1. Introduction
This research was inspired by the works “Quantum man-in-the-middle attack on the calibration process of quantum key distribution” [
1] and “Device calibration impacts security of quantum key distribution” [
2], which describe attacks on the calibration system. In the beginning, it is necessary to clarify several important nuances about our research: the experiments were carried out with a two-pass quantum key distribution system (QKDS) Clavis
2; we do not examine the security of the quantum BB84 protocol and do not claim that our attack is an attack on the BB84 protocol; and we do not test the strength of quantum keys and do not claim that the described attack affects the strength of the keys. These are important notes for understanding the aims of the paper. The quantum key distribution process and the synchronization process are different. There are many articles in the literature that describe these processes in detail. There are attacks on both quantum protocols and the synchronization process, but there is practically no literature describing attacks on the synchronization process. Our experiment was carried on the real Clavis
2 quantum key distribution system. These are two stations connected by a quantum channel-optical fiber. In real operating conditions, QKDS have many loopholes for an attacker. This is not about quantum cryptography protocols that are reasonably secure. We are referring to the technical imperfection of systems. The authors [
1,
2] discuss such imperfections and show that an attacker can use them for attacks. It is important to understand that the purpose of an attack on the QKDS may not only be the acquisition of a secret key. Implementation of a controlled interference can also be a target of an attacker. From the user’s point of view, this looks like a technical failure of the system, and there are two options: the user understands that the failure was caused by an attacker, or the user does not detect the attacker. In this work, we will show experimentally how it is possible to interfere with the normal operation of the QKDS without revealing itself.
The basic principles of quantum cryptography are absolute theoretical secrecy of the transmitted data and the impossibility of unauthorized access to it. For cryptographic systems, the security issue is formulated as the problem of distributing the encryption key between legitimate users. Quantum cryptography systems solve the problem of generating and distributing the encryption key using methods that are based on the laws of quantum physics and are implemented in quantum key distribution systems. In the description of quantum key distribution systems, much attention is paid to the operation of quantum protocols. The main problem is the insufficient study of the synchronization process of quantum key distribution systems. This paper contains a general description of quantum cryptography principles. A two-way plug and play fiber-optic quantum key distribution system with phase coding of photon states in synchronization mode was examined. A quantum key distribution system was built on the basis of the scheme with automatic compensation of polarization mode distortions. Single-photon avalanche diodes were used as optical radiation detecting devices. The operation of such systems is impossible without the process of station coordination, i.e., synchronization of the transmitter and receiver separated in space. In the QKDS, synchronization consists of a high-precision determination of the length of the optical pulse propagation path and is based on the registration of the moment when the synchronizing pulse is received by photodetectors.
3. Single-Photon Synchronization Method
The results of the experiment show the vulnerability of the synchronization process QKDS and prove the possibility of interfering with the system, while remaining unnoticed. Note that the classical method of controlling the emission power in a quantum communication channel does not allow for detection of the presence of couplers. Under ideal experimental conditions, when the quantum channel consists of a continuous fiber (coil), the couplers can be detected using a reflectometer. In this case, it was possible to see attenuation of 0.2–0.4 dB at the places of split joints. If only welded joints are used, the presence of losses is almost impossible to detect. In real conditions, the completed length of the quantum channel does not exceed 1 km, and the presence of fiber optic splice closure is an integral part of the communication system. Fiber optic splice closure and inhomogeneities of optical fiber introduce additional attenuation and hide the possible presence of unauthorized connection to the communication channel. The reflectometric detection method does not allow one to distinguish legitimate inhomogeneities (of different types) from illegitimate ones.
We should also mention the quantum effects of the environment [
17,
18]. Note that the quantum fluctuations are not described by classical functions and cannot be compensated. Moreover, such quantum effects could be influencing the system, but it is expected that their effects would be small. Of course, such effects must be taken into account, and their influence on the quantum system should be investigated. There are environmental effects that can affect the physical properties of the fiber. For example, temperature tends to change the physical length of a fiber under certain conditions, but it is compensated for by checking the length in the program.
We propose a method that provides protection against an attack on the QKDS during the synchronization process. A distinctive feature of the method is the use of synchronization pulses weakened to a single-photon level. In this case, the optical signal is attenuated at the encoding station by a controlled attenuator, and the value of the insertion loss is calculated so that after reflection from the Faraday mirror, the average number of photons (m) in the synchronizing pulse is 0.1–0.5. Registration of single-photon pulses is performed by avalanche photodiodes in Geiger mode.
The maximum length of the fiber optic link in QKDS is
= 100 km. Taking into account the back propagation of emission to avoid overlapping of back transmitted pulses at
= 100 km, the repetition period is
≈ 1 ms. Therefore, the maximum repetition rate of optical pulses should not exceed
1 kHz. The repetition period
is divided into
time intervals with duration
in such a way that
. All intervals are analyzed sequentially. Each interval is analyzed N times, where N is the selection size. The pulse duration
ns and
. Absolute stability of the repetition period
and the duration
is assumed. In each interval, the number of accepted photoelectrons and/or dark current pulses (DCP) are recorded. After polling all
time intervals, an array of values is generated as follows:
At the values of and , the synchronizing pulse can lie entirely within one time interval or lie on the border of two neighboring ones. In the first case, the values in intervals are described by Poisson’s law with the parameter . At the same time, in the interval with a synchronizing pulse, the number , with the parameter . Here is the rate of occurrence of DCP, is the average number of the photoelectrons registered for the duration of the pulse.
If the pulse lies in two neighboring intervals, then random values
in
noise intervals are described by Poisson’s law with the parameter
, and in neighboring intervals are the numbers
and
, respectively, with parameters
and
. Here
and
are, respectively, the average number of photons registered in neighboring intervals with the condition that the moment of occurrence of single-photon pulse
belongs to the first interval. Noise intervals should be understood as analyzed intervals in which the signal is not recorded. In such intervals, noise values can be recorded—the DCP of the photodetector [
12,
13]. To analyze the process of detecting a synchronizing signal using single-photon pulses, the laws of probability of the distribution density are applied [
14].
The analytical expression (2) is used for calculating the probability of correct detection of the signaling interval (
).
Here
represents the probability of registering no more than (
) DCP in all (
) noise time intervals during the analysis, provided that
photoelectrons and DCP are registered in the signal time interval for a selection of size N. Taking into account the value
, the average number of DCP per sample in the noise interval tends to zero. This allows summation in the formula only for 2 values of
equal to 0 and 1. Simplifying expression (2), we get
The simulation results show that the divergence of the calculation results for Equations (2)−(4) do not exceed 0.02% over the entire variation range in the number of time intervals. The registration validity condition for no more than one photoelectron and/or DCP is typical for a single-photon avalanche photodiode. This proves that it is possible to use expression (4) to calculate the probability of correctly detecting the time interval during the synchronization of the QKDS, provided that
. An important parameter of the avalanche photodiode is the recovery time of the operating mode (
). In the proposed method, the time interval poll is performed sequentially in each frame, i.e., one-time interval is analyzed for the repetition period (T); here
. This approach allows the recovery time of the working mode of the photodetector to be ignored when calculating. Another distinctive feature of the single-photon mode of operation of the photodetector is the quantum efficiency coefficient of the photocathode (k), which must be taken into account when simulating. Let us look at the graphs in
Figure 7, which demonstrate the dependence of the probability of correctly detecting the time interval with signal on the selection size. Dependencies are plotted using Equation (4). The developed method involves the use of a weakened optical synchronizing pulse with an average number of photons 0.1 < m < 1. Thus, given the critical values of the average number of photons per pulse, the frequency of DCP and the quantum efficiency of the photocathode, the variable value is only the selection size in each time interval. Let us explain that the DCP of the photodetector are its shot-noise, which can cause an avalanche effect [
15,
16,
17].
The graphs show that the probability of correct detection reaches maximum values
already at the selection size N = 30 (without taking into account quantum efficiency) and at N = 150 with taking into account quantum efficiency. Note that the typical selection size of the current Clavis
2 3110 system is 800. Next, let us consider the simulation results that show the influence of the frequency of DCP and the selection size on the probabilistic characteristics of detecting the signaling time interval. The task of simulation is to find the optimal values of N and DCP, at which the maximum probability of detection is achieved. Calculations were made taking into account the above average quantum efficiency of the photocathode (k = 25%).
Figure 8 shows the results of simulation of the algorithm for detecting a single-photon signal. The graphs show the dependence of the probability of correct detection of the signaling interval on selection size for different values of DCP.
The average amount of photoelectrons (m) in a pulse is 0.1. The graph shows that at the minimum values of the selection size (128 < N < 32), the probability of detection (
) is no more than 80%, and the number of DCP does not matter. This behavior of the curves is explained by a small difference in the number of DCP and photoelectrons in time intervals. The divergence is leveled when the selection size increases. On the other hand, if the value of DCP > 200, the selection size does not matter, since the probability of detection (
) over the entire range of values does not exceed 98%. The optimal values of DCP and N for achieving high probability values
are the limits of N > 256 for DCP < 150. Consider
Figure 9, where calculations of the probability of erroneous detection of a signaling time interval with a single-photon pulse are presented.
The figure is made for three values of the selection size (N = 256, 512, 1024) and the range of values of
. It is apparent that the selection size N = 1024 has a significant impact on the probability at the maximum values of DCP. Thus, in the single-photon mode, the probability of erroneous detection increases sharply at DCP > 200. This is due to the fact that with the statistical accumulation of summands in Equation (4), an increase in the direct dependence of the number of DCP and the selection size causes an increase in noise signals, which are interpreted as “false positives” of single-photon avalanche photodiode. Note that the average value of DCP for the photodiodes used in QKD systems is within the range of 25 < DCP < 100. For example, the typical DCP value for id210 and id230 photodetectors is 40 and 50 Hz, respectively [
18,
19]. Such photodetectors are used in the Clavis
2 and Clavis
3 QKDS [
20,
21,
22,
23,
24]. We applied the real characteristics of the id230 photodetector to our calculations (see
Figure 10). The average number of photoelectrons m = 0.1 was achieved by attenuating the signal in the receiver station. The quantum efficiency of the photocathode k = 25%.