation, which removes residual entanglement from Eve’s probes.Source: §6 · pp. 23–24
- The approach is presented as applicable to standard QKD, mdiQKD, and device-independent QKD when phase or intensity modulators are used.The paper identifies practical cases as a basis for analyzing real quantum-communication systems.Source: §6 · p. 24
Appendix A. Azuma’s inequality
The appendix introduces Azuma’s inequality through martingales with bounded differences. It then models potentially correlated coin flips to establish a martingale suitable for applying the inequality.
Appendix A. Azuma’s inequality
- Azuma’s inequality applies to a sequence satisfying the martingale and bounded-difference conditions.The bounded-difference condition requires successive values to differ by at most a specified positive bound.Source: Appendix A · p. 24
- For the coin-flip construction, each binary outcome may depend on all preceding outcomes, and the accumulated number of heads is tracked.The appendix states that the resulting variable is a martingale and satisfies the bounded-difference condition.Source: Appendix A · pp. 24–25
Appendix B. Joint THA when the IM and the PM are correlated
The appendix adapts the security analysis to arbitrary correlations between the intensity and phase modulators. It estimates bit- and basis-dependent single-photon statistics and requires a full description of both devices to establish security.
Appendix B. Joint THA when the IM and the PM are correlated
- The security analysis can accommodate arbitrary correlations between the intensity and phase modulators, provided their behavior is fully described.The appendix applies the decoy-state method to the bit- and basis-dependent single-photon events used for key generation.Source: Appendix B · pp. 25–26
- The correlated-modulator treatment estimates the signal-setting single-photon yield conditioned on Alice’s bit and basis using decoy-setting detection data.The yield is the conditional probability that Bob obtains a click for the specified single-photon preparation.Source: Appendix B · p. 25
- The single-photon bit-error estimate additionally conditions on Bob’s measurement basis and bit value.The resulting statistics support key generation from signal-setting single-photon events prepared and measured in the Z basis.Source: Appendix B · p. 25
Appendix C. Estimation of Y γs
The appendix formulates yield estimation as a linear program, assuming three intensity settings as in the main text. It derives constraints for equal and unequal setting indices to express yields in terms of selected yields and leakage parameters.
Appendix C. Estimation of Y γs
- The estimation method applies to any number of decoy states, while the appendix assumes three intensity settings: γs, γv, and γw.The optimization instances can be solved efficiently in polynomial time.Source: Appendix C · p. 26
- For k = l, the yields for γv and γw can be expressed as functions of the γs yield and the parameters ∆ws and ∆vw.This rewriting uses the relations among the six constraints for three intensity settings.Source: Appendix C · pp. 26–27
- For k ≠ l, the rewritten relations yield three equality constraints, with each ∆njkl bounded between −Dn,j,k,l and Dn,j,k,l.The constraints are combined with the stated bounds on ∆njkl.Source: Appendix C · p. 27
Appendix C.1. Estimation of Y γs
The appendix constructs a linear program to estimate yields using gains when Alice and Bob use the key-generation basis. It bounds the gains using a finite set of yields and uses the resulting constraints in the optimization.
Appendix C.1. Estimation of Y γs
- The linear program estimates Y γs 0L from gains for the three intensity settings when Alice and Bob use the same key-generation basis.The example basis is Z.Source: Appendix C.1 · pp. 27–28
- The gains for the intensity settings are written as functions of the yields Y γs n and the additional terms ∆ws and ∆vw.Source: Appendix C.1 · pp. 27–28
- The gain bounds depend on only Scut + 1 yields, reducing the optimization from infinitely many yield parameters to a finite set.The bounds use 0 ≤ Y γs n ≤ 1 and nonnegative photon probabilities.Source: Appendix C.1 · p. 28
- The linear program has Scut + 3 unknowns: the yields Y γs n and the two parameters ∆ws and ∆vw.The appendix states that the parameter values and typical-channel observables are given in Appendices D and E.Source: Appendix C.1 · pp. 28–29
Appendix C.2. Estimation of Y γs
The lower bound Y γs 1L is obtained by reusing the linear program from Eq. (C.11) with a changed objective function.
Appendix C.2. Estimation of Y γs
- The lower-bound estimate Y γs 1L reuses the linear program in Eq. (C.11), changing its objective function to Y γs 1L.Source: Appendix C.2 · p. 29
Appendix C.3. Estimation of eγs
The appendix adapts the linear program to the X basis to bound the single-photon error quantity. It replaces gains with error-weighted gains and changes the variables and objective to obtain an upper bound.
Appendix C.3. Estimation of eγs
- For the X-basis upper bound, the program replaces each gain Qγj with the error-weighted quantity QγjEγj and uses variables ωγs n = Y γs n eγs n.Source: Appendix C.3 · p. 29
- The objective is −ωγs 1 because the program minimizes while seeking an upper bound for ωγs 1.Source: Appendix C.3 · p. 29
- The resulting estimate eγs 1U is derived from the optimization solution, and eγs 1L denotes a lower bound for single-photon pulses when both parties use the X basis.The typical-channel observables Qγj and Eγj are provided in Appendix E.Source: Appendix C.3 · p. 29
Appendix D. Estimation of Dn,j,k and Dn,j,k,l
Appendix D estimates trace-distance parameters for three individual-THA cases under specified source and correlation assumptions. Appendix E supplies a device-and-channel model for simulating decoy-state BB84 gains and error rates.
Appendix D. Estimation of Dn,j,k and Dn,j,k,l
- For individual THA, Eve-accessible states are instance-independent and Alice’s system is assumed uncorrelated with Eve’s; the resulting D_j,k parameters do not depend on photon number.These parameters help bound yields, while Appendix C bounds the phase error rate.Source: Appendix D · pp. 29–30
Appendix D.1. Individual THA - Case 1:
- Case 1 represents Eve’s returned states as coherent states with common amplitude β and uses a 3 × 3 matrix eigenvalue claim to calculate trace-distance quantities.The phase reference is set to θ_γs = 0, and β² is denoted I_max.Source: Appendix D.1 · p. 30
Appendix D.2. Individual THA - Case 2:
- Case 2 assumes Eve’s back-reflected light is attenuated like Alice’s signals and calculates the corresponding distance parameters using the earlier eigenvalue claim.Source: Appendix D.2 · p. 31
Appendix D.3. Individual THA - Case 3:
- For phase-randomised, similarly attenuated back-reflections, when Imax ≤ log 2 and γs ≥ γv ≥ γw, finite upper bounds are given for Dw,s, Dv,w, and Dn,s,v,w, Dn,v,s,w, and Dn,w,s,v.Source: Appendix D.3 · pp. 31, 33
Appendix E. Toolbox for Alice and Bob, and channel model
- Appendix E models Alice’s and Bob’s devices and the channel to simulate the observed decoy-state gains and error rates.The model assumes gains and error rates are basis-independent and includes Bob’s receiver loss and detector efficiency in system loss.Source: Appendix E · pp. 33–35
- The modeled setup uses phase-encoded decoy-state BB84, with Alice choosing signal, vacuum, or weak intensities and Bob measuring with an interferometer and two detectors.Channel transmission is parameterized by distance and loss coefficient; the setup also assumes an intrinsic error rate from misalignment and instability.Source: Appendix E · p. 34
Appendix F. Approaching the optimal THA with phase-randomised coherent states
The phase-randomised case is extended to Eve injecting Fock states rather than coherent states. For the very small device transmission rates considered, the resulting distances are approximately those already analyzed for Case 3.
Appendix F. Approaching the optimal THA with phase-randomised coherent states
- The analysis treats Eve’s n-photon Fock-state injection as her optimal strategy when her back-reflected light is phase-randomised, then compares the resulting states with Case 3.The comparison uses a trace-distance bound and sets Eve’s input-pulse intensity equal to n.Source: Appendix F · p. 35
- The returned light after Alice’s device is modeled with binomial and Poisson photon-number distributions, which are used in bounding the state-distance comparison.Source: Appendix F · p. 35
- For transmission rates of about 10^-13–10^-18 in the cited 1 GHz-clocked examples, the Fock-state attack gives distances approximately equal to Case 3, so its results also apply.Source: Appendix F · p. 36