IEEE - Aerospace and Electronic Systems - March 2021 - 45

Amer et al.
network spanning 165 km in total. In this network, neighboring nodes conduct standard QKD protocols to establish
keys between them. For more distant nodes, the nodes
between them are used as trusted nodes.
Another of the SECOQC's innovations is their node
specification and the complementary quantum point to
point protocol (Q3P) [71]. The SECOQC network is comprised of six nodes following this specification, each constructed from different types of QKD hardware, but all of
them working to achieve the three main capabilities of the
SECOQC node modules. Namely, each node must allow
for point-to-point information theoretic secure communication between nodes that are directly linked to that node,
each node must be able to compute an efficient path from
itself to any other reachable node in the network, and
finally, each node must be able to transport secret key
material securely over this path using the trusted nodes
along the path.
Furthermore, these nodes together take part in the
QKD-network layer protocol (QKD-NL). This protocol is
responsible for defining and broadcasting the necessary
information to properly represent the state of the network
and route packets across the network. As noted in [71], it
would be possible to use IPv4 or IPv6 to accomplish this
goal, but as the routing information packets are authenticated using QKD generated key bits, QKD-NL is designed
to be more economic in when and how link announcements are broadcast to be more economic with the keybits, therefore resulting in an overall more efficient
network.
In China, there have been large-scale tests of MDIQKD reliant networks, in a star shaped network in which
a single MDI server is located in the center of a ring of
parties. When two parties would engage, they instead
transmit information to the MDI server which facilitates
the key distribution. Of note is that in this protocol, only
the central MDI server needs to be equipped with SPDs,
which are often the most expensive component in a QKD
network. Such a network was tested in the QKD network
Hefei, China. Also in China, a series of metropolitan
QKD networks were connected over 2000 km with the use
of a QKD backbone. Connecting networks in Beijing,
Hefei, Shanghai, and Jinan, this backbone operators using
the same principles as the Vienna network by utilizing 32
trusted nodes [133]. Importantly, these networks have
begun being tested for use in practical metropolitan applications, paving the way for future advances as the practical limitations of the networks are investigated.

QKD SECURITY: THEORETICAL AND PRACTICAL
As is the case with many other systems, when implementing designs that are theoretically secure, there can be vulnerabilities discovered due to the use of imperfect
MARCH 2021

devices. QKD is no exception to this. There have been discovered several attacks against the actual devices which
we discuss here. We also discuss potential countermeasures.

SIDE-CHANNELS IN THE SOURCE
As discussed in the " Quantum Key Infrastructure " section,
a weak coherent photon source works by attenuating the
laser beam so that with high probability it emits one or no
photons, and with lower probability emits multiple photons. In the case that such a device is used, Eve is able to
compromise the security of the system by blocking pulses
sent from A to B that contain only one photon, and
siphoning off one of the photons contained in the higher
intensity pulses. She can store these extra photons until
the protocol is completed, at which point she is able use
the information transmitted during the key distillation
phase (which, importantly, discloses the correct basis
information) to measure the photons in the correct bases
and thus distill her own copy of the secret key, completely
undetected.
To counter this attack, the decoy state protocol was
introduced which we discussed in the " Quantum Key
Infrastructure " section. Its security depends on E not
being able to determine what A's intensity setting is
(which randomly changes each iteration). However, as
shown in [134], even in cases when decoy states are being
employed, flaws in the implementation can lead to Eve
discovering and abusing side channels to distinguish
between rounds in which Alice prepares a decoy state and
rounds in which she does not. By doing this, Eve is able to
run a PNS attack that bypasses the supposed security
afforded by the decoy states.
Furthermore, in discrete variable protocols utilizing
some kind of weakly coherent source (a common implementation choice in QKD), Alice must attempt to choose
an optimal mean photon number m that should be low
enough to prevent PNS attacks but high enough to counteract the loss in the channel. In [135], it was shown that
by manipulating the channel into temporarily exhibiting a
higher level of loss, an attacker could trick Alice into
choosing a nonoptimal photon number. In many QKD
schemes, a basic assumption is that the mean photon number is low enough that bursts of multiple photons happen
infrequently enough that it is safe to disregard them in the
security analysis. By making Alice increase the mean photon number, Eve makes the assumption invalid and can, as
a result, gain more information on the system than should
be possible otherwise, in some cases gaining full information on the key.

SIDE-CHANNELS IN THE DETECTOR
A clever attacker may also be capable of extracting auxiliary information about the system by exploiting

IEEE A&E SYSTEMS MAGAZINE

IEEE - Aerospace and Electronic Systems - March 2021

Table of Contents for the Digital Edition of IEEE - Aerospace and Electronic Systems - March 2021