Zheng-Fu Han

Recent studies have revealed critical source-side vulnerabilities in practical quantum key distribution systems. Despite their demonstrated risks, these threats receive limited attention in both academic discussions and practical implementations. To highlight the urgency of addressing source-side vulnerabilities, we will report two widespread but overlooked loopholes: the induced-photorefractive effect and the pattern effect, including a report of the first-time system-level attack against a running MDI-QKD. Except for the attack, we will also report countermeasures against the loopholes, including a fully-passive QKD architecture resistant to encoding side-channels and a correlation-immune QKD protocol mitigating the pattern effect. These works provide essential insights and solutions for advancing the practical deployment of secure QKD systems.

Among all existing quantum key distribution (QKD) protocols, the round-robin-differential-phase-shift (RRDPS) protocol is one of the unique protocols. Because it can be running without monitoring signal disturbance, which improves its tolerance of error rate and does well in the finite-key scenario. Considering that a tight finite-key analysis with a practical phase-randomized source is still missing, we propose an improved security proof of RRDPS against the most general coherent attack based on the entropic uncertainty relation. We also introduce Azuma’s inequality into our proof, which can tackle finite-key effects. The results indicate experimentally acceptable numbers of pulses are sufficient to approach the asymptotic bound closely. This method may be the optimal one in the finite-key analysis for the RRDPS protocol.

The security proofs of continuous-variable quantum key distribution are based on the assumptions that the eavesdropper can neither act on the local oscillator nor control Bob’s beam splitter. These assumptions may be invalid in practice due to potential imperfections in the implementations of such protocols. In this paper, we consider the problem of transmitting the local oscillator in a public channel and propose a wavelength attack which can allow the eavesdropper to control the intensity transmission of Bob’s beam splitter by switching the wavelength of the input light. Specifically we target continuous-variable quantum key distribution systems that use the heterodyne detection protocol using either direct or reverse reconciliation. Our attack is proved to be feasible and renders all of the final key shared between the legitimate parties insecure, even if they have monitored the intensity of the local oscillator. To prevent our attack on commercial systems, a simple wavelength filter should be added before performing the monitoring detection.