Improved security bounds against the Trojan-horse attack in decoy-state quantum key distribution

Abstract

In a quantum Trojan-horse attack (THA), eavesdroppers learn encoded information by injecting bright light into encoded or decoded devices of quantum key distribution (QKD) systems. These attacks severely compromise the security of non-isolated systems. Thus, analytical security bound was derived in previous studies. However, these studies achieved poor performance unless the devices were strongly isolated. Here, we present a numerical method for achieving improved security bound for a decoy-state QKD system under THAs. The developed method takes advantage of the well-established numerical framework and significantly outperforms previous analytical bounds regarding the achievable final key and secure transmitted distance. The results provide a new tool for investigating the efficient security bounds of THA in practical decoy-state QKD systems. This study constitutes an important step toward securing QKD with real-life components.

Appendices

Appendix A: Measurement operator, Kraus operator, key mapping

In this section, we will describe the specific forms of operators required in BB84 and MDI protocols. Our protocol description model is similar to Ref. [55].

1.1 1 BB84

The measurement operator is:

$P_{i}^{A}$	$|0\rangle \langle 0|$	$|1\rangle \langle 1|$	$|2\rangle \langle 2|$	$|3\rangle \langle 3|$
$P_{i}^{B}$	$|Z_{+} \rangle \langle Z_{+}| \oplus 0$	$|Z_{-} \rangle \langle Z_{-}|\oplus 0$	$|X_{+} \rangle \langle X_{+}|\oplus 0$	$|X_{-} \rangle \langle X_{-}|\oplus 0$	$1-\sum _{i=1}^{4}P_{i}^{B}$

The tomographic scanning operator is:

$$\begin{aligned} |i\rangle \left\langle \left. j\right| _{A} \otimes {\mathbb {I}}_{\text{ dim } _{B}}.\right. \end{aligned}$$

(A1)

The Kraus operator is:

$$\begin{aligned} \begin{array}{l} K_{Z}=\left[ \left( \begin{array}{l} 1 \\ 0 \end{array}\right) \otimes \left( \begin{array}{llll} 1 &{} &{} &{} \\ &{} 0 &{} &{} \\ &{} &{} 0 &{} \\ &{} &{} &{} 0 \end{array}\right) +\left( \begin{array}{l} 0 \\ 1 \end{array}\right) \otimes \left( \begin{array}{llll} 0 &{} &{} &{} \\ &{} 1 &{} &{} \\ &{} &{} 0 &{} \\ &{} &{} &{} 0 \end{array}\right) \right] \\ \sqrt{p_{Z}}\left( \begin{array}{lll} 0 &{} &{} \\ &{} 1 &{} \\ &{} &{} 1 \end{array}\right) \otimes \left( \begin{array}{l} 1 \\ 0 \end{array}\right) ,\\ K_{X}=\left[ \left( \begin{array}{l} 1 \\ 0 \end{array}\right) \otimes \left( \begin{array}{llll} 0 &{} &{} &{} \\ &{} 0 &{} &{} \\ &{} &{} 1 &{} \\ &{} &{} &{} 0 \end{array}\right) +\left( \begin{array}{l} 0 \\ 1 \end{array}\right) \otimes \left( \begin{array}{llll} 0 &{} &{} &{} \\ &{} 0 &{} &{} \\ &{} &{} 0 &{} \\ &{} &{} &{} 1 \end{array}\right) \right] \\ \sqrt{p_{X}}\left( \begin{array}{ccc} 0 &{} &{} \\ &{} 1 &{} \\ &{} &{} 1 \end{array}\right) \otimes \left( \begin{array}{l} 0 \\ 1 \end{array}\right) . \\ \end{array} \end{aligned}$$

(A2)

While the key maps are:

$$\begin{aligned} \begin{aligned} Z_{1}&=\left( \begin{array}{ll} 1 &{} 0 \\ 0 &{} 0 \end{array}\right) \otimes {\mathbb {I}}_{{\text {dim}}_{A} \times {\text {dim}}_{B} \times 2}, \\ Z_{2}&=\left( \begin{array}{ll} 0 &{} 0 \\ 0 &{} 1 \end{array}\right) \otimes {\mathbb {I}}_{{\text {dim}}_{A} \times {\text {dim}}_{B} \times 2}. \end{aligned} \end{aligned}$$

(A3)

1.2 2 MDI

The measurement operator is

$P_{i}^{A}$	$|0\rangle \langle 0|$	$|1\rangle \langle 1|$	$|2\rangle \langle 2|$	$|3\rangle \langle 3|$
$P_{i}^{B}$	$|0\rangle \langle 0|$	$|1\rangle \langle 1|$	$|2\rangle \langle 2|$	$|3\rangle \langle 3|$
$P_{i}^{C}\, \left| \Phi ^{+}\right\rangle _{a b}\left\langle \left. \Phi ^{+}\right| _{a b}\right. \, \left| \Phi ^{+}\right\rangle _{a b}\left\langle \left. \Phi ^{+}\right| _{a b}\right. \, 1-\sum _{i=1}^{2} P_{i}^{C}$

The tomographic scanning operator is

$$\begin{aligned} |i\rangle \left\langle \left. j\right| _{A} \otimes \mid k\right\rangle \left\langle \left. l\right| _{B} \otimes {\mathbb {I}}_{\text{ dim } _{C}}.\right. \end{aligned}$$

(A4)

The Kraus operator is

$$\begin{aligned} \begin{array}{l} K_{Z}=\left[ \left( \begin{array}{l} 1 \\ 0 \end{array}\right) \otimes \left( \begin{array}{llll} 1 &{} &{} &{} \\ &{} 0 &{} &{} \\ &{} &{} 0 &{} \\ &{} &{} &{} 0 \end{array}\right) +\left( \begin{array}{l} 0 \\ 1 \end{array}\right) \otimes \left( \begin{array}{llll} 0 &{} &{} &{} \\ &{} 1 &{} &{} \\ &{} &{} 0 &{} \\ &{} &{} &{} 0 \end{array}\right) \right] \\ \otimes \left( \begin{array}{llll} 1 &{} &{} &{} \\ &{} 1 &{} &{} \\ &{} &{} 0 &{} \\ &{} &{} &{} 0 \end{array}\right) \otimes \left( \begin{array}{lll} 1 &{} &{} \\ &{} 1 &{} \\ &{} &{} 0 \end{array}\right) \otimes \left( \begin{array}{l} 1 \\ 0 \end{array}\right) , \\ K_{X}=\left[ \left( \begin{array}{l} 1 \\ 0 \end{array}\right) \otimes \left( \begin{array}{llll} 0 &{} &{} &{} \\ &{} 0 &{} &{} \\ &{} &{} 1 &{} \\ &{} &{} &{} 0 \end{array}\right) +\left( \begin{array}{l} 0 \\ 1 \end{array}\right) \otimes \left( \begin{array}{llll} 0 &{} &{} &{} \\ &{} 0 &{} &{} \\ &{} &{} 0 &{} \\ &{} &{} &{} 1 \end{array}\right) \right] \\ \quad \otimes \left( \begin{array}{llll} 0 &{} &{} &{} \\ &{} 0 &{} &{} \\ &{} &{} 1 &{} \\ &{} &{} &{} 1 \end{array}\right) \otimes \left( \begin{array}{lll} 1 &{} &{} \\ &{} 1 &{} \\ &{} &{} 0 \end{array}\right) \otimes \left( \begin{array}{l} 0 \\ 1 \end{array}\right) . \\ \end{array} \end{aligned}$$

(A5)

While the key maps are

$$\begin{aligned} \begin{array}{l} Z_{1}=\left( \begin{array}{ll} 1 &{} 0 \\ 0 &{} 0 \end{array}\right) \otimes {\mathbb {I}}_{{\text {dim}}_{A} \times {\text {dim}}_{B} \times {\text {dim}}_{C} \times 2}, \\ Z_{2}=\left( \begin{array}{ll} 0 &{} 0 \\ 0 &{} 1 \end{array}\right) \otimes {\mathbb {I}}_{{\text {dim}}_{A} \times {\text {dim}}_{B} \times {\text {dim}}_{C} \times 2}. \end{array} \end{aligned}$$

(A6)

Appendix B: Channel model

In this section, we will provide a description of the channel model used in our simulation. The channels utilized in our simulation include loss, misalignment, and dark count rate channels, which are similar to [55].

1.1 1 BB84

In the WCP source, the output is a coherent state with amplitude of $\mu$. After passing through the misaligned channel, the amplitude reaching each detector can be summarized as

		Bob’s detectors (passive detection)
		$\mathrm {Z_{+}}$	$\mathrm {Z_{-}}$	$\mathrm {X_{+}}$	$\mathrm {X_{-}}$
	$\mathrm {Z_{+}}$	$\sqrt{p_{Z}} \cos \theta$	$\sqrt{p_{Z}} \sin \theta$	$\sqrt{p_{X}} \cos \alpha$	$\sqrt{p_{X}} \sin \alpha \quad \quad \qquad (B1)$
Alice	$\mathrm {Z_{-}}$	$-\sqrt{p_{Z}} \sin \theta$	$\sqrt{p_{Z}} \cos \theta$	$\sqrt{p_{X}} \sin \alpha$	$-\sqrt{p_{X}} \cos \alpha$
sends	$\mathrm {X_{+}}$	$\sqrt{p_{Z}} \sin \alpha$	$\sqrt{p_{Z}} \cos \alpha$	$\sqrt{p_{X}} \cos \theta$	$-\sqrt{p_{X}} \sin \theta$
	$\mathrm {X_{-}}$	$\sqrt{p_{Z}} \cos \alpha$	$-\sqrt{p_{Z}} \sin \alpha$	$\sqrt{p_{X}} \sin \theta$	$\sqrt{p_{X}} \cos \theta$

Here, $\alpha =\frac{\pi }{4} -\theta$, $\theta$ is the misalignment. Considering the channel loss, the loss factor $\sqrt{\mu \eta }$ should be multiplied before the above amplitudes. By considering the dark count, we can get the click probability of each detector:

$$\begin{aligned} p_{j \mid i}^{\text{ click } }=1-\left( 1-p_\textrm{d}\right) \times e^{-\left| \alpha _{j|i}\right| ^{2}}, \end{aligned}$$

(B2)

where $\alpha _{j|i}$ is the amplitude reaching the detector, $p_\textrm{d}$ is the detector dark count rate $i,j\in \left\{ H,V,+,-\right\}$. The probabilities of individual detector clicks are known, for a given i, there could be a total of 4 detectors that will register a click, leading to 16 possible detection patterns. The probability of each detection pattern $b_{1} b_{2} b_{3} b_{4}$ is represented by

$$\begin{aligned} p_{b_{1} b_{2} b_{3} b_{4} \mid i}=\Pi _{j=1,2,3,4}\left\{ \overline{b_{j}}+p_{j \mid i}^{\text{ click } }(-1)^{\overline{b_{j}}}\right\} , \end{aligned}$$

(B3)

where $b_{k}$ represents the response of the k detectors, $b_{k}=0,1$. $\overline{b_{k}}$ is the bit flip of $\overline{b_{k}}$.

For a given signal intensities $\mu$ ($\mu \in \left\{ u, v, w \right\}$), iterate through all the i and all of the detection mode to obtain $4\times 16$ data, and then write it into a matrix $P_{raw,\mu }$ with $4\times 16$ data.

Suppose that double-click events on the same basis are randomly assigned to a measurement value, while double-click events on different basis are discarded. The following deletion model is defined:

$$\begin{aligned} \begin{aligned} M_{H}&=[0,0,0,0,0,0,0,0,1,0,0,0,0.5,0,0,0] \\ M_{V}&=[0,0,0,0,1,0,0,0,0,0,0,0,0.5,0,0,0] \\ M_{+}&=[0,0,1,0.5,0,0,0,0,0,0,0,0,0,0,0,0] \\ M_{-}&=[0,1,0,0.5,0,0,0,0,0,0,0,0,0,0,0,0] \\ M_{\varnothing }&=[1,0,0,0,0,1,1,1,0,1,1,1,0,1,1,1] \\ M&=\left[ M_{H}^{T}, M_{V}^{T}, M_{+}^{T}, M_{-}^{T}, M_{\varnothing }^{T}\right] . \end{aligned} \end{aligned}$$

(B4)

Then the simulated statistical data can be given by

$$\begin{aligned} P_{\mu }=P_{\text{ raw } , \mu } \times M. \end{aligned}$$

(B5)

1.2 2 MDI

In the case of MDI, the WCP source of Alice and Bob transmits a weak coherent state with amplitude of $\mu$. After passing through the misaligned channel, the signals of Alice and Bob are mismatched $\theta _{A}$, $\theta _{B}$. Because H and V are different modes, we can simply think of $\sqrt{\mu _{A}} \cos \theta _{A}$ in H mode (similar to Alice and Bob), $\sqrt{\mu _{A}} \sin \theta _{A}$ in mode V(Alice and Bob are similar); then, the amplitude reaching each detector is expressed as follows:

$$\begin{aligned} \begin{aligned} \alpha _{3 H}^{\phi }&=\sqrt{\mu _{A} \eta _{A} \cos \theta _{A} / 2}+i \sqrt{\mu _{B} \eta _{B} \cos \theta _{B} / 2} e^{i \phi } \\ \alpha _{4 H}^{\phi }&=i \sqrt{\mu _{A} \eta _{A} \cos \theta _{A} / 2}+\sqrt{\mu _{B} \eta _{B} \cos \theta _{B} / 2} e^{i \phi } \\ \alpha _{3 V}^{\phi }&=\sqrt{\mu _{A} \eta _{A} \sin \theta _{A} / 2}+i \sqrt{\mu _{B} \eta _{B} \sin \theta _{B} / 2} e^{i \phi } \\ \alpha _{4 V}^{\phi }&=i \sqrt{\mu _{A} \eta _{A} \sin \theta _{A} / 2}+\sqrt{\mu _{B} \eta _{B} \sin \theta _{B} / 2} e^{i \phi }. \end{aligned} \end{aligned}$$

(B6)

Then the click probability of each detector can be given by

$$\begin{aligned} p_{k \mid i j}^{\text{ click } , \phi }=1-\left( 1-p_\textrm{d}\right) \times e^{-\left| \alpha _{k \mid i j}^{\phi }\right| ^{2}}, \end{aligned}$$

(B7)

where $\alpha _{k \mid i j}^{\phi }$ is the amplitude reaching the detector, $i,j\in \left\{ H,V,+,-\right\}$, $k\in \left\{ 3\,H,3V,4\,H,4V\right\}$.

For fixed i, j, a total of 4 detectors may respond, which results in a total of 16 possible detection modes. The response probability of each detection mode $b_{1} b_{2} b_{3} b_{4}$ is given by

$$\begin{aligned} p_{b_{1} b_{2} b_{3} b_{4} \mid i j}=\prod _{k=1,2,3,4}\left\{ \overline{b_{k}}+p_{k \mid i j}^{\text{ click } }(-1)^{\overline{b_{k}}}\right\} , \end{aligned}$$

(B8)

where $b_{k}$ represents the response of the k detectors, $b_{k}=0,1$. $\overline{b_{k}}$ is the bit flip of $\overline{b_{k}}$.

For a given signal intensities $\mu _{A}\mu _{B}$ ($\mu _{A},\mu _{B} \in \left\{ u, v, w \right\}$), traverse all i, j and detection modes, there are $4\times 4\times 16$ data in total. Write the data as $P_{raw,\mu _{A}\mu _{B}}$ and define the following deletion model

$$\begin{aligned} \begin{aligned} M_{\Psi ^{-}}&=[0,0,0,0,0,0,1,0,0,1,0,0,0,0,0,0] \\ M_{\Psi ^{+}}&=[0,0,0,1,0,0,0,0,0,0,0,0,1,0,0,0] \\ M_{\varnothing }&=1_{1 \times 16}-M_{\Psi ^{+}}-M_{\Psi ^{-}} \\ M&=\left[ M_{\Psi ^{-}}^{T}, M_{\Psi ^{+}}^{T}, M_{\varnothing }^{T}\right] . \end{aligned} \end{aligned}$$

(B9)

Then the simulated statistical data can be given by

$$\begin{aligned} P_{\mu _{A} \mu _{B}}=P_{\text{ raw, } \mu _{A} \mu _{B}} \times M. \end{aligned}$$

(B10)