Secure quantum key distribution with realistic devices Feihu Xu,1, 2 Xiongfeng Ma,3 Qiang Zhang,1, 2 Hoi-Kwong Lo,4, ∗ and Jian-Wei Pan1, 2, y 1Hefei National Laboratory for Physical Sciences at Microscale and Department of Modern Physics, University of Science and Technology of China, Hefei 230026 China 2Shanghai Branch, CAS Center for Excellence and Synergetic Innovation Center in Quantum Information and Quantum Physics, University of Science and Technology of China, Shanghai 201315 China 3Center for Quantum Information, Institute for Interdisciplinary Information Sciences, Tsinghua University, Beijing 100084 China 4Center for Quantum Information and Quantum Control, Department of Physics and Department of Electrical & Computer Engineering, University of Toronto, M5S 3G4 Toronto Canada (Dated: February 20, 2020) In principle, quantum key distribution (QKD) offers information-theoretic security based on the laws of physics. In practice, however, the imperfections of realistic devices might introduce deviations from the idealized models used in security analyses. Can quantum code-breakers successfully hack real systems by exploiting the side channels? Can quan- tum code-makers design innovative counter-measures to foil quantum code-breakers? This article reviews theoretical and experimental progress in the practical security as- pects of quantum code-making and quantum code-breaking. After numerous attempts, researchers now thoroughly understand and are able to manage the practical imper- fections. Recent advances, such as the measurement-device-independent protocol, have closed the critical side channels in the physical implementations, paving the way for secure QKD with realistic devices. CONTENTS A. Encoding and decoding 20 B. Photon sources 20 I. Introduction2 1. Prepare-and-measure 20 A. Secure communication2 2. Entanglement-based 21 B. Quantum key distribution (QKD)3 C. Channel 22 1. BB84 protocol4 D. Detection 22 2. Intuition of security4 E. Postprocessing 22 3. Overview of recent developments5 1. Error correction 23 C. Focus of this review6 2. Error verification and authentication 24 D. Outline of this review6 3. Privacy amplification 24 4. Finite-key length 25 II. Security analysis7 A. Security definition8 IV. Quantum Hacking 25 B. Security proofs 10 A. Attacks at source 26 1. Lo-Chau security proof 10 1. Photon-number-splitting attack 26 2. Shor-Preskill: reduction to prepare-and-measure 2. Phase-remapping attack 26 schemes 13 3. Nonrandom-phase attack 27 arXiv:1903.09051v3 [quant-ph] 19 Feb 2020 3. Koashi’s complementarity approach 14 B. Attacks at detection 27 4. Entropic approach 15 1. Double-click attack 28 C. Security assumptions 16 2. Fake-state attack 28 1. Source 16 3. Time-shift attack 29 2. Measurement 17 4. Detector-control attack 29 3. Channel 17 C. Other attacks 30 D. Practical security analysis 17 1. GLLP 18 V. Source Security 31 2. Random sampling and finite-data size 19 A. Decoy-state method 31 III. QKD Implementation 19 1. Theory 32 2. Experiment 33 B. Source flaws 33 1. Basis-dependent source 33 2. Nonrandom phase 35 ∗ [email protected] 3. Encoding flaws 35 y [email protected] C. Leaky source 35 2 VI. Detection Security 36 presence of Eve is called the key distribution problem. In A. Countermeasures against detection attacks 36 fact, the key distribution problem is a central challenge B. Measurement-device-independent scheme 36 in all kinds of encryption methods. 1. Time-reversed EPR QKD 36 2. MDI-QKD protocol 37 In principle, all conventional key distribution schemes 3. Theoretical developments 38 that rely on classical physics and mathmatics can only 4. Experimental developments 39 provide computational security, because in classical C. Twin-field QKD 41 physics, there is nothing to prevent an eavesdropper VII. Continuous-Variable QKD 42 from copying the key during the key distribution pro- A. Protocol and security 43 cess. Now, if Eve and Bob have the same key, whatever 1. Gaussian-modulated protocol 43 Bob can decrypt, Eve can decrypt too. 2. Discrete modulated protocol 44 3. Security analysis 44 Currently, the key distribution problem is often solved B. Experimental developments 45 by public key cryptography. In public key cryptography, C. Quantum hacking and countermeasures 46 there are a pair of keys: a public key and a private key. An intended recipient Bob will publish the public key so VIII. Other Quantum Cryptographic Protocols 47 A. Device-independent QKD 47 that anyone, such as an intended sender Alice, can en- B. Some New QKD implementations 48 crypt a message, called a plain text, with the public key 1. Round-robin DPS QKD 48 and send the encrypted message, a cipher text, to Bob. 2. High-dimensional QKD 50 On the other hand, only Bob with the private key can de- 3. QKD with wavelength-division multiplexing 51 4. Chip-based QKD 51 crypt the cipher text to recover the plain text efficiently. C. Other quantum cryptographic protocols 53 The security of public key cryptography is based on com- 1. Quantum bit commitment 53 putational assumptions. Given the public key, there is no 2. Quantum digital signature 53 efficient known algorithm for Eve to work out the private 3. Other protocols 54 key or to recover the plain text, from the cipher text. IX. Concluding Remarks 55 For instance, the security of the best-known public key crypto-system, RSA (Rivest et al., 1978), is based on the Acknowledgement 57 presumed hardness of factoring large integers. Unfortu- A. General questions to QKD 57 nately, public key cryptography is vulnerable to unan- ticipated advances in hardware and software. Moreover, References 58 in 1994, Peter Shor then at AT&T invented an efficient quantum algorithm for factorization (Shor, 1997). For this reason, if a large scale quantum computer is ever I. INTRODUCTION constructed, much of conventional cryptography will fall apart! A. Secure communication After more than two decades of intense theoretical and experimental efforts, primitive small scale quantum com- For thousands of years, code-makers and code-breakers puters have already been built. Several big companies have been fighting for supremacy. With the recent rise and a number of labs and start-ups are racing to build of Internet of Things, cyber security has become a hot the world’s first practical quantum computer. For in- topic. Cyber warfare that can undermine the security stance, Google AI Quantum Laboratory1 has realized of critical infrastructures, such as smart power grids and the quantum advantage (or supremacy) over state-of-the- financial systems, threatens the well-being of individual art classical supercomputer for a specific computational countries and the global economy. task (Arute et al., 2019), and plans to commercialize In conventional cryptography, two distant parties, tra- quantum computers within a few years (Mohseni et al., ditionally called Alice and Bob, share a communication 2017); IBM Q has already put its sixteen-qubit quantum channel and they would like to communicate privately in processor online for client use2; Rigetti has also provided the presence of an eavesdropper, Eve. The Holy Grail the quantum cloud service3; Chinese Academy of Sci- of secure communication is information-theoretical secu- ences (CAS) and Alibaba have established the Quantum rity. It is known that one could achieve information- Computing Laboratory to advance the research of quan- theoretically secure communication via the one-time-pad tum computing4; Other companies, such as Intel, Mi- (OTP) method (Vernam, 1926), if the two users, Alice crosoft, Baidu, Tencent, IonQ, Xanadu, Zapata and so and Bob, share a long random string that is kept se- cret from Eve. Note that, for the OTP scheme to be information-theoretically secure, it is important not to 1 Google Q: research.google/teams/applied-science/quantum re-use the key (Shannon, 1949). That is to say that the 2 IBM Q: www.research.ibm.com/ibm-q key has to be as long as the message itself and can only 3 Rigetti: www.rigetti.com be used once. How to distribute such a long key in the 4 CAS-Alibaba: quantumcomputer.ac.cn/index.html 3 forth, have also joined the international race to build a quantum crypto algorithm in Transport Layer Security quantum computer. Moreover, China is building the Na- (TLS)9. One drawback of post-quantum algorithms is tional Laboratory for Quantum Information Science to that those conventional algorithms are only shown to be support the revolutionary research in quantum informa- secure against known quantum attacks. There is always tion; The European Commission is planning to launch a possibility that some smart conventional or quantum the flagship initiative on quantum technologies5; USA physicist or computer scientist might one day come up has already launched the National Quantum Initiative with clever algorithms for breaking them efficiently. As Act in 20186. All in all, the risk of successful construc- said, this would lead to a retroactive security breach in tion of a quantum computer in the next decade can no future for data transmitted today with potentially disas- longer be ignored. trous consequences. Note that some data such as our DNA data and health The second approach is to use quantum cryptogra- data need to kept secret for decades. This is called long- phy (Bennett and Brassard, 1984; Ekert, 1991), particu- term security. However, cryptographic standards could larly quantum key distribution (QKD). It has the advan- take many years to change. An eavesdropper intercepting tage of promising information-theoretical security based encrypted data sent in 2019 may save them for decades on the fundamental laws of quantum physics, i.e., the se- as they wait for the future successful construction of a curity is independent of all future advances of algorithm quantum computer. The eavesdropper could then retro- or computational power. actively successfully crack an encryption scheme, there- Note however that quantum cryptography cannot fore cryptographic standards need to consider potential replicate all the functionalities of public key cryptogra- future technological advances of the next few decades.