Quantum key distribution (QKD) is a secure communication method that implements a cryptographic protocol based on the laws of quantum mechanics, specifically quantum entanglement, the measurement-disturbance principle, and the no-cloning theorem. The goal of QKD is to enable two parties to produce a shared random secret key known only to them, which then can be used to encrypt and decrypt messages. This means, when QKD is correctly implemented, one would need to violate fundamental physical principles to break a quantum protocol. The QKD process should not be confused with quantum cryptography in general.
An important and unique property of QKD is the ability of the two communicating users to detect the presence of any third party trying to gain knowledge of the key. This results from a fundamental aspect of quantum mechanics: the process of measuring a quantum system in general disturbs the system. This means, a third party attempting to eavesdrop on the key must in some way measure it, thus introducing detectable anomalies, thereby revealing the presence of the eavesdropper. This unique property ensures that the distributed keys remain secure, as any attempt at interception will be immediately apparent and will invalidate the exchanged key. By using quantum superpositions or quantum entanglement and transmitting information in quantum states, a communication system can be implemented that detects eavesdropping. If the level of eavesdropping is below a certain threshold, a key can be produced that is guaranteed to be secure (i.e., the eavesdropper has no information about it). Otherwise no secure key is possible, and communication is aborted.
The security of encryption that uses quantum key distribution relies on the foundations of quantum mechanics, in contrast to traditional public key cryptography, which relies on the computational difficulty of certain mathematical functions, which although conjectured to be strong has not to date been formally proved. In contrast, QKD has provable security based on information theory, and forward secrecy.
The main drawback of quantum-key distribution is that it usually relies on having an authenticated classical channel of communication. In modern cryptography, having an authenticated classical channel means that one already has exchanged either a symmetric key of sufficient length or public keys of sufficient security level. With such information already available, in practice one can achieve authenticated and sufficiently secure communication without using QKD, such as by using the Galois/Counter Mode of the Advanced Encryption Standard. Thus QKD does the work of a stream cipher at many times the cost.
Quantum key distribution is used to produce and distribute only a key, not to transmit any message data. This key can then be used with any chosen encryption algorithm to encrypt (and decrypt) a message, which can then be transmitted over a standard communication channel. The algorithm most commonly associated with QKD is the one-time pad, as it is provably secure when used with a secret, random key. In real-world situations, it is often also used with encryption using symmetric key algorithms like the Advanced Encryption Standard algorithm.
Contents
Quantum key exchange
Quantum communication involves encoding information in quantum states, or qubits, as opposed to classical communication's use of bits. Usually, photons are used for these quantum states. Quantum key distribution exploits certain properties of these quantum states to ensure its security. There are several different approaches to quantum key distribution, but they can be divided into two main categories depending on which property they exploit.
Prepare-and-measure protocols
A prepare-and-measure protocol is a fundamental technique used to establish a secure cryptographic key between two parties, commonly referred to as Alice and Bob. The parties exploit two communication channels: an insecure quantum channel and an authenticated classical channel. The quantum channel transmits signal states, which an eavesdropper usually has complete control over. As such, Alice prepares quantum states according to her basis and sends them through a quantum channel to Bob, who measures them to retrieve information from the transmitted state which they use to create a shared secret key. Later, Alice and Bob reveal a small sample of their data, and verify that Bob's measurement outcomes are indeed compatible or correlated with those prepared by Alice. If the measurements are compatible, it means the quantum states were undisturbed. However, if the measurements are not compatible, this suggests the presence of an eavesdropper and, depending on the level of error, the parties may abort the protocol. It is important to emphasize that the classical channel is authenticated. This allows Alice and Bob to be sure that they are talking only to each other and are not being impersonated. As such the eavesdropper can only listen to the communication but cannot modify the messages being sent between Alice and Bob. Examples of prepare-and-measure protocols include the BB84, B92 and SARG04 protocols.
Entanglement-based protocols
Entanglement-based schemes leverage the properties of quantum entangled quantum states to securely share cryptographic keys between two parties, Alice and Bob. In an entanglement-based scheme, Alice and Bob share pairs of entangled photons. This means the state of one photon is inherently linked to the state of the other, no matter the distance between them. This is known as entanglement and means that, for example, performing a measurement on one object affects the other. If an entangled pair of objects is shared between two parties, anyone intercepting either object alters the overall system, revealing the presence of the third party (and the amount of information they have gained). This property is important to ensuring security. In this scheme, a source prepares and distributes a maximally entangled quantum state where one system is sent to Alice and another to Bob. Alice measures her half of the entangled pair, randomly choosing between different measurement bases. Bob then measures his half using the same or different bases. On measurement, Alice and Bob obtain perfectly correlated outcomes which are completelly random. The results of their measurements, when compared, can be used to establish a shared secret key. Examples of entanglement-based protocols include the E91, BBM92 protocols. The quantum states of two (or more) separate objects can become linked together in such a way that they must be described by a combined quantum state, not as individual objects.
BB84 protocol: Charles H. Bennett and Gilles Brassard (1984)
This protocol, known as BB84 after its inventors and year of publication, was originally described using photon polarization states to transmit the information. However, any two pairs of conjugate states can be used for the protocol, and many optical-fibre-based implementations described as BB84 use phase encoded states. The sender (traditionally referred to as Alice) and the receiver (Bob) are connected by a quantum communication channel which allows quantum states to be transmitted. In the case of photons this channel is generally either an optical fibre or simply free space. In addition they communicate via a public classical channel, for example using broadcast radio or the internet. The protocol is designed with the assumption that an eavesdropper (referred to as Eve) can interfere in any way with the quantum channel, while the classical channel needs to be authenticated.
The security of the protocol comes from encoding the information in non-orthogonal states. Quantum indeterminacy means that these states cannot in general be measured without disturbing the original state (see No-cloning theorem). BB84 uses two pairs of states, with each pair conjugate to the other pair, and the two states within a pair orthogonal to each other. Pairs of orthogonal states are referred to as a basis. The usual polarization state pairs used are either the rectilinear basis of vertical (0°) and horizontal (90°), the diagonal basis of 45° and 135° or the circular basis of left- and right-handedness. Any two of these bases are conjugate to each other, and so any two can be used in the protocol. Below the rectilinear and diagonal bases are used.
The first step in BB84 is quantum transmission. Alice creates a random bit (0 or 1) and then randomly selects one of her two bases (rectilinear or diagonal in this case) to transmit it in. She then prepares a photon polarization state depending both on the bit value and basis, as shown in the adjacent table. So for example a 0 is encoded in the rectilinear basis (+) as a vertical polarization state, and a 1 is encoded in the diagonal basis (x) as a 135° state. Alice then transmits a single photon in the state specified to Bob, using the quantum channel. This process is then repeated from the random bit stage, with Alice recording the state, basis and time of each photon sent.
According to quantum mechanics (particularly quantum indeterminacy), no possible measurement distinguishes between the 4 different polarization states, as they are not all orthogonal. The only possible measurement is between any two orthogonal states (an orthonormal basis). So, for example, measuring in the rectilinear basis gives a result of horizontal or vertical. If the photon was created as horizontal or vertical (as a rectilinear eigenstate) then this measures the correct state, but if it was created as 45° or 135° (diagonal eigenstates) then the rectilinear measurement instead returns either horizontal or vertical at random. Furthermore, after this measurement the photon is polarized in the state it was measured in (horizontal or vertical), with all information about its initial polarization lost.
E91 protocol: Artur Ekert (1991)
Artur Ekert's scheme uses entangled pairs of photons. These can be created by Alice, by Bob, or by some source separate from both of them, including eavesdropper Eve. The photons are distributed so that Alice and Bob each end up with one photon from each pair.
The scheme relies on two properties of entanglement. First, the entangled states are perfectly correlated in the sense that if Alice and Bob both measure whether their particles have vertical or horizontal polarizations, they always get opposite answers with 100% probability. The same is true if they both measure any other pair of complementary (orthogonal) polarizations. This necessitates that the two distant parties have exact directionality synchronization. However, the particular results are completely random; it is impossible for Alice to predict if she (and thus Bob) will get vertical polarization or horizontal polarization. Second, any attempt at eavesdropping by Eve destroys these correlations in a way that Alice and Bob can detect.
Similarly to BB84, the protocol involves a private measurement protocol before detecting the presence of Eve. The measurement stage involves Alice measuring each photon she receives using some basis from the set
Z
0
,
Z
π
8
,
Z
π
4
{\displaystyle Z_{0},Z_{\frac {\pi }{8}},Z_{\frac {\pi }{4}}}
while Bob chooses from
Z
0
,
Device-Independent quantum key distribution
One of the most significant vulnerabilities in a cryptosystem, whether quantum or classical, arises from a discrepancy between its theoretical design and its actual implementation. If a cryptosystem is implemented correctly and the hardware performs as expected, everything functions smoothly. However, real systems are imprecise. In traditional QKD, the quantum devices used must be perfectly calibrated, trustworthy, and working exactly as they are expected to. Deviations from expected measurements can be extremely hard to detect, which leaves the entire system vulnerable. A new protocol called device independent QKD (DIQKD) or measurement device independent QKD (MDIQKD) allows for the use of uncharacterized or untrusted devices, and for deviations from expected measurements to be included in the overall system. These deviations will cause the protocol to abort when detected, rather than resulting in incorrect data. Specifically, the security of a protocol is not dependent on a correct model or implementation. Due to its robust security guarantees, DI protocols like DI-QKD are considered the gold standard in cryptography, as no attacks can exploit discrepancies between theoretical models and the implementation of quantum hardware.
The most significant aspect of DI-QKD protocols lies in their capacity to verify the unpredictability of outcomes generated by various devices, such as those employed for cryptographic key generation, quantum computations, or the characterization of quantum properties including entanglement. Thus, DI-QKD protocols extend their utility beyond the realm of cryptography, serving as a formidable technique for hardware characterization. This is particularly pertinent in the evaluation of components and functionalities in quantum communication systems, especially with regard to fidelity metrics. Despite notable advancements in the field, DI-QKD protocols continue to depend on a limited set of minimal assumptions. These include the capability for clock synchronization and the expectation that classical hardware will perform as specified. Currently, while the potential for DI-QKD is substantial, challenges remain related to the reliable distribution of entanglement and the necessity for enhanced performance across systems. Therefore, considerable research effort is still required to advance DI-QKD schemes to their full potential.
DIQKD was first proposed by Mayers and Yao, building off of the BB84 protocol. They presented that in DIQKD, the quantum device, which they refer to as the photon source, be manufactured to come with tests that can be run by Alice and Bob to "self-check" if their device is working properly. Such a test would only need to consider the classical inputs and outputs in order to determine how much information is at risk of being intercepted by Eve. A self checking, or "ideal" source would not have to be characterized, and would therefore not be susceptible to implementation flaws.
Twin-Field quantum key distribution
The Twin-Field quantum key distribution (TF-QKD) was introduced in 2018, and is a version of DIQKD designed to improve the security and overcome the fundamental rate-distance limit of traditional QKD protocols. The rate-distance limit, also known as the rate-loss trade off, describes how as distance increases between Alice and Bob, the rate of key generation decreases exponentially. In traditional QKD protocols, this decay has been eliminated via the addition of physically secured relay nodes, which can be placed along the quantum link with the intention of dividing it up into several low-loss sections. Researchers have also recommended the use of quantum repeaters, which when added to the relay nodes make it so that they no longer need to be physically secured. Quantum repeaters, however, are difficult to create and have yet to be implemented on a useful scale. The TF-QKD aims to bypass the rate-distance limit without the use of quantum repeaters or relay nodes, creating manageable levels of noise and a process that can be repeated much more easily with today's existing technology. Most significantly, the TF-QKD protocol effectively uses phase-locked signals from distant quantum light sources. This allows for the measurement of key bits without requiring a direct quantum channel between the two parties.
The original protocol for TF-QKD is as follows: Alice and Bob each have a light source and one arm on an interferometer in their laboratories. The light sources create two dim optical pulses with a randomly phase pa or pb in the interval [0, 2π) and an encoding phase γa or γb. The pulses are sent along a quantum to Charlie, a third party who can be malicious or not. Charlie uses a beam splitter to overlap the two pulses and perform a measurement. He has two detectors in his own lab, one of which will light up if the bits are equal (00) or (11), and the other when they are different (10, 01). Charlie will announce to Alice and Bob which of the detectors lit up, at which point they publicly reveal the phases p and γ. This is different from traditional QKD, in which the phases used are never revealed.
Information reconciliation and privacy amplification
The quantum key distribution protocols described above provide Alice and Bob with nearly identical shared keys, and also with an estimate of the discrepancy between the keys. These differences can be caused by eavesdropping, but also by imperfections in the transmission line and detectors. As it is impossible to distinguish between these two types of errors, guaranteed security requires the assumption that all errors are due to eavesdropping. Provided the error rate between the keys is lower than a certain threshold (27.6% as of 2002), two steps can be performed to first remove the erroneous bits and then reduce Eve's knowledge of the key to an arbitrary small value. These two steps are known as information reconciliation and privacy amplification respectively, and were first described in 1988.
Information reconciliation is a form of error correction carried out between Alice and Bob's keys, in order to ensure both keys are identical. It is conducted over the public channel and as such it is vital to minimise the information sent about each key, as this can be read by Eve. A common protocol used for information reconciliation is the cascade protocol, proposed in 1994. This operates in several rounds, with both keys divided into blocks in each round and the parity of those blocks compared. If a difference in parity is found then a binary search is performed to find and correct the error. If an error is found in a block from a previous round that had correct parity then another error must be contained in that block; this error is found and corrected as before. This process is repeated recursively, which is the source of the cascade name. After all blocks have been compared, Alice and Bob both reorder their keys in the same random way, and a new round begins. At the end of multiple rounds Alice and Bob have identical keys with high probability; however, Eve has additional information about the key from the parity information exchanged. However, from a coding theory point of view information reconciliation is essentially source coding with side information. In consequence any coding scheme that works for this problem can be used for information reconciliation. Lately turbocodes, LDPC codes and polar codes have been used for this purpose improving the efficiency of the cascade protocol.
Privacy amplification is a method for reducing (and effectively eliminating) Eve's partial information about Alice and Bob's key. This partial information could have been gained both by eavesdropping on the quantum channel during key transmission (thus introducing detectable errors), and on the public channel during information reconciliation (where it is assumed Eve gains all possible parity information). Privacy amplification uses Alice and Bob's key to produce a new, shorter key, in such a way that Eve has only negligible information about the new key. This is performed using a randomness extractor, for example, by applying a universal hash function, chosen at random from a publicly known set of such functions, which takes as its input a binary string of length equal to the key and outputs a binary string of a chosen shorter length. The amount by which this new key is shortened is calculated, based on how much information Eve could have gained about the old key (which is known due to the errors this would introduce), in order to reduce the probability of Eve having any knowledge of the new key to a very low value.
Implementations
Experimental
In 1991, John Rarity, Paul Tapster and Artur Ekert, researchers from the UK Defence Research Agency in Malvern and Oxford University, demonstrated quantum key distribution protected by the violation of the Bell inequalities.
In 2008, exchange of secure keys at 1 Mbit/s (over 20 km of optical fibre) and 10 kbit/s (over 100 km of fibre), was achieved by a collaboration between the University of Cambridge and Toshiba using the BB84 protocol with decoy state pulses.
In 2007, Los Alamos National Laboratory/NIST achieved quantum key distribution over a 148.7 km of optic fibre using the BB84 protocol. Significantly, this distance is long enough for almost all the spans found in today's fibre networks. A European collaboration achieved free space QKD over 144 km between two of the Canary Islands using entangled photons (the Ekert scheme) in 2006, and using BB84 enhanced with decoy states in 2007.
As of August 2015 the longest distance for optical fiber (307 km) was achieved by University of Geneva and Corning Inc. In the same experiment, a secret key rate of 12.7 kbit/s was generated, making it the highest bit rate system over distances of 100 km. In 2016 a team from Corning and various institutions in China achieved a distance of 404 km, but at a bit rate too slow to be practical.
In June 2017, physicists led by Thomas Jennewein at the Institute for Quantum Computing and the University of Waterloo in Waterloo, Canada achieved the first demonstration of quantum key distribution from a ground transmitter to a moving aircraft. They reported optical links with distances between 3–10 km and generated secure keys up to 868 kilobytes in length.
Also in June 2017, as part of the Quantum Experiments at Space Scale project, Chinese physicists led by Pan Jianwei at the University of Science and Technology of China measured entangled photons over a distance of 1203 km between two ground stations, laying the groundwork for future intercontinental quantum key distribution experiments. Photons were sent from one ground station to the satellite they had named Micius and back down to another ground station, where they "observed a survival of two-photon entanglement and a violation of Bell inequality by 2.37 ± 0.09 under strict Einstein locality conditions" along a "summed length varying from 1600 to 2400 kilometers." Later that year BB84 was successfully implemented over satellite links from Micius to ground stations in China and Austria. The keys were combined and the result was used to transmit images and video between Beijing, China, and Vienna, Austria.
Commercial
Many companies around the world offer commercial quantum key distribution, for example: ID Quantique (Geneva), Toshiba, MagiQ Technologies, Inc. (New York), QNu Labs (Bengaluru, India), QuintessenceLabs (Australia), QRate (Russia), Merqury (Malta), SeQureNet (Paris), Quantum Optics Jena (Germany) and KEEQuant (Germany). Several other companies also have active research programs, including KETS Quantum Security (UK), HP, IBM, Mitsubishi, NEC and NTT (See External links for direct research links).
In 2004, the world's first bank transfer using quantum key distribution was carried out in Vienna, Austria. Quantum encryption technology provided by the Swiss company Id Quantique was used in the Swiss canton (state) of Geneva to transmit ballot results to the capital in the national election occurring on 21 October 2007. In 2013, Battelle Memorial Institute installed a QKD system built by ID Quantique between their main campus in Columbus, Ohio and their manufacturing facility in nearby Dublin. Field tests of Tokyo QKD network have been underway for some time.
Quantum key distribution networks
The DARPA Quantum Network, was a 10-node quantum key distribution network, which ran continuously for four years, 24 hours a day, from 2004 to 2007 in Massachusetts in the United States. It was developed by BBN Technologies, Harvard University, Boston University, with collaboration from IBM Research, the National Institute of Standards and Technology, and QinetiQ. It supported a standards-based Internet computer network protected by quantum key distribution.
The first computer network protected by quantum key distribution was implemented in October 2008, at a scientific conference in Vienna. The name of this network is SECOQC (Secure Communication Based on Quantum Cryptography) and the EU funded this project. The network used 200 km of standard fibre-optic cable to interconnect six locations across Vienna and the town of St Poelten located 69 km to the west.
Id Quantique has successfully completed the longest running project for testing Quantum Key Distribution (QKD) in a field environment. The main goal of the SwissQuantum network project installed in the Geneva metropolitan area in March 2009, was to validate the reliability and robustness of QKD in continuous operation over a long time period in a field environment. The quantum layer operated for nearly 2 years until the project was shut down in January 2011 shortly after the initially planned duration of the test.
In May 2009, a hierarchical quantum network was demonstrated in Wuhu, China. The hierarchical network consisted of a backbone network of four nodes connecting a number of subnets. The backbone nodes were connected through an optical switching quantum router. Nodes within each subnet were also connected through an optical switch, which were connected to the backbone network through a trusted relay.
Launched in August 2016, the QUESS space mission created an international QKD channel between China and the Institute for Quantum Optics and Quantum Information in Vienna, Austria − a ground distance of 7,500 km (4,700 mi), enabling the first intercontinental secure quantum video call. By October 2017, a 2,000-km fiber line was operational between Beijing, Jinan, Hefei and Shanghai. Together they constitute the world's first space-ground quantum network. Up to 10 Micius/QUESS satellites are expected, allowing a European–Asian quantum-encrypted network by 2020, and a global network by 2030.
Attacks and security proofs
Intercept and resend
The simplest type of possible attack is the intercept-resend attack, where Eve measures the quantum states (photons) sent by Alice and then sends replacement states to Bob, prepared in the state she measures. In the BB84 protocol, this produces errors in the key Alice and Bob share. As Eve has no knowledge of the basis a state sent by Alice is encoded in, she can only guess which basis to measure in, in the same way as Bob. If she chooses correctly, she measures the correct photon polarization state as sent by Alice, and resends the correct state to Bob. However, if she chooses incorrectly, the state she measures is random, and the state sent to Bob cannot be the same as the state sent by Alice. If Bob then measures this state in the same basis Alice sent, he too gets a random result—as Eve has sent him a state in the opposite basis—with a 50% chance of an erroneous result (instead of the correct result he would get without the presence of Eve). The table below shows an example of this type of attack.
The probability Eve chooses the incorrect basis is 50% (assuming Alice chooses randomly), and if Bob measures this intercepted photon in the basis Alice sent he gets a random result, i.e., an incorrect result with probability of 50%. The probability an intercepted photon generates an error in the key string is then 50% × 50% = 25%. If Alice and Bob publicly compare
n
{\displaystyle n}
of their key bits (thus discarding them as key bits, as they are no longer secret) the probability they find disagreement and identify the presence of Eve is
So to detect an eavesdropper with probability
P
d
=
0.999999999
{\displaystyle P_{d}=0.999999999}
Alice and Bob need to compare
n
Man-in-the-middle attack
Quantum key distribution is vulnerable to a man-in-the-middle attack when used without authentication to the same extent as any classical protocol, since no known principle of quantum mechanics can distinguish friend from foe. As in the classical case, Alice and Bob cannot authenticate each other and establish a secure connection without some means of verifying each other's identities (such as an initial shared secret). If Alice and Bob have an initial shared secret then they can use an unconditionally secure authentication scheme (such as Carter-Wegman,) along with quantum key distribution to exponentially expand this key, using a small amount of the new key to authenticate the next session. Several methods to create this initial shared secret have been proposed, for example using a 3rd party, chaos theory, post-quantum protocols, and physical unclonable functions.
Photon number splitting attack
In the BB84 protocol Alice sends quantum states to Bob using single photons. In practice many implementations use laser pulses attenuated to a very low level to send the quantum states. These laser pulses contain a very small number of photons, for example 0.2 photons per pulse, which are distributed according to a Poisson distribution. This means most pulses actually contain no photons (no pulse is sent), some pulses contain 1 photon (which is desired) and a few pulses contain 2 or more photons. If the pulse contains more than one photon, then Eve can split off the extra photons and transmit the remaining single photon to Bob. This is the basis of the photon number splitting attack, where Eve stores these extra photons in a quantum memory until Bob detects the remaining single photon and Alice reveals the encoding basis. Eve can then measure her photons in the correct basis and obtain information on the key without introducing detectable errors.
Even with the possibility of a PNS attack a secure key can still be generated, as shown in the GLLP security proof; however, a much higher amount of privacy amplification is needed reducing the secure key rate significantly (with PNS the rate scales as
t
2
{\displaystyle t^{2}}
as compared to
t
{\displaystyle t}
for a single photon sources, where
t
{\displaystyle t}
is the transmittance of the quantum channel).
There are several solutions to this problem. The most obvious is to use a true single photon
source instead of an attenuated laser. While such sources are still at a developmental stage QKD has been carried out successfully with them. However, as current sources operate at a low efficiency and frequency key rates and transmission distances are limited. Another solution is to modify the BB84 protocol, as is done for example in the SARG04 protocol, in which the secure key rate scales as
Denial of service
Because currently a dedicated fibre optic line (or line of sight in free space) is required between the two points linked by quantum key distribution, a denial of service attack can be mounted by simply cutting or blocking the line. This is one of the motivations for the development of quantum key distribution networks, which would route communication via alternate links in case of disruption.
Trojan-horse attacks
A quantum key distribution system may be probed by Eve by sending bright light into the quantum channel and analyzing the back-reflections in a Trojan-horse attack. In a recent research study it has been shown that Eve discerns Bob's secret basis choice with higher than 90% probability, breaching the security of the system.
Security proofs
If Eve is assumed to have unlimited resources, for example both classical and quantum computing power, there are many more attacks possible. BB84 has been proven secure against any attacks allowed by quantum mechanics, both for sending information using an ideal photon source which only ever emits a single photon at a time, and also using practical photon sources which sometimes emit multiphoton pulses. These proofs are unconditionally secure in the sense that no conditions are imposed on the resources available to the eavesdropper; however, there are other conditions required:
Eve cannot physically access Alice and Bob's encoding and decoding devices.
The random number generators used by Alice and Bob must be trusted and truly random (for example a Quantum random number generator).
The classical communication channel must be authenticated using an unconditionally secure authentication scheme.
The message must be encrypted using one-time pad like scheme
Quantum hacking
Hacking attacks target vulnerabilities in the operation of a QKD protocol or deficiencies in the components of the physical devices used in construction of the QKD system. If the equipment used in quantum key distribution can be tampered with, it could be made to generate keys that were not secure using a random number generator attack. Another common class of attacks is the Trojan horse attack which does not require physical access to the endpoints: rather than attempt to read Alice and Bob's single photons, Eve sends a large pulse of light back to Alice in between transmitted photons. Alice's equipment reflects some of Eve's light, revealing the state of Alice's basis (e.g., a polarizer). This attack can be detected, e.g. by using a classical detector to check the non-legitimate signals (i.e. light from Eve) entering Alice's system. It is also conjectured that most hacking attacks can similarly be defeated by modifying the implementation, though there is no formal proof.
Several other attacks including faked-state attacks, phase remapping attacks, and time-shift attacks are now known. The time-shift attack has even been demonstrated on a commercial quantum cryptosystem. This is the first demonstration of quantum hacking against a non-homemade quantum key distribution system. Later on, the phase-remapping attack was also demonstrated on a specially configured, research oriented open QKD system (made and provided by the Swiss company Id Quantique under their Quantum Hacking program). It is one of the first 'intercept-and-resend' attacks on top of a widely used QKD implementation in commercial QKD systems. This work has been widely reported in media.
The first attack that claimed to be able to eavesdrop the whole key without leaving any trace was demonstrated in 2010. It was experimentally shown that the single-photon detectors in two commercial devices could be fully remote-controlled using specially tailored bright illumination. In a spree of publications thereafter, the collaboration between the Norwegian University of Science and Technology in Norway and Max Planck Institute for the Science of Light in Germany, has now demonstrated several methods to successfully eavesdrop on commercial QKD systems based on weaknesses of avalanche photodiodes (APDs) operating in gated mode. This has sparked research on new approaches to securing communications networks.
Counterfactual quantum key distribution
The task of distributing a secret key could be achieved even when the particle (on which the secret information, e.g. polarization, has been encoded) does not traverse through the quantum channel using a protocol developed by Tae-Gon Noh. Here Alice generates a photon which, by not taking a measurement until later, exists in a superposition of being in paths (a) and (b) simultaneously. Path (a) stays inside Alice's secure device and path (b) goes to Bob. By rejecting the photons that Bob receives and only accepting the ones he doesn't receive, Bob & Alice can set up a secure channel, i.e. Eve's attempts to read the counterfactual photons would still be detected. This protocol uses the quantum phenomenon whereby the possibility that a photon can be sent has an effect even when it is not sent. So-called interaction-free measurement also uses this quantum effect, as for example in the bomb testing problem, whereby an experimenter can conceptually determine which bombs are not duds without setting them off, except in a counterfactual sense.
History
Quantum cryptography was proposed first by Stephen Wiesner, then at Columbia University in New York, who, in the early 1970s, introduced the concept of quantum conjugate coding. His seminal paper titled "Conjugate Coding" was rejected by IEEE Information Theory but was eventually published in 1983 in SIGACT News (15:1 pp. 78–88, 1983). In this paper he showed how to store or transmit two messages by encoding them in two "conjugate observables", such as linear and circular polarization of light, so that either, but not both, of which may be received and decoded. He illustrated his idea with a design of unforgeable bank notes. A decade later, building upon this work, Charles H. Bennett, of the IBM Thomas J. Watson Research Center, and Gilles Brassard, of the University of Montreal, proposed a method for secure communication based on Wiesner's "conjugate observables". In 1990, Artur Ekert, then a PhD student at Wolfson College, University of Oxford, developed a different approach to quantum key distribution based on quantum entanglement.
Challenges
Despite the achievements in QKD, several challenges need to be addressed to fully realize its benefits. The primary challenge lies in the inevitable imperfections that occur during the preparation, transmission, and measurement of quantum states. These imperfections make it difficult, if not impossible, to distinguish between the actions of legitimate parties and those of eavesdroppers. This is one reason why errors must be attributed to eavesdropping, necessitating very high system performance for QKD protocols. These challenges impact various aspects of QKD schemes, particularly the secret key rate, transmission distance, cost, and practical security. While alternative QKD implementations, such as decoy-state or device-independent QKD, have been proposed to tackle these issues, large-scale deployment remains difficult due to channel loss and decoherence, which result in a relatively low secret key rate. As a result of these challenges associated with implementing QKD protocols, governments have advised against their use for commercial and military applications. Therefore, to achieve full-scale practical QKD for secure everyday communications, it is crucial to develop efficient methods and models that address these challenges.
Future
The current commercial systems are aimed mainly at governments and corporations with high security requirements. Key distribution by courier is typically used in such cases, where traditional key distribution schemes are not believed to offer enough guarantee. This has the advantage of not being intrinsically distance limited, and despite long travel times the transfer rate can be high due to the availability of large capacity portable storage devices. The major difference of quantum key distribution is the ability to detect any interception of the key, whereas with courier the key security cannot be proven or tested. QKD (quantum key distribution) systems also have the advantage of being automatic, with greater reliability and lower operating costs than a secure human courier network.
Kak's three-stage protocol has been proposed as a method for secure communication that is entirely quantum unlike quantum key distribution in which the cryptographic transformation uses classical algorithms.
Factors preventing wide adoption of quantum key distribution outside high security areas include the cost of equipment, and the lack of a demonstrated threat to existing key exchange protocols. However, with optic fibre networks already present in many countries the infrastructure is in place for a more widespread use.
An Industry Specification Group (ISG) of the European Telecommunications Standards Institute (ETSI) has been set up to address standardisation issues in quantum cryptography.
European Metrology Institutes, in the context of dedicated projects, are developing measurements required to characterise components of QKD systems.
Toshiba Europe has been awarded a prestigious Institute of Physics Award for Business Innovation. This recognises Toshiba's pioneering QKD technology developed over two decades of research, protecting communication infrastructure from present and future cyber-threats, and commercialising UK-manufactured products which pave the road to the quantum internet.
Toshiba also took the Semi Grand Prix award in the Solutions Category for the QKD has won the Minister of Economy, Trade and Industry Award in CEATEC AWARD 2021, the prestigious awards presented at CEATEC, Japan's premier electronics industry trade show.
Deprecation of quantum key distributions from governmental institutions
Given the practical challenges raised below, several organizations recommend using "post-quantum cryptography (or quantum-resistant cryptography)" instead of quantum key distribution.
USA National Security Agency,
European Union Agency for Cybersecurity of EU (ENISA),
United Kingdom's National Cyber Security Centre,
French Secretariat for Defense and Security (ANSSI),
German Federal Office for Information Security (BSI)
Australia ASD
Netherland National Communications Security Agency (NLNCSA)
and Swedish National Communications Security Authority, Swedish Armed Forces
For example, the US National Security Agency addresses five issues:
Quantum key distribution is only a partial solution. QKD generates keying material for an encryption algorithm that provides confidentiality. Such keying material could also be used in symmetric key cryptographic algorithms to provide integrity and authentication if one has the cryptographic assurance that the original QKD transmission comes from the desired entity (i.e. entity source authentication). QKD does not provide a means to authenticate the QKD transmission source. Therefore, source authentication requires the use of asymmetric cryptography or pre-placed keys to provide that authentication. Moreover, the confidentiality services QKD offers can be provided by quantum-resistant cryptography, which is typically less expensive with a better understood risk profile.
Quantum key distribution requires special purpose equipment. QKD is based on physical properties, and its security derives from unique physical layer communications. This requires users to lease dedicated fiber connections or physically manage free-space transmitters. It cannot be implemented in software or as a service on a network, and cannot be easily integrated into existing network equipment. Since QKD is hardware-based it also lacks flexibility for upgrades or security patches.
Related physical layer technologies
While Quantum Key Distribution (QKD) focuses on securing the generation of keys, other Physical layer security (PLS) technologies focus on shielding the high-speed transmission payload itself—including any keys contained within it. Emerging approaches, such as optical chaos or optical steganography, utilize spectral phase encoding to disperse the data signal, burying it within the optical noise floor.
By rendering the raw optical waveform indistinguishable from background static, these methods prevent the physical recording of the ciphertext. This effectively makes the data "unharvestable" by attackers, as no valid signal can be digitized or stored for future decryption. Recent field trials have demonstrated this capability at 100 Gbit/s over 200 km of populated DWDM infrastructure, establishing that physical security can be maintained over standard long-haul networks without the dark fiber requirements often associated with quantum key distribution.