Effect of source tampering in the security of quantum cryptography

Shi-Hai Sun, Feihu Xu, Mu-Sheng Jiang, Xiang-Chun Ma, Hoi-Kwong Lo, and Lin-Mei Liang

Phys. Rev. A 92, 022304 – Published 4 August 2015

Abstract

The security of source has become an increasingly important issue in quantum cryptography. Based on the framework of measurement-device-independent quantum key distribution (MDI-QKD), the source becomes the only region exploitable by a potential eavesdropper (Eve). Phase randomization is a cornerstone assumption in most discrete-variable (DV) quantum communication protocols (e.g., QKD, quantum coin tossing, weak-coherent-state blind quantum computing, and so on), and the violation of such an assumption is thus fatal to the security of those protocols. In this paper, we show a simple quantum hacking strategy, with commercial and homemade pulsed lasers, by Eve that allows her to actively tamper with the source and violate such an assumption, without leaving a trace afterwards. Furthermore, our attack may also be valid for continuous-variable (CV) QKD, which is another main class of QKD protocol, since, excepting the phase random assumption, other parameters (e.g., intensity) could also be changed, which directly determine the security of CV-QKD.

Received 24 January 2015

DOI:https://doi.org/10.1103/PhysRevA.92.022304

Authors & Affiliations

Shi-Hai Sun^1,*, Feihu Xu^2,3,†, Mu-Sheng Jiang¹, Xiang-Chun Ma¹, Hoi-Kwong Lo^2,‡, and Lin-Mei Liang^1,4,§

¹College of Science, National University of Defense Technology, Changsha 410073, China
²Center for Quantum Information and Quantum Control, Department of Electrical and Computer Engineering and Department of Physics, University of Toronto, Toronto, Ontario, M5S 3G4, Canada
³Research Laboratory of Electronics, Massachusetts Institute of Technology, 77 Massachusetts Avenue, Cambridge, Massachusetts 02139, USA
⁴State Key Laboratory of High Performance Computing, National University of Defense Technology, Changsha 410073, China

^*shsun@nudt.edu.cn
^†tigerfeihuxu@gmail.com
^‡hklo@ece.utoronto.ca
^§nmliang@nudt.edu.cn

Article Text (Subscription Required)

Click to Expand

References (Subscription Required)

Click to Expand

Issue

Vol. 92, Iss. 2 — August 2015

Reuse & Permissions

Access Options

Author publication services for translation and copyediting assistance advertisement

Images

Figure 1
Schematic setup of our experiment. Part (a) shows Eve's control devices, in which Eve uses a continuous wave (cw) laser to tamper with the parameters of Alice's pulsed signal laser. Part(b) shows the experimental setups to measure the parameters of Alice's signal pulses. The phase of adjacent pulse is measured by an unbalanced Mach-Zehnder interferometer [lower arm of part(b)], and the waveform of Alice's signal pulse is directly measured with a photodiode [upper arm of part(b)]. The output of photodiodes ( $D_{0}$ and $D_{1}$ ) are recorded with an oscilloscope. Cir.: circulator; PC: polarization controller; Pol.: polarizer; BS: beam splitter. Solid lines are optical fibers (single-mode fiber for black color and polarization-maintaining fiber for red color), and dashed lines are electrical lines. Here we consider Eve's control laser working at continuous wave (cw) mode. However, in later parts of this paper, we will consider the possibility that Eve modulates her control laser into short photon pulses. This can make it harder for Alice to detect Eve's attack.
Reuse & Permissions
Figure 2
Experimental results for normalized intensity distribution of $V_{P}^{s}$ . $P_{c}$ is the power of Eve's control laser. Parts (a)–(d) show the intensity distribution of four S-LDs with Eve's different control intensities. Part (e) shows the theoretical simulation (dashed line) of the probability distribution when the phase of each pulse follows a uniform distribution from 0 to $2 π$ , and the experimental results of ID300-1 (solid line) when Eve is absent. These results clearly show that when photons are injected into Alice's signal laser, the phase of the signal laser becomes correlated. Here $P_{c}$ is not minimized for Eve [41], and a further experiment about the minimal power is discussed in the following text (see Fig. 4).
Reuse & Permissions
Figure 3
(a) Principle scheme to attack a complete QKD system by combining our attack with those of [42]. $s$ is Alice's quantum signal pulse. Eve splits her bright control pulse into two parts with a beam splitter (BS1); one part serves as control laser to tamper with the parameters of Alice's signal pulse, while the other part serves as phase reference for Eve to perform the source attack [42]. (b) A possible countermeasure for Alice to monitor our attack. Alice splits parts of the light with BS2 and monitors the power with a photodetector. The optical frequency filter is used to remove all wavelength-dependent flaws of Alice's source. The isolator (Iso.) is used to prevent light from entering Alice's laboratory from the quantum channel. (c) Active phase randomization scheme (PR.), which can guarantee the phase randomization assumption and partially reduce the risk of our attack, but it cannot entirely remove our attack (see text for details).
Reuse & Permissions
Figure 4
(a) Experimental results for $V_{P}^{s}$ , when a 25-dB isolator is placed after the signal laser ID300-1. (b) The standard deviation of $V_{P}^{s} \propto sin (Δ ϕ)$ and $V_{P}^{c} \propto cos (Δ ϕ)$ with different powers of control light. The standard deviation has been normalized by that of $P_{c} = 0$ . The experimental results clearly show that, even if a 25-dB isolator is used by Alice, the intensity distribution is still Gaussian type but not U type when Eve uses a cw laser with a power of $0.6 mW$ , which means that Eve could still introduce a nonrandom phase in Alice's quantum signal. In the test, only a 25-dB isolator is put after the output of Alice (the photodetector and the filter will be discussed later). Other setups used here are the same as those for Fig. 2.
Reuse & Permissions
Figure 5
Measured signal pulse waveforms when Alice's signal laser is illuminated by a bright light. Eve sends a bright cw light to Alice's signal lasers (including both commercial and homemade pulsed lasers), then the signal pulse of Alice is directly measured using a photodiode $(D_{1})$ with bandwidth 40 GHz, an oscilloscope with bandwidth 33 GHz, and sample rate 80 GHz (model DSOX93303Q, Agilent). The repetition rate of the signal laser is 10 MHz. It is clearly seen that when Alice's signal laser is illuminated, the pulse amplitude and width will be changed.
Reuse & Permissions
Figure 6
Part (a) shows the experimentally measured pulse amplitudes by directly inputting an electrical signal with amplitude 1 V and 3-dB width 100 ps into an oscilloscope (model DSOX93304Q, Agilent) with various bandwidths: 1, 5, and 10 GHz. The electrical signal is generated from a pattern generator (model 12050, Picosecond Pulse Labs). Parts (b) and (c) show the theoretical amplitude of an ideal Gaussian pulse which passes an ideal low-pass filter. $Δ x$ is the 3-dB width of the Gaussian signal. $ω_{0}$ is the maximal bandwidth of the low-pass filter. In part (b), we set $Δ x = 100 ps$ . The mismatch between experiment [part (a)] and theory [part (b)] is mainly due to the simplified version of our model. All the results show that the monitor devices with finite bandwidth cannot faithfully characterize the input signal.
Reuse & Permissions

Physical Review A

covering atomic, molecular, and optical physics and quantum information