Security of QKD: attacks, proofs and post-processing

Assumptions behind “unconditional security”

QKD is information-theoretically secure: its security holds against an adversary with unlimited computing power, including a quantum computer. But the proof has premises:

Quantum mechanics is correct and complete.
Alice’s and Bob’s devices behave as modelled in the proof (relaxed by MDI and DI protocols).
Their labs are private: nothing leaks except through the quantum channel (Trojan-horse and side channels must be closed).
They have a source of true randomness.
The classical channel is authenticated (not secret). Eve can read it but not modify it.

Authentication: why QKD is “key growing”

Without authentication a man-in-the-middle could impersonate both parties. QKD uses information-theoretic Wegman–Carter message authentication based on universal hash functions and a small pre-shared key, part of which is replenished from each QKD round. Alternatively authentication can use a post-quantum signature or MAC, which is computationally secure but still immune to future quantum attacks if the signature cannot be forged in the short session window.

Security proofs and composability

Result	Idea
Mayers (2001)	First general unconditional proof for BB84
Lo–Chau (1999)	Reduction to entanglement distillation with quantum computers
Shor–Preskill (2000)	Simple proof: BB84 equals CSS-code error correction, giving $R\ge1-2h(Q)$
Koashi; Renner (2005)	Complementarity and de Finetti / entropic methods for general attacks
Tomamichel et al. (2012)	Tight finite-key bounds via smooth entropies

Composable security. The final key is $\varepsilon$-secure if its joint state with Eve is within trace distance $\varepsilon$ of an ideal, uniform, independent key, so it remains safe when used in any later protocol. Typically $\varepsilon=\varepsilon_{\rm cor}+\varepsilon_{\rm sec}$ with e.g. $10^{-10}$. Finite-key effects matter: with a block of $n$ sifted bits the parameter estimate has statistical error $\sim1/\sqrt n$, shortening the key.

Weak pulses, PNS and decoy states

Real sources are attenuated lasers emitting Poisson photon-number statistics

$$P(n\mid\mu)=\frac{\mu^ne^{-\mu}}{n!},\qquad P(n\ge2)=1-e^{-\mu}(1+\mu)\approx\tfrac{\mu^2}{2}$$

Multi-photon pulses leak. In the photon-number-splitting (PNS) attack Eve (i) intercepts a multi-photon pulse, (ii) splits off one photon, (iii) forwards the rest to Bob, and (iv) stores her photon until the bases are announced, then measures it correctly. Because the pulses carry identical copies, she learns the bit with no extra error. A lossy channel makes it worse: Eve can block single-photon pulses and replace the loss with lossless forwarding of multi-photon ones. Without countermeasures the secure rate scales as $\eta^2$ (optimal $\mu\sim\eta$).

Decoy-state method (Hwang 2003; Lo–Ma–Chen 2005; Wang 2005). Alice randomly varies pulse intensity between signal, decoy and vacuum. Eve cannot tell them apart, so statistics of detections at each intensity reveal the yield $Y_1$ and error $e_1$ of the single-photon component. The key rate becomes

$$R\;\ge\;q\left\{-Q_\mu f\,h(E_\mu)+Q_1\bigl[1-h(e_1)\bigr]\right\}$$

(GLLP form) restoring $R\propto\eta$ with $\mu\approx0.5$. Alternatives: true single-photon sources, SARG04, or heralded SPDC sources.

Classical post-processing pipeline

Sifting. Keep matching-basis positions.
Parameter estimation. Reveal a random sample, estimate $Q$ (and phase error). Abort above threshold.
Information reconciliation. Interactive Cascade (Brassard–Salvail 1993): exchange block parities in several passes with shuffling, binary-search to locate errors. Or LDPC codes with syndrome decoding. Leaked information is about $n f h(Q)$ bits with $f\approx1.05$–$1.2$. A short hash check verifies equality.
Privacy amplification. Apply a random 2-universal hash (Toeplitz matrices) to compress. By the leftover hash lemma, if Eve’s smooth min-entropy about the string is at least $k$, output of length $m\le k-2\log_2(1/\varepsilon)$ is $\varepsilon$-close to uniform.

$$\ell\;\approx\;n\bigl[1-h(e_{\rm ph})\bigr]-\mathrm{leak}_{\rm EC}-\log_2\tfrac{2}{\varepsilon_{\rm cor}}-2\log_2\tfrac{1}{2\varepsilon_{\rm sec}}$$

Attack catalogue and defences

Quantum cryptography has proven security on paper; implementation attacks exploit gaps between model and hardware.

Attack	What Eve exploits	Defence
Intercept-resend	Measures and resends photons	Detected as 25% QBER
Photon-number splitting	Multi-photon pulses from weak lasers	Decoy states, SARG04, single-photon sources
Trojan horse	Probes Alice’s or Bob’s modulators with bright light and reads the reflection	Optical isolators, filters, monitoring of incoming power
Detector blinding / control	Bright light forces APDs into linear mode, faking clicks	Detector monitoring, MDI-QKD, DI-QKD
Time-shift / efficiency mismatch	Detectors have different efficiency windows	Randomised gating, characterisation, MDI
Wavelength / spatial-mode dependence	Beam-splitter ratio depends on wavelength	Filtering, source monitoring
Phase remapping, laser seeding, damage	Modulator or laser vulnerabilities	Calibrated hardware, hardening, testing
Source imperfections	Intensity fluctuation, state preparation flaws	Loss-tolerant proofs, state-flaw analysis
Relay compromise (networks)	Trusted nodes see key in clear	Physical security, MDI/TF relays, key splitting over paths
Denial of service	Cutting or jamming the quantum channel	Redundant paths, multi-path routing

Reading this tableNote that an attack is not a defeat of the theory. Each real break so far (e.g. detector blinding on commercial systems, 2010) targeted a mismatch between device and proof and led to patches and to new protocols (MDI, DI).