Quantum Hacking. Feihu Xu Dept. of Electrical and Computer Engineering, University of Toronto

Transcription

1 Quantum Hacking Feihu Xu Dept. of Electrical and Computer Engineering, University of Toronto 1

2 Outline Introduction Quantum Key Distribution (QKD) Practical QKD Quantum Hacking Fake-state & Time-shifted attack Detector-control attack Phase-remapping attack Wavelength-dependent attack Conclusion and Outlook 2

3 Quantum key distribution (QKD) BB84 (Bennett & Brassard 1984) Alice Bob X11X X11X X10X0 3 0: 1: Eve Quantum no-cloning theorem.

4 Intercept-and-resend attack Alice Bob X11X0 Eve X11X0 0: 1: A simple intercept-and-resend (man-in-middle) attack will introduce an average bit error rate of 25%. 4

5 Performance of practical QKD 1 K Secure key rate [bps] 100k 1M 5 ~20km Year

6 Security of practical QKD In general, the developing process of all secure fields is a fighting process between two groups - enforcer and attacker. The process consists of two parts: discovering loopholes & implementing countermeasures. In theory, security proofs of QKD are based on ideal assumptions. In practice, real-life setups have many imperfections. Do the assumptions apply to real-life applications? Can an attacker exploit these imperfections and launch quantum attacks? 6 Push the development of QKD.

7 Security of practical QKD Experimental demonstration More attacks, demonstrations and countermeasures Security of practical QKD Large-pulse attack PNS attack Double-click attack Trojan-horse attack Fake-state attack Time-shift attack Optical isolator Decoy-state Random assignment Theoretical security Practical security proofs Year

8 Outline Introduction Quantum Key Distribution (QKD) Practical QKD Quantum Hackings Fake-state & Time-shifted attack Detector-control attack Phase-remapping attack Wavelength-dependent attack Conclusion and Outlook 8

9 Fake-state attack & Time-shift attack 1. Single photon detector in gated mode Quantum signal Bit 1 Sync Bit 0 Gating pulses 2. Detection Efficiency mismatch Detector efficiency η SPD 0 SPD 1 η0>η1 η1>η0 9 t 1 t 0 t 2 Time V. Makarov, A. Anisimov, and J. Skaar, Phy. Rev. A, 74, (2006) B. Qi, C.-H. F. Fung, H.-K. Lo, and X. Ma, Quant. Info. Comp. 7, 73 (2007).

10 Time-shift attack 10 Y. Zhao, C.-H. F. Fung, B. Qi, C. Chen, and H.-K. Lo, Phy. Rev. A, 78, (2008).

11 Detector-control attack 11 InGaAs-APD

12 Detector-control attack Eve Alice Bob Alice Bob Bob chooses same basis as Eve: Bob chooses different basis: 0 Click! I 0 I th t 0 I 0 I th t 1 I 1 I th 1 I 1 I th t t 12 L. Lydersen et al., Nature Photonics, 4, 686, 2010 I. Gerhardt et al., Nature Communications, 2, 349, 2011

13 Phase-remapping attack Phase shift φ₀ Phase Modulation φ₁ Alice s encoded information: Basis1 Basis2 1 2 π π 4 π 4 Original states t₁ t₀ 1 2 Φ 3 Φ 2 Φ 1 time New states 13 C.-H. F. Fung, B. Qi, K. Tamaki, and H.-K. Lo, Physical Review A, (2007)

14 Eve s attack strategy Unambiguous State Discrimination 14 Feihu Xu, Bing Qi, and Hoi-Kwong Lo, New Journal of Physics, 12, (2010)

15 15 Plug & Play QKD system in our lab

16 Hacking setup Eve Bob Alice State Preparation Bob Detection Results Alice Intercept and resend (man in the middle) attack. Det1 Modifications: Eve replaces Bob; PC: Polarization Controller. VODL: variable optical delay line; LD C Det2 Bob PMB VODL 48ns PBS PC 16 Feihu Xu, Bing Qi, and Hoi-Kwong Lo, New Journal of Physics, 12, (2010)

17 Results QBER 1 QBER 2 Quantum bit error rate(qber): VODL A(4.65m) VODL B(5.8m) 21.8% 30.8% 19.1% 17.6% QBER = QBER 1( A) + QBER 2 2( B) = 19.7% A simple intercept-and-resend attack will normally cause a QBER of 25% in BB84 QKD protocol. In single-photon BB84, the proven secure bound of QBER is 20.0%. An imperfection exists in the commercial QKD system. The security is compromised. 17 Feihu Xu, Bing Qi, and Hoi-Kwong Lo, New Journal of Physics, 12, (2010)

18 Wavelength-dependent attack Beam Splitter (BS) Wavelength dependent BS Port1 Port2 SPD SPD 18 H. Li, et al. arxiv: , 2011

19 Outline Introduction Quantum Key Distribution (QKD) Motivation Quantum Hackings Fake-state & Time-shifted attack Detector-control attack Phase-remapping attack Wavelength-dependent attack Conclusion and Outlook 19

20 Quantum Hackings Attack Target component Tested system Time-shift detector ID Quantique Y. Zhao et al., Phys. Rev. A 78, (2008) Phase-remapping phase modulator F. Xu, B. Qi, H.-K. Lo, New J. Phys. 12, (2010) Faraday-mirror Faraday mirror ID Quantique (theory) S.-H. Sun, M.-S. Jiang, L.-M. Liang, Phys. Rev. A 83, (2011) Channel-calibration detector ID Quantique 20 N. Jain et al., Phys. Rev. Lett. 107, (2011) Detector-control detector L. Lydersen et al., Nat. Photonics 4, 686 (2010) ID Quantique, MagiQ Tech. Deadtime detector research sys. H. Weier et al., New J. Phys. 13, (2011) Wavelength H. Li et al., arxiv: (2011) Beam splitter research sys.

21 21 Outlook How to counter an Eve who combines various quantum attacks together? Are there any imperfections in other QKD implementations, for instance high-speed QKD, CV-QKD and Free-space QKD? More research to carefully quantify each component and each specific QKD implementation. For instance, MDI-QKD to counter the detector-control attack. Working on security proofs of QKD with testable assumptions. Every assumption should be written down and experimentally verified. Only through battle-testing can we gain confidence about the security of a practical QKD system, and thus the security of a future cryptosystem. Let us work together to make a bright future for QKD!

22 Thank you! Feihu Xu Dept. of Electrical and Computer Engineering, University of Toronto 22