An approach for security evaluation and certification of a complete quantumcommunication system

Shihan Sajeed,1, 2, 3, ∗ Poompong Chaiwongkhot,1, 2 Anqi Huang,4, 1, 5 Hao Qin,6, 1 Vladimir Egorov,7, †

Anton Kozubov,7 Andrei Gaidash,7 Vladimir Chistiakov,7 Artur Vasiliev,7 Artur Gleim,7 and Vadim Makarov8, 2

1Institute for Quantum Computing, University of Waterloo, Waterloo, ON, N2L 3G1 Canada2Department of Physics and Astronomy, University of Waterloo, Waterloo, ON, N2L 3G1 Canada3Department of Electrical and Computer Engineering, University of Toronto, M5S 3G4, Canada4Institute for Quantum Information & State Key Laboratory of High Performance Computing,

College of Computer, National University of Defense Technology, Changsha 410073, People’s Republic of China5Department of Electrical and Computer Engineering, University of Waterloo, Waterloo, ON, N2L 3G1 Canada

6CAS Quantum Network Co., Ltd., 99 Xiupu road, Shanghai 201315, People’s Republic of China7Faculty of Photonics and Optical Information, ITMO University, Kadetskaya line 3/2, 199034 St. Petersburg, Russia

8Shanghai Branch, National Laboratory for Physical Sciences at Microscale and CAS Center for Excellence inQuantum Information, University of Science and Technology of China, Shanghai 201315, People’s Republic of China

(Dated: 16 March 2020)

Although quantum communication systems are being deployed on a global scale, their realisticsecurity certification is not yet available. Here we present a security evaluation methodology for acomplete quantum communication system. We have subdivided the system into seven layers basedon a hierarchical order of information flow, and categorised its known implementation imperfec-tions by hardness of protection and practical risk. To illustrate the use of our methodology, wereport security evaluation results of a sub-carrier wave quantum key distribution system and thefollow-up interactions between the manufacturer and the security evaluation team. This has led toimprovements in the system security. We hope our method enters future standards for quantumcryptography.

I. INTRODUCTION

Instead of relying on assumptions of computational hard-ness like most other classical cryptography protocols,quantum cryptography relies on the laws of physics forproviding information-theoretic security. From the firsttheoretical proposal in 1983 [1] to the recent key exchangevia satellite over 1200 km [2], quantum key distribution(QKD) has come forward a long way. Over the course oftime, the journey has been (and is still being) impeded bya number of attacks that exploit the deviations betweentheory and practice [3–12]. Ironically, as a consequenceof the attacks, QKD has been equipped with improvedprotocols and tools like decoy states [13, 14], measure-ment device independence [15], device-independence [16],twin-field QKD [17] and so on. As a result, QKD todayis much more secure and efficient in practice than it was20 years ago.

It is now time for QKD to be expanded and deployedon a larger scale. As the push from the lab to practi-cal deployment is initiated in various parts of the globe,a number of security, compatibility and connectivity is-sues are needed to be solved. These demand developinguniversally accepted standards and certification method-ologies, and also the formation of a common platform forcollaboration and addressing these issues. To fulfil thisneed, ETSI has had an industry specification group for

∗ shihan.sajeed@gmail.com† viegorov@itmo.ru

QKD (ISG-QKD) since 2008 that provides a platform forthe creation of universally accepted standards and pro-motes coordination, cooperation and standardization ofresearch for QKD [18–20]. Development of security cer-tification standards is at present being discussed in thisgroup and in other standards organisations such as Inter-national Organisation for Standardisation (ISO) [21] andInternational Telecommunication Union (ITU) [22, 23].At the same time, several recent studies attempt to in-troduce certification of countermeasures against specificvulnerabilities in a quantum-optical part. For example,Ref. 24 studies the security of a photon source in a fiber-based QKD system against a general Trojan-horse attack(THA) [25, 26]. By treating the attack as an informationleakage problem, the secure key rate becomes a functionof the specifications of the installed optical components.The latter can be characterised when necessary. A similarapproach has been suggested for other individual imper-fections [12, 27–29]. A methodology to characterise andsecure the source against several imperfections is underdevelopment [30]. Attention to several imperfections andattacks is being paid when designing QKD equipment[31].

Although these studies have addressed several indi-vidual vulnerabilities, no complete system analysis hasyet been reported. This is what we do in this work.We lay out a methodology for security evaluation andcertification of a complete quantum communication sys-tem against all known implementation imperfections inits quantum optical part. Our methodology requires aniterative interaction between the manufacturer and thecertifiers. It starts with security evaluation stage from

arX

iv:1

909.

0789

8v2

[qu

ant-

ph]

15

Mar

202

0

2

the testing team; then follow-up state from the manu-facturer; then again security evaluation stage, and so on.Throughout this iterative process, the system security isgradually expected to reach a level that can be trustedand widely accepted. For the ease of security evalua-tion, we propose a layered structure that subdivides thecomplete system into seven layers so that people with dif-ferent expertise can tackle the right problems. Then wecategorise each implementation imperfection—expectedor existing in the system—in terms of hardness of solu-tion. We also assign a risk level to each of them, whichis useful for the manufacturer for prioritising patch de-velopment for each imperfection.

To exemplify how our security evaluation methodol-ogy works, we present the results of our initial securityevaluation performed at ITMO University and QuantumCommunication Ltd. (St. Petersburg, Russia) in 2017.They are therefore the first commercial QKD manufac-turer to openly publish the security assessment of theirsystem. We also present the results of follow-up (per-formed by the manufacturer) to exemplify the follow-upstep of our methodology. It consists of theoretical and ex-perimental studies that have allowed the manufacturer toquickly improve implementation security of their productby patching its most prominent loopholes. We hope thatour methodology will pave the way for developing secu-rity evaluation and certification standards for completequantum communication systems.

We would like to add that the security evaluation teamhas performed similar initial security evaluation in 2016on the QKD system Clavis3 from ID Quantique (Switzer-land) and on 40 MHz QKD system from QuantumCTek(China). The follow-up step with the latter is currentlyin progress. While the methodology of these projects hasbeen similar to that reported in this Article, their contentremain confidential at the request of the manufacturers.

The Article is organised as follows. Our proposed lay-ered architecture of the complete quantum communica-tion system is presented in Sec. II and our severity ratingscheme for the implementation imperfections in Sec. III.We describe the system under test in Sec. IV. Our ini-tial security evaluation results are presented in Sec. Vand the follow-up from the manufacturer is presented inSec. VI. We conclude in Sec. VII.

II. SYSTEM IMPLEMENTATION LAYERS

Security analysis of a complete quantum communicationsystem is a complex procedure that requires different ar-eas of expertise. To simplify the job and ensure that peo-ple with specific expertise can tackle the right problems,it is necessary to subdivide the implementation complex-ity into layers. As a first step of our methodology, wehave subdivided the system implementation into sevenlayers based on a hierarchical order of information flowand control as presented in Table I. Our layer structure isconceptually similar to the open systems interconnection

(OSI) model for telecommunication systems [32]. Justlike OSI layers, a layer in our system serves the layerabove it and is served by the layer below; however, un-like OSI, all our layers are inside one system, and mostof them are not abstraction layers. When a generic sys-tem is installed, it starts with the top layer: Q7 instal-lation and maintenance; then operation and processingis subsequently initiated in each underlying layer untilit gets down to handling quantum states in Q1 opticslayer. Once the optics layer generates photon detections,they are again processed in each layer above in sequenceuntil the top layers: either Q6 interfacing the output ofthe quantum protocol with the application that has re-quested it, or all the way up to Q7. Below we explainthe functioning of each layer with examples.

The lowest layer Q1 handles the photonic signals thatcarry the quantum states and service functions. The nextlayer Q2 interfaces the optical components with digitalprocessing and possibly performs some analog signal pro-cessing. It contains analog electronics and digital-analogconverters. Q3 comprises digital and software algorithmsthat immediately control the electronics and optics, in-cluding its calibration aspects. It might contain, for ex-ample, a set of algorithms to maintain avalanche photo-diode (APD) temperature, bias voltage, and gating. Thenext layer Q4 is software that decides which Q3 layersubroutine to run. For example, it decides when APDsneed to be cooled, or when gating control should be ini-tiated. The next layer Q5 processes the raw data gen-erated by the hardware to distill the final data in theprotocol, for example generate secret keys in QKD. Thelayer above Q6 handles the communication between thequantum protocol and the classical application that asksfor the service of the protocol. Finally, the topmost layerQ7 handles issues in any underlying layer that requirehuman intervention, even if the human follows a check-list. We have found that the system evaluated in thisArticle, as well as several other QKD systems [33], allowa clear division into this layer structure.

If the system contains a separate physical randomnumber generator (RNG), it is considered to be a sepa-rate quantum device and therefore not included into ourlayer classification. Its output would of course interfacesomewhere with the system, e.g., at layer Q5. Being aseparate device it may have an implementation structureof its own, which we do not consider here.

We remark that an initial theoretical proposal of aquantum communication protocol (such as Refs. 1 and34) covers a part of the single layer Q5, while beingmostly ignorant of the other layers except their few se-lected aspects. However practical security loopholes canbe present anywhere in the complete implementation andbe in any of its layers. The implementation of each layerhas high technical complexity and contain tens of opti-cal components, operator’s checklists, thousands of elec-tronic components and lines of software code. The taskof security analysis is to find all the loopholes.

3

TABLE I. Implementation layers in a quantum communication system.

Layer Description

Q7. Installation and maintenance Manual management procedures done by the manufacturer, network operator, andend users.

Q6. Application interface Handles the communication between the quantum communication protocol and the(classical) application that has asked for the service. For example, for QKD thislayer may transfer the generated key to an encryption device or key distributionnetwork. For quantum secure direct communication this layer transfers secretmessages from/to an external unit that sends and receives them.

Q5. Post-processing Handles the post-processing of the raw data. For QKD it involves preparation andstorage of raw key data, sifting, error correction, privacy amplification,authentication, and the communication over a classical public channel involved inthese steps.

Q4. Operation cycle State machine that decides when to run subsystems in different regimes, at anygiven time, alternating between qubit transmission, calibration and other serviceprocedures, and possibly idling.

Q3. Driver and calibration algorithms Firmware/software routines that control low-level operation of analog electronicsand electro-optical devices in different regimes.

Q2. Analog electronics interface Electronic signal processing and conditioning between firmware/software andelectro-optical devices. This includes for example current-to-voltage conversion,signal amplification, mixing, frequency filtering, limiting, sampling, timing-to-digitaland analog-to-digital conversions.

Q1. Optics Generation, modulation, transmission and detection of optical signals, implementedwith optical and electro-optical components. This includes both quantum states andservice optical signals for synchronization and calibration. For example, in adecoy-state BB84 QKD protocol this layer may include generation of weak coherentpulses with different polarization and intensity, their transmission, polarizationsplitting and detection, but also optical pointing-and-tracking for telescopes.

III. QUANTIFYING HARDNESS AGAINSTIMPLEMENTATION IMPERFECTIONS

When an implementation imperfection is suspected tobe security-critical, it is necessary to evaluate the secu-rity risks. The first step is testing. If it is found tobe compromising the security then the next step is todesign a countermeasure solution, and the last step ischecking the robustness of that solution. This proce-dure is often a loop, because most countermeasures inturn need to be tested. In order to quantify implementa-tion imperfections—existing inside the system—in termsof solutions implemented, we have categorised them asshown in Table II. The lowest state CX indicates thatthe imperfection is suspected to be a potential securityissue, and needs to be further analysed or tested before aconclusion can be made. After an imperfection is foundto be security-critical, its state becomes C0, i.e., insecure.Next, a solution needs to be developed that provides se-curity against the original attack model. At this state thesolution is expected to be robust and the imperfection isconsidered to be state C2. After it has been integratedinto a security proof, the state can be shifted to C3: so-lution secure. However, often it may be the case thatnewer attack models are found that bypass the counter-measure; then the state moves to C1, which means the

solution is robust only against a specific attack modelbut not against others or a combination of the originaland some other attacks.

For example, in ID Quantique Clavis2 QKD system,the imperfection that the detectors were vulnerable tobright-light detector control attack became C0 upon itsdiscovery in 2009 [3], was reclassified C2 after beingpatched in 2015, then downgraded to C1 next year af-ter the patch was demonstrated to be inadequate againsta modified attack [10]. A similar development can betraced for another imperfection: variation of detector ef-ficiency with angle of the incoming light [7]. It was sus-pected to be a security vulnerability (CX) up to 2015,then proven to be so (C0) in 2015 [7, 38], then moved toC2 by the use of a pinhole and later brought down to C1after the results presented in Refs. 9 and 39.

We emphasize that the categorisation of a specificvulnerability reflects only the existing knowledge aboutthem which can change with time as seen from the abovediscussion. Also the categorisation of each existing im-perfection depends on the specific system and the specificsolution implemented. For example, an imperfection inthe single-photon detectors may be classified as insecure(C0) but the same imperfection might be irrelevant (C3)for a system running a measurement-device-independent(MDI) QKD protocol.

4

TABLE II. Hardness against implementation imperfections. Here we propose a classification scheme quantifying howrobust a given system or countermeasure is against a given imperfection. The hardness level is assigned to each particularimperfection and the same imperfection at different systems may be assigned different levels. For each imperfection the hardnesslevel reflects current knowledge, and may change over time.

Hardness level Description Examples

C3. Solution secure Imperfection is either not applicable or hasbeen addressed with proven security.

The threat of a photon-number-splitting attack onmultiphoton pulses is eliminated by the decoy-stateprotocol [13, 14]; detector imperfections are madeirrelevant by measurement-device-independent (MDI)QKD [15]; statistical fluctuations owing to finitesample size are accounted by finite-key post-processing.

C2. Solution robust This is the status of many countermeasuresafter their initial design. With time thisstate may move up to C3 after a securityproof is completed, or down to C1 or C0after working attacks on it are found.

Phase-remapping in Clavis2 [4] (the imperfection isthere, but any known attack attempting to exploit itcauses too many errors); long wavelength Trojan-horseattack on Bob in Clavis2 [11] (the use of a narrowpasswavelength filter appears to be sufficient given that anyknown remaining attack causes too many errors).

C1. Solution onlypartially effective

Countermeasure is successful againstcertain attack(s), but known to bevulnerable against at least one other attackor a modification of the original attack.

Random-efficiency countermeasure against detectorcontrol in Clavis2 [10]; pulse-energy-monitoring systemin Alice against Trojan-horse attack [6]; pinholecountermeasure against detector-efficiency-mismatchattacks [7].

C0. Insecure Security-critical imperfection has beenconfirmed to exist, but no countermeasurehas been implemented.

Laser damage attack on the pulse-energy-monitoringdetector in Alice in Clavis2 [9] and on opticalattenuators in several systems [35]; photon emissioncaused by detection events in single-photondetectors [12, 36].

CX. Not tested Imperfection is suspected to exist and besecurity-critical, but has not been tested.

Patch for channel-calibration in Clavis2 [37];imperfections reported in Ref. 8 againstdetector-device-independent QKD.

Eventually, the objective of the security evaluationprocess should be to upgrade the system such that allimperfections are on the level C3. Level C3 should beconsidered good for a commercial product, while levelsC1, C0 and CX should be deemed inadequate and needto be remedied by a security update or new product de-velopment. Level C2 lies in the gray zone and while itmay be considered secure for practical purposes, i.e., ad-equate for a commercial product, one should rememberthat it has no theoretical security proof based on quan-tum mechanics. However, the development of securityproofs taking into account imperfections can—in somecases—be a slow process, and we expect many of themto attain C2 earlier than C3.

IV. SECURITY EVALUATION OF ITMO’SSUBCARRIER WAVE QUANTUM KEY

DISTRIBUTION SYSTEM

In the rest of this Article we demonstrate how our pro-posed security evaluation and certification methodologycan be applied to a specific system. As an example,we select the subcarrier wave quantum key distribution(SCW QKD) system manufactured by ITMO University

and its spin-off company Quantum Communications Ltd.During the initial security evaluation, the manufacturerhas provided us with an overall design specification ofthe system along with further oral information and writ-ten notes on various aspects of design and manufacturingprocess. We had physical access to the hardware but didnot perform any experiments on the setup during thatstage. Following the methodology from Sec. II and Ta-ble I, we have performed a complete security analysis ofthe bottom four layers (Q1–Q4) that correspond to op-tics, analog electronics, driver and calibration algorithms,and operation cycle of the system. For these layers, wehave examined all suspected implementation security is-sues according to the current knowledge. For higher lay-ers Q5 and up (from QKD protocol post-processing andup), we cannot perform a complete security evaluationas they lay outside our expertise area; they should beanalysed by a team with expertise in classical informa-tion technology security. Nevertheless, we have pointedout a few issues in the layer Q5.

The results of this initial security evaluation have ini-tially been delivered to ITMO in a confidential reportin February 2018 (prepared by those authors not affili-ated with ITMO). A summary of that report is presentedin Sec. V, after we briefly introduce the system to the

5

Laser PSM1 PSM2 SF SPD

QuantumchannelAlice Bob

φA= φB

ωω+Ωω-Ω

ATT

ω+Ωω-Ω ω

ω+Ωω-Ω ω

φA φB

FIG. 1. Basic subcarrier-wave QKD scheme. Insets showoptical spectra at different points in the setup. ATT, opti-cal attenuator; PSM, electro-optical phase shift modulator;SF, notch spectral filter; SPD, single-photon detector.

reader.The subcarrier wave QKD principle was proposed in

1999 [40] and experimentally demonstrated later thesame year [41]. It was initially conceived as a prac-tical fiber-optic system offering an alternative to then-dominant polarization and time-bin encoding schemesthat would require a precise alignment during opera-tion [40], as well as to “plug-and-play” systems devel-oped a year earlier [42] that limited QKD source rep-etition rate due to an intrinsic two-pass architecture.More recently, SCW QKD has been demonstrated asbeing robust against external conditions affecting thetelecom fiber [43], allowing increased spectral density[44, 45], and being invariant to telescope rotation inopen-air links [46]. Its viability has been experimentallydemonstrated for metropolitan area telecommunicationlines [47], multi-user [48, 49] and software-defined [50]networks.

A basic design of the SCW QKD system is shownin Fig. 1. In Alice module, a continuous narrow linewidthlaser acts as a light source. This radiation with frequencyω is usually referred as carrier wave, or simply a car-rier. It passes through an electro-optical phase modula-tor, to which an electrical driving signal with frequencyΩ is applied. As a result, two subcarriers (or sidebands)with frequencies ω − Ω and ω + Ω appear in the opti-cal frequency spectrum, as shown on the inset in Fig. 1.Quantum information is encoded in the phase shift ϕAbetween the carrier and the subcarriers, which is inducedby phase modulation of the electrical driving signal [43].Four phase states (0, π/2, π, 3π/2) are used in both Al-ice and Bob modules. After modulation the signal passesto the quantum channel through an attenuator. Carrierpower, modulation index and attenuation value are cho-sen so that the mean photon number µsb (on two side-bands combined) meets the protocol requirements. OnBob side a similar modulator introduces phase shift ϕBresulting in single-photon interference on the sidebands.An optical filter separates the carrier from the sidebands,and the latter are detected on a single-photon detector.The registered optical power depends on the difference|ϕA − ϕB |. If Alice and Bob introduce equal phase shifts,constructive interference is observed, and the optical sig-

nal power at the sidebands differs from zero. In the op-posite case, when the difference equals π, destructive in-terference occurs and the registered counts correspond todark noise of the detector. Instances when the differenceis π/2 are discarded during sifting. Key bits are obtainedfrom the registered counts using algorithms similar to aphase-encoded BB84 protocol [43, 51]. A full quantumdescription of the system and the implemented protocolscan be found in Refs. 51 and 52.

V. POTENTIAL VULNERABILITIES

Based on the received information about the system, wehave identified a number of potential security issues thatmight be exploitable by an adversary Eve. A summaryof these results is given in Table III. For each imperfec-tion, we specify the corresponding Q-layers (see Sec. II),hardness level Cinit (see Sec. III) and an estimate of therisk. Almost all the identified issues require further de-tailed analysis, and in many cases, in-depth experimentaltesting in a laboratory. For many issues, the hardnesslevel is CX, meaning the issue’s applicability to the sys-tem implementation needs to be studied and tested. Wespecify in which system implementation Q-layers each is-sue is located, according to the classification introducedin Sec. II.

The risk evaluation listed in Table III is based on aguessed likelihood of the vulnerability, expected fractionof the secret key leakage, and estimated feasibility of ex-ploit technology. It is essential for manufacturers withlimited resources to prioritize the problems. Vulnerabil-ities that can be exploited using today’s technology andcompromise full secret key are a more immediate threat.They should be addressed before those that require fu-ture technology or provide only partial key information(thus requiring of Eve an additional classical cryptan-alytic task). We have followed this strategy and testedthe two highest risk issues during the follow-up stage (seeSec. VI). The security proof and implementation of post-processing have also been completed after the report.

We remark that more security issues may be discoveredin the future once the system design and operation areexamined in greater detail. We now explain the identifiedissues.

A. Controllable detectors

Two types of detectors are used in the present implemen-tation: ID Quantique (IDQ) ID210 gated APD and Scon-tel TCORPS-CCR-001 superconducting nanowire single-photon detector (SNSPD). Among them, Scontel SNSPDis at least partially controllable by bright light [57–59].Whether the same was true for ID210, required exper-imental testing. From our previous measurements onID Quantique Clavis2 QKD system, we know that it ispossible to blind its detectors by sending a continuous-

6

TABLE III. Summary of potential security issues in ITMO’s subcarrier wave QKD system. Cinit, hardness of theinitial implementation (analysed in 2017) against this security issue; Ccurr, hardness of the current implementation (patched asof early 2020) against this security issue. Ccurr reflects the current knowledge about the security issue, and may change in thefuture (see Sec. III). Q, system implementation layers involved (see Sec. II).

Potentialsecurity issue

Cinit QTarget

componentBrief

description

Requirelab

testing?

Initialrisk

evaluationCcurr Current status

Controllabledetectors

CX Q1–5,7

SPDs See Ref. 53. Yes High C2 Loophole has been experimentallyconfirmed and the suggestedcountermeasures [54] have beenimplemented in the current version.

Laser damage CX Q1,3 Alice’s &Bob’soptics

See Ref. 9. Yes High C2 Loophole has been experimentallyconfirmed in Alice and the suggestedcountermeasures [35] have beenimplemented in the current version.

Trojan horse C2,C0

Q1 Alice’s &Bob’soptics

See Ref. 24. Yes Low(Alice),High(Bob)

C2,C2

Manufacturer has developedcountermeasures (patent pending) tobe implemented in the next systemmodification and then analysedagain by the testing team.

Lack ofgeneralsecurity proof

C0 Q1,5 QKDprotocol

see Sec. V D. No High C3 Was a known issue. Has beencovered by the manufacturer afterreceiving the report, see Ref. 52. Theprivacy amplification procedure hasbeen updated in the software. Thetwo groups continue to jointly verifythe security proof.

Manipulationof referencepulse

CX Q1,5 QKDprotocol

see Sec. V E. No High C3 Was a known issue. Has beencovered by the manufacturer afterreceiving the report, see Ref. 52.Reference monitoring has beenimplemented in the system.

Time-shiftattack

CX Q1–3,5

PSMs See Sec. V F. Yes Medium CX Lower priority issue that is a subjectfor future work.

Privacyamplification

C0 Q5 Post-processing

See Sec. V G. No High C3 Was a known issue. Has beencovered by the manufacturer afterreceiving the report, see Ref. 52. Theprivacy amplification procedure hasbeen updated in the software.

Finite key sizeeffects

C0 Q5 QKDprotocol

See Ref. 55. No Low C3 Was a known issue. Has beencovered by the manufacturer afterreceiving the report, see Ref. 52. Thesystem software has been updatedtaking the finite-sized effects intoaccount.

Non-quantumRNG

C0 Q5 RNG See Sec. V I. No Low C3 Was a known issue. Themanufacturer has put effort intoquantum RNG research [56] and hasselected a physical RNG for the nextversion of the system.

Intersymbolinterference

CX Q1–3 PSM’sdrivers

See Sec. V J. Yes Low CX Lower priority issue that is a subjectfor future work.

7

Laser PSM1 VOA

FOA LPOI

to quantumchannel

Polarization-maintaining fiberSingle-mode fiber

FC/APCbulkhead connector

φA

FIG. 2. Alice’s optical scheme in detail. Component pigtailsare connected using angled ferrule connectors (FC/APC).OI, optical isolator; FOA, fixed optical attenuator (plug-instyle); LP, linear polarizer; VOA, variable optical attenuator.

wave (c.w.) light of power Pblind = 0.3 mW [10]. Thenby choosing a trigger pulse power Ptr greater than thethreshold power Pth = 0.15 mW, it is possible to force aclick when Bob-Eve phases match. If we assume ID210behaves similarly to the detectors in Clavis2 system, thenEve could send c.w. power to blind it and perform thefaked-state attack [3] detailed in Appendix A.

However, sending a trigger power Ptr at the subcarrierfrequency will not work as the photons will be shiftedto another frequency due to Bob’s modulation. Instead,Eve needs to inject extra photons in the reference signalfrequency so that they are shifted to the subcarrier afterthe modulation and trigger a click in the blinded detector.Due to the small m in the present system, the referencepower required by Eve is Pref ≈ Ptr/m. For example,for m = 0.05, a 1 ns trigger pulse at the subcarrierswith peak power Ptr > 0.15 mW [10] just before thedetectors would require a 1 ns wide reference pulse withpeak power of Pref > 3 mW at Bob’s input. This is aneasily generated and transmitted optical power.

B. Laser damage

Whether the current system is vulnerable to laser dam-age attack (LDA) [9, 60], can be ascertained only afterexperimental testing. Since one of attenuating compo-nents, a variable optical attenuator (VOA; FOD 5418) inAlice is the closest to the channel (see Fig. 2), it will bethe first target for Eve’s LDA. Eve can send high powerlaser to damage the optical attenuator to reduce its at-tenuation. If successful, lights coming out of Alice willhave higher mean photon numbers than permitted by thesecurity proofs, thus compromising the security.

It will also be interesting to experimentally check theeffect of laser damage on the optical PSMs to see whetherLDA can affect m. If it can, then further studies needto be conducted to check whether it leads to a denial ofservice or a security compromise. Finally, if LDA canreduce the insertion loss of either the PSM1, linear po-larizer (LP) or fixed optical attenuator (FOA) in Alice,it may facilitate other attacks, e.g., Trojan-horse attack.Hence, these components must be characterized meticu-lously against LDA.

C. Trojan-horse attack

In SCW QKD protocol, after sifting, Alice and Bob keeponly the outcomes for which they both used the samephase, i.e., ϕA = ϕB . Thus if Eve can extract informa-tion on either ϕA or ϕB by performing a Trojan-horseattack (THA) [25, 26, 61], the security will be com-promised. With current technology, Eve needs a meanphoton number µB→E ∼ 4 to perform homodyne detec-tion [61].

The secure key rate in the presence of THA—underreasonable assumptions—is available for both single-photon and decoy-state Bennett-Brassard 1984 (BB84)protocol [24]. It is based on Alice’s ability to upper-bound the outgoing mean photon number µout. A sim-ilar theoretical analysis under assumptions appropriatefor the present scheme is not available, and needs to beperformed. Moreover, wavelength can also be an attackvariable [11, 62]. It is thus important to measure ex-perimentally the actual values of the insertion loss andreflection coefficients of several components such as LP,FOA, OI, connectors, etc. in a large range of wavelengthsthat can propagate through the optical fiber (from < 400to > 2500 nm). Since a laboratory with wideband char-acterisation equipment is not readily available to us, wehave limited our analysis to Eve using a single 1550 nmwavelength. With these two shortcomings, our securityevaluation of the system against the THA is detailed be-low.

1. Alice

In the present scheme (Fig. 2), possible sources of re-flection are the LP (Thorlabs ILP1550PM-APC), FOA(Fibertool FC-FC 15 dB), optical isolator (OI; AC Pho-tonics PMIU15P22B11), all the standard optical connec-tors placed after PSM1 (i.e., at its side facing away fromthe quantum channel), and that facet of PSM1. We iden-tify that one of the strongest sources of reflection is theLP with 45 dB return loss (according to its data sheet).Assuming the VOA is set to 70 dB (which is a typi-cal attenuation value required by the SCW QKD pro-tocol), the insertion loss of the PSM1 is 3 dB and thatof each connector is 0.3 dB, the total round-trip attenua-tion experienced by a Trojan photon is 193.4 dB. For theother protocols, an appreciable decline of performancebegins at µout ∼ 10−6 [24]. For that, an eavesdropperwould need to send 2.2× 1013 photons per pulse into thesystem, which—considering a phase change frequency off = 100 MHz—corresponds to injecting c.w. power of280 W. This is somewhat above present-day technol-ogy capability, may be around the physical limit of howmuch power the standard fibers can carry, and will cer-tainly trigger laser damage of Alice’s components. Mostfiber-optic components get damaged at less than 10 W[9, 35, 63]. While this suggests the risk of THA at Al-ice’s side is relatively low, it is important to check the

8

PSM2φB

from quantumchannel

PBS

PBC

SPD

FBG

C

φB

FIG. 3. Bob’s optical scheme in detail. Bob’s phase shift mod-ulator PSM2 is polarization-insensitive and is implemented astwo identical modulators acting on orthogonal components ofinput polarization. PBS, fiber-optic polarization beam split-ter; PBC, fiber-optic polarization beam combiner; C, circula-tor; FBG, fiber Bragg grating.

reflection from the OI and FOA, which requires experi-mental testing. Finally, this analysis should be repeatedfor lower attenuation settings of the VOA that may beused by the system and the risk should be evaluated ac-cordingly.

2. Bob

The risk of THA on Bob seems to be comparativelyhigher than that at Alice since there is no attenuatoror isolator in Bob’s module (Fig. 3). The reflection coef-ficient of the polarization beam combiner (PBC; AC Pho-tonics PBS15P12S11-2m) just after PSM2 is 50 dB (ac-cording to its data sheet) while the insertion loss of thepolarization beam splitter (PBS; same as PBC), PSM2,and each of the four connectors is 0.48, 1.7, and 0.3 dB,respectively. Assuming the point of reflection is the PBCjust after the phase modulator, the total loss experiencedby a Trojan photon will be l = 56.8 dB. This means thatin order to get a single photon out, Eve needs to inject ac.w. power of only 6 µW, which is easy.

Note that ID210 runs in gated mode with afterpuls-ing. So, Eve can send the Trojan photons just after thegate but still inside the phase modulation window. How-ever, this may cause a high level of afterpulsing in Bob’ssingle-photon detectors [61]. Scontel TCORPS-CCR-001has no afterpulsing but it runs in continuous mode, thusmaking it difficult for Eve to send Trojan photons. Evecan resort to a longer wavelength (such as 1924 nm) toreduce both the afterpulsing side-effect [11] and also theprobability of the Trojan photons to be detected. As aresult, wavelength filters are necessary in Bob. Never-theless, afterpulsing characterization of detectors alongwith characterization of the wavelength filter at longerwavelengths are necessary in order to prevent the THA.

D. Lack of general security proof

An apparent requirement of the SCW QKD protocol (toprevent photon number splitting (PNS) [34, 64] and un-

ambiguous state discrimination (USD) attack [6, 65]) isto monitor the carrier signal as highlighted in [41, 66].However, based on our discussions with ITMO’s engi-neers, we learned that the monitoring of the referencesignal might not be implemented partly due to imple-mentation complexity and partly because they do notdeem it necessary for security, because Ref. 51 shows thatthe system is secure against a collective beam splitting(CBS) attack over a large distance. Here, we emphasizethat being secure against the CBS attack mentioned inRef. 51 does not guarantee security against more gen-eral attacks. As an example, we outline a more powerfulattack in Appendix B.

E. Manipulation of reference pulse

Here we assume that the reference pulse monitoring is im-plemented in the system and analyse the consequences. Ifcare is not taken during the implementation, there mightstill be ways for Eve to perform the USD attack as thefollowing.

First, Eve intercepts Alice’s signal just outside Alice’slab and performs a USD measurement [67]. For any con-clusive measurement, she prepares the same state with ahigher mean photon number and sends it to Bob via alossless channel, in order to maximize his detection prob-ability. For any inconclusive measurement, she still needsto send the reference signal to Bob and wants it to be de-tected. However, sending only the reference signal whilesuppressing the sidebands does not work as it will intro-duce errors. Instead, Eve wishes the subcarrier signaldetection probability to be as low as possible while stillkeeping the reference signal detection probability as highas possible. The number of photons in the subcarrierand reference signal—after Bob’s modulation—is givenin Ref. 51 as

nsbph = αµ0η(L)ηB[1− |ds00(β′)|2

],

nrefph = αµ0η(L)ηB |ds00(β′)|2.(1)

Here, µ0 is the mean photon number of the referencepulse, η(L) is channel transmission, ηB is transmissionin Bob module, and α is additional loss induced by Eve.|ds00(β′)| is the Wigner d-function that decides the num-ber of photons to be shifted from reference to side-bandsbased on its argument β′, which itself is a function of themodulation index and the phase difference between Aliceand Bob.

We assume APDs are used for the detection of boththe reference and subcarrier signals. Then the detection

probability in mode i ∈ ref, sb is P idet = 1− e−niph (for

simplicity, we consider unity detection efficiency). Fornormal operation, nsbph nrefph, which leads to P sb

det P refdet. Depending on the chosen value of m and µ0, P sb

detcan be significantly more sensitive to α compared to P ref

det.In that case, increasing α would reduce P sb

det much fasterthan P ref

det. As a result, it might be possible for Eve to

9

reduce subcarrier signal detection rate without affectingthe reference detection rate considerably. The small re-duction in P ref

det can be compensated by adjusting thepower of the pulses sent during the conclusive measure-ment cases. The only limitation on α is that P ref

det shouldnot be lowered significantly for Alice and Bob to notice.A countermeasure to this attack can be to monitor thereference and subcarrier detection rates. However, a fur-ther study is required to find the optimal strategy tomonitor the reference and subcarriers and also to de-sign the monitoring detector, determine µ0, monitoringthreshold, and m.

F. Time-shift attack

In order to achieve time synchronization, Alice sends toBob a continuous 10 MHz sinusoidal optical signal, whichis further modulated by a signal of a special shape with60 ms period. The position of bit slots of 10 ns period [43]and other time intervals are defined with respect to thissignal. We suspect that it might be possible for Eve tocontrol the time delay of the reference and side-band sig-nals relative to this synchronization signal to shift theirarrival times into a specific moment inside or outside thephase modulation window. This might make the sys-tem vulnerable against time-shift attacks (TSA) [68]. Atime-shift attack can be performed on the SCW QKDsystem as follows. For ease of understanding, let us firstassume that there is a time gap between successive phasemodulation windows (i.e., they are narrower than the bitslot), and in between the modulation windows the phaseis 0. We assume a faked-state attack in which Eve staysoutside of Alice’s module and performs USD of Alice’sstates. Whenever she obtains a conclusive outcome, shesends the same state ϕE to Bob in the correct time win-dow (i.e., she does not alter the arrival time). When Bobmeasures in the same basis, and ϕE = ϕB (ϕE 6= ϕB),he gets a click (no click). However, when Eve obtains aninconclusive outcome, she generates a ϕE = π state andsends it in-between the phase modulation windows. Sincein between the modulation window the phase applied is0, this ensures no detection by Bob’s detector.

In our discussion with the developers, we learned thatin the current SCW QKD implementation, there is nogap between successive phase modulation windows. How-ever, at the transition region from one window to thenext, there is a fast fluctuation. Thus, it will be interest-ing to know what effective phase shift is experienced bya pulse if it is sent at the time interval corresponding tothe fluctuations. For example, if the effective phase shiftis ϕ0, then it might still be possible for Eve to remaininconspicuous during the inconclusive measurement slotsby sending a state ϕE = π+ϕ0. However, the feasibilityof this attack can only be ascertained by experimentaltesting. For that, one needs to characterize Bob’s phasemodulation windows—including the transition regions—in the time domain for all phase values. Click processing

by Bob will also need to be checked for detection timesin the transition regions.

G. Privacy amplification method

In the composability framework of QKD [69], to achieveε-security, it is required that Alice and Bob estimate theupper bound of Eve’s information on their key up to theend of error correction step, and apply a proper universal-2 hash function. This is done to generate a shorter secretkey such that the probability that the key is not perfectand the protocol did not abort is bounded by ε. How-ever, the present system does privacy amplification byfirst calculating secret key size and then randomly dis-carding bits in the error-corrected key to match that cal-culated secret key size. The disadvantage of this randomkey removal procedure compared to hashing is that Evecan listen to the classical communication between Aliceand Bob and follow the exact procedure to discard bitsfrom her own set. At the end, ε-security cannot be guar-anteed. To make the secret key ε-secure according to thecomposability framework, the proper implementation ofprivacy amplification using the hash function is advised.

H. Finite-key-size analysis

In the present system, the size of the raw key is limitedby the size of Alice’s memory (1 Mbit). According to thedevelopers, this leads to a sifted key size of ≈ 20 kbit fora distance of 12 km. For a larger distance of 200 km,the size becomes as low as ≈ 10 kbit [43]. 10% of thissifted key is used for parameter estimation. This smallsample size has a high probability to lead to discrepanciesbetween the estimated and actual parameter values dueto finite-size-effects [70]. Since the present security proofused by the developers does not consider the finite-key-size effects, the system might be vulnerable to them.

Based on our previous analysis on a different sys-tem [71], we know that the finite-size effects become sig-nificant when the sifted key size is lower than 200 kbit.At that size of the sifted key, the system—without finite-size-analysis—generated a larger secret key than theupper-bound set by the finite-key-size analysis. Thus,security of the generated key was not guaranteed. Sincethe sifted-key size of 20 kbit in the present system is muchlower than 200 kbit, we strongly suspect that finite-sizeeffects are significant. Thus, we advise to develop a thor-ough finite-key analysis. To do this, any deviation ofparameters due to finite-size-effect needs to be analysed.An example of this effect is the collision probability, i.e.,the probability of a hash function mapping two differentinput keys to the same output key. Other examples couldbe found in Refs. 55, 69, 72–74.

10

I. Non-quantum random number generator

In the present system, three types of RNGs can be usedin an interchangeable manner. One is a pseudorandomnumber generation software drand48 r from Linux oper-ating system. The second is a commercial product man-ufactured by the developers of this QKD system. Thethird one is the internal RNG of Altera Cyclone IV field-programmable gate array (FPGA) chip. Using a pseudo-random generator (or randomness expansion) does notsatisfy the randomness assumption of the security proof.For the other two generators, care should be taken toverify the quantum origin of the random numbers andthe quality of implementation.

J. Intersymbol interference

Owing to the limited bandwidth of the driving electron-ics, high speed systems might exhibit intensity correla-tion among the neighboring pulses—an effect known asthe intersymbol interference or the pattern effect [75, 76].The electronic signal applied to the modulator might bedependent on the preceding pulse, which violates the as-sumption of security proof. This may lead to vulnerabil-ity. Testing should be done in order to assess the risk ofthe intersymbol interference in the present system.

VI. POSSIBLE COUNTERMEASURES ANDFOLLOW-UP

After the initial security evaluation report had been de-livered in 2017, the follow-up process ensued. Till now,laboratory testing of the two issues controllable detectorsand laser damage has been carried out. In both cases,the testing has confirmed the vulnerability’s presence andthe manufacturer has designed countermeasures and im-plemented them in the current version of the SCW QKDsystem. Most other issues (Trojan-horse attack, lack ofgeneral security proof, manipulation of reference pulse,privacy amplification, finite key size effects, non-quantumRNG) have also been addressed as outlined below. Twolower-risk issues, time-shift attack and intersymbol inter-ference, remain to be studied in the future.

Controllable detectors: Both detector units men-tioned in Sec. V A have been tested. It has been foundthat ID210 is fully controllable by bright light [54], whileScontel SNSPD with a built-in electronic countermeasure(recently developed by Scontel) is partially controllableand the countermeasure in it needs to be improved [59].The optical power required to control ID210 can easily begenerated and transmitted through Bob’s optical scheme[54], confirming our original risk assessment. Technicalcountermeasures against this attack are currently underconsideration. We remark that this vulnerability remainsunsolved in most existing QKD systems [77].

Laser damage attack: as suggested in Sec. V B, wehave performed laboratory testing of the VOA unit (FOD5418). We have found it to be severely vulnerable to theLDA [35]. A brief application of ∼ 2.8 W c.w. laser powerdamages a metal film layer inside this component and re-liably reduces its attenuation by ∼ 10 dB, which rendersthe key insecure. A countermeasure currently under con-sideration is to insert another component between theline and the VOA, in order to prevent the latter frombeing exposed to high power. Candidates for this othercomponent are being tested [63].Protocol-related issues: A proof of security for a

general attack—the lack of which has been highlightedin Sec. V D—has been developed in Ref. 52. It is sum-marised in Appendix C. The issues discussed in Secs. V Dand V E have been closed by an analysis of advanced at-tack and appropriate countermeasures [78, 79]. We recapthese results in Appendix D. Finally, a correct privacyamplification method (Sec. V G) and finite-key analysis(Sec. V H) have been included in Ref. 52. The finite-keyanalysis is recapped in Appendix E. Since all these issuesappear to have been addressed by this recently publishedtheoretical work, we have updated their current hardnesslevel in Table III to C3.

Two more issues have also been analysed and patchedby the manufacturer. For the Trojan-horse attack(Sec. V C), additional components have been added tothe optical scheme in order to detect the attack (patentpending). Also, possible Eve’s information acquired byTrojan-horse attack has been quantified and consideredin the security model. The non-quantum RNG (Sec. V I)will be replaced in the next version of the system by aquantum one developed by the ITMO team.

Overall, our joint work has allowed ITMO Universityand Quantum Communications Ltd. to quickly patchmost of the loopholes by introducing countermeasures.The implementation hardness levels have been raisedfrom Cinit of CX and C0 at the time of the initial re-port to the current state Ccurr of mostly C2 or even C3.Countermeasures marked C2 may eventually become C3,after additional experimental testing and improvement.The two groups also continue to jointly verify the proto-col security proof.

VII. CONCLUSION

The lack of security certification for quantum cryptogra-phy is ironic, since security is the main concern behindthe shift from classical to quantum cryptography. In thiswork we have presented a methodology for security evalu-ation of a complete quantum communication system. Todo so, we have subdivided the complete system imple-mentation into seven layers based on a hierarchical orderof information flow and categorised the implementationimperfections based on the hardness of the realised so-lution and practical risk. Using these classifications, wehave evaluated the security of the SCW QKD system

11

from ITMO University and Quantum CommunicationsLtd. We have found a number of potential security is-sues that need a careful investigation by the manufac-turer. Experimental tests, countermeasure and theorydevelopment have followed. As the result, most of the is-sues have been addressed, increasing the hardness ratingof this implementation. We would like to add that a sim-ilar process is also going on with the two other systems(by ID Quantique and QuantumCTek) that we earlieranalysed.

One important but sometimes overlooked aspectshould be emphasised. When someone is in the process ofdesigning a system, his mindset tends to become biased,and he may not be able to think from a different point ofview and see security problems with his own design. Thisis the very reason the task of security certification shouldbe done in collaboration with third-party experts whosemain goal is to find problems. This helps a responsibleQKD manufacturer to quickly assess and resolve the secu-rity issues, as has clearly happened in the case of ITMO.Furthermore, the third-party analysis should ideally be-gin during initial design considerations, rather than afterthe commercial implementation has been completed (ashas been the case here).

We hope our security evaluation approach will pavethe way towards development of a security certificationmethodology for existing and future quantum communi-cation systems.

ACKNOWLEDGMENTS

We thank M. Legre, N. Lutkenhaus, E. Tan and R. Ren-ner for discussions. This work was funded by NSERCof Canada (programs Discovery and CryptoWorks21),MRIS of Ontario, and the Ministry of Education andScience of Russia (programs 5-in-100 and NTI center forquantum communications). P.C. was supported by ThaiDPST scholarship. A.H. was supported by China Schol-arship Council, the National Natural Science Founda-tion of China (grant 61901483), and the National KeyResearch and Development Program of China (grant2019QY0702). H.Q. is sponsored by Shanghai PujiangProgram. This work was funded by Government of Rus-sian Federation (grant 08-08).

Author contributions: S.S., P.C., A.H., H.Q., and V.M.performed the security analysis. V.E., A.K., A.Ga., V.C.,A.V., and A.Gl. developed the SCW QKD system, itssecurity proof and countermeasures to the attacks listedin the security analysis. All authors wrote the Article.

Appendix A: Faked-state attack strategy

Let’s assume first that there is no reference monitor-ing implemented in the system. Let’s assume Alice en-codes phase ϕA. We further assume that Eve—sitting

outside Alice’s module—measures the signal (using sim-ilar measurement setup as Bob) by randomly applyingϕE ∈ 0, π/2, π, 3π/2. Another part of her—sittingnear Bob—sends bright c.w. light of power Pblind to blindBob’s side-band detector. When ϕE = ϕA, she getsa detection. In this case, she recreates the reference-subcarrier pulse pairs scaling their powers up to makePref = 3 mW. When Bob also measures in the samebasis as Alice-Eve and ϕE = ϕB (ϕE = ϕB ± π), thisresults in constructive (destructive) interference and will(will not) trigger a click in the blinded sideband detec-tor. If Bob and Eve select different bases, Bob shouldnot register any detection. For the slots when Eve getsno detection due to ϕE 6= ϕA or low detection efficiency,she simply does nothing owing to the absence of referencepulse monitoring, and these events will appear as loss toBob.

In order to successfully perform this attack in prac-tice, the blinded detector should be characterized to knowPnever and Palways, which are the thresholds of the triggerpulse power making the detector never click and alwaysclick. The trigger pulse power Ptr in the successful attackneeds to satisfy the conditions

Ptr ≥ Palways,

1

2Ptr ≤ Pnever.

(A1)

However, if the reference monitoring is implemented,both the reference and sideband monitoring detectorswould be blinded and Eve will need to modify her strat-egy. When she has a conclusive outcome, she proceedsas before. However, when her measurement outcome isinconclusive, i.e., ϕE 6= ϕA, Eve needs to tailor the powerof the reference signal in such a way that it is enough toforce a click on the blinded reference detector but not onthe subcarrier detector.

Note that, sometimes Eve gets a detection when mea-suring in the opposite basis to that of Alice and has noway to know if her measurement result coincides withAlice’s bit. However, these states are either not detectedat Bob due to Eve-Bob basis mismatch or detected andthen discarded during sifting due to Alice-Bob basis mis-match.

Appendix B: A more general attack than CBSattack mentioned in Ref. 51

• For each quantum signal going from Alice to Bob,Eve splits off a tiny fraction x of each signal in thechannel.

• Eve performs a quantum non-demolition measure-ment on the split signal [65].

• If no photons are found, she splits off another frac-tion x. She does this until her induced loss equalsthe line loss.

12

• When photons are found, she keeps them in herquantum memory and sends the rest of the radi-ation to Bob via a lossless channel. The state ofeach photon in her possession is

|ψ〉e = (a† +meiϕAb†) |0〉A |0〉B , (B1)

where a† and b† are the creation operators on thecarrier and subcarrier modes respectively, m is themodulation index and ϕA is Alice’s phase encoding.

• For different values of ϕA ∈ 0, π/2, π, 3π/2, Eve’sstates are not orthogonal. To make them orthog-onal to each other, Eve needs to apply a filteringoperation

Asuccess = m |0〉B 〈0|B + |1〉B 〈1|B ,Afail = I −Asuccess.

(B2)

This turns |ψ〉e into

|ψ′〉e = (a† + eiϕAb†) |0〉A |0〉B (B3)

with a success probability

Psuccess =2m2

1 +m2. (B4)

• When the bases are revealed during sifting, Evesimply measures |ψ′〉e in the correct basis to extractϕA.

This attack is more powerful because, in Ref. 51, for aline loss η Eve uses a (1 − η) : η beam splitter and theattack only succeeds when both Eve and Bob receive aphoton. This becomes less likely as the line loss increases.However, in the present case Eve is not restricted to splitin the (1− η) : η ratio for the line loss η, which gives hermore power. Thus, the security proof should be updatedto include more (and ideally the most) general attacksthan the collective beam splitting attacks.

Appendix C: Asymptotic security

We assume here, that the family of protocols consideringin this paper belongs to the class of one-way QKD proto-cols with independent and identically-distributed (i.i.d.)information carriers and direct reconciliation. It is com-monly accepted that secure key generation rate K forthe protocols of this class in the presence of collectiveattacks in asymptotic regime is lower bounded accordingto [80, 81] by the Devetak-Winter bound [82]

K = νSPB

[1− leakEC(Q)−max

Eχ(A : E)

], (C1)

where νS is the repetition rate; PB is the probabilityof successful decoding and accepting a bit in a singletransmission window; Q is the quantum bit error rate

(QBER), the probability that a bit accepted by Bob iserroneous; codeEC(Q) is the amount of information re-vealed by Alice through the public channel for the sakeof error correction, which depends on QBER and is lim-ited by the Shannon bound: codeEC(Q) ≥ h(Q) whereh(Q) = −Q log2Q − (1 − Q) log2(1 − Q) is the binaryShannon entropy. Quantity χ(A : E) in Eq. (C1)) is theHolevo capacity, giving an upper bound for amount of in-formation accessible to eavesdropper Eve in a given col-lective attack (quantum channel). It is well-known thatcoherent attacks in i.i.d. case can be bounded with collec-tive attacks. So one usually considers coherent attacksas general collective attacks [83] in terms of arbitraryunitary operations on purified states in enlarged Hilbertspace (described in terms of isometry) provided by Eve.

In Reference 52, the result of arbitrary isometry is con-sidered in order to estimate Holevo capacity in comple-mentary channel. Eve performs unitary operation (de-scribed by isometry) between states in the channel andEve’s ancillas to make them (in general case) entangledin some way [84]. It has been shown that Holevo capac-ity of complementary channel is maximized when statesbecome untangled (but interacted). Further consideringthe property of isometry, i.e., preserving the overlap be-tween the states, it has been shown that highest mutualinformation between Alice and Eve is bounded by theHolevo bound. This statement eliminates the necessityto consider particular kinds of isometries.

In case of subcarrier wave quantum key distributionHolevo bound can be found considering reduced uncon-ditioned channel density operator, i.e., considering onlytwo states since Eve can wait to measure her states afterreconciliation. Therefore the obtained Holevo bound us-ing binary Shannon entropy function h(x) = −x log2 x−(1− x) log2(1− x) of the unconditioned channel densityoperator eigenvalues is as follows:

χ(ρ) = h

(1

2(1− exp

[−µ0

(1− dS00(2β)

)]), (C2)

where µ0 is the amplitude of the coherent state on theof carrier wave determined by the average number ofphotons in a transmission window provided with coher-ent monochromatic light beam with optical frequency ω,dS00(β) is the Wigner d-function from the quantum the-ory of angular momentum [85], and β is determined bythe modulation index m [51].

Appendix D: Advancedunambiguous-state-discrimination attack

The collective attack that considers a mutual informationbetween Alice and Eve might not be the most generalattack. There might be attacks that decrease conditionalmutual information I(A;B|E) to zero. An example ofsuch attack has been introduced in Ref. 79 where Eveperforms an errorless USD measurement [86, 87] thenblocks inconclusive results and alters (amplifies and adds

13

errors) the distinguished states. The latter is necessary tomaintain both detection and error rates. In Reference 79the condition of revealing Eve’s actions [88] is generalisedas

Pdet > PUSD, (D1)

where Pdet is an expected detection probability and PUSD

is the probability of unambiguous state discrimination.Obviously there are two main strategies to increase theperformance of the system. The first is to increase Pdet

and the second is to decrease PUSD. We refer to Refs. 78and 79 for a further discussion of proposed approachesagainst the USD attack.

Appendix E: Finite-key security

Since the resources such as time and memory are fi-nite, it is not sufficient to consider asymptotic secu-rity. Therefore, in Ref. 52 a finite-key analysis hasbeen performed. To estimate appropriate bound on se-cure key rate we consider the notation of Renyi en-tropies Hα(X) = 1

1−α log (∑ni=1 p

αi ), because they de-

scribe the worst case and not the average one. In thepaper we consider that α→∞ since we use min-entropyH∞(X) = Hmin = − log maxi pi. Thereby a quantumasymptotic equipartition property (QAEP) [89] is con-sidered in order to bound ε-smooth min-entropy by vonNeumann entropy. It means that for a large number ofrounds, the operationally relevant total uncertainty canbe well approximated by the sum over all i.i.d. rounds.In SCW QKD, conditional von Neumann entropy, ormore precisely an entropy of Alice’s bit conditioned onEve’s side-information in a single round, is bound asH(A|E) ≥ 1− χ(ρ).

To provide the key extraction one should carry out thefollowing steps.

(i) Parameter estimation. One should estimate theerror rate (Bob publicly sends a random subset of k bitsto Alice, and she estimates the QBERQest in that subset)and detection rate at Bob’s side.

(ii) Error correction. At this step both legitimateparties should check and correct the errors in their bitstrings. It can be done using any error correction code.

(iii) Privacy amplification. In Reference 52, the pri-vacy amplification has been studied using the bound fromRef. 90, which tells us that the trace distance d betweenthe protocol’s output and an ideal output (where the keyis uniform and independent from Eve, even after Eveknows the matrix used for the hashing) is bound aboveby

d =1

2‖ρKFE − ωK ⊗ σFE‖1

≤ εs +1

2

√2l−H

εsmin(A

′|E)

≤ εs +1

2

√2−lossPA

≤ εs + εPA = εsec,

(E1)

where in the last step the quantity εsec is introduced asan upper bound on d.

Reference 52 gives the final result that the protocol isεcorr-correct with εcorr = εEC and εsec-secure with εsec =εs + εPA, hence εQKD-secure-and-correct, with εQKD =εEC + εs + εPA providing secure bit string with length

l = n(1− χ(ρ))− 4√n log

(2 +√

2)√

log

(2

ε2S

)−

−k − codeEC(Q)− log1

εEC

− log1

εPA+ 2.

(E2)

[1] C. H. Bennett and G. Brassard, in Proceedings of In-ternational Conference on Computers, Systems, and Sig-nal Processing (IEEE Press, New York, Bangalore, India,1984) pp. 175–179.

[2] J. Yin, Y. Cao, Y.-H. Li, S.-K. Liao, L. Zhang, J.-G. Ren,W.-Q. Cai, W.-Y. Liu, B. Li, H. Dai, G.-B. Li, Q.-M. Lu,Y.-H. Gong, Y. Xu, S.-L. Li, F.-Z. Li, Y.-Y. Yin, Z.-Q.Jiang, M. Li, J.-J. Jia, G. Ren, D. He, Y.-L. Zhou, X.-X.Zhang, N. Wang, X. Chang, Z.-C. Zhu, N.-L. Liu, Y.-A.Chen, C.-Y. Lu, R. Shu, C.-Z. Peng, J.-Y. Wang, andJ.-W. Pan, Science 356, 1140 (2017).

[3] L. Lydersen, C. Wiechers, C. Wittmann, D. Elser,J. Skaar, and V. Makarov, Nat. Photonics 4, 686 (2010).

[4] F. Xu, B. Qi, and H.-K. Lo, New J. Phys. 12, 113026(2010).

[5] S.-H. Sun, M.-S. Jiang, and L.-M. Liang, Phys. Rev. A83, 062331 (2011).

[6] S. Sajeed, I. Radchenko, S. Kaiser, J.-P. Bourgoin,A. Pappa, L. Monat, M. Legre, and V. Makarov, Phys.Rev. A 91, 032326 (2015).

[7] S. Sajeed, P. Chaiwongkhot, J.-P. Bourgoin, T. Jen-newein, N. Lutkenhaus, and V. Makarov, Phys. Rev.A 91, 062301 (2015).

[8] S. Sajeed, A. Huang, S. Sun, F. Xu, V. Makarov, andM. Curty, Phys. Rev. Lett. 117, 250505 (2016).

[9] V. Makarov, J.-P. Bourgoin, P. Chaiwongkhot,M. Gagne, T. Jennewein, S. Kaiser, R. Kashyap,M. Legre, C. Minshull, and S. Sajeed, Phys. Rev. A 94,030302 (2016).

[10] A. Huang, S. Sajeed, P. Chaiwongkhot, M. Soucarros,M. Legre, and V. Makarov, IEEE J. Quantum Electron.52, 8000211 (2016).

[11] S. Sajeed, C. Minshull, N. Jain, and V. Makarov, Sci.Rep. 7, 8403 (2017).

[12] P. V. P. Pinheiro, P. Chaiwongkhot, S. Sajeed, R. T.Horn, J.-P. Bourgoin, T. Jennewein, N. Lutkenhaus, andV. Makarov, Opt. Express 26, 21020 (2018).

[13] W.-Y. Hwang, Phys. Rev. Lett. 91, 057901 (2003).[14] H.-K. Lo, X. Ma, and K. Chen, Phys. Rev. Lett. 94,

230504 (2005).[15] H.-K. Lo, M. Curty, and B. Qi, Phys. Rev. Lett. 108,

130503 (2012).[16] A. Acın, N. Brunner, N. Gisin, S. Massar, S. Pironio,

and V. Scarani, Phys. Rev. Lett. 98, 230501 (2007).[17] M. Lucamarini, Z. L. Yuan, J. F. Dynes, and A. J.

Shields, Nature 557, 400 (2018).

14

[18] T. Langer and G. Lenhart, New J. Phys. 11, 055051(2009).

[19] ETSI white paper no. 8, “Quantum safe cryptographyand security” (2015), http://www.etsi.org/images/

files/ETSIWhitePapers/QuantumSafeWhitepaper.pdf,visited 10 March 2020.

[20] ETSI white paper no. 27, “Implementation secu-rity of quantum cryptography” (2018), https:

//www.etsi.org/images/files/ETSIWhitePapers/

etsi_wp27_qkd_imp_sec_FINAL.pdf, visited 10 March2020.

[21] ISO/IEC 23837, first working draft, “Security require-ments, test and evaluation methods for quantum keydistribution” (2019), https://www.iso.org/standard/

77097.html, visited 24 September 2019.[22] International Telecommunications Union, Recom-

mendation under study X.sec-QKDN-ov, “SecurityRequirements for QKD Networks – Overview”(2019),https://www.itu.int/itu-t/workprog/wp_item.aspx?

isn=15001, visited 24 September 2019.[23] International Telecommunications Union, Recom-

mendation under study X.sec-QKDN-tn, “SecurityRequirements for QKD Networks – Trusted node”(2019), https://www.itu.int/itu-t/workprog/wp_

item.aspx?isn=15244, visited 24 September 2019.[24] M. Lucamarini, I. Choi, M. B. Ward, J. F. Dynes, Z. L.

Yuan, and A. J. Shields, Phys. Rev. X 5, 031030 (2015).[25] A. Vakhitov, V. Makarov, and D. R. Hjelme, J. Mod.

Opt. 48, 2023 (2001).[26] N. Gisin, S. Fasel, B. Kraus, H. Zbinden, and G. Ri-

bordy, Phys. Rev. A 73, 022320 (2006).[27] F. Xu, K. Wei, S. Sajeed, S. Kaiser, S. Sun, Z. Tang,

L. Qian, V. Makarov, and H.-K. Lo, Phys. Rev. A 92,032305 (2015).

[28] A. Huang, S.-H. Sun, Z. Liu, and V. Makarov, Phys.Rev. A 98, 012330 (2018).

[29] A. Huang, A. Navarrete, S.-H. Sun, P. Chaiwongkhot,M. Curty, and V. Makarov, Phys. Rev. Appl. 12, 064043(2019).

[30] A. Tomita, Adv. Quantum Technol. 2, 1900005 (2019).[31] A. R. Dixon, J. F. Dynes, M. Lucamarini, B. Frohlich,

A. W. Sharpe, A. Plews, W. Tam, Z. L. Yuan,Y. Tanizawa, H. Sato, S. Kawamura, M. Fujiwara,M. Sasaki, and A. J. Shields, Sci. Rep. 7, 1978 (2017).

[32] OSI model, Wikipedia, http://en.wikipedia.org/

wiki/OSI_model, visited 10 March 2020.[33] To give another example, let’s consider commercial QKD

system Clavis3 [91]. Its operation can be divided into ourproposed layer structure as follows. When a customer re-ceives the system, the first steps involve a manual instal-lation procedure that is done according to the instruc-tion from the manufacturer. For example, the user needsto connect Alice and Bob QKD stations with a fiber,setup two control PCs (running Linux OS) to install the‘Clavis3 Cockpit’ software, configure an Ethernet net-work with specific IP addresses to establish communica-tion between control PC and Alice-Bob QKD stations,and connect fibers in Bob QKD station in a specificway depending on whether internal or external single-photon detectors are used. During the course of opera-tion, manual interventions may be needed from time totime for maintenance: for instance, if the control soft-ware hangs, a manual restart is required. All these fall

under layer Q7. Next, the system should interact withsome external key management system or encryption en-gine. These tasks are handled in layer Q6. Next, layer Q5specifies the post-processing rules: for example, coherent-one-way (COW) QKD protocol with LDPC error correc-tion (with a code rate 2/3) and security parameter ofε = 4 × 10−9. Next layer Q4 decides which subroutineto initiate: for instance, whether to adjust synchroniza-tion between the Alice and Bob QKD stations, optimisemodulator voltages in order to maximize the interferencevisibility, or send qubits from Alice to Bob. The con-trol is then transferred to layer Q3, which executes thechosen subroutines with help from Q2 and Q1. For ex-ample, when Q3 initiates the raw key exchange subrou-tine, the field-programmable gate array (FPGA) chip inAlice—at layer Q2—outputs a stream of 1.25 Gbps digi-tal pulses with adjustable amplitude and width to drivean intensity modulator that prepares the quantum sig-nals. The latter are then sent over the fiber to Bob. An-other FPGA at Bob—a layer Q2 device—outputs anotherstream of 1.25 Gbps pulses to provide the gating signalsto the single-photon detectors and receives detection sig-nals from these detectors. Here, the intensity modulators,fiber, and detectors all belong to layer Q1 that—togetherwith components from layer Q2—executes a subroutineinitiated by layer Q3.

[34] C. H. Bennett, F. Bessette, L. Salvail, G. Brassard, andJ. Smolin, J. Cryptology 5, 3 (1992).

[35] A. Huang, R. Li, V. Egorov, S. Tchouragoulov, K. Ku-mar, and V. Makarov, Phys. Rev. Appl. 13, 034017(2020).

[36] A. Meda, I. P. Degiovanni, A. Tosi, Z. Yuan, G. Brida,and M. Genovese, Light Sci. Appl. 6, e16261 (2017).

[37] N. Jain, C. Wittmann, L. Lydersen, C. Wiechers,D. Elser, C. Marquardt, V. Makarov, and G. Leuchs,Phys. Rev. Lett. 107, 110501 (2011).

[38] M. Rau, T. Vogl, G. Corrielli, G. Vest, L. Fuchs,S. Nauerth, and H. Weinfurter, IEEE J. Quantum. Elec-tron. 21, 6600905 (2015).

[39] P. Chaiwongkhot, K. B. Kuntz, J.-P. Bourgoin,N. Lutkenhaus, V. Makarov, and T. Jennewein,“Generalized spatial-mode detection efficiency mis-match in a free-space QKD system with Zernikepolynomials,” QCrypt 2018 conference abstract(2018), http://www.vad1.com/publications/

chaiwongkhot2018.QCrypt2018-subm196.pdf.[40] J.-M. Merolla, Y. Mazurenko, J.-P. Goedgebuer,

H. Porte, and W. T. Rhodes, Opt. Lett. 24, 104 (1999).[41] J.-M. Merolla, Y. Mazurenko, J.-P. Goedgebuer, and

W. T. Rhodes, Phys. Rev. Lett. 82, 1656 (1999).[42] A. Muller, T. Herzog, B. Huttner, W. Tittel, H. Zbinden,

and N. Gisin, Appl. Phys. Lett. 70, 793 (1997).[43] A. V. Gleim, V. I. Egorov, Y. V. Nazarov, S. V. Smirnov,

V. V. Chistyakov, O. I. Bannik, A. A. Anisimov, S. M.Kynev, A. E. Ivanova, R. J. Collins, S. A. Kozlov, andG. S. Buller, Opt. Express 24, 2619 (2016).

[44] J. Mora, A. Ruiz-Alba, W. Amaya, A. Martınez,V. Garcıa-Munoz, D. Calvo, and J. Capmany, Opt. Lett.37, 2031 (2012).

[45] A. Ortigosa-Blanch and J. Capmany, Phys. Rev. A 73,024305 (2006).

[46] S. M. Kynev, V. V. Chistyakov, S. V. Smirnov, K. P.Volkova, V. I. Egorov, and A. V. Gleim, J. Phys. Conf.Ser. 917, 052003 (2017).

15

[47] A. V. Gleım, V. V. Chistyakov, O. I. Bannik, V. I.Egorov, N. V. Buldakov, A. B. Vasilev, A. A. Gaıdash,A. V. Kozubov, S. V. Smirnov, S. M. Kynev, S. E. Kho-ruzhnikov, S. A. Kozlov, and V. N. Vasil’ev, J. Opt.Technol. 86, 362 (2017).

[48] V. V. Chistyakov, A. V. Gleim, V. I. Egorov, and Y. V.Nazarov, J. Phys. Conf. Ser. 541, 012078 (2014).

[49] O. I. Bannik, V. V. Chistyakov, L. R. Gilyazov, K. S.Melnik, A. B. Vasiliev, N. M. Arslanov, A. A. Gaidash,A. V. Kozubov, V. I. Egorov, S. A. Kozlov, A. V.Gleim, and S. A. Moiseev, “Multinode subcarrier wavequantum communication network,” QCrypt 2017 confer-ence abstract Th413 (2017), http://2017.qcrypt.net/wp-content/uploads/2017/09/Th413.pdf.

[50] V. V. Chistyakov, O. L. Sadov, A. B. Vasiliev, V. I.Egorov, M. V. Kompaniets, P. V. Fedchenkov, O. I. Lazo,A. E. Shevel, N. V. Buldakov, A. V. Gleim, and S. E.Khoruzhnikov, arXiv:1709.09081 [quant-ph].

[51] G. P. Miroshnichenko, A. V. Kozubov, A. A. Gaidash,A. V. Gleim, and D. B. Horoshko, Opt. Express 26,11292 (2018).

[52] A. Kozubov, A. Gaidash, and G. Miroshnichenko,arXiv:1903.04371 [quant-ph].

[53] L. Lydersen, C. Wiechers, C. Wittmann, D. Elser,J. Skaar, and V. Makarov, Opt. Express 18, 27938(2010).

[54] V. Chistiakov, A. Huang, V. Egorov, and V. Makarov,Opt. Express 27, 32253 (2019).

[55] M. Tomamichel, C. C. W. Lim, N. Gisin, and R. Renner,Nat. Commun. 3, 634 (2012).

[56] A. Ivanova, S. Chivilikhin, G. Miroshnichenko, andA. Gleim, Nanosyst. Phys. Chem. Math. 8, 441 (2017).

[57] L. Lydersen, M. K. Akhlaghi, A. H. Majedi, J. Skaar,and V. Makarov, New J. Phys. 13, 113042 (2011).

[58] M. G. Tanner, V. Makarov, and R. H. Hadfield, Opt.Express 22, 6734 (2014).

[59] M. Elezov, R. Ozhegov, G. Goltsman, and V. Makarov,Opt. Express 27, 30979 (2019).

[60] A. N. Bugge, S. Sauge, A. M. M. Ghazali, J. Skaar, L. Ly-dersen, and V. Makarov, Phys. Rev. Lett. 112, 070503(2014).

[61] N. Jain, E. Anisimova, I. Khan, V. Makarov, C. Mar-quardt, and G. Leuchs, New J. Phys. 16, 123030 (2014).

[62] N. Jain, B. Stiller, I. Khan, V. Makarov, C. Marquardt,and G. Leuchs, IEEE J. Sel. Top. Quantum Electron. 21,6600710 (2015).

[63] A. Ponosova, D. Ruzhitskaya, P. Chaiwongkhot,V. Egorov, V. Makarov, and A. Huang, manuscriptin preparation.

[64] N. Lutkenhaus, New J. Phys. 4, 44 (2002).[65] M. Dusek, M. Jahma, and N. Lutkenhaus, Phys. Rev. A

62, 022306 (2000).[66] C. H. Bennett, Phys. Rev. Lett. 68, 3121 (1992).[67] B. Huttner, A. Muller, J. D. Gautier, H. Zbinden, and

N. Gisin, Phys. Rev. A 54, 3783 (1996).

[68] Y. Zhao, C.-H. F. Fung, B. Qi, C. Chen, and H.-K. Lo,Phys. Rev. A 78, 042333 (2008).

[69] R. Renner, Security of quantum key distribution, Ph.D.thesis, ETH Zurich (2005).

[70] M. Ben-Or, M. Horodecki, D. W. Leung, D. Mayers, andJ. Oppenheim, Lect. Notes Comp. Sci. 3378, 386 (2005).

[71] P. Chaiwongkhot, S. Sajeed, L. Lydersen, andV. Makarov, Quantum Sci. Technol. 2, 044003 (2017).

[72] R. Y. Q. Cai and V. Scarani, New J. Phys. 11, 045024

(2009).[73] R. Renner and R. Konig, Lect. Notes Comp. Sci. 3378,

407 (2005).[74] V. Scarani and R. Renner, Phys. Rev. Lett. 100, 200501

(2008).[75] Ken-ichiro Yoshino, M. Fujiwara, K. Nakata, T. Sumiya,

T. Sasaki, M. Takeoka, M. Sasaki, A. Tajima, M. Koashi,and A. Tomita, npj Quantum Inf. 4, 8 (2018).

[76] G. L. Roberts, M. Pittaluga, M. Minder, M. Lucamarini,J. F. Dynes, Z. L. Yuan, and A. J. Shields, Opt. Lett.43, 5110 (2018).

[77] A. Fedorov, I. Gerhardt, A. Huang, J. Jogen-fors, Y. Kurochkin, A. Lamas-Linares, J.-A. Larsson,G. Leuchs, L. Lydersen, V. Makarov, and J. Skaar, LaserPhys. Lett. 16, 019401 (2019).

[78] A. Gaidash, A. Kozubov, and G. Miroshnichenko, J.Opt. Soc. Am. B 36, B16 (2019).

[79] A. Gaidash, A. Kozubov, and G. Miroshnichenko, Phys.Scr. 94, 125102 (2019).

[80] V. Scarani, H. Bechmann-Pasquinucci, N. J. Cerf,M. Dusek, N. Lutkenhaus, and M. Peev, Rev. Mod.Phys. 81, 1301 (2009).

[81] S. Pirandola, U. L. Andersen, L. Banchi, M. Berta,D. Bunandar, R. Colbeck, D. Englund, T. Gehring,C. Lupo, C. Ottaviani, J. Pereira, M. Razavi, J. S. Shaari,M. Tomamichel, V. C. Usenko, G. Vallone, P. Villoresi,and P. Wallden, arXiv:1906.01645 [quant-ph].

[82] I. Devetak and A. Winter, Proc. R. Soc. A 461, 207(2005).

[83] M. Christandl, R. Konig, and R. Renner, Phys. Rev.Lett. 102, 020504 (2009).

[84] A. K. Ekert, B. Huttner, G. M. Palma, and A. Peres,Phys. Rev. A 50, 1047 (1994).

[85] D. A. Varshalovich, A. N. Moskalev, and V. K. Kher-sonskii, Quantum theory of angular momentum (WorldScientific, 1988).

[86] A. Peres and D. R. Terno, J. Phys. A 31, 7105 (1998).[87] A. Chefles, Phys. Lett. A 239, 339 (1998).[88] K. Tamaki and T. Tsurumaru, IEICE Trans. Fundam.

Electron. Comm. Comput. Sci. E93.A, 880 (2010).[89] M. Tomamichel, R. Colbeck, and R. Renner, IEEE

Trans. Inf. Theory 55, 5840 (2009).[90] M. Tomamichel, C. Schaffner, A. Smith, and R. Renner,

IEEE Trans. Inf. Theory 57, 5524 (2011).[91] Clavis3 QKD platform, https://www.idquantique.com/

quantum-sensing/products/clavis3-qkd-platform/,visited 10 March 2020.