QKD

QKD’s actual goal is narrow and specific: it lets two parties establish a shared, secret, random string of bits (a symmetric key) with a security guarantee rooted in physics rather than computational hardness assumptions – it is not a mechanism for directly transmitting an arbitrary message or file over a quantum channel. A common misconception is imagining QKD as ”quantum-encrypted email” or ”unhackable data transmission” – in reality, the actual message/data is still sent via completely ordinary classical communication, encrypted using an entirely conventional symmetric cipher (very often the one-time pad, or AES), where the only thing QKD contributes is the secret key that cipher uses. QKD solves key distribution specifically, leaving message encryption itself to standard, unmodified classical cryptographic techniques.

Discrete-variable QKD (e.g. BB84, E91) encodes information in a discrete, two-level quantum degree of freedom – typically a single photon’s polarization or phase, measured with single-photon detectors that register discrete ”click” or ”no-click” events. Continuous-variable QKD instead encodes information in the continuous quadrature ampli- tudes of a light field (analogous to the amplitude and phase quadratures discussed in quantum sensing’s squeezed-light context), measured using homodyne or heterodyne detection – standard, mature telecom-grade optical detection technology, rather than specialized, often more expensive single-photon detectors. This distinction drives real prac- tical trade-offs: CV-QKD can often reuse cheaper, more readily available classical optical communication hardware, but DV-QKD protocols generally have more mature, well-established security proofs and better-understood behavior at longer transmission distances.

Standard QKD’s secret key rate falls off with distance in proportion to the channel transmittance η (roughly, the probability a photon survives the trip), which decays exponentially with fiber length – fundamentally capping the key rate achievable at long distances without trusted nodes or full quantum repeaters (both discussed elsewhere in this deck). Twin-Field QKD restructures the protocol so that Alice and Bob each send phase-encoded pulses toward a central, untrusted measurement station roughly halfway between them, where the two pulses interfere – because the relevant loss in this interference-based scheme scales with the square root of the total channel transmittance (effectively, each party’s photon only needs to survive half the total distance) rather than the full transmittance, TF- QKD’s key rate falls off much more gently with distance, allowing it to beat the previously proven fundamental rate- distance bound for standard ”repeaterless” point-to-point QKD, and enabling record-breaking demonstrated distances exceeding 500-800+ km over standard optical fiber without any trusted intermediate node.

What is the fundamental rate-distance bound (the PLOB bound) for repeaterless point-to- point quantum communication, and why was Twin-Field QKD’s ability to beat it initially considered surprising?

QKD’s own key-generation process is information-theoretically secure – but that security guarantee applies specif- ically to how unpredictable and eavesdropper-free the resulting key itself is, not to whatever cipher is subsequently used with that key to actually encrypt real message data. If the QKD-generated key is used with the one-time pad (a classical cipher that is itself information-theoretically secure, provided the key is truly random, used only once, and at least as long as the message), the entire combined system inherits a genuine, unconditional, information-theoretic security guarantee. If instead the QKD-generated key is used merely as a symmetric key for a computationally-secure cipher like AES (reusing the same key for many messages, as is standard practice, since one-time pad key material is consumed at the same rate as the message itself and is often impractically expensive to generate fast enough), the overall system’s security reverts to relying on AES’s own computational-hardness assumption – meaning the celebrated ”unconditional security” of QKD, in most practical real-world deployments, is specifically a property of the key distribution step alone, not necessarily of the entire end-to-end encrypted communication system as actually deployed.

The six-state protocol extends BB84 by using three mutually unbiased measurement bases (adding the circular/Y- basis to BB84’s rectilinear and diagonal bases) rather than just two, with Alice and Bob each randomly choosing among all three for every qubit. Because there are now three possible bases instead of two, the probability that Alice’s and Bob’s independently, randomly chosen bases happen to match during sifting drops from BB84’s 50% down to only 33%, directly reducing the raw sifted key generation rate. In exchange, an eavesdropper attempting an intercept- resend attack must now correctly guess among three possible bases rather than two, meaningfully increasing the error rate any given eavesdropping strategy introduces into the observable QBER for a given amount of information gained – giving the six-state protocol a measurably higher security threshold (tolerating a higher QBER before aborting) than plain BB84, at the direct cost of that lower raw sifting efficiency.

SARG04 uses the exact same four quantum states as BB84 (encoded and transmitted identically), but changes the classical sifting procedure: instead of Alice announcing which basis she used (as in standard BB84), she announces one of two possible non-orthogonal state pairs that could have included her actually-sent state, and Bob must cor- rectly infer the bit value from his own measurement result combined with Alice’s announced pair. This change was specifically designed to be more resistant to the Photon Number Splitting (PNS) attack (discussed in the Quantum Cryptography deck) when using realistic weak coherent laser pulses rather than true single-photon sources – because SARG04’s sifting logic requires an eavesdropper to correctly distinguish between non-orthogonal states even when possessing an extra split-off photon from a multi-photon pulse, it meaningfully raises the practical difficulty and reduces the effectiveness of PNS attacks compared to standard BB84 sifting, at the cost of a lower overall raw key generation rate for a given photon flux.

DPS-QKD has Alice send a continuous train of weak coherent laser pulses, each randomly phase-modulated by either 0 or π relative to the previous pulse – rather than Alice needing to actively, randomly choose among multiple discrete preparation bases for each individual transmitted qubit (as BB84 requires). Bob interferes each received pulse with the immediately preceding one (using a simple, fixed unbalanced interferometer) and measures which output port detects a photon, revealing the relative phase difference (and hence the encoded bit) between consecutive pulses. This significantly simplifies Alice’s required hardware (a single phase modulator applying just one of two possible phase shifts to a steady pulse train, with no need for active, randomized basis-switching setup/measurement apparatus at all) – though DPS-QKD’s security proof and analysis is generally considered less mature and more protocol-specific than BB84’s well-established, extensively studied security framework.

COW encodes information using the presence or absence, and timing pattern, of weak coherent pulses within a se- quence of time slots – e.g. a logical 0 might be represented by a pulse present in the first of two time slots (and absent in the second), while a logical 1 is the reverse pattern, with occasional ”decoy” sequences (two consecutive empty or consecutive present slots) inserted to specifically test for coherent eavesdropping attacks that might otherwise go undetected by simple timing analysis alone. This time-encoding approach is notable for being comparatively simple and robust to implement using standard telecom components (intensity modulators and single-photon detectors, with- out needing precise phase or polarization state preparation/measurement), making it one of the more straightforward DV-QKD protocols to deploy using largely off-the-shelf, mature telecom-industry optical hardware.

In the GG02 protocol (named for Grosshans and Grangier), Alice prepares coherent states of light and randomly displaces (modulates) their amplitude and phase quadratures according to a Gaussian probability distribution – rather than preparing one of a small, discrete set of specific quantum states (as in BB84), Alice’s quadrature values are drawn continuously from this Gaussian distribution, directly encoding continuous, real-valued information rather than discrete bit values. Bob then measures the received state’s quadratures using homodyne detection (measuring just one quadrature, randomly chosen to match either amplitude or phase) or heterodyne detection (simultaneously measuring both quadratures, at the cost of additional inherent measurement noise) – with the raw key ultimately extracted from statistical correlations between Alice’s originally chosen Gaussian-distributed values and Bob’s correspondingly noisy quadrature measurements.

Homodyne and heterodyne detectors are exactly the same, extremely mature, high-bandwidth coherent optical de- tection technology already used ubiquitously throughout conventional classical fiber-optic telecommunications (e.g. in coherent optical modems) – they operate at room temperature, are comparatively inexpensive and readily com- mercially available off-the-shelf, and don’t suffer from some of the practical limitations (afterpulsing, limited count rates, dead time) that specialized single-photon avalanche detectors used in DV-QKD systems do. This gives CV- QKD a genuine, practically significant advantage in potential cost and ease of integration with existing telecom network infrastructure and components – a major part of its appeal for eventual widespread commercial deployment, even though (as discussed below) its security proofs and achievable transmission distances have historically lagged somewhat behind the more mature DV-QKD field.

DV-QKD protocols operate in a finite-dimensional quantum state space (a single qubit’s polarization, for instance, is described by a simple two-dimensional Hilbert space), for which the mathematical machinery needed to bound an eavesdropper’s maximum possible information gain under the most general coherent attacks is comparatively well- developed and tractable. CV-QKD, by contrast, operates in a fundamentally infinite-dimensional Hilbert space (since a continuous quadrature variable can, in principle, take on a continuum of possible values) – this infinite dimensionality makes rigorously bounding an eavesdropper’s information gain under the most general possible co- herent attacks a substantially harder mathematical problem, and it took considerably longer for the field to establish security proofs for CV-QKD against fully general coherent attacks (as opposed to more restricted individual or collec- tive attacks) with the same level of rigor and tightness already well-established for DV protocols like BB84, though such general-attack security proofs for CV-QKD have since been successfully developed.

Excess noise refers to any noise present in the CV-QKD channel/detection process beyond the fundamental, theo- retically unavoidable minimum quantum shot noise inherent to the measurement process itself – arising in practice from imperfect modulation, detector electronic noise, or genuine channel-induced noise (which, conservatively and pessimistically, security proofs must attribute entirely to a possible eavesdropper rather than assuming it’s benign). Because CV-QKD’s security proof must assume the worst case – that any observed excess noise beyond ideal shot noise could, in principle, be an eavesdropper’s doing rather than benign hardware imperfection – even quite small amounts of real, unavoidable excess noise from imperfect hardware can already consume a large fraction of the secu- rity margin the protocol has available, disproportionately reducing the achievable secret key rate and severely limiting the maximum tolerable channel loss (and hence transmission distance) compared to how the protocol would perform under a purely idealized, noise-free assumption – making excess noise control and characterization one of the most critical practical engineering challenges specific to CV-QKD system design.

DI-QKD aims to certify security based purely on the observed statistics of a Bell inequality violation between Alice’s and Bob’s measurement outcomes, without needing to trust or even characterize the internal workings of either party’s measurement devices at all – treating both Alice’s and Bob’s apparatus as complete, untrusted ”black boxes.” This goes a meaningful step further than MDI-QKD, which specifically removes trust in the (untrusted, potentially malicious) detectors at a shared, central measurement station but still requires the two source devices generating the quantum states to be reasonably well-characterized and trusted – DI-QKD instead aims to eliminate trust assumptions on every device involved (both sources and detectors, on both Alice’s and Bob’s sides), providing security guaranteed directly by the observed Bell violation statistics alone, regardless of what might be happening inside any of the physical hardware – the strongest possible level of implementation-independent security achievable in principle.

Certifying security from an observed Bell inequality violation requires the violation itself to be genuinely conclusive – but if a real experiment’s detectors have low efficiency (missing many photons and simply discarding those ”no- detection” events from the statistical analysis), it’s mathematically possible for local hidden variable theories to mimic an apparent Bell violation through this selective, efficiency-related ”detection loophole,” undermining the DI-QKD security claim entirely. Achieving a genuine, ”loophole-free” Bell test (closing this detection loophole, alongside the related locality loophole ensuring measurement choices are made too late for any sub-light-speed signal to influence the other party) requires extremely high detection efficiency across the entire experimental chain – a demanding requirement only convincingly satisfied in landmark loophole-free Bell test experiments beginning around 2015, which is precisely why practical DI-QKD demonstrations have only become achievable relatively recently, and generally still only over quite limited distances, compared to the much more mature, already-widely-deployed standard BB84-based systems.

TF-QKD’s security and correct operation fundamentally depends on Alice’s and Bob’s independently transmitted phase-encoded pulses arriving at the central, untrusted measurement station and interfering with a stable, precisely tracked relative phase relationship – but the optical phase of light traveling through many tens or hundreds of kilome- ters of real-world fiber is highly sensitive to and constantly perturbed by thermal fluctuations, mechanical vibrations, and other environmental noise sources affecting the fiber’s exact effective length over time. Successfully implemented TF-QKD systems must therefore incorporate sophisticated, continuously-operating phase-tracking and active sta- bilization techniques (often involving a separate, dedicated strong reference laser signal transmitted alongside the actual quantum signal specifically to continuously monitor and actively compensate for the fiber’s slowly drifting phase behavior in real time) – representing a substantial, non-trivial additional engineering complexity on top of the already-considerable challenges of any long-distance fiber-based QKD system, and a major focus of ongoing practical

Both protocols share the same basic underlying architecture: Alice and Bob each independently send quantum states toward a shared, physically untrusted intermediate measurement station, which performs a specific joint measure- ment and publicly announces (only) its outcome – neither protocol requires trusting this central station’s internal hardware, since a malicious or compromised station cannot compromise the resulting key’s security (this shared ar- chitecture is precisely why both protocols are, at a structural level, well suited to a star-shaped network topology with the untrusted measurement node placed at a shared, centrally-located network hub). TF-QKD can be understood as a specific further refinement/variant building on this same general MDI architecture, but designed and analyzed specif- ically around achieving its favorable √η rate-distance scaling (discussed in Section 1) by using single-photon-level phase interference rather than MDI-QKD’s original Bell-state-measurement-based approach – both remain active areas of ongoing research aimed at combining strong security guarantees (untrusted measurement stations) with practical, extended-range performance.

The asymptotic key rate is calculated under the theoretical, idealized assumption that Alice and Bob exchange an infinite number of quantum signals – in this limit, statistical fluctuations in estimating quantities like the QBER become negligible, and elegant, comparatively simple closed-form security formulas apply cleanly. Any real, prac- tically deployed QKD system necessarily operates on only a finite number of transmitted signals within any given key-generation session (constrained by a practical time budget for refreshing keys) – and with a finite sample size, the QBER and other security-relevant parameters can only be estimated with some statistical uncertainty, which a rigorous finite-key security analysis must explicitly and conservatively account for. This finite-key statistical penalty generally reduces the practically achievable secret key rate meaningfully below what the simpler asymptotic formula would naively predict for the same number of transmitted signals, and the gap between asymptotic and finite-key performance is especially pronounced for shorter key-generation blocks – making rigorous finite-key analysis an essential, non-optional part of any real, deployed QKD system’s actual security claims, not merely an abstract theo- retical refinement.

A representative (deliberately simplified) key rate formula’s factors each capture a distinct source of key-rate reduc- tion: the sifting factor q (roughly 1/2 for standard BB84, accounting for the fraction of raw signals surviving basis- matching sifting, as discussed in the Quantum Cryptography deck); a term related to the binary Shannon entropy H(e) of the observed error rate e (accounting for the information that must be sacrificed during privacy amplifi- cation to eliminate any information a worst-case eavesdropper could have gained, which grows as the error rate e increases); and an error correction efficiency factor f (typically slightly greater than 1, e.g. around 1.1-1.2 for practical error-correction codes, representing the real-world overhead of actual error-correction protocols compared to the theoretical Shannon-limit minimum). Together, these factors formalize the same core mechanisms discussed in the Quantum Cryptography deck (sifting, error correction, privacy amplification) into an explicit, quantitative expression for exactly how many secure key bits are extracted per raw transmitted signal.

A weaker, more narrowly-defined notion of security might only guarantee that a QKD protocol’s output key looks ”sufficiently random and secret” when analyzed in isolation, considered entirely on its own. Composable security is a stronger, more operationally meaningful guarantee: it ensures the QKD-generated key can be safely plugged into and used within any other larger cryptographic protocol or application (encryption, authentication, or anything else) that itself expects a perfectly ideal, uniformly random secret key as input, with a rigorously bounded, quantifiable failure probability for the entire combined system – rather than security holding only for the QKD step considered in complete isolation, with no formal guarantee about what happens once that key is actually put to real downstream use. This distinction matters immensely in practice because a QKD-generated key is, after all, virtually never the actual

The smooth min-entropy is a specific, more conservative and operationally relevant entropy measure (related to, but importantly distinct from, ordinary Shannon entropy) that directly quantifies the minimum amount of genuinely extractable, uniformly random secret key that can be reliably distilled from a given, possibly-imperfect random source or measurement outcome, accounting rigorously for a bounded, small probability of the security guarantee failing (the ”smoothing” parameter). It has become the standard tool specifically for finite-key QKD analysis because, unlike Shannon entropy (which is fundamentally an average, asymptotic-limit quantity, well-suited to describing many independent identically-distributed trials but not any single specific, finite instance), smooth min-entropy directly and rigorously bounds the extractable secure key length for one specific, single finite block of raw data with an explicit, quantifiable security failure probability – making it precisely the right mathematical tool for the finite-key regime every real, practically deployed QKD system actually operates in, rather than the idealized infinite-signal asymptotic limit that ordinary Shannon-entropy-based reasoning implicitly assumes.

Multiplexing refers to sending both a QKD system’s extremely weak, single-photon-level quantum signal and or- dinary, much more powerful classical data traffic through the same physical optical fiber simultaneously (using wavelength-division multiplexing, placing the quantum and classical signals on different wavelength channels) – an economically important capability, since it avoids the substantial cost of running entirely separate, dedicated ”dark fiber” exclusively for QKD alongside a network’s existing classical infrastructure. The core practical challenge is that classical channels operate at vastly higher optical power levels than the QKD channel’s single-photon-level sig- nal – even a very small amount of unwanted crosstalk (light leaking between adjacent wavelength channels due to imperfect filtering, or spontaneous Raman scattering, where classical channel photons scatter into the quantum channel’s wavelength) can introduce enough spurious noise photons to substantially degrade or entirely swamp the extremely weak quantum signal, requiring careful wavelength channel selection, high-quality optical filtering, and often specifically minimizing classical channel launch power to make practical co-existence achievable.

SECOQC (Secure Communication based on Quantum Cryptography) was a European research project that, in 2008, demonstrated a functioning, multi-node trusted-node QKD network spanning several locations across the city of Vi- enna, connecting multiple point-to-point QKD links (using several different underlying QKD technologies/protocols across different links) into one integrated, extended network via trusted relay nodes. Its significance was demonstrat- ing, for the first time at real metropolitan scale (rather than a single isolated laboratory point-to-point link), that a heterogeneous, multi-vendor, multi-protocol QKD network could actually be integrated and operated together as one coherent, extended-coverage system using the trusted-node relay architecture (discussed in the Quantum Cryptog- raphy deck) – an important early proof-of-concept establishing the practical viability of QKD network architectures beyond simple isolated two-party links, directly influencing the design of subsequent, larger-scale QKD network deployments and field trials.

China’s Beijing-Shanghai quantum backbone is a roughly 2,000 km trusted-node fiber QKD network connecting several major Chinese cities, representing one of the largest metropolitan/backbone-scale QKD deployments built to date, providing quantum-secured key distribution capability to government, financial, and other high-security in- stitutions along its route. Significantly, this terrestrial fiber backbone has been directly integrated with the Micius satellite (discussed in the Quantum Cryptography deck) – satellite-to-ground QKD links effectively extend key dis- tribution capability well beyond the fixed fiber backbone’s own physical footprint to more distant or otherwise uncon- nected ground stations, with the satellite acting as an additional, very-long-range ”trusted relay” bridging otherwise geographically disconnected terrestrial network segments – together demonstrating an integrated, hybrid fiber-plus- satellite architecture as a practical, near-term path toward genuinely continental and eventually intercontinental-scale quantum-secured key distribution coverage.

A mature quantum repeater network would eventually allow genuine, fully end-to-end quantum-secured key dis- tribution over arbitrary distances without requiring any trusted intermediate node at all – entirely eliminating the trusted-node architecture’s core security weakness (that any single compromised intermediate relay node anywhere along the path can compromise the entire end-to-end key). However, practical quantum repeaters require long-lived, high-fidelity quantum memories and reliable entanglement swapping/purification operating at a scale and reliability that remains substantially beyond current experimental capability (as discussed in the Quantum Cryptography deck) – which is precisely why essentially all currently operational, real-world long-distance QKD networks (including the SECOQC and Beijing-Shanghai examples above) rely instead on the comparatively mature, practically achievable- today trusted-node relay architecture as a pragmatic, currently-necessary stopgap, with fully repeater-based, trust-free extended-range QKD remaining an important but still longer-term research and engineering goal for the field.

ETSI (the European Telecommunications Standards Institute) established a dedicated Industry Specification Group specifically for QKD, tasked with developing standardized specifications covering areas including QKD system secu- rity proof requirements/certification methodology, application programming interfaces (defining how a QKD system should expose generated key material to the applications that will actually consume it), and protocols for how inde- pendent, potentially multi-vendor QKD modules should interoperate within a larger network. This standardization effort matters practically because, without common, agreed-upon interfaces and security evaluation criteria, QKD systems from different commercial vendors would remain incompatible isolated islands, unable to interoperate within a shared network, and organizations evaluating QKD products would have no standardized, trusted basis for com- paring different vendors’ security claims – ETSI’s standardization work is a necessary, foundational step toward QKD maturing from isolated research demonstrations into a genuinely interoperable, commercially deployable, and independently verifiable security technology.

Independent certification labs (analogous to Common Criteria evaluation labs used for certifying conventional classi- cal cryptographic hardware/software products) rigorously and independently test whether a specific, real, physically manufactured QKD product’s actual implementation genuinely satisfies its claimed theoretical security properties – verifying not just that the underlying protocol’s mathematics is sound (which academic security proofs already es- tablish), but that the specific physical hardware and its exact operational parameters (detector characteristics, source properties, finite-key parameter choices) are correctly and safely implemented in practice. This is particularly crit- ical for QKD specifically because, as extensively discussed regarding side-channel and detector-blinding attacks (Quantum Cryptography deck), the gap between an elegant, mathematically rigorous theoretical security proof and a genuinely secure, real-world physical implementation has repeatedly proven to be where actual demonstrated vul- nerabilities arise – independent, adversarial, hands-on hardware certification testing is specifically designed to catch exactly this class of implementation-specific vulnerability that a purely theoretical protocol-level security proof, how- ever rigorous in the abstract, cannot by itself guarantee has been correctly and safely realized in an actual physical device.

Commercial QKD vendors active in the field include companies such as ID Quantique (Switzerland), Toshiba (which has been particularly active in demonstrating high-performance, long-distance fiber QKD systems), QuantumCTek (China), and several others across Europe, North America, and Asia, offering QKD systems primarily targeting government, defense, financial-sector, and critical-infrastructure customers with the highest security-assurance re- quirements and correspondingly larger security budgets. The existence of this active, if still relatively small and specialized, commercial market suggests QKD has genuinely progressed beyond a purely academic research curios- ity into an early-but-real commercial technology stage – though, as discussed in the Quantum Cryptography deck’s

The Tokyo QKD Network, established through international collaboration and operational beginning around 2010, was one of the first major field trials specifically designed to test multiple different QKD system implementations (from several different international research groups and vendors) operating together, continuously, over an extended real-world operational period on installed metropolitan fiber – rather than the comparatively brief, tightly-controlled proof-of-concept demonstrations more typical of laboratory QKD research at the time. It was particularly notable for validating QKD’s ability to run essentially continuously, unattended, over extended real-world periods spanning weeks and months, while also successfully demonstrating practical secured applications running on top of the gener- ated QKD keys (including secure video conferencing) – directly addressing and validating the transition from ”QKD works as a laboratory physics demonstration” toward ”QKD can function as a genuinely reliable, continuously operat- ing piece of real-world network infrastructure,” an essential and non-obvious practical validation step distinct from, and arguably at least as important as, the underlying theoretical security proofs and record-distance achievements more commonly emphasized in academic QKD research.

A Trojan-horse attack has Eve inject her own bright light pulses into Alice’s (or Bob’s) QKD transmitter/receiver device from outside, through the same optical fiber used for the legitimate quantum signal, and then carefully analyze the light that reflects/scatters back out of the device – potentially revealing information about the device’s internal settings (e.g. which specific modulator setting Alice actually applied to prepare a given quantum state) that an idealized security proof implicitly assumes remains entirely private and inaccessible to any external party. This directly exploits the practical reality that real physical QKD devices are never perfectly, ideally isolated ”black boxes” with absolutely no information leakage whatsoever across their input/output optical ports, as an idealized theoretical security proof might implicitly assume – standard countermeasures include installing optical isolators (allowing light to pass in only one direction) and attenuators specifically at each device’s input/output ports to block or severely attenuate any injected probe light and its resulting information-carrying back-reflection before it could reveal anything useful to an external attacker.

Bob’s QKD receiver typically uses two separate single-photon detectors, one assigned to register a ”0” outcome and the other a ”1” outcome for a given measurement basis – in a real, physical implementation, these two nominally- identical detectors virtually never have perfectly identical detection efficiency, and that relative efficiency can, in practice, vary depending on precisely when (relative to a synchronized clock signal) a given photon actually arrives at the detector. In a time-shift attack, Eve deliberately and slightly shifts the arrival timing of the transmitted pulses (without altering their encoded quantum state or measurement outcome at all) to exploit whichever specific tim- ing window happens to favor one particular detector’s efficiency over the other’s – subtly biasing Bob’s effective measurement statistics in a way an idealized theoretical security proof (which typically assumes perfectly identical, timing-independent detector efficiencies) doesn’t account for, potentially letting Eve extract partial information with- out triggering the expected corresponding QBER increase. Countermeasures include actively randomizing detector- assignment timing windows, or using detectors and control electronics carefully characterized and calibrated to have closely matched, timing-independent efficiency.

QKD protocols encoding information via optical phase modulation assume a specific, precisely known correspon- dence between the electrical control voltage applied to a phase modulator and the actual physical phase rotation it imparts to the outgoing light pulse – a phase-remapping attack exploits any subtle imperfection or non-linearity in this assumed voltage-to-phase mapping (for instance, by sending additional ”trigger” pulses timed to interact with the modulator in a way that shifts its effective operating point) to cause the transmitter to actually prepare a state subtly different from what the theoretical protocol description assumes for a given intended control setting – poten- tially opening a security loophole specific to that particular hardware’s imperfect real-world calibration, distinct from and not accounted for by the idealized protocol-level security proof. Countermeasures generally involve rigorous,

Every one of these attacks succeeds not by finding any flaw whatsoever in the underlying mathematical security proof of the QKD protocol itself (BB84’s core theoretical security guarantee, for instance, remains entirely mathematically sound and unbroken) – rather, each attack exploits a specific gap between the idealized physical assumptions a security proof necessarily must make about the devices involved (perfectly isolated black-box components, perfectly matched detector efficiencies, perfectly linear and precisely characterized modulators) and how an actual, real, physically manufactured device inevitably behaves in practice, with all its unavoidable small imperfections and unaccounted-for physical side-channels. This recurring pattern has driven the QKD security research community toward increasingly rigorous device-independent and measurement-device-independent protocol variants (discussed earlier in this deck and in the Quantum Cryptography deck) specifically designed to progressively minimize or entirely eliminate the number and severity of physical assumptions a security proof must place on the actual hardware – reflecting a broader, hard-won and still-evolving understanding that a mathematically rigorous protocol-level security proof, however elegant and unconditional in the abstract, is fundamentally necessary but never automatically sufficient on its own to guarantee that any specific, real, physically deployed implementation of that protocol is itself genuinely secure in practice. End of deck.