Demonstrating feasibility of a Trojan-horse attack on a commercial QKD systemNitin Jain , , Christoffer Wittmann ,Vadim Makarov and Gerd Leuchs
1,2 1,2
3
Imran Khan ,1,2
1,2
Elena Anisimova Christoph Marquardt ,3 1,2
1Max Planck Institute for the Science of Light, Günther-Scharowsky-Str. 1, Bau 24, 91058 Erlangen, Germany
2Universität Erlangen-Nürnberg, Staudtstraße 7/B2, 91058, Erlangen, Germany
3Institute for Quantum Computing, University of Waterloo, 200 University Avenue West, Waterloo, Ontario, N2L 3G1 Canada
Quantum hacking: Motivation� To investigate loopholes in practical QKD that
could be exploited by an eavesdropper Eve.implementations
�
�
Imperfections & vulnerabilities mainly arise from technologicaldeficiencies or operational weaknesses.
Looking for loopholes is a normal, iterative process duringdevelopment of a secure communication system.
Responsible disclosure provides a positive feedback to the field.The eventual goal is to make practical implementations more secure!�
�
�
�
Quantum channel is not just for Alice and Bob, it is also a potential open door for an eavesdropper.
No optical component transmits or absorbs perfectly; some light is inevitably reflected back towards the input.
Optical time/frequency domain reflectometry (OTDR/OFDR) can be used to generate maps of Alice and Bob fromthe quantum channel, allowing Eve to know when and with what intensity to attack.
N. Gisin, S. Fasel, B. Kraus, H. Zbinden, and G. Ribordy, Phys. Rev. A 73, 022320 (2006)A. Vakhitov, V. Makarov, and D. R. Hjelme, J. Mod. Opt. 48, 2023 (2001)
�
�
�
�
�
When exactly should the Trojan-horsepulse be launched?
adversely
How
What
Which
What
to choose the suitable wavelength,brightness, and polarization for this pulse?
properties of the back-reflectedpulse should be analyzed?
components in the QKD systemcould be affected by the attack?
percentage of the final secret keymay be obtained from this attack?
Eve’s bane: Afterpulsing effects in Bob’s APD based single-photon detectors
�
�
�
A back-reflection level of -60 dB, as perthe OTDR map, implies Eve nmillions of photons
igh attack frequency worsens the problem.
eeds to send(bright pulses) into Bob
to get just a few photons back.
Bright pulses cause in theAPD due to
raises the QBER andthus, may disclose Eve’s presence.
afterpulsingfilling of traps by charge carriers.
H
Afterpulsing results in substantial increaseof dark counts. This
R. H. Haitz, J. Appl. Phys. 36, 3123 (1965); S. Cova, A. Lacaita, and G. Ripamonti, IEEE Electron. Dev. Lett. 12 685 (1991)
Clavis2 – Commercial QKD system from ID Quantique
P. Jouguet et al., Phys. Rev. A 86, 032309 (2012)N. Jain, arXiv:1206.7019v1
G. Leuchs, ICQI, Ottawa (2011)V. Makarov, CLEO/Europe-EQEC, Munich (2011)
V. Scarani and C. Kurtsiefer, arXiv:0906.4547v1D. Stucki, N. Gisin, O. Guinnard, G. Ribordy,
and H. Zbinden, New J. Phys. 4, 41 (2002)
OTDR maps
Spectral characterization of reflectivity
Asymmetricdouble pass (both source and detector in Bob).Mach-Zehnder interferometric configuration
operating in
Operating principle: Plug-n-Play
BB84 SARG04and protocols with highly attenuatedlaser pulses ( mean photon number, < 1.0).typical μ
QKD protocols implemented
If Eve can surreptitiously read Bob’s modulation during theoperation of , then she obtains the raw key
Alice and Bob knowledge.SARG04 exchanged
by without their
Exploitable vulnerability
State preparation, basis application and detection
Alice modulates φ = {0, π/2, π, 3π/2}
φ = {0, π/2}A
B
to prepare the state.
Bob modulates to apply the basis choice and
measures the outcome using avalanche photodiodes (APDs).
V. Scarani, A. Acín, G. Ribordy, and N. Gisin, Phys. Rev.Lett. 92, 057901 (2004)
C. H. Bennett and G. Brassard, Proc. IEEE Int. Conference onComputers, Systems, and Signal Processing, 175 (1984)
A Trojan-horse eavesdropper
List of questions for Eve
Trojan-horse attack: from ideas to implementationConcepts
Experimental results and issues for Eve
quantumchannel
V
Detector 0 Detector 1
polarizingbeamsplitter
50/50 beamsplitter
circulator
phase modulator
BobB
H
Laser
photodiode
90/10coupler
variableopticalattenuator(VOA1)
VOA2
Faradaymirror
delay loops
phase modulator
Alice
A
Future directions
�
�
�
Use interfaces such as with reduced reflections.
Reducing the duty cycle of the phase modulation voltage.
Technical countermeasures, e.g. watchdog detector, arepossible but need to be adapted to security proofs.
FC/APC
Possible countermeasures
Schematic of Alice and Bob in Clavis2
Schematic of Eve’s apparatus to perform a readout of Bob’s phase modulation
Oscilloscopetrace of Eve’scorresponding
homodynedetection output
Integratingover a
suitabletime windowper slot for250 slots
Bob’s randomlychosen & secret
basis choice
slot no. in the QKD frame
pulse no. in homodyne output
Eve’sestimation
using asuitable
threshold
0
1
0
1
{{
Oscilloscopetrace of Bob’s
phase modulationvoltage
10 20 30 40 50 60
1
2
3
4
attack frequency, (kHz)fEatt
rise
in d
ark c
ount
level 5
1 qu
antu
m b
it e
rro
r ra
te,Q
BE
R Mu
tual in
form
ation
,I(A
:B)
channel transmission, T
fEatt =10 kHzNo attack
fEatt =20 kHz
0.1 0.2 0.3 0.4
0.02
0.04
0.06
0.08
0.10
0.12
0.14
0.2
0.4
0.6
0.8
}
ΔQBER = +2.3%
}
ΔI(A:B) = -8.8%
Increase in dark counts due to afterpulsing and correspondingchanges in quantum bit error rate, QBER [solid lines] and mutualinformation of Alice and Bob, I(A:B) [dashed lines].
Above 99%
correlations!
C. Branciard, N. Gisin, B. Kraus, V. Scarani, Phys. Rev. A 72, 032301 (2005)
�
�
�
�
A
We are devising an attack
Preliminary simulation results show this strategy works
fterpulsing is a blessing in disguise for security.
strategy in which Evemanipulates the QKD frame sent by Alice to Bob so that:
for low channel transmission values ( 0.2) at least.
Spectral sensitivity of the APD is four orders smaller at1700 nm than at 1550 nm. We conjecture the afterpulsingmight be significantly reduced in this wavelength regime.
T ≤
Attack strategy and further improvements
�
�
the incurred QBER is below the abort-threshold of Clavis2,
the privacy amplification step is insufficient in preventingEve from knowing a partial amount of the final secret key, and
the detection rate observed by Bob is within the bounds ofthe expected detection rate.�
Control Arm
50:50 BS
Signal Arm
Homodynedetector
Outcoupler FC1 ona micrometer stage
fibercoupler
Eve lasersynchronizedto Bob
isolator
Bob
1
Bob
PC1
PC3
4
3
9
2
coarse delayline
PC2
FC2
PC: polarization controllerBS: beam splitterFC: Fiber collimator
Results of phase readout; mean photon number, 100\10 and attack frequency, = 5 MHzµ f≈
8
Eatt(Signal\Control arm)
φ πBob = /2
φBob = 0
0.2 0.4 0.6 0.8 1.0time (μs)
time (μs)
Reflections (
in d
B)
time delay (ns)
1550 nm
Sum of the remainingthree connectors 806 nm
D0Laser
D1
PM
PBS-BS-CD0
LaserD1
D0Laser
D1
short-short short-long / long-short long-long
PBS-BS-C
PBS-BS-C
-40
-100
-60
-120
-80
-40
-100
-60
-120
-80
0 20 40 60 80 100 120 140
No
. o
f p
ub
lica
tio
ns
Year
Inception ofMagiQ Technologiesand ID Quantique
2000 2002 2004 2006 2008 2010 2012
123456
SeQuereNetis launched
-70
-60
-50
-40
-30
-20
-10
Wavelength (nm)
Supercontinuum
OSA Noise Floor
800 1000 1200 1400 1600
po
we
r (d
Bm
)
Reflectionfrom Bob with
connector afterPM open
Reflectionfrom Bob
as a whole