1

candidate: Vadim Makarov

Quantum cryptography and

quantum cryptanalysis

Defence for the degree doktor ingeniørat the Norwegian University of Science and Technology, April 30, 2007

SPbSPUSt. Petersburg StatePolytechnic University

2

ca. 1970

2004 First commercial offers

Concept (“money physically impossible to counterfeit”)

...... Market?

1984 Key distribution protocol (BB84)

1989 Proof-of-the-principle experiment

1993 Key transmission over fiber optic link

Quantum cryptography timeline

3

Encoder Decoder

Open (insecure)channel

BobAlice

Key

Secure channel

MessageMessage

Encoded message

Secret key cryptography requires secure channel for key distribution.

Quantum cryptography distributes the keyby transmitting quantum states in open channel.

Key distribution

4

Retained bit sequence 1 – – 1 0 0 – 1 0 0 – 1 – 0

Bob’s measurement 1 0 0 1 0 0 1 1 0 0 0 1 0 0Bob’s detection basis

Alice’s bit sequence 1 0 1 1 0 0 1 1 0 0 1 1 1 0

Light source

Alice

Bob

Diagonal detector basis

Horizontal-vertical detector basis

Diagonal polarization filters

Horizontal-vertical polarization filters

Image reprinted from article: W. Tittel, G. Ribordy, and N. Gisin, "Quantum cryptography," Physics World, March 1998

Quantum key distribution

0

01

1

5

A = – 45 or + 45 : 0

Detector bases:

B = – 45 : X

B = + 45 : Z

A = +135 or – 135 : 1

A

Lightsource D0

B

Alice BobLA

SA

Transmission line

SB

LBD1

Interferometric QKD channel

6Quantum cryptography at NTNU

Fiber optic QKD setup

1. Optimal tracking of phase drift

2. Single photon detector with afterpulse blocking

Security against practical attacks

3. Large pulse attack: experiment

4. Faked states attack

5. Detector efficiency mismatch”0"

”1"

t

BOB

7QKD setup

Bob

Laser

APD

1310 nmPulse rate = 10 MHz

Line

Polarizationсontroller

AttenuatorAlice’s

PC

Publiccommunication(TCP/IP)

Bob’s PC

Polarizationcombiner

Polarizationсombiner

Phasemodulator 2

Polarizingsplitter

Phase modulator 1

PM coupler50/50

Variabledelay linePolarizer

Variable ratioPM coupler

“1”

“0”

Alice

PM fiberstandard SM fiber

8

Photo 1. Alice (uncovered, no thermoisolation installed)

9

Photo 2. Bob (uncovered, no thermoisolation installed)

10Tracking phase drift

To get phase accuracy Δφ within ±10° (QBERopt 1%),

no more than Na = ~ 200 detector counts per adjustment

are required.

Optimally counted at ±90° points from the extreme of the

interference curves. Exact required number of counts

where k is the number of standard deviations of not exceeding Δφ.

,2

2

2

QBER21

12

k

Na

J. Appl. Opt. 43, 4385 (2004)

11Tracking phase drift

+

–

0

0 60 minTime

J. Appl. Opt. 43, 4385 (2004)

To get phase accuracy Δφ within ±10° (QBERopt 1%),

no more than Na = ~ 200 detector counts per adjustment

are required.

Experiment: adjustment every 3 s, Na = 230:

12Test of QKD in laboratory conditions

Test run No. 2

QBER =

.5.7% average

QB

ER

, %

50

11

00 5 min

Time

Test run No. 1

best QBER

~ 4%

QB

ER

, %

50

11

00 5 min

Time

13

tgate down to 1ns

Gate pulse rate = 20 MHz

VE

Vbias

VB

t

T=1/(Gate pulse rate)

tgate–VAPD

Single photon detector:avalanche photodiode in Geiger mode

APD: Ge FD312L

T=77K, QE=16%, DC=5·10 –5

APD inside cryostatC = CAPD

Differentialamplifier

50 coaxial cables

Gate pulse generator Bias

14Afterpulse blocking

In QKD systems, probability of detecting a photon per pulse is always much lower than 1 (e.g., ~ 1/1000). This makes afterpulse blocking efficient, allowing without much loss in detection probability:

In our QKD system: 20 MHz gate pulse rate In principle: a few orders of magnitude faster gate pulse rate

–VAPD

Detector output

Hold-off time: N pulses are blocked after detecting avalanche

t

VB

t

15Hardware implementation of

afterpulse blocking

APD

Differentialamplifier

Gate pulse generator Bias

RF switch

= = Set

Reset

TriggerComparatorIntegrator

Digital output

0 0

N set by switch

CLK

Load

Counter

Overflow

16Test of afterpulse blocking

APD: Ge FD312L

Gate pulse rate = 12 MHz

QE = 7%

T = 77K

Number of gate pulses blocked

0.00

0.05

0.10

0.15

0.20

Co

un

t p

rob

abili

ty, %

Dark counts

Counts at 0.005 photon per pulse

0 2 5 12 18 34

N

17

1. Conventional security; trusted equipment manufacturer

2. Security against quantum attacks – security proofs for idealized model of equipment

3. Loopholes in optical scheme – imperfections not yet accounted in the proof

Quantum key distribution:components of security

2 311

Alice Bob

18Large pulse attack

Alice

Line

AttenuatorAlice’s

PC

Eve’s equipment

Phase modulator

– interrogating Alice’s phase modulator with powerful external pulses (can give Eve bit values directly)

19Large pulse attack: experiment

Laser

4% reflection

Vmod

OTDR

Out

In

Fine length adjustmentto get L1 = L2

L2

L1

Received OTDR pulse

Vmod, V4.1 8.20

Variable attenuator

Alice

Phase modulator

Eve

J. Mod. Opt. 48, 2023 (2001)

20

Photo 3. Artem Vakhitov tunes up Eve’s setup

21

Conventional intercept -resend:

Faked states attack:

BA FSB

EVE

A BB A

EVE

ALARM!!!

(no alarm)

Faked states attack

J. Mod. Opt. 52, 691 (2005)

22

”0"

”1"

t

BOB

Exploiting common imperfection:detector gate misalignment

Phys. Rev. A 74, 022313 (2006)

23

”0"

”1"

t

BOB

Laser pulse from Alice

Detector gate misalignment

Phys. Rev. A 74, 022313 (2006)

24

”0"

”1"

t

BOB

Detector gate misalignment

Phys. Rev. A 74, 022313 (2006)

25

”0"

”1"

t

BOB

Detector gate misalignment

Phys. Rev. A 74, 022313 (2006)

26

”0"

”1"

t

Example: Eve measured with basis Z (90°), obtained bit 1

0°BOB

= 0 °

Detector gate misalignment

(Eve resends the opposite bit 0 in the opposite basis X, shifted in time)

27

(Eve resends the opposite bit 0 in the opposite basis X, shifted in time)

”0"

”1"

t

Example: Eve measured with basis Z (90°), obtained bit 1

90°BOB

Eve’s attack is not detectedEve’s attack is not detected Eve obtains 100% information of the keyEve obtains 100% information of the key

= 0 °

Detector gate misalignment

28

Det

ecto

r ef

fici

ency

t0

t0 t1

0(t0)

1(t0)0(t1)1(t1)

Partial efficiency mismatch

29Partial efficiency mismatch

In the symmetric case (when 1(t0)/0(t0) = 0(t1)/1(t1) ),

Eve causes less than 11% QBER if mismatch is larger than 1:15

A. Practical faked states attack:

B. General security bound (incomplete):

where

30

-3 -2 -1 1 2 30t, ns

0

No

rmal

ized

det

ecto

r se

nsi

tivi

ty, a

rb. u

.

Detector model 1.Sensitivity curves

31

0 1 2 3 4 5 6 7 8 9 10 11 12t, ns

0

10

20

Det

ecto

r q

uan

tum

eff

icie

ncy

, % t = 5.15 ns

1/9

t = 7.40 ns

1/30

0 1

1

0

0

1

Detector model 2.Sensitivity curves at low photon number µ=0.5

32Detector efficiency mismatch

Detector efficiency mismatch is a problem for many protocols and encodings: BB84 (considered above), SARG04, phase-time, DPSK and Ekert protocols.

Control parameter t that changes detector efficienciesshall not be necessarily timing; it can be, e.g., wavelength or polarization.

The worst-case mismatch, no matter how small,must be characterized and accounted for duringprivacy amplification.

[quant-ph/0702262]

33Conclusion

A phase tracking technique and detector with afterpulse blocking were successfully developed.(QKD was demonstrated with a very limited success.)

Our group has built unique expertise in quantum cryptanalysis of attacks via optical loopholes.Several attacks have been proposed, studied in detail,and protection measures suggested.

34Possible future research

Continuing security studies beyond those presented in the thesis; we have experimented with passively-quenchedSi APD; we are trying to incorporate detector efficiency mismatch into general proof... With sufficient financing,a study of high-power damage can be attempted.

Improving the QKD experiment, demonstrating it overat least ~ 20 km distance. Performance of detectorand phase tracking can be more accurately characterized.

The QKD field is abound with novel ideas that can be tried...

35

Optional slides

36

0.00 0.11QBER

0

1

R

0

Handling errors in raw key

R = 1 – 2 h(QBER)

37

MagiQ Tecnologies

USA

id Quantique

Switzerland

Standard VPN router + QKD equipment for frequent key changes

Several other companies also have the QKD technology, but are not selling yet

Commercial offers (as of late 2006)

38

Photo 4. Bob (left) and Alice (right), thermoisolation partially installed

39

Typical values of reflection coefficients for different fiber-optic components(courtesy Opto-Electronics, Inc.)

40( Eve’s basis = Bob’s basis )

is sufficient for eavesdropping

Alice

Eve’s basis det. result

Bob

Incompatible basis –discarded by Alice and Bob during sifting

41

0 10.00

0.11

QB

ER

Not proven(assumed insecure)

Insecure

0.0660

Securewith reduced key rate

Security state of QKD system

( reduced rate at QBER=0 line, too )

42

Trondheim

St. Petersburg