| photon number splitting attack | |
|---|---|
| Name | Photon number splitting attack |
| Caption | Schematic of a weak coherent pulse subject to photon number splitting |
| Type | Quantum cryptographic attack |
| Introduced | 1990s |
| Field | Quantum cryptography |
| Related | Quantum key distribution, BB84 protocol, Decoy state protocol |
photon number splitting attack
A photon number splitting attack is a side-channel exploit against quantum optical implementations of Quantum key distribution (QKD) in which an eavesdropper capitalizes on multi-photon signals to obtain key information without introducing the error rates expected from individual-photon interception. It matters in Quantum Physics and practical cryptography because realistic sources (e.g., weak coherent pulses) deviate from ideal single-photon states, creating a vulnerability that can undermine the information-theoretic security guarantees of protocols such as BB84 protocol.
The photon number splitting (PNS) attack was identified in the context of practical QKD systems that use attenuated lasers rather than true single-photon emitters. In a PNS variant, an adversary (commonly denoted as Eve) performs a non-demolition measurement of the photon number in a transmitted pulse and selectively splits off one or more photons from pulses that contain multiple photons, forwarding the remainder to the legitimate receiver (Bob). This strategy leverages properties of coherent state sources and imperfect detectors used in early commercial systems. The vulnerability spurred developments in hardware (single-photon sources, quantum dot emitters) and protocol-level countermeasures such as the decoy state protocol.
A typical implementation begins with an adversary performing a quantum non-demolition measurement or an equivalent attack that distinguishes the photon-number subspace without disturbing encoded degrees of freedom (e.g., polarization or phase). For pulses containing two or more photons, the attacker extracts one photon and stores it in a quantum memory or routes it to a measurement device, allowing the remaining photons to continue to Bob with little increase in loss or error. Later, after basis reconciliation in protocols like BB84 protocol or SARG04 protocol, Eve measures her stored photons in the revealed bases to obtain the key bit deterministically. The attack exploits the statistics of Poisson distribution emission from weak coherent pulses and assumes access to technologies such as low-loss beam splitters, quantum memories, and photon-number-resolving detectors.
PNS attacks directly affect the security bounds and achievable key rates of practical QKD. Early security proofs that assumed ideal single-photon sources overestimated secure transmission distances and rates for systems using weak coherent pulses. The existence of PNS attacks necessitated modified security analyses that account for multi-photon events and realistic device imperfections. For instance, unconditional security proofs for the BB84 protocol had to be extended by authors such as H.-K. Lo and collaborators to include decoy-state techniques and composable security frameworks. In practical terms, PNS-capable adversaries can force a zero secret-key rate beyond shorter distances unless countermeasures are implemented, influencing deployment choices by entities such as ID Quantique and research groups at institutions like NIST and the University of Geneva.
Detection of active PNS attacks is difficult because the eavesdropper can keep observed quantum bit error rates (QBER) low while inducing only loss. Countermeasures fall into hardware and protocol categories: - Hardware: development of true single-photon sources (e.g., nitrogen-vacancy center, quantum dot emitters) and improved photon-number-resolving detectors reduce multi-photon emission and allow monitoring of incoming photon statistics. - Protocol: the decoy state protocol (proposed by Hwang (quant-ph/0302142), formalized by Xiang-Bin Wang and H.-K. Lo et al.) randomizes pulse intensities so that an eavesdropper cannot selectively exploit multi-photon pulses without changing detection statistics; privacy amplification and error correction parameters are adjusted using rigorous statistical bounds (e.g., finite-key analysis). - Implementation safeguards: monitoring channel loss and timing correlations, use of device-independent or measurement-device-independent QKD (e.g., MDI-QKD) architectures to remove specific trust assumptions about detectors or sources.
Laboratory demonstrations of PNS effects have been performed to validate theoretical attacks and test countermeasures. Experiments by groups at Tsinghua University, University of Vienna, and NIST investigated splitting strategies, photon-number-resolving measurements, and the performance of decoy-state QKD over fiber and free-space links. Practical systems from vendors such as ID Quantique and trial networks (e.g., SECOQC) implemented decoy-state methods and hardware upgrades to mitigate PNS risk. Considerations include the current limits of quantum memory fidelity, the feasibility of lossless manipulation, and realistic channel noise; these determine whether a real-world adversary could mount an effective PNS attack at scale.
The discovery of PNS attacks led to refined security proofs that explicitly model source imperfections and adversarial capabilities. Security analyses now commonly include bounds for multi-photon fractions, finite-key scenarios, and composable security definitions. Techniques such as decoy-state analysis, entanglement-based equivalence proofs, and information-theoretic modeling by researchers including Charles H. Bennett, Gilles Brassard, and H.-K. Lo underpin modern proofs. Advanced research explores generalizations of PNS in networked QKD, relations to side-channel attacks (e.g., timing and detector blinding), and integration with quantum repeater architectures to extend secure distances while preserving resistance to photon-number exploits.
Category:Quantum cryptography Category:Quantum information theory