Open Access
Add to BibSonomy
Abstract
We investigate the secret key rates for the recently proposed intensity-modulated dual-threshold key distribution [T. Ikuta and K. Inoue, New J. Phys. 18, 013018 (2016) [CrossRef] ] under beam splitting attacks. We show that previous assumptions on an eavesdropper that performs hard decision measurements on the channel, overestimates the secret key rate. We discuss the impact of an eavesdropper that can measure full soft information and give the secret key rates under forward and reverse reconciliation. Further, we perform simulations for different system assumptions and show the optimal modulation depths for these systems. We also outline an attack on this protocol based on photon counting that prohibits secret key generation.
© 2018 Optical Society of America under the terms of the OSA Open Access Publishing Agreement
1. Introduction
Secure communication is an increasingly important topic and different levels of encryption, ranging from application layer security to physical layer security (PLS), are currently receiving a lot of research attention. Typically, encryption technologies can be divided into two groups; security based on computationally hard problems and information theoretic security. The currently employed encryption techniques are in the former group, such as RSA or Advanced Encryption Standard (AES), and are applied in the upper parts of the network layers. One fundamental problem of any encryption scheme is how to secretly share a key between two remote parties (often referred to as Alice and Bob) without an interfering party (typically denoted Eve) gaining sufficient information of the key. Information theoretic secure key distribution techniques are so far realized in the physical layer, and are often referred to as physical layer security (PLS) [1]. Conventional PLS is based on designing forward error correction (FEC) coding schemes under different assumptions of the wiretap channel [2] such that the communicating parties can be sure that an eavesdropper cannot decode the wiretapped signal without significant errors [3–5].
For optical communication, PLS protocols can be divided into two groups; classical PLS and quantum key distribution (QKD) techniques. A range of different classical PLS methods have been suggested for optical fiber networks [6, 7] as well as free space optical links [5, 8]. Further, there also exists a branch of classical PLS which does not rely on information theoretic security but rather employ modulation or hardware that is hard for an interfering party to model or replicate. Examples of such are information scrambling [9], chaos based communication [10], stealth transmission using optical phase masks [11] or physically unclonable medium such as spatial light modulators [12].
For QKD techniques on the other hand, security is assured under any physically realizable attack on the channel. In this case, two legitimate parties can share a secret random bit string where any possible eavesdropping attack by a third party can either be detected or proven to not compromise the security [13]. Many different techniques and protocols exist which typically can be divided into discrete variable protocols operating with single photon detectors [14], or continuous variable protocols [15, 16] operating with shot-noise limited coherent receivers. Overall, QKD has attracted a lot of both academic and industrial research attention over the last decade [13, 17–19].
A common factor for different QKD technologies is the relatively high complexity of realizing such systems. Recently, a key distribution protocol based on intensity modulated and direct detection has been proposed as a low-complexity alternative [20]. The security relies on transmitting two non-orthogonal intensity states where the receiver applies direct detection with a dual threshold detector where only reliable detection events are kept, similar to the sifting process of conventional QKD protocols. The lower complexity comes from that only intensity modulation is required in the transmitter, and the receiver can be implemented with a single conventional photo-diode. However, such scheme is not yet proven to have similar security as conventional QKD protocols; it is yet not known how to perform channel estimation and hence we refer to this scheme as PLS in this paper. Further, in section 4 of this manuscript we show an attack that makes it impossible to generate secure keys. The intensity modulated/direct detection (IMDD) key distribution technique has been studied for free space optical links [21–23] where high secret key rates can be achieved under relaxed assumptions of how and where an eavesdropper can interact with the channel.
In previous works [20–23], both Bob and Eve are assumed to make hard decision measurements on the channel, i.e. their receivers work on bit level with binary information. While this assumption can be justified for Bob, given that the scheme is developed as a low complexity solution, the same is not true for Eve. In the case of Eve, as will be shown in this paper, her receiver can apply soft measurements on the channel observations which always yields higher (or equal) information compared to the hard measurement case.
In this paper, we discuss the impact on the secret key rates (SKRs) when Eve is allowed to make soft measurements on the channel under the beam splitting attack. We show that when assuming an eavesdropper that is restricted to hard decisions, the SKR is severely overestimated. We also show that reverse reconciliation is beneficial over the previously discussed forward reconciliation case. Finally, we show in simulations the optimal modulation depth for different channel losses and discuss the impact of our findings.
2. Intensity modulated dual-threshold detection key distribution - information rates
In intensity modulated dual-threshold detection key distribution (IMDTD-KD), Alice modulates the intensity of a laser source with a modulation depth, denoted δ, as indicated in Fig. 1. We assume that her binary source is random and with uniform probability. The general scheme has been described in [20]. Bob sets two thresholds on his received signal, where detection events above and below the two thresholds are considered as a detected signal while detection events in-between the two thresholds are considered erased. To simplify the calculations we will make some approximations to the system in [20]. We approximate the variance to be the same for the two intensity levels. Since the shot noise is intensity dependent, this is only viable if δ is small. However, as we will see, for any practical scenario with positive SKR, δ will always be extremely small. From this approximation, we can also assume that Bob’s thresholds are uniformly chosen around the mean intensity µ, i.e. given as µ ± d.
Fig. 1 Conceptual sketch of the modulation scheme used in IMDTD-KD. δ is the modulation depth, d the symmetric threshold chosen by Bob, and µ is the mean intensity.
The signal transmitted by Alice is given as
where b ∈ {−1, 1} is given by a random bit stream with uniform probability, and µ is the average optical intensity of the transmitted signal.In this paper, we investigate the beam splitting attack which is illustrated in Fig. 2. The channel is simply given by the transmittance T where all the loss of the channel is assumed to benefit Eve. The power received by Bob is PBob = TPAlice where PAlice is the transmitted power by Alice. The power received by Eve is then simply PEve = (1 − T)PAlice. The signal seen after Bob’s detector is then given as
where is Bob’s noise variance. The thermal noise is given as , where kB is the Boltzmann constant, TK is the temperature, RL is the load resistance, and RB is the bandwidth. The shot noise is given as , where e is the electron charge, ip = PBobℜBob is Bob’s detected photo current. ℜBob denotes the responsivity of Bob’s detector.For Eve’s receiver, we assume a perfect detector, i.e. the detector has 100% quantum efficiency which gives a responsivity given as , where h is Planck’s constant, and v the frequency of the transmitter laser. Further, we assume that Eve’s detector does not suffer from any thermal noise. Eve’s received signal is then given as
where where the detected current of Eve is given as ip,Eve = PEveℜEve.2.1. Bob: hard-decision
When Bob is applying a hard-decision receiver, which is the case investigated in [20, 21, 23], the detection events below the lower level is detected as bit = “0”, detection events above the upper level is detected as bit = “1”, and anything in-between the two thresholds is denoted as an erasure. Bob’s received signal can then be described as the binary symmetric channel with erasures shown in Fig. 3.
The binary mutual information [24] between Alice and Bob is given by
where p and q are the error and erasure probabilities, respectively, as indicated in Fig. 3.2.2. Eve: hard-decision
The assumption in [20, 21, 23], is that Eve also applies a hard decision detector. In that case it can be shown that the optimal detection strategy for Eve is to put a single detection threshold at the mean intensity of the received signal [20]. This can easily be understood from the fact that making erasures at Eve’s side can never increase the information rate as her noise is independent from Bob’s noise. The received hard-decision signal can then be described as a binary symmetric channel given in Fig. 4. The binary mutual information between Alice and Eve is given by
where pE is Eve’s probability of bit error, as shown in Fig. 4. Note that the location of the erased symbols will be known to Eve during the reconciliation phase, and thus her information rate is also degraded by (1 − q).2.3. Eve: soft-decision
However, opposed to what has previously been investigated for IMDTD-KD [20, 21, 23], Eve is not restricted to perform hard-decisions on the channel. In forward reconciliation, Eve’s information rate is independent of if Bob is making hard or soft measurements on the channel. The correct measure of Eve’s obtained information in passive beam splitting attacks is the soft mutual information given as
where is the channel transition probability distribution seen by Eve and the channel output probability density seen by Eve. Note that Eve’s information rate depends on Bob’s erasure probability due to the fact that only the received symbols that were not erased are used in the key distillation process. The erasures directly reduce the information rate [25]. It can be shown that ISD(A; E) ≥ IHD(A; E), i.e. assuming that Eve is performing hard decisions will always underestimate her information rate.We will also consider the case of reverse reconciliation when Eve is making soft decisions but Bob is applying a hard decision receiver. In this case the mutual information between Eve and Bob is given by
where is Bob’s estimated transmitted signal, which directly depends on Bob’s detected bit sequence, i.e. it contains symbol errors with a rate p.2.4. Bob: soft-decision
Also Bob can benefit from performing soft-decisions on his channel with erasures.
where, as in the case of Eve, is the channel transition probability distribution seen by Bob and the channel output probability density seen by Bob. Again, it can be shown that ISD(A; B) ≥ IHD(A; B), i.e., Bob can never increase the information rate by performing hard decisions.3. Secret key rates
Given the information rates derived in the previous section, we can calculate the secret key rates (SKRs) for different assumptions on the system. To get an upper bound, we will assume that the reconciliation efficiency is 100%. First, the SKR in forward (direct) reconciliation when assuming that both Bob and Eve are making hard decisions is given as
If we instead assume that Eve is making soft decisions on the channel, the SKR is given as
Already now we can say that
since we know that ISD(A; E) ≥ IHD(A; E). However, in the simulation section we will see more quantitatively the difference for different channel assumptions.We will also investigate the scenario when Bob makes soft decisions in the case of direct reconciliation. In this case, the SKR is given as
For the reverse reconciliation case, we assume Eve is making soft decisions but Bob is applying a hard-decision receiver. In this case, the secret key rate is given as
Note that in this case, Eve’s measurements are performed on the signal transmitted by Alice but the relevant quantity is the mutual information between Bob and Eve (due to the reverse reconciliation). However, Bob’s binary sequence may contain bit-errors, i.e. Eve is measuring y(x) but trying to maximize the information of , where is Bob’s hard-decision estimation of x.
4. Remark on a more powerful attack
We remark that in principle there exists a more effective attack which prohibits Alice and Bob to share keys with proven security. Consider the intercept-resend attack where Eve applies a lossy channel with transmittance T to the signals and then measure them by an ideal detector which can count the number of photons in the signal with 100% quantum efficiency. She then retransmit the photon number state |n〉, where n is the number of detected photons, which is detected by Bob’s (maybe) imperfect detector. This attack is possible since Bob is applying a square law detector, i.e. only the absolute intensity is monitored, and the interference by Eve affects the phase of the retransmitted states only.
To consider the worst case to Eve, assume that Bob’s detector is fully isolated from Eve. Denote Alice, Bob and Eve’s measured information as A, B, and E. First, Alice and Bob cannot distinguish if the channel is a simple lossy channel or it contains Eve’s intercept-resend attack as they give exactly the same intensity distribution. Second, by applying this attack, Eve’s information can always be greater than the information shared by Alice and Bob. More precisely, I(A; E), I(E; B) ≥ I(A; B) always holds and thus both the forward and reverse reconciliation key rates can never be positive. The inequalities are justified as follows. I(A; E) ≥ I(A; B) is the direct consequence of the data processing inequality for the mutual information. I(E; B) ≥ I(A; B) follows from the data processing inequality, I(AE; B) ≥ I(A; B), and the fact that I(E; B) = I(AE; B) holds since A, E, and B form the Markov chain A–E–B. This attack is effective since the protocol does not have an ability to estimate the phase information of the channel. Hence, we cannot label this protocol as quantum key distribution. However, intensity modulated key distribution is still an interesting technology targeting practical applications where assumptions on the power of Eve’s abilities can be made. For instance, at present, it is highly unlikely that Eve holds the kind of detectors and sources described above.
5. Simulations
To evaluate the difference in SKR for the different scenarios, we perform simulations for a system with the values given in Table 1. In this section, we assume the repetition rate to be 1 GHz. Note that we assume 100% reconciliation efficiency in the simulations. In these simulations we fix the transmittance of the channel, we then sweep the modulation depth δ, and for each value of δ we optimize the threshold d.
Table 1. Simulation Parameters
The results for Tch = 0.65 is shown in Fig. 5 for the different investigated SKR cases. We first note that when we correctly assumes that Eve can make soft measurements on the channel, the difference in SKRs between the case when Bob is making hard or soft measurements in forward reconciliation is negligible. Our second observation is that when we wrongly assume that Eve is restricted to hard measurements on the channel in the forward reconciliation case, the SKR is severely overestimated, for this particular case by 0.027 bit/symbol compared to the case when Eve is making soft measurements of 0.011 bit/symbol. Finally, we also plot the case with reverse reconciliation where Bob is making hard measurements and as seen this case outperforms the forward reconciliation case with a SKR of 0.070 bit/symbol.
Fig. 5 Secret key rate (SKR) as a function of modulation depth δ. The threshold d is optimized for each value of δ. The channel transmittance is T = 0.65 and the bandwidth is RB = 1 GHz.
In Fig. 6, we plot the results for Tch = 0.40, with the other parameters kept the same as in the previous results. As expected, the forward reconciliation cases are not able to generate a secure key at this channel transmittance. However, with reverse reconciliation we can still generate a key with a SKR of maximum 0.019 bit/symbol using a modulation depth δ of 1.7 × 10−3.
Fig. 6 Secret key rate (SKR) as a function of modulation depth δ. The threshold d is optimized for each value of δ. The channel transmittance is T = 0.40 and the bandwidth is RB = 1 GHz.
5.1. Bandwidth dependence
Given that the modulation depth at 1 GHz is very small which might be unpractical, we were interested in investigating the impact of receiver bandwidth on the SKR and the optimal modulation depth. In this case, we keep all the parameters in Table 1 fixed, except the bandwidth which is sweep from 1 GHz to 50 GHz. Note that in our simulations, the bandwidth only affects the noise of Bob’s and Eve’s receivers. The results are shown in Fig. 7 where the SKR is plotted as a function of both bandwidth and modulation depth δ. Note that for each case, we optimize over the decision threshold d. As seen, the maximum SKR in bit/symbol is not affected by the bandwidth (although the final key rate is the SKR in bit/symbol times the bandwidth). However, increasing the bandwidth increases the optimal modulation depth δ and it also increases the span of modulation depth that gives SKR close to the optimum. However, even at very high bandwidths the optimal modulation depth is only in the order of 1.5 % of the intensity.
Fig. 7 Secret key rate (SKR) as a function of bandwidth and modulation depth δ. For each point, the threshold d is optimized. Channel transmittance is Tch = 0.65.
5.2. Power dependence
From Eq. (3) it is clear that increasing the optical power will increase the ratio of shot noise compared to thermal noise since the thermal noise is independent of the optical signal. Further, since Eve is assumed to only suffer from shot noise, changing the optical power means that the ratio of the noise for Bob compared to Eve is changing with launched power. In Fig. 8, the variance for Bob (black) and Eve (orange) is plotted as a function of launched optical power for Tch = 0.40 (solid lines), Tch = 0.65 (dashed lines), and Tch = 0.80 (dotted lines). From a pure noise perspective, it is beneficial to increase Alice’s launched power since the difference between Bob’s and Eve’s variance decreases with power.
Fig. 8 Variance as a function of launched optical power for Tch = 0.40 (solid lines) and Tch = 0.65 (dashed lines) and Tch = 0.80 (dotted lines) for Bob (black) and Eve (orange).
However, the launched optical power also affects the optimal modulation depth as shown in Fig. 9. If both Bob and Eve possess perfect receivers (i.e. no thermal noise and 100% quantum efficiency), the optimal modulation depth is decreasing with transmitted power. The maximum SKR is more or less constant over the span of transmitted powers we investigate, see Fig. 10 when both Bob and Eve have ideal receivers. However, if consider a realistic detector for Bob (same as previous, see Table 1) and ideal detector for Eve, we see that the SKR increases with launched power. Indeed the performance of a realistic system is then a trade-off between what modulation depth that can realistically be implemented and the maximum power. If considering fiber optical links, for higher launch powers Kerr nonlinearities will also be a limited factor which is out of the scope of this paper.
Fig. 9 Optimal modulation depth δ as a function of Alice’s transmitted power for reverse reconciliation showing the case when Bob has an ideal receiver (dashed black line) and a realistic receiver (green solid line). Channel transmittance is Tch = 0.65.
Fig. 10 Maximum secret key rate as a function of Alice’s transmitted Power for forward reconciliation (yellow lines) and reverse reconciliation (pink lines) shown when Bob’s receiver is deal (dotted lines) or realistic (solid lines). Channel transmittance is Tch = 0.65.
6. Remarks
It turns out that under the assumptions investigated in this paper, very small modulation depths are required to obtain positive secret key rates. We remark that such small modulation signals might be very challenging to implement experimentally when nonidealities, such as modulator bias and laser power fluctuations, are present. Future work should investigate the required modulation depth under more relaxed assumptions of the eavesdropper, such as for instance assuming that an eavesdropper cannot be present within the main beam of a free-space channel.
7. Conclusions
Assuming that Eve is restricted to hard decisions severely underestimates the information rate that an eavesdropper can obtain under individual beam splitting attacks. We have given secret key rates under the more realistic assumption that Eve always can make soft measurements on the channel even if Bob by choice restricts his receiver to hard measurements. For beam splitting attacks, we have shown that reverse reconciliation achieves higher secret key rates compared to forward reconciliation when Bob’s receiver is hard decision. One concern for practical implementation is the fact that the optimal modulation depth is very small, around 0.2% for 1 GHz bandwidth and channel transmittance of 0.65. This can be slightly increased by applying higher bandwidth, however only to around 1.5%. For realistic systems, the SKR is a trade-off between launched optical power and how small modulation depth that is practically achievable.
Funding
ImPACT Program of Council for Science, Technology, and Innovation, Japan; Japan Society for the Promotion of Science (JSPS) KAKENHI (18H01157).
Acknowledgments
The authors would like to thank Alberto Carrasco-Casado and Mikio Fujiwara for fruitful discussions.
References and links
1. M. Bloch and J. B. Matthieu, Physical-layer security: From information theory to security engineering(Cambridge University Press, 2011). [CrossRef]
2. A. D. Wyner, “The wire-tap channel,” Bell Labs Technical Journal 54(8), 1355–1387 (1975). [CrossRef]
3. R. Ahlswede and I. Csiszár, “Common randomness in information theory and cryptography. I. Secret sharing,” IEEE Transactions on Information Theory 39(4), 1121–1132 (1993). [CrossRef]
4. M. Bloch, M. Hayashi, and A. Thangaraj, “Error-control coding for physical-layer secrecy,” Proc. of the IEEE 103(10), 1725–1746 (2015). [CrossRef]
5. H. Endo, M. Fujiwara, M. Kitamura, T. Ito, M. Toyoshima, Y. Takayama, H. Takenaka, R. Shimizu, N. Laurenti, G. Vallone, P. Villoresi, T. Aoki, and M. Sasaki, “Free-space optical channel estimation for physical layer security,” Opt. Express 24(8), 8940–8955 (2016). [CrossRef] [PubMed]
6. M. P. Fok, Z. Wang, Y. Deng, and P. R. Prucnal, “Optical layer security in fiber-optic networks,” IEEE Trans. Inf. Forensics Security 6(3), 725–736 (2011). [CrossRef]
7. V. Forutan, R. Elschner, C. Schmidt-Langhorst, C. Schubert, and R. F. H. Fischer, “Towards information-theoretic security in optical networks,” Photonic Networks; 18. ITG-Symposium, 64–70 (2017).
8. J. F. Lopez-Martinez, G. Gomez, and J. M. Garrido-Balsells, “Physical-layer security in free-space optical communications,” IEEE Photon. J 7(2), 7901014 (2015). [CrossRef]
9. J. Cho, K. Guan, S. Chandrasekhar, and P. J. Winzer, “Experimental demonstration of physical-layer security in a fiber-optic link by information scramblings,” Proc. European Conference on Optical Communication (ECOC), paper W.4.P 1.SC5.55, (2016).
10. A. Argyris, D. Syvridis, L. Larger, V. Annovazzi-Lodi, P. Colet, I. Fischer, J. Garcia-Ojalvo, C.R. Mirasso, L. Pesquera, and K.A. Shore, “Chaos-based communications at high bit rates using commercial fibre-optic links,” Nature 438(17), 343–346, (2005). [CrossRef] [PubMed]
11. E. Wohlgemuth, Y. Yoffe, T. Yeminy, Z. Zalevsky, and D. Sadot, “Demonstration of coherent stealthy and encrypted transmission for data center interconnection,” Opt. Express 26(6), 7638–7645 (2018). [CrossRef] [PubMed]
12. S. Goorden, M. Horstmann, A. Mosk, B. Škorić, and P. Pinkse, “Quantum-secure authentication of a physical unclonable key,” Optica 1(6), 421–424 (2014). [CrossRef]
13. E. Diamanti, H-K. Lo, B. Qi, and Z. Yua, “Practical challenges in quantum key distribution,” npj Quantum Information 2, 16025 (2016). [CrossRef]
14. C. H. Bennett and G. Brassard, “Quantum cryptography: Public key distribution and coin tossing,” Int. Conf. on Computer System and Signal Processing 560, 175–179 (1984).
15. F. Grosshans and P. Grangier, “Continuous variable quantum cryptography using coherent states,” Phys. Rev. Lett. 88(5), 057902 (2002). [CrossRef] [PubMed]
16. R. Namiki and T. Hirano, “Security of quantum cryptography using balanced homodyne detection,” Phys. Rev. A 67(2), 022308 (2003). [CrossRef]
17. R. Alléaume, J. Bouda, C. Branciard, T. Debuisschert, M. Dianati, N. Gisin, M. Godfrey, P. Grangier, T. Länger, A. Leverrier, N. Lütkenhaus, P. Painchault, M. Peev, A. Poppe, T. Pornin, J. Rarity, R. Renner, G. Ribordy, M. Riguidel, L. Salvail, A. Shields, H. Weinfurter, and A. Zeilinger, “SECOQC white paper on quantum key distribution and cryptography,” White Paper Secoqc-WP-v5, (2007).
18. R. Alléaumea, C. Branciard, J. Bouda, T. Debuisschert, M. Dianati, N. Gisin, M. Godfrey, P. Grangier, T. Länger, N. Lütkenhaus, C. Monyk, P. Painchault, M. Peev, A. Poppe, T. Pornin, J. Rarity, R. Renner, G. Ribordy, M. Riguidel, L. Salvail, A. Shields, H. Weinfurter, and A. Zeilinger, “Using quantum key distribution for cryptographic purposes: A survey,” Theoretical Computer Science 560, 62–81 (2014). [CrossRef]
19. M. Sasaki, M. Fujiwara, H. Ishizuka, W. Klaus, K. Wakui, M. Takeoka, S. Miki, T. Yamashita, Z. Wang, A. Tanaka, K. Yoshino, Y. Nambu, S. Takahashi, A. Tajima, A. Tomita, T. Domeki, T. Hasegawa, Y. Sakai, H. Kobayashi, T. Asai, K. Shimizu, T. Tokura, T. Tsurumaru, M. Matsui, T. Honjo, K. Tamaki, H. Takesue, Y. Tokura, J. F. Dynes, A. R. Dixon, A. W. Sharpe, Z. L. Yuan, A. J. Shields, S. Uchikoga, M. Legré, S. Robyr, P. Trinkler, L. Monat, J.-B. Page, G. Ribordy, A. Poppe, A. Allacher, O. Maurhart, T. Länger, M. Peev, and A. Zeilinger, “Field test of quantum key distribution in the Tokyo QKD Network,” Opt. Express 19(11), 10387–10409 (2011). [CrossRef] [PubMed]
20. T. Ikuta and K. Inoue, “Intensity modulation and direct detection quantum key distribution based on quantum noise,” New Journal of Physics 18, 013018 (2016). [CrossRef]
21. P. V. Trinh, T. V. Pham, H. V. Nguyen, S. X. Ng, and A. T. Pham, “Performance of free-space QKD systems using SIM/BPSK and dual-threshold/direct-detection,” IEEE Globecom, Workshop on Quantum Communications and Information Technology, (2016).
22. P. V. Trinh and A. T. Pham, “Design and secrecy performance of novel two-way free-space QKD protocol using standard FSO systems,” Proc. IEEE International Conference on Communications (ICC), 929–934 (2017).
23. P. V. Trinh, T. V. Pham, N. T. Dang, H. V. Nguyen, S. X. Ng, and A. T. Pham, “Design and security analysis of quantum key distribution protocol over free-space optics using dual-threshold direct-detection receiver,” IEEE Access 6, 4159–4175 (2018). [CrossRef]
24. T. M. Cover and J. A. Thomas, Elements of Information Theory, 2 ed. (Wiley, New York, NY, USA2006).
25. D. Julian, “Erasure networks,” IEEE International Symposium on Information Theory,138 (2002). [CrossRef]
