A generalized efficiency mismatch attack to bypass detection-scrambling countermeasure
AA generalized efficiency mismatch attack to bypass detection-scramblingcountermeasure
M A Ruhul Fatin
1, 2, ∗ and Shihan Sajeed
3, 4, 5, † Department of Electrical and Electronic Engineering,Bangladesh University of Engg and Tech., Dhaka, Bangladesh Department of Electronics, Carleton University, Ottawa, ON, K1S 5B6, Canada Institute for Quantum Computing, University of Waterloo, Waterloo, ON, N2L 3G1 Canada Department of Physics and Astronomy, University of Waterloo, Waterloo, ON, N2L 3G1 Canada Department of Electrical and Computer Engineering, University of Toronto, M5S 3G4, Canada (Dated: 7 January, 2021)The ability of an eavesdropper to compromise the security of a quantum communication systemby changing the angle of the incoming light is well-known. Randomizing the role of the detectorshas been proposed to be an efficient countermeasure to this type of attack. Here we show that theproposed countermeasure can be bypassed if the attack is generalized by including more attack vari-ables. Using the experimental data from existing literature, we show how randomization effectivelyprevents the initial attack but fails to do so when Eve generalizes her attack strategy. Our resultand methodology could be used to security-certify a free-space quantum communication receiveragainst all types of detector-efficiency-mismatch type attacks.
I. INTRODUCTION
Recent trends in quantum technologies suggest a fu-ture of quantum computers (QC) having superior com-putational power [1, 2]. Such computational power canefficiently solve hard mathematical problems that are thefoundations of security for certain public-key cryptosys-tems. QCs thus pose a serious threat to our current cryp-tographic infrastructure. One possible solution can bepost-quantum cryptography [3–5] – classical algorithmsthought to be secure against quantum attacks – but thereis no mathematical proof that these algorithms provideinformation theoretic security. Thus, in an effort to fightquantum with quantum the trend is towards quantumcryptography [6–8] – more popularly known as quantumkey distribution (QKD).QKD [7, 8] uses the laws of quantum mechanics togenerate a secret key between two distant parties Al-ice and Bob. This key then can be used for encryp-tion using one-time-pad and guarantee secure commu-nication. In theory, QKD provides mathematical proofof security by modeling the device behaviors and us-ing the laws of quantum mechanics. However, in prac-tice, devices often behave differently than the assumedmodel, leaving a gap between theory and practice thatcan be exploited by an eavesdropper. This gap can beanywhere in the system implementation such as mea-surement devices [9, 10], monitoring systems [11], as-sumption in the security proofs [12], leakage of informa-tion [13–15], change of characteristics [16, 17], imperfectsources [18, 19], imperfect detector characteristics [20–23] etc. It is essential for QKD security to explore andidentify these gaps and characterize them in order to as- ∗ [email protected] † [email protected] sess the threat. In this work we analyze one such gap –detector-efficiency mismatch [20, 21, 23, 24]– and analyzeits effects.A fundamental assumption in QKD security proofs isthat the measurement outcomes should be independentof the measurement bases and Eve should not have anycontrol over them. In ideal QKD, it is impossible forEve to control the measurement outcomes without in-troducing errors called quantum bit error rate (QBER).However, in practice, there might be implementation vul-nerabilities that allow Eve to have this control. For ex-ample, if there is a sensitivity mismatch among the de-tectors for a certain degree of freedom of the incomingphotons, Eve can modify that degree of freedom so thatone detector becomes more sensitive compared to an-other [21, 22, 24, 25]. This can happen in the time degreeof freedom: implementation vulnerability may make onedetector more sensitive in a particular time window thanthe others. In this case, Eve can shift the arrival time ofcertain pulses to coincide with that window. Thus, de-tection events occurring in that particular time-windowhave a higher chance of occurring in the sensitive de-tector and a bias is achieved. Similarly, if the detec-tor sensitivity varies with spatial-mode of the incominglight [20], Eve can send light at certain angle ( φ , θ ) tocreate a bias among the detector sensitivity and achievesa control. The demonstration of exploiting such spatial-mode-sensitivity-mismatch was shown in [21, 22].A countermeasure to this loophole, detector scram-bling , was proposed in Refs. [26] that involves randomlychanging the roles of the detectors to hash out anymismatch in the detection system and reduce efficiencymismatch. In this paper, we scrutinize the effective-ness of this countermeasure. In Sec. II, we introduceand review some necessary details of the spatial-mode-efficiency-mismatch attack reported in [21]. In Sec. III,we simulate a detector scrambling countermeasure andshow the countermeasure blocks the side-channel. Then a r X i v : . [ ee ss . SP ] J a n in Sec. V, we show how the scrambling countermeasurecan be bypassed by resorting to a more general attackstrategy. We conclude in Sec. V. II. REVIEW OF DETECTION EFFICIENCYMISMATCH
We shall assume a polarization-encoded Bennett-Brassard (BB84) QKD scheme with passive basis-choiceimplementation as shown in Fig. 1a. The beam splitter(BS) is used for selecting the HV or DA bases and thepolarization beam splitters (PBSs) followed by two de-tectors are used to measure the polarization in a basis.Detectors h and v are used for measuring the incoming H and V polarized light while detectors d and a are usedfor measuring D and A polarized light respectively.The efficiency-mismatch side-channel is explained withthe help of Fig. 1b. Here we show how the sensitivity ofthe h and v detectors varies in response to the angle ofthe incoming light. The circle on the left (right) showsthe sensitive area of detector h ( v ). Outside the circle thesensitivity is zero (in practical detectors, sensitivity doesnot go to zero so abruptly, but this simple assumptionserves the purpose to explain the concept). In the over-lapping (green) region, both the detectors are equallysensitive. However, if the light is sent towards the red(blue) region, detector v ( h ) has a higher sensitivity thanthe h ( v ) detector. Eve can stage a faked-stage attack toexploit this bias.The faked-state attack considered in ref[21] is based onthe following assumptions. Eve is present outside Alice’slab. She intercepts and measures the signal going to-wards Bob. Then she reproduces another pulse with thesame polarization as her measurement outcome but withdifferent mean photon number, and sends it towards Bobat an angle where the target detector has a higher sen-sitivity compared to others. More specifically, if Eve’smeasurement outcome is j , she reproduces j polarizedlight with mean photon number µ j and sends it at anangle where detector j has a higher sensitivity than theother three detectors. This angle is referred to as the attack angle for detector j . She uses a lossless channel toovercome the channel loss and maximize her target de-tection probabilities. The sifted key rate and QBER inEve’s presence become R e = 14 (cid:88) j = H,V,D,A R e ( j ) , QBER e = 14 R e (cid:88) j = H,V,D,A E j . (1)In order to remain hidden, Eve’s first target would beto match the sifted key rate R e to the expected key rate R ab , i.e., R ab = R e . The next target would be to min-imize QBER e to maximize the amount of leaked infor-mation. Thus, the problem can be turned into an opti-mization problem with the goal of minimizing QBER e a)b) ф θ h v FIG. 1. a) Schematic of a typical BB84 receiver setup withfour photodetectors. The labels indicate the case when thereis incoming H -polarized light.b) Spatial efficiency mismatchin detectors h and v when looked from the channel. Blueand Red regions indicate the efficiencies – as a function ofillumination angle ( φ , θ ) – of the h and v detectors respec-tively where one detector is on while the other is off . Thegreen region indicates ranges of ( φ , θ ), where both detectorsare equally sensitive. None of the detectors are sensitive inthe white region. For a mismatch of this kind, an adversarycan utilize this to get some information about the key. with the constraints R ab = R e . The parameters to opti-mize are the four mean photon numbers which Eve canmanipulate to minimize the error. A harder constraintcan also be chosen. Instead of matching only total keyrate, the key rate at each channel can also be matched.Both of these optimizations were done in Ref. [21] andthe result is reproduced in Fig. 2. III. DETECTOR SCRAMBLINGCOUNTERMEASURE
In this section we discuss the general detector scram-bling countermeasure outlined in [26] and investigate itseffectiveness in preventing the attack. Let us assume thata half-wave plate (HWP) is placed in front of the BS inFig. 1. By rotating the axis of the HWP Bob can ro-tate the incoming polarization by θ B = 0 ◦ , ◦ , ◦ and 135 ◦ . When θ B = 0 ◦ , the detectors marked by h,v,d and a are used to detect incoming horizontal (H) ,vertical (V) , diagonal (D) and anti-diagonal (A) polar-ized lights respectively. When θ B = 90 ◦ , the bases areunchanged but the roles of each detector is inverted, i.e,detector marked h measures V and vice versa. In caseof θ B = 45 ◦ , the roles of each basis is flipped and finally Loss (dB)
QBER e (%) FIG. 2. Simulated QBER vs line loss. The lower twosolid curve (red and blue) indicates the results obtained in[21]. The blue curve shows the optimized
QBER e when Evematches the Bob compares the total sifted key rate with theexpected Alice-Bob sifted key rate R ab . The red curve showsthe optimized QBER e when Eve matches the rate for indi-vidual channels like R ab = R e ( j ) where j ∈ { h , v , d , a } . Theupper solid curve shows the optimized QBER in presence ofdetector scrambling countermeasure. It can be seen that Bobcan smoke out Eve’s presence with this countermeasure. for θ B = 135 ◦ both the roles of each basis and eachdetector is flipped, i.e, a detector marked h measures D and A when θ B = 45 ◦ and θ B = 135 ◦ respectively.Thus, by randomly changing the incoming polarizationby a HWP, it is possible for Bob to scramble the roles ofboth his bases and detectors.In the following, we assume Bob scrambles his detec-tors with equal a-priori probability. The sifted key rate R e ( j | θ B ) and error rate E j | θ B in the presence of Eve givenshe sends j polarized light – towards attack angle j withmean photon number µ j – and Bob applies θ B rotation,can be derived similar to Eqs. (A3) to (A5) as presentedin Appendix B. Thus, the total sifted key rate R se and QBER se with Eve’s attack and Bob applying scramblingcountermeasure become (derived in Appendix B) : R se = 14 (cid:88) j = H,V,D,A (cid:88) θ =0 ◦ , ◦ , ◦ , ◦ R e ( j | θ ) QBER se = 14 R e (cid:88) j = H,V,D,A (cid:88) θ =0 ◦ , ◦ , ◦ , ◦ E j | θ , (2)As discussed in Sec. II, the terms E j | θ and R e are depen-dent on mean photon number chosen by Eve. Thus, weperform similar optimization using the four mean pho-ton numbers as the free parameters to minimize QBER se with the constraint R se = R ab . Our result is shown withthe black curve in Fig. 2. The presence of scramblingmakes QBER se >
25% and no successful key generationis possible. In the simulation, the efficiency of the de-tectors, the mismatch values, background counts and allother parameters are taken from [21]. This result high-lights that as soon as Bob employs detector scramblingtechnique, Eve cannot manipulate the four mean photonnumbers to achieve a QBER less than 25% while satis-fying the constraints of matching the rates. This showsthe effectiveness of the scrambling countermeasure.
IV. DETECTOR-SCRAMBLING-BYPASSSTRATEGY
So far, we have assumed that when Eve sends a j po-larized light, it is always sent towards attack angle j with mean photon number µ j . In this section, we dis-card this assumption to generalize the attack. In par-ticular, we assume, when Eve sends a j polarized light,it can be directed towards any of the four attack angles k ∈ { h, v, d, a } with mean photon number µ kj and prob-ability f kj with (cid:80) k f kj = 1. Let p ki ( j | θ B ) be the rawclick probability at Bob’s detector i , given Eve sent a j -polarized light towards attack angle k with mean photonnumber µ kj that has been rotated by an angle θ B duringscrambling. p kh ( H | ◦ ) ≈ c h + 1 − exp ( − µ kH F η k ( H )2 ) (3)Let R ke ( j | θ B ) be the sifted key rate when Eve sends j polarized light at k attack angle with Bob rotating thepolarization by angle θ B . By deriving R ke ( j | θ B ) usingsimilar analysis as Eq. (B5)-B8 we get, R e ( H | θ B ) =[ f hh .R he ( H | θ B ) + f vh .R ve ( H | θ B )+ f dh .R de ( H | θ B ) + f ah .R ae ( H | θ B )] (4)The above equation takes into consideration the attackangles for every polarized light sent by Eve. Thus,we now have new variables such as P hhv ( V ) (instead of P hv ( V )) that indicates the probability – after squashing– that Bob selects an outcome in the hv basis given theincoming light is V -polarized sent at h -attack angle. Wecan now plug in Eq. (4) in Eq. (2) and calculate theQBER values for this detection-scrambling-bypass strat-egy. In the attack model in [21], when Eve sent a j polar-ized light she sent it at j attack angle with mean photonnumber µ j which left her with only four free parame-ters to minimize the error while satisfying the constraint.However, in the strategy presented in this section, whenEve decides to send a j polarized light, she can send Loss (dB)
QBER e (%) FIG. 3. QBER versus line loss with Eve’s improved attack.Eve can keep the error rate below 5% for line loss upto 17dB with the detection-scrambling-bypass strategy. The blueand red curves indicate
QBER e when Bob matches R ab withtotal sifted key rate and individual channel rates respectively. a) H V D A Polarization of Light Sent by EveADVH A tt a c k A n g l e s Probabilities b) H V D A Polarization of Light Sent by EveADVH A tt a c k A n g l e s Mean Photon Number Per Pulse
FIG. 4. a) Scatter plot of probability f kj at channel loss of6 dB. In the detection-scrambling-bypass strategy Eve wouldsend a specific polarized light at all attack angles with a spe-cific probability distribution. Each column indicates the at-tack angles and each row represents the polarization of lightsent by Eve. We see that in most of the cases Eve sends H -polarized light at h attack angle and so on. b) Scatter plotof mean Photon number at a channel loss of 6 dB with samecolumn and row representation. In this case, if Eve wantsto manage a successful attack, she needs to send V -polarizedlight more at H -attack angle than that at V -polarized light.Thus, depending on the window where there is total efficiencymismatch Eve needs to deploy her faked states following aspecific blueprint. towards attack angles k with probability f kj and meanphoton number µ kj . So there are 16 different values of µ kj and f kj equipping her with a total of 32 free parametersto perform the optimization. We have solved the op-timization problem for this detection-scrambling-bypassstrategy with the same efficiency, Fidelity and dark countvalues taken from Ref. [21]. For matching the total rates,Eve follows the constraint R ab = R e and for individ-ual rates she follows R ab = R e ( j ) where j ∈ { h, v, d, a } .With these 32 free parameters at hand the optimizationprogram is executed and the result is shown in Fig. 3. Wesee that by having more free parameters, Eve can indeedadjust their values to keep the QBER less than 5% for aloss up to 17 dB.Figure 4a and Fig. 4b show the optimized probabilities f kj and mean photon number per pulse chosen by Evefor a channel loss of 6 dB respectively. For a certainchannel loss, Eve has to follow a specific blueprint to attack the system. For example, the probability plot inFig. 4a) shows that Eve sends V polarized light at V attack angle with higher probability than others. On theother hand, Eve has to send V polarized light with highermean photon number than other polarizations as shownin Fig. 4b). For different channel loss the value of theoptimized free parameters will be different. Moreover,These scenarios are entirely dependent on the specificmismatch present in the system. V. CONCLUSION
In this work, we have shown that randomizing theroles of the detectors cannot function as an efficient coun-termeasure against detector-efficiency-mismatch type at-tacks. Although it can prevent the original attack pro-posed in Ref. [21], it fails to do so when a more generalstrategy is followed. The general strategy works evenwhen Bob uses any non-uniform a priori scrambling prob-abilities.We note that no two practical setups will have an ex-act mismatch, and hence it would not be possible for Eveto acquire one prototype to learn the mismatch of thetarget system. However, according to Kerckhoff’s princi-ple [27] quantum cryptography assumes that except forthe key, Eve knows all the system’s imperfections. So,to guarantee unconditional security in theory, we needto assume that Eve knows the exact details of the mis-match and Bob’s scrambling countermeasure to optimizeher attack. From a practical point of view, Eve can listento Bob’s classical communication channel while sendinga small fraction of faked states at different spatial anglesto get an estimate of the efficiency mismatch [28]. Evecan pursue a similar strategy to estimate Bob’s detectorscrambling statistics. Thus, unless new techniques areproposed to strengthen the existing detector-scramblingcountermeasure strategies, it cannot guarantee securityagainst detector efficiency mismatch based attacks. Ourresult and methodology could be used to security-certifya free-space quantum communication receiver against alltypes of detector-efficiency-mismatch type attacks. [1] W. Knight,
IBM Raises the Bar with a 50-Qubit Quan-tum Computer , Tech. Rep. (MIT Technology Review,2017).[2] D. Castelvecchi,
Quantum computers ready to leap out ofthe lab in 2017 , Tech. Rep. (Nature News, 2017).[3] R. C. Merkle,
Secrecy, authentication, and public key sys-tems , Ph.D. thesis, Stanford University (1979).[4] R. J. Mceliece, Coding Thv , 114 (1978).[5] J. Hoffstein, J. Pipher, and J. H. Silverman, in
Interna-tional Algorithmic Number Theory Symposium (Springer,1998) pp. 267–288.[6] C. H. Bennett and G. Brassard, in
Proceedings of IEEE International Conference on Computers, Systems, andSignal Processing (IEEE Press, New York, Bangalore,India, 1984) pp. 175–179.[7] N. Gisin, G. Ribordy, W. Tittel, and H. Zbinden, Rev.Mod. Phys. , 145 (2002).[8] V. Scarani, H. Bechmann-Pasquinucci, N. J. Cerf,M. Duˇsek, N. L¨utkenhaus, and M. Peev, Rev. Mod.Phys. , 1301 (2009).[9] L. Lydersen, C. Wiechers, C. Wittmann, D. Elser,J. Skaar, and V. Makarov, Nat. Photonics , 686 (2010).[10] I. Gerhardt, Q. Liu, A. Lamas-Linares, J. Skaar, C. Kurt-siefer, and V. Makarov, Nat. Commun. , 349 (2011). [11] S. Sajeed, I. Radchenko, S. Kaiser, J.-P. Bourgoin,A. Pappa, L. Monat, M. Legr´e, and V. Makarov, Phys.Rev. A , 032326 (2015).[12] S. Sajeed, A. Huang, S. Sun, F. Xu, V. Makarov, andM. Curty, Phys. Rev. Lett. , 250505 (2016).[13] N. Jain, E. Anisimova, I. Khan, V. Makarov, C. Mar-quardt, and G. Leuchs, New J. Phys. , 123030 (2014).[14] S. Sajeed, C. Minshull, N. Jain, and V. Makarov, Sci.Rep. , 8403 (2017).[15] P. V. P. Pinheiro, P. Chaiwongkhot, S. Sajeed, R. T.Horn, J.-P. Bourgoin, T. Jennewein, N. L¨utkenhaus, andV. Makarov, Opt. Express , 21020 (2018).[16] V. Makarov, J.-P. Bourgoin, P. Chaiwongkhot,M. Gagn´e, T. Jennewein, S. Kaiser, R. Kashyap,M. Legr´e, C. Minshull, and S. Sajeed, Phys. Rev. A ,030302 (2016).[17] A. N. Bugge, S. Sauge, A. M. M. Ghazali, J. Skaar, L. Ly-dersen, and V. Makarov, Phys. Rev. Lett. , 070503(2014).[18] C. H. Bennett, F. Bessette, L. Salvail, G. Brassard, andJ. Smolin, J. Cryptology , 3 (1992).[19] F. Xu, K. Wei, S. Sajeed, S. Kaiser, S. Sun, Z. Tang,L. Qian, V. Makarov, and H.-K. Lo, Phys. Rev. A ,032305 (2015).[20] V. Makarov, A. Anisimov, and J. Skaar, Phys. Rev. A , 022313 (2006), erratum ibid. , 019905 (2008).[21] S. Sajeed, P. Chaiwongkhot, J.-P. Bourgoin, T. Jen-newein, N. L¨utkenhaus, and V. Makarov, Phys. Rev.A , 062301 (2015).[22] M. Rau, T. Vogl, G. Corrielli, G. Vest, L. Fuchs,S. Nauerth, and H. Weinfurter, IEEE J. Quantum. Elec-tron. , 6600905 (2015).[23] P. Chaiwongkhot, K. B. Kuntz, Y. Zhang, A. Huang, J.-P. Bourgoin, S. Sajeed, N. L¨utkenhaus, T. Jennewein,and V. Makarov, Phys. Rev. A , 062315 (2019).[24] B. Qi, C.-H. F. Fung, H.-K. Lo, and X. Ma, Quant. Inf.Comp. , 73 (2007).[25] V. Makarov and J. Skaar, Quant. Inf. Comp. , 622(2008).[26] T. F. da Silva, G. C. do Amaral, G. B. Xavier, G. P.Tempor˜ao, and J. P. von der Weid, IEEE Journal ofSelected Topics in Quantum Electronics , 159 (2014).[27] A. Kerckhoffs, Journal des sciences militaires IX , 5(1883).[28] V. Makarov and D. R. Hjelme, J. Mod. Opt. , 691(2005).[29] N. J. Beaudry, T. Moroder, and N. L¨utkenhaus, Phys.Rev. Lett. , 093601 (2008).[30] T. Tsurumaru and K. Tamaki, Phys. Rev. A , 032302(2008).[31] O. Gittsovich, N. J. Beaudry, V. Narasimhachar, R. R.Alvarez, T. Moroder, and N. L¨utkenhaus, Phys. Rev. A , 012325 (2014). Appendix A: Sifted key rate and QBER duringattack
To derive the key rate and QBER formula in Eve’spresence, Ref [21] started with a system with only Eveand Bob. Let us consider Eve is sending a j -polarizedpulse to Bob with mean photon number µ j towards theattack angles j . Let p i ( j ) be the raw click probability at TABLE I. Possible outcome of events after squashing.Case h v d a
Decision after squashing1 (cid:88) × × × click on h × (cid:88) × × click on v × × (cid:88) × click on d × × × (cid:88) click on a (cid:88) (cid:88) × × decision random h or v × × (cid:88) (cid:88) decision random d or a detector i while incoming light is j polarized. For Evesending H polarized light, these probabilities are: p h ( H ) ≈ c h + 1 − exp (cid:18) − µ H F η h ( H )2 (cid:19) p v ( H ) ≈ c v + 1 − exp (cid:18) − µ H (1 − F ) η v ( H )2 (cid:19) p d ( a ) ( H ) ≈ c d ( a ) + 1 − exp (cid:18) − µ H η d ( a ) ( H )4 (cid:19) (A1)Here, c i is the dark count probability per bit slot atthe i -th detector, F is the fidelity and η i ( j ) is the prob-ability of detection at Bob’s i -th detector given Eve sent j -polarized light. We assume that when Bob registersa multiple click, he performs a squashing operation[29–31]. Table I shows the cases where Bob makes his deci-sions based on the clicks on his detectors. All other casesare discarded in the squashing model. Let P k (l) (where k ∈ { hv, da } , l ∈ { H, V, D, A } ) be the probability thatBob measures in the k basis given the incoming light is l polarized. Then P hv ( H ) can be computed from cases 1,2 and 5 in Table I as: P hv ( H ) = p h ( H )[1 − p d ( H )][1 − p a ( H )][1 − p v ( H )]+ p v ( H )[1 − p d ( H )][1 − p a ( H )][1 − p h ( H )]+ p v ( H ) p h ( H )[1 − p d ( H )][1 − p a ( H )]= [1 − p d ( H )][1 − p a ( H )] × [ p h ( H ) + p v ( H ) − p h ( H ) p v ( H )] . (A2)The probabilities P hv ( V ) , P da ( D ) , P da ( A ) can be calcu-lated similarly. Now we include Alice into the picture.We first assume the case where Alice sends a H -polarizedlight. The possible scenarios are shown in Fig. 5. Itis sufficient to consider only the cases when Bob mea-sures in same basis as Alice (HV in this case) as theother cases will be discarded during sifting. Here we as-sume, Eve measures Alice’s outgoing signal in HV or DA basis with equal a-priory probability using a mea-surement setup having perfect detection efficiency andno dark count. Thus, with 50% probability she measuresin the correct (incorrect) basis and sends the correct (in-correct) state to Bob. Let R e ( j ) be the sifted key ratewith Eve’s presence given Alice sent a j polarized light.Following Fig. 5, R e ( j ) can be given by, R e ( H ) ≈ P hv ( H ) + 14 P hv ( D ) + 14 P hv ( A ) (A3)The error rate with Eve given Alice sends a H polarizedlight can also be calculated with the help of Fig. 5. WhenEve measures in the same basis as Alice, she introducesno error (assuming perfect fidelity at Bob). However,when she measures in the wrong basis (in this case, DA )there is some probability of error. Let P i (j) be the prob-ability that, after squashing, Bob decides on outcome i given incoming light was j -polarized light. Thus, P v (H)would be,P v (H) = [ p v ( H ) − p h ( H ) p v ( H )2 ][1 − p d ( H )][1 − p a ( H )](A4) Alice Send HV
Eve ’s Measurement Basis Bob measures in
HV Basis H HVDA
H HD
A H V H V Polarization sent toward Bob0.50.5 0.50.5 (Error Case) (Error Case)
FIG. 5. A Bayesian network showing the possible scenarios ifAlice sends H -polarized light and Bob measure in HV -basis.This only portrays a scenario where fidelity is 1.0 with nodark counts. Hence, the error rate during attack given Alice sendsa H -polarized light is, E H = 18 P v (D) + 18 P v (A) (A5)In deriving Eqs. (A3) to (A5), we have assumed sim-plified cases. In a more general scenario, we also needto consider P hv ( V ) since the setup may have imperfectfidelity and dark counts in the photodetectors. Let P ec and P ew be the probability that Eve measures Alice’s sig-nal in the correct basis and gets a click in the correct andwrong photodetector respectively. Let, P enc be the proba-bility that Eve measures in the non-compatible or wrongbasis. We can then modify equation A3 for the case ofsifted key rate when there is incoming H -polarized light.Thus, the sifted key rate can be written from [21] in thefollowing form R e ( H ) ≈ P ec P hv ( H ) + P ew P hv ( V ) + P enc [ P hv ( D ) + P hv ( A )]+ (1 − P ec − P ew − P enc )( c h + c v − c h c v ) (A6)Similarly, we can modify equation A5 to calculate theerror rate with Eve in between, when Alice sends H -polarized light. If Bob has a click in the v photodetectorwith incoming H -polarized light then that would be an (H, (cid:1754) H ) ha d v (cid:1754) H /4 (cid:1754) H /2 (cid:1754) H /2 (cid:1754) H /4 (cid:1754) H /2 θ B FIG. 6. Bob’s measurement setup during scrambling error case with Eve measuring Alice’s signal in the cor-rect basis. Similarly, for other cases where Eve measuresin the correct basis but gets a click in the wrong pho-todetector and Eve measuring in the wrong basis, if Bobgets a click in the v photodetector that would count asan error and can be expressed in the following form: E H ≈ P ec P v (H) + P ew P v (V) + P enc [P v (D) + P v (A)]+ (1 − P ec − P ew − P enc )( c v − c v c h V , D and A polarized light can be calculatedsimilarly. The total sifted key rate and QBER in Eve’spresence become R e = 14 (cid:88) j = H,V,D,A R e ( j ) , QBER e = 14 R e (cid:88) j = H,V,D,A E j . (A8) Appendix B: Sifted key rate and QBER withscrambling countermeasure
Let p i ( j | θ B ) be the raw click probability at Bob’s i -th detector given Eve sends j polarized light with meanphoton number µ j directed towards attack angle j whichis rotated by Bob by an angle θ B . The probabilities for θ B = 0 ◦ , ◦ , ◦ and 135 ◦ can be derived similar toEq. (A1). When θ B = 0 ◦ : p h ( H | ◦ ) ≈ c h + 1 − exp (cid:18) − µ H F η h ( H )2 (cid:19) p v ( H | ◦ ) ≈ c v + 1 − exp (cid:18) − µ H (1 − F ) η v ( H )2 (cid:19) p d ( a ) ( H | ◦ ) ≈ c d ( a ) + 1 − exp (cid:18) − µ H η d ( a ) ( H )4 (cid:19) (B1)When θ B = 45 ◦ the H -polarized light is rotated to a D -polarized light and corresponding raw click probabili-ties become: p d ( H | ◦ ) ≈ c d + 1 − exp ( − µ H F η d ( H )2 ) p a ( H | ◦ ) ≈ c a + 1 − exp ( − µ H (1 − F ) η a ( H )2 ) p h ( v ) ( H | ◦ ) ≈ c h ( v ) + 1 − exp ( − µ H η h ( v ) ( H )4 ) (B2)For θ B = 90 ◦ : p v ( H | ◦ ) ≈ c v + 1 − exp ( − µ H F η v ( H )2 ) p h ( H | ◦ ) ≈ c h + 1 − exp ( − µ H (1 − F ) η h ( H )2 ) p d ( a ) ( H | ◦ ) ≈ c d ( a ) + 1 − exp ( − µ H η d ( a ) ( H )4 ) (B3)and finally for θ B = 135 ◦ : p a ( H | ◦ ) ≈ c a + 1 − exp ( − µ H F η a ( H )2 ) p d ( H | ◦ ) ≈ c d + 1 − exp ( − µ H (1 − F ) η d ( H )2 ) p h ( v ) ( H | ◦ ) ≈ c h ( v ) + 1 − exp ( − µ H η h ( v ) ( H )4 ) (B4)Let R e ( j | θ B ) be the sifted key rate in the presence ofEve given she sends j polarized light – towards attackangle j with mean photon number µ j – and Bob applies θ B rotation on it. Using similar analysis used for derivingEq. (A6), we can find the rates for different θ B . Forexample, R e ( H | ◦ ) ≈ P ec P hv ( H | ◦ ) + P ew P hv ( V | ◦ )+ P enc [ P hv ( D | ◦ ) + P hv ( A | ◦ )]+ (1 − P ec − P ew − P enc )( c h + c v − c h c v ) (B5) R e ( H | ◦ ) ≈ P ec P hv ( H | ◦ ) + P ew P hv ( V | ◦ )+ P enc [ P hv ( D | ◦ ) + P hv ( A | ◦ )]+ (1 − P ec − P ew − P enc )( c h + c v − c h c v ) (B6) R e ( H | ◦ ) ≈ P ec P da ( H | ◦ ) + P ew P da ( V | ◦ )+ P enc [ P da ( D | ◦ ) + P da ( A | ◦ )]+ (1 − P ec − P ew − P enc )( c d + c a − c d c a ) (B7) R e ( H | ◦ ) ≈ P ec P da ( H | ◦ ) + P ew P da ( V | ◦ )+ P enc [ P da ( D | ◦ ) + P da ( A | ◦ )]+ (1 − P ec − P ew − P enc )( c d + c a − c d c a ) (B8)We assume in our model that Bob is scrambling therole of the photodetectors with equal a-priori probabil-ities. Thus, modifying equation 1 and averaging Bob’srate for each θ B (that accounts for the extra factor),we obtain Bob’s total sifted key rate: R se = 14 (cid:88) j = H,V,D,A (cid:88) θ =0 ◦ , ◦ , ◦ , ◦ R e ( j | θ ) (B9)The error rates conditioned on Alice send-ing H -polarized light and Eve applying θ B ∈{ ◦ , ◦ , ◦ , ◦ } rotation can be calculatedsimilar to Eq. (A7) in previous section. They are: E H | ◦ ≈ P ec P v (H | ◦ ) + P ew P v (V | ◦ )+ P enc [P v (D | ◦ ) + P v (A | ◦ )]+ (1 − P ec − P ew − P enc )( c v − c v c h E H | ◦ ≈ P ec P h (H | ◦ ) + P ew P h (V | ◦ )+ P enc [P h (D | ◦ ) + P h (A | ◦ )]+ (1 − P ec − P ew − P enc )( c v − c v c h E H | ◦ ≈ P ec P a (H | ◦ ) + P ew P a (V | ◦ )+ P enc [P a (D | ◦ ) + P a (A | ◦ )]+ (1 − P ec − P ew − P enc )( c v − c v c h E H | ◦ ≈ P ec P d (H | ◦ ) + P ew P d (V | ◦ )+ P enc [P d (D | ◦ ) + P d (A | ◦ )]+ (1 − P ec − P ew − P enc )( c v − c v c h i (j | θ B ) is the probability that outcome i is se-lected by Bob after squashing given that Eve has sent j -polarized light which was rotated by Bob by an angle θ B . So, modifying Eq. (A2) we get,P v (H | θ ) = [ p v ( H | θ ) − p h ( H | θ ) p v ( H | θ )2 ] × [1 − p d ( H | θ )][1 − p a ( H | θ )] (B14)The total QBER in Eve’s presence becomes: QBER se = 14 R e (cid:88) j = H,V,D,A (cid:88) θ =0 ◦ , ◦ , ◦ , ◦ E j | θ (B15)In a plausible scenario, if Bob applies θ B = 45 ◦ andexpects an incoming H polarized light from Alice, hewill be expecting a click in his d detector. But if thelight is coming from Eve, it will be directed towards,the H attack angle where the hh