Practical Analysis of Sending or Not-Sending Twin-Field Quantum Key Distribution with Frequency Side Channels

Abstract

The twin-field quantum key distribution (TF-QKD) and its variants can overcome the fundamental rate-distance limit of QKD. However, their physical implementations with the side channels remain the subject of further research. We test the side channel of a type of external intensity modulation that applies a Mach–Zehnder-type electro-optical intensity modulator, which shows the distinguishability of the signal and decoy states in the frequency domain. Based on this security loophole, we propose a side-channel attack, named the passive frequency-shift attack, on the imperfect implementation of the sending or not-sending (SNS) TF-QKD protocol. We analyze the performance of the SNS protocol with the actively odd-parity pairing (AOPP) method under the side-channel attack by giving the formula of the upper bound of the real secret key rate and comparing it with the lower bound of the secret key rate under Alice and Bob’s estimation. The simulation results quantitatively show the effectiveness of the attack on the imperfect devices at a long distance. Our results emphasize the importance of practical security at the light source and might provide a valuable reference for device selection in the practical implementation of the SNS protocol.

1. Introduction

Quantum key distribution (QKD) promises to share the secret key bits with its security guaranteed by the laws of quantum physics [1,2,3]. Combined with the one-time pad, Alice and Bob can achieve unconditionally secure private communication. However, there are inevitable imperfections in the practical QKD systems which can be exploited by Eve and compromise the practical security. With the development of QKD, the proposal of the measurement-device-independent (MDI) QKD [4] and the decoy-state method [5,6,7] have greatly improved the practicality, performance, and practical security.

However, the secret key rate and distance are two implementation bottlenecks of point-to-point QKD. For example, the TGW bound [8] and PLOB bound [9] determine the repeaterless secret key capacity. To overcome this limit of repeaterless QKD, Lucamarini et al. [10] proposed the twin-field QKD (TF-QKD) protocol whose secret key rate scales with the square root of the channel transmittance by using the single-photon interference. However, the security is not completed as a security loophole is caused by the later announcement of the phase information [11]. Then, many variants of TF-QKD [11,12,13,14,15,16,17] have been proposed to deal with this security loophole and each has its own advantages. To accelerate the application of the TF-QKD protocols, many effects have been considered and analyzed, including the finite-key effects [18,19,20,21], the asymmetric effects [22,23,24], the discrete phase randomization [25,26], the optimization of the protocol [27,28,29], and the practical issues [30,31]. Meanwhile, several experiments of the TF-QKD have been carried out in the laboratory and field, demonstrating its ability to break the limit of repeaterless QKD [32,33,34,35,36,37,38,39].

However, the physical implementations of the TF-QKD protocols with the side channels remain to be further researched at present. Ideally, it is assumed that the sending devices are placed in a protected laboratory, and can prepare and encode quantum states correctly without information leakage. Unfortunately, these conditions may be not satisfied in the practical systems due to the imperfect devices [40,41,42,43] or Eve’s disturbance [44,45,46,47,48,49,50]. In those QKD protocols with the practical light source, the decoy-state method is vital and used to monitor the channel eavesdropping [51] in which the security is based on the fact that Eve cannot distinguish between the signal and decoy states. However, the indistinguishability of the signal and decoy states may be violated due to the imperfections of the real apparatuses or Eve’s disturbance. For instance, the probability distributions of the signal and decoy states do not overlap in the time domain completely with the pump-current modulation [42]. In the frequency domain, Eve could apply the wavelength-selected photon-number-splitting attack [52] or the frequency shift attack [53] actively to distinguish the signal and decoy states in the “plug-and-play” systems. However, the frequency shift attack needs to perform time shift on the signal pulses actively which is only applicable to the “plug-and-play” systems. In addition, it only analyzes the frequency shift in the ideal case. Therefore, to exploit the negative effects of the frequency side channels clearly, we consider the most general case of side channels caused only by the imperfect devices and test it experimentally. As the decoy-state method is used in the TF-QKD protocols, it is of significance to analyze its practical security in this aspect. More specifically, we concentrate on the sending or not-sending (SNS) TF-QKD protocol [11] with the actively odd-parity pairing (AOPP) method [29] and propose a side-channel attack, named the passive frequency-shift attack, which could take advantage of the most general side channels in the frequency domain.

The paper is arranged as follows. In Section 2, we recap the frequency shift of intensity modulators (IMs) and test experimentally the spectral distribution of the signal pulses with the external modulation method, which shows a side channel in the frequency domain. In Section 3, we propose the side-channel attack on imperfect implementation of the SNS protocol with AOPP that applies the imperfect IM. We analyze the adverse impact of the side channels by giving the formula of the upper bound of the secret key rate and comparing it with the lower bound of the secret key rate under Alice and Bob’s estimation. In Section 4, we present our simulation results with the finite-key effects. Last, we give some discussion about the countermeasure of the side channels in Section 5 and conclude in Section 6.

2. Frequency Shift of Intensity Modulators

In this section, we will recap the frequency shift of the IMs and test experimentally to show a side channel in the frequency domain.

There are several kinds of IMs such as the Mach–Zehnder type electro-optical intensity modulators (EOIMs), electro-absorption modulators (EAMs), and acousto-optical modulators (AOMs). EOIMs, especially LiNbO${}_3$-based devices, possess excellent performance of wavelength-independent modulation characteristics, excellent extinction performance (typically 20 dB), and low insertion losses (typically 5 dB) [54].

LiNbO${}_3$-based EOIMs work using the principle of interference, which is controlled by modulating the optical phase. The incoming light is coupled into a waveguide and then split into two paths of a Mach–Zehnder interferometer equally, which finally interfere at an output coupler. The two arms made of lithium-niobate will induce a phase change when the modulation voltages are applied. Accordingly, the intensity and phase of the output light will be modulated after interference depending on the applied modulation voltages. Assuming voltages $V_1\left(t\right)$ and $V_2\left(t\right)$ are applied to the two arms separately with the input field of intensity $E_0$ and frequency ${\omega }_0$, the output field can be written as [52]

$$E_{\mathrm{out}}\left(t\right)=E_0\cos [\Delta \phi \left(t\right)]e^{i[{\omega }_{0}t+\phi \left(t\right)]},$$

(1)

where $\Delta \phi \left(t\right)=[\gamma V_1\left(t\right)+{\phi }_1-\gamma V_2\left(t\right)-{\phi }_2]/2$, $\phi \left(t\right)=[\gamma V_1\left(t\right)+{\phi }_1+\gamma V_2\left(t\right)+{\phi }_2]/2$. Here, $\gamma =\pi /V_{\pi }$ is the voltage-to-phase conversion coefficient for two arms, and ${\phi }_1$ and ${\phi }_2$ are the static phases which we will omit for simplicity. Here, $V_{\pi }$ is the half-wave voltage that is required to change the phase in one modulator arm by $\pi$ radians. The output intensity is given by

$$P_{\mathrm{out}}\left(t\right)={|E_{\mathrm{out}}\left(t\right)|}^2=\frac{P_0}{2}[1+\cos [\gamma V(t)]],$$

(2)

where $V\left(t\right)=V_1\left(t\right)-V_2\left(t\right)$. Here, $P_0$ is the input optical power. The phase is maintained and the intensity is determined by Equation (2) on the condition that the two modulator arms are driven by the same amount, but in opposite directions (i.e., $V_1\left(t\right)=-V_2\left(t\right)$), which is known as the balanced driving or a push–pull operation. When $V\left(t\right)$ is constant we will get pure intensity modulation without a frequency shift. However, once $V\left(t\right)$ is not a constant anymore, something unexpected arises in the output field. For example, if $V_1\left(t\right)=-V_2\left(t\right)=V_0+kt$, the output field can be expressed as [52]

$$E_{\mathrm{out}}=\frac{E_0}{2}[e^{i[({\omega }_0+\gamma k)t+\gamma V_0]}+e^{i[({\omega }_0-\gamma k)t+\gamma V_0]}].$$

(3)

From Equation (3), we can see a frequency shift of the light pulses with $\pm {\omega }_m=\pm \gamma k$ compared with the original frequency ${\omega }_0$. The frequency shift of the output field becomes more confusing when the modulation voltages are more complicated. To analyze the spectrum of the output field, the fast Fourier transform method can be used.

To evaluate the frequency shift of different intensity pulses, we tested it experimentally. The 33-MHz optical pulses with 1 ns pulse width were produced by a CW laser, modulated by an IM, and measured by an optical-spectrum analyzer. The IM was driven by an arbitrary waveform generator with an electric signal amplified by an electric amplifier. The measurement was taken before the fixed attenuation where the photon number follows the same distribution with the emitting pulses at the single-photon level. Figure 1a illustrates the wavelength spectrum of three signal pulses, where the intensity ratio is taken from the SNS experiment [36] as 0.1: 0.384: 0.447 (${\mu }_a=0.1$, ${\mu }_b=0.384$, ${\mu }_z=0.447$), and the original continuous light. The normalized intensity probability distributions are shown in Figure 1b to distinguish the difference. In addition, Figure 2 shows the modulation voltages corresponding to these signal pulses.

Obviously, the states modulated by the IM with different intensities do not overlap completely in the frequency domain. The distinction will be more evident when increasing the repetition rate and narrowing the pulse width to increase the key distribution rate. Therefore, we tested it using the same method and obtained the normalized intensity distribution of 33-MHz optical pulses with 300 and 100 ps pulse widths, which is shown in Figure 3a,b, respectively.

From Figure 1b and Figure 3a,b, we can see that the distinction of the signal states (also the strong-decoy states) and the weak-decoy states is evident. This is because the amplitude of the modulation voltages of the signal and strong-decoy states are higher, which will induce a greater frequency shift. Thus, the peaks of the signal and strong-decoy states are lower than that of the weak-decoy states. There are also slight differences between the signal and strong-decoy states. On this foundation, Eve could take advantage of this side channel to distinguish different states, which will threaten the decoy-state method.

3. Passive Frequency-Shift Attack on Imperfect Implementation of SNS

In this section, we propose a side-channel attack, named the passive frequency-shift attack, on the imperfect implementation of the SNS protocol with AOPP by exploiting the side channels in the frequency domain. The four-intensity decoy-state SNS protocol with AOPP is reviewed in the Appendix A.

In those TF-QKD protocols that need the post-phase compensation method, such as the SNS TF-QKD [11] and phase-matching (PM) TF-QKD [12], the signal and reference pulses should be produced with a stable CW laser source and modulated with the external modulation method to estimate and compensate for the phase noise. In the four-intensity decoy-state SNS TF-QKD protocol, Alice and Bob need to modulate the continuous light to five kinds of pulses with different intensities. The maximum-intensity pulses are used as the phase reference pulses, the minimums as the vacuum states, and others as the signal states, weak- and strong-decoy states. In the practical SNS systems [35,36], three IMs are used to modulate these five different pulses. The first IM modulates the continuous light to five pulses of different intensities and the second IM modulates the intensity to the designed ratio. The last IM only modulates the signal pulse width to a fixed width which can eliminate the side channels caused by the first two IMs. In this paper, we consider the simplified SNS systems where only one IM is applied to modulate the signal pulses. In this way, the side channels caused by the IM are exposed to Eve totally. We use this to verify the side channels of the IMs, prove their harmfulness, and present a reference for the device selection in the practical implementation.

Suppose Eve intercepts all of the signal pulses at Alice and Bob’s output ports where the signal pulses have not been attenuated by the channels, and then distinguishes the signal and decoy states with a wavelength-division multiplexer (WDM) and three single-photon detectors (SPDs), which is illustrated in Figure 4. To distinguish the states with intensity ${\mu }_{\alpha }$, Eve sets internals $T_{\alpha }$ with $\alpha \in \{z,a,b\}$, according to the wavelength spectrum of different states. Suppose the four ports of WDM 1, 2, 3, and 4 can export photons with frequency located in $T_z$, $T_a$, $T_b$, and others. The light-path selector S1 (S2) is controlled by SPD1 (SPD1 and SPD2). Denote it as 1 or 0 when the SPD (i.e., SPD1, SPD2, or SPD3) clicks or not, and 1 or 0 when the light-path selector (i.e., S1 or S2) selects the up or down path. We set

$$\begin{array}{cc}\hfill \mathrm{S}1=& \overline{\mathrm{SPD}1},\hfill \\ \hfill \mathrm{S}2=& \mathrm{SPD}1\vee \mathrm{SPD}2.\hfill \end{array}$$

(4)

Note that only one SPD at most will click under this principle. According to the response of the SPDs, set the total transmittance as ${\eta }_1$, ${\eta }_2$, ${\eta }_3$ or ${\eta }_v$ when SPD1, SPD2, SPD3, or none click, respectively.

In this process, Eve can get partial raw-key bits after Alice (Bob) announces the signal and decoy windows. It can be understood in this way that Eve can conclude the key bit as 1 (0) for Alice (Bob) when $\mathrm{SPD}1\vee \mathrm{SPD}2\vee \mathrm{SPD}3=1$ in a Z window. There is no bit-flip error between Alice (Bob) and Eve because Eve can intercept photons at output ports without stray photons. Only the raw bits can be used to distill the secret bits in Z windows when $\mathrm{SPD}1\vee \mathrm{SPD}2\vee \mathrm{SPD}3=0$ on both sides. Once Eve detects photons successfully on one side, Eve’s bit is either the same or a bit-flip error with the other side, which will be revealed in the error-correction step (and the pre-error correction step when the AOPP method is performed). However, the bits are balanced (i.e., random for Eve) in one-detector heralded events with $\mathrm{SPD}1\vee \mathrm{SPD}2\vee \mathrm{SPD}3=0$, which means the raw bits are unknown to Eve in these windows. Although Eve cannot distinguish the decoy and signal states without errors, the decoy-state method may not estimate the lower bound of the secret key rate correctly when the transmittances of the signal and decoy states differ. When the actual secret key rate is lower than the estimated one, the final secret string is partially insecure.

We emphasize that this side-channel attack will not introduce unnecessary errors, as the beam splitting and measurement by Eve can be viewed as a loss without phase noise. What is more, Eve could control errors completely except the inherent errors of the protocol through channels, superconducting-nanowire single-photon detectors (SNSPDs), and classic information he announces. In the following, we will analyze the effect of this passive frequency-shift attack.

Consider the most general case, assume the envelope of the wavelength spectrum can be written as $f_i\left(\lambda \right)$, where $i\in \{z,a,b,v\}$ and $f_v\left(\lambda \right)\equiv 0$ for vacuum states. When the wavelength spectrum of the signal and decoy states do not overlap completely, Eve can distinguish these states with errors by setting the internals $T_{\alpha }$. The proportion of state ${\mu }_i$ in internals $T_{\alpha }$ can be shown as

$$r_{i|\alpha }=\frac{{\int }_{T_{\alpha }}{f}_i\left(\lambda \right)d\lambda }{{\int }_{-\infty }^{\infty }{f}_i\left(\lambda \right)d\lambda }.$$

(5)

The states of intensity ${\mu }_i$ would be transformed with one of four different transmittances ${\eta }_{i,k}$ $(k\in \{1,2,3,v\left\}\right)$ when SPD${}_k$ clicks (SPD${}_v$ corresponds to no SPD click), where

$$\begin{array}{cc}\hfill {\eta }_{i,1}=& {\eta }_z(1-r_{i|z}),\hfill \\ \hfill {\eta }_{i,2}=& {\eta }_a(1-r_{i|z}-r_{i|a}),\hfill \\ \hfill {\eta }_{i,3}=& {\eta }_b(1-r_{i|z}-r_{i|a}-r_{i|b}),\hfill \\ \hfill {\eta }_{i,v}=& {\eta }_k(1-r_{i|z}-r_{i|a}-r_{i|b}).\hfill \end{array}$$

(6)

The total transmittance ${\eta }_{i,k}$ can be controlled by Eve completely, which means that Eve is allowed to use a lower-loss or even lossless channel and perfect detectors with 100% detection efficiency and no dark count. In addition, Eve could select the internals $T_{\alpha }$ freely to obtain satisfactory results. For the states with intensity ${\mu }_i$, the probability of being transmitted with ${\eta }_{i,k}$ can be shown as

$$\begin{array}{cc}\hfill p_{i,z}=& (1-e^{-{\mu }_{i|z}}),\hfill \\ \hfill p_{i,a}=& e^{-{\mu }_{i|z}}(1-e^{-{\mu }_{i|a}}),\hfill \\ \hfill p_{i,b}=& e^{-{\mu }_{i|z}}{e}^{-{\mu }_{i|a}}(1-e^{-{\mu }_{i|b}}),\hfill \\ \hfill p_{i,v}=& e^{-{\mu }_{i|z}}{e}^{-{\mu }_{i|a}}{e}^{-{\mu }_{i|b}},\hfill \end{array}$$

(7)

where ${\mu }_{i|\alpha }={\mu }_i{r}_{i|\alpha }$. Here $e^{-{\mu }_{i|\alpha }}$ is the probatility of zero photons in internal $T_{\alpha }$ with intensity ${\mu }_i$.

Since the TF-QKD protocols are proposed for the implementation of long optical-fiber communications, Eve’s best target is to acquire a higher percentage of the key bits as far as possible while maintaining the key rate and communication distance under Alice and Bob’s estimation. When the communication distance is long enough, Eve may steal secret key bits.

There are two key rates that matter: the lower bound of the secret key rate under Alice and Bob’s estimation $R_e$ and the upper bound of the actual secret key rate $R_u$. In the QKD protocols, it is challenging to obtain the actual secret key rate with one communication step by sending N pulses. Fortunately, Alice and Bob can estimate the lower bound of the secret key rate. It is risky to exceed the lower bound because the security of those bits is uncertain, although the final key bits may still be secure. Note that Alice and Bob could not estimate $R_e$ correctly under this attack because it is impossible to pick out the decoy states that have undergone the same operation as the signal states, i.e., the decoy-state method does not work properly. The key rate $R_u$, which is an upper bound of the actual secret key rate, is introduced to evaluate the effect of this attack. In the following, we analyze how to obtain the formula of $R_u$.

When the attack is applied, the phase-randomized coherent states with ${\mu }_z$ sent by Alice (Bob) will be transformed with one of four transmittances ${\eta }_{z,k}$ with probability $p_{z,k}$. As Alice and Bob will announce their signal and decoy windows, the Z windows are known to Eve. Hence, Eve can obtain Alice’s (Bob’s) raw bits as 1 (0) when obtaining a detection event with three SPDs in Z windows. In other words, only the raw bits of Alice (Bob) that are caused by the pulses transmitted with ${\eta }_{z,v}$ are unknown to Eve. Considering the raw-bit strings of both parties at the same time, there will be four kinds of twin bits, given as $\{10,1x,x0,xx\}$ according to Eve’s information on raw bits, where the first (second) bit indicates that Alice’s (Bob’s) bits are known to Eve as 1 (0) or unknown as x.

In the SNS protocol, Alice and Bob will perform the AOPP method on raw bits before error correction. When the AOPP method is performed with partial bits leaked to Eve, from Eve’s perspective, Bob will only choose pairs $0x$, $x0$ and, $xx$, and Alice’s pairs can only be $11,1x,x1,xx$ accordingly (12 scenarios in total). Note that these bit pairs are between Alice and Bob’s own bit strings. Since Bob only chooses odd-parity bit pairs and will keep the second bits if Alice’s bit pairs are odd too, Eve can infer that Alice’s (Bob’s) result bit (i.e., the second bit) is $1,0,x$ ($1,0,1,x$), correspondingly. At this time, there will be nine kinds of twin bits $\{{11}_P,{10}_P,{01}_P,{00}_P,1x_P,x{1}_P,0x_P,x{0}_P,x{x}_P\}$ according to Eve’s information on raw bits, where the subscript P represents that the AOPP method is applied. Only the last twin bit $x{x}_P$ can be used to distill the secret-key bits because, for all other twin bits, at least one’s bit is leaked and all will be revealed or discarded in the error-correction step. Finally, we note that the twin bits $x{x}_P$ can only be generated with two twin bits $xx$ which correspond to states transmitted with ${\eta }_{z,v}$.

In the decoy-state method [5,6,7], the secret key is only derived from the single-photon component, i.e., the untagged bits [55,56]. In the decoy-state SNS protocol [11,30], the untagged bits are defined during effective events, which are caused by the two-mode single-photon states $|01\rangle$ or $|10\rangle$ in Z windows (see Appendix A for details). The secret twin bits $x{x}_P$ can only be generated with two untagged-twin bits when the AOPP method is applied. Therefore, the upper bound of the actual secret key rate can be shown as

$$R_u=\frac{n_{1,\sec }}{N}=\frac{n_p}{N}\frac{n_{1s}^0}{n_{t0}}\frac{n_{1s}^1}{n_{t1}},$$

(8)

where $n_{1s}^0$ and $n_{1s}^1$ are the upper bound of the untagged bits when they make the opposite decision and obtain twin bits 0 and 1, respectively. Note that for the above simplified attack scheme,

$$n_{1s}^0=n_{1s}^1=N{p}_z^2{p}_{z0}(1-p_{z0})p_{z,v}G\left(u_z{\eta }_{z,v}\right),$$

(9)

where $G\left(x\right)=e^{-x}x$ is obtained without considering dark counts.

In addition, note that the above attack scheme is clumsy since Eve does not consider the relevance of the response of the SPDs at Alice and Bob’s side. We modify the attack in the following.

There are 16 kinds of state pairs according to the intensities of Alice and Bob, which can be denoted as ${\mu }_i{\mu }_j$ with $i,j\in \{z,a,b,v\}$, regardless of the type of windows. Similarly, there will be 16 scenarios about the response of the SPDs denoted as $km$ at Alice and Bob’s side, where $k,m\in \{1,2,3,v\}$. Therefore, when Alice and Bob select states with intensities ${\mu }_i$ and ${\mu }_j$, the probability when SPDk and SPDm clicks can be shown as

$$p_{ij,km}=p_{i,k}{p}_{j,m}.$$

(10)

Given the loss due to Eve’s interception, the total transmission for Alice and Bob can be shown as

$$\begin{array}{cc}\hfill {\eta }_{ij,km}^A=& {\eta }_{km}^A{\eta }_{i,k}/{\eta }_k,\hfill \\ \hfill {\eta }_{ij,km}^B=& {\eta }_{km}^B{\eta }_{j,m}/{\eta }_m,\hfill \end{array}$$

(11)

where ${\eta }_{km}^A$ (${\eta }_{km}^B$) is the total transmission between Alice (Bob) and Charlie that Eve sets when SPDk and SPDm clicks at Alice and Bob’s side, respectively.

Similarly, only the raw bits that are caused by those signal states transmitted with ${\eta }_{zv,vv}$ (${\eta }_{vz,vv}$) are secured. At this time, Equation (8) is the upper bound of the actual secret key rate combined with

$$\begin{array}{cc}\hfill n_{1s}^0=& N{p}_z^2{p}_{z0}(1-p_{z0})p_{zv,vv}G\left({\mu }_z{\eta }_{zv,vv}^A\right),\hfill \\ \hfill n_{1s}^1=& N{p}_z^2{p}_{z0}(1-p_{z0})p_{vz,vv}G\left({\mu }_z{\eta }_{vz,vv}^B\right).\hfill \end{array}$$

(12)

This side-channel attack is a passive attack on the imperfect implementation of the SNS protocol that applies only an IM since the violation of the security assumption is caused by Alice and Bob themselves. The security of the SNS protocol is not dependent on the channels or detectors. This side-channel attack can be applied as long as the wavelength-spectrum distributions of the signal and decoy states are different. The effect of this attack varies based on the distinguishability of the different states.

4. Numerical Simulations

We numerically simulate the behavior of the SNS protocol with AOPP, which applies an imperfect IM, under the passive frequency-shift attack in this section.

In the actual systems, the key rate under Alice and Bob’s estimation may be affected by the spectral distribution of signal pulses. Ideally, there will be an expected key rate without attack denoted as $R_{ideal}$ when eliminating the effects of the spectral distribution. Here, we ignore the effect of the spectral distribution for simplicity. We suppose that Eve’s target is to acquire more key bits, i.e., lower the upper bound of the secret key rate while maintaining the key rate under Alice and Bob’s estimation constant with the expected key rate. Therefore, Eve need to maximize $R_u$ while keeping $R_e$ equal to the expected key rate $R_{ideal}$ by optimizing the transmittances ${\eta }_{km}^A$ and ${\eta }_{km}^B$, which can be expressed as

$$\underset{{\eta }_{km}^A,{\eta }_{km}^B}{min}{R}_u,\mathrm{s}.\mathrm{t}.R_e=R_{ideal}.$$

(13)

When $R_u$ is lower than $R_e$, it means the final key bits are partially insecure. And the secret key rate is reduced to 0 when $R_u=0$.

For simulation purposes, the experimental parameters listed in

Table 1. List of the experimental parameters. Here, $\gamma$ is the fiber loss coefficient (dB/km), ${\eta }_d$ is the detection efficiency of detectors, $e_d$ is the misalignment-error probability, $f_{\mathrm{EC}}$ is the error-correction inefficiency, $\xi$ is the failure probability of the statistical-fluctuations analysis, $p_d$ is the dark-count rate, M is the number of phase slices, and N is the number of pulses sent at one communication step.

$\mathit{\gamma }$	${\mathit{\eta }}_{\mathit{d}}$	${\mathit{e}}_{\mathit{d}}$	${\mathit{f}}_{\mathbf{EC}}$	$\mathit{\xi }$	${\mathit{p}}_{\mathit{d}}$	M	N
0.2	56%	0.1	1.1	$2.2\times {10}^{-9}$	${10}^{-10}$	16	$1.55\times {10}^{12}$

and

Table 2. List of the experimental parameters about the intensity and probability Alice and Bob select.

${\mathit{\mu }}_{\mathit{a}}$	${\mathit{\mu }}_{\mathit{b}}$	${\mathit{\mu }}_{\mathit{z}}$	${\mathit{p}}_{\mathit{z}}$	${\mathit{p}}_{\mathit{a}}$	${\mathit{p}}_{\mathit{b}}$	${\mathit{p}}_{\mathit{z}0}$
0.1	0.384	0.447	0.776	0.85	0.073	0.732

are taken according to the SNS experiment [36]. The most important of the passive frequency-shift attack is the side channels in the frequency domain. To distinguish the states and obtain raw bits probabilistically, Eve will intercept pulses in three internals $T_z$, $T_a$ and $T_b$. According to our experimental results, the internals are marked in Figure 1b and Figure 3a,b. And the parameters $r_{i|\alpha }$, the proportion if state with intensity ${\mu }_i$ in internals $T_{\alpha }$, are listed in

Table 3. List of the parameter $r_{i|\alpha }$, which is the proportion of the state ${\mu }_i$ in the internal $T_{\alpha }$. The left column indicates the numbers of the groups. The parameters are taken from Figure 1b and Figure 3a,b. The valus in the table are multiplied by 100.

	Width	${\mathit{r}}_{\mathit{z}|\mathit{z}}$	${\mathit{r}}_{\mathit{z}|\mathit{a}}$	${\mathit{r}}_{\mathit{z}|\mathit{b}}$	${\mathit{r}}_{\mathit{a}|\mathit{z}}$	${\mathit{r}}_{\mathit{a}|\mathit{a}}$	${\mathit{r}}_{\mathit{a}|\mathit{b}}$	${\mathit{r}}_{\mathit{b}|\mathit{z}}$	${\mathit{r}}_{\mathit{b}|\mathit{a}}$	${\mathit{r}}_{\mathit{b}|\mathit{b}}$
1	1 ns	3.996	1.367	0.376	3.592	1.531	0.357	4.033	1.225	0.454
2	300 ps	2.071	6.910	2.071	1.325	8.563	1.325	1.958	6.994	1.958
3	100 ps	1.791	6.028	1.616	0.963	8.544	0.911	1.522	6.420	1.618

. Note that the side channels in Table 3 are independent with the experiment [36] which we have discussed at the beginning of Section 3.

Last, we simulate the expected secret key rate without attack $R_{ideal}$, the key rate under Alice and Bob’s estimation $R_e$, and the upper bound of the secret key rate under the frequency-shift attack $R_u$. There are nine parameters should be obtained by statistics in the practical systems, including $n_{\alpha \beta }$ $(\alpha \beta \in S=\{vv,va,av,vb,bv\left\}\right)$, $n_{{\Delta }^{+}}^R$, $n_{{\Delta }^{-}}^L$, $n_t$, and $E_z$. Here, $n_t=n_{\mathrm{sig}}+n_{\mathrm{err}}$ is the length of the raw bits, and $E_z=n_{\mathrm{err}}/n_t$ is the bit-flip error rate of the raw bits, where $n_{\mathrm{sig}}$ and $n_{\mathrm{err}}$ are the number of right and wrong raw bits, respectively. Under the passive frequency-shift attack, these parameters could be simulated as discussed in the Appendix B.

In Figure 5, the estimated key rate $R_e$ under the passive frequency-shift attack represented by the blue solid line is the same as the expected key rate, which means that Eve’s action would not be detected by Alice and Bob. In comparison, the dashed lines represent the upper bounds of the secret key rates $R_{ul}$ ($l\in \{1,2,3\}$) under the frequency-shift attack with the parameters taken from Group l in Table 3. And the details of transmission ${\eta }_{km}^A$ and ${\eta }_{km}^B$ are shown in Appendix C. The effects of the side-channel attack can be analyzed by comparing $R_e$ and $R_{ul}$. Specifically, the upper bounds $R_{u1}$, $R_{u2}$ and $R_{u3}$ are lower than $R_e$ at 230 km, 298 km, and 376 km, respectively. At this time, the final key bits are partially insecure which can be depicted with the upper bounds of the percentage of the secret key bits, defined as $R_{rl}=R_{ul}/R_e$ and shown in Figure 6. And the farther the distance, the smaller the proportion of secret key bits. $R_{u1}$, $R_{u2}$, and $R_{u3}$ are reduced to zero at 412 km, 370 km, and 306 km, respectively, which means no secret-key bits can be distributed when exceeding this distance.

5. Discussion

It is widely known that the inevitable side channels are detrimental to the security of the practical QKD systems. For this reason, how can Eve exploit these side channels and how much the systems may be affected are worth researching. The side-channel attack proposed above on the imperfect implementation of the SNS protocol, which applies an imperfect IM, truly proves that even small side channels at the light source can compromise the secret key rate severely.

We note that there are two key points of the side-channel attack. The first and the most important is the imperfect IM is applied, which produces the decoy and signal states differently in the frequency domain, i.e., the frequency side channels. The second is the long-distance key distribution where the channel attenuation is large enough, which could be utilized by Eve to amplify the effects of the side channels. Since the long-distance key distribution is a primary goal of the SNS protocol, the above attack emphasizes the harmfulness of the side channels specifically and may provide a reference for the practical implementation.

To guarantee the security in the practical systems with the side channels, the first potential way is to improve the experimental techniques or modulation methods to restrain the side channels [57,58]. For example, three IMs can be used to modulate the signal pulses and reference pulses, where the last IM is used to eliminate the side-channels [35,36]. The second alternative is to develop the mathematical models in theory to include the side channels, such as the loss-tolerant method [59,60,61,62,63] with the characterization of the real apparatuses [64]. Finally, it would be a good choice to improve the protocol theoretically to resist the side-channel attack [65]. An ongoing search for the side channels may be needed to guarantee the practical security of QKD systems.

6. Conclusions

The goal of QKD at present is to provide long-distance and high-speed key distribution. Increasing the repetition rate and narrowing the pulse width may make the pulses complex and the parameters, such as the frequency, polarization, and temporal shape, more distinguishable. Any small imperfections may be exploited and enhanced by Eve utilizing the channel loss. Therefore, it is necessary to pay more attenuation to the practical implementations of the TF-QKD systems.

In this paper, we investigate and test the frequency side channels with the external modulation method. The imperfect IM will produce the signal and decoy states distinguishable in the frequency domain. Based on this, we propose a side-channel attack, named the passive frequency-shift attack, on the imperfect implementation of the SNS TF-QKD protocol that applies to the most general case of frequency side channels. Normally, when without the side channels, Alice and Bob could estimate the lower bound of the secret key rate correctly no matter what Eve does. However, this estimation is not accurate once Eve’s operations on the signal and decoy states are different, which may cause insecure bits when the upper bound of the secret key rate is lower than the estimated lower bound. The numerical results quantitatively show the effectiveness of the attack at a long distance if Alice and Bob neglect this distinguishability.

Finally, we note that at present the side channel in the frequency domain can be restrained with more than one IM in the actual QKD systems [35,36]. We test with only one IM in this study just to prove the harmfulness of the side channels and emphasize the practical security of the light source specifically. Our results might provide a reference for the device selection in the practical implementation. The final goal is to build the hardened implementations of the practical QKD systems.