# Randomized ancillary qubit overcomes detector-control and intercept-resend
hacking
of quantum key distribution

Salem F. Hegazy
National Institute of Laser Enhanced Sciences,
Cairo University,
Giza 12613, Egypt
<EMAIL_ADDRESS>
&Salah S. A. Obayya
Center for Photonics and Smart Materials,
Zewail City of Science and Technology,
Giza 12578, Egypt
<EMAIL_ADDRESS>
&Bahaa E. A. Saleh
CREOL, The College of Optics & Photonics,
University of Central Florida,
Orlando, FL, 32816, USA
<EMAIL_ADDRESS>

###### Abstract

Practical implementations of quantum key distribution (QKD) have been shown to
be subject to various detector side-channel attacks that compromise the
promised unconditional security. Most notable is a general class of attacks
adopting the use of faked-state photons as in the detector-control and, more
broadly, the intercept-resend attacks. In this paper, we present a simple
scheme to overcome such class of attacks: A legitimate user, Bob, uses a
polarization randomizer at his gateway to distort an ancillary polarization of
a phase-encoded photon in a bidirectional QKD configuration. Passing through
the randomizer once on the way to his partner, Alice, and again in the
opposite direction, the polarization qubit of the genuine photon is immune to
randomization. However, the polarization state of a photon from an intruder,
Eve, to Bob is randomized and hence directed to a detector in a different
path, whereupon it triggers an alert. We demonstrate theoretically and
experimentally that, using commercial off-the-shelf detectors, it can be made
impossible for Eve to avoid triggering the alert, no matter what faked-state
of light she uses.

##  1 Introduction

The unconditional security offered by quantum key distribution (QKD) relies on
laws of quantum physics [1, 2], which dictate that any attempt by an adversary
to know about the secret key, would inevitably introduce disturbance that
alerts the legitimate parties [3, 4]. This ultimate information-theoretic
security has been proved for idealized devices [4, 5, 6] and also under semi-
realistic conditions [7, 8, 9]. In practice, however, real-life components of
QKD systems may deviate from these idealized theoretical models, or encounter
new scenarios, offering effective vulnerabilities to the adversary.

For instance, the imperfect preparation of the single-photon state may lead to
leaking information about the key. This gap between theory and real-life
practice allows for a plethora of source-side attacks ranging from the photon-
number-splitting (PNS) attack [10, 11], the phase-remapping attack [12, 13],
the wavelength-selected photon-number-splitting attack [14], and the pattern-
effect attack [15], to the nonrandom-phase attacks based on unambiguous-state-
discrimination [16], and laser seed control [17, 18, 19].

Compared to the source-side attacks, imperfections on the detection side are
known to show much higher vulnerability to quantum hacking [20]. For example,
detector imperfections such as breakdown fluorescence [21], finite
($\sim\mu$s) dead time [22], nonzero dark counts, less-than-unity efficiency,
and nonfixed efficiency within the gate time [23], all of which can be
exploited by Eve to compromise QKD security. This leads in practice to a
significant number of potential attacks such as detector fluorescence [24],
faked-state [25, 26], time-shift [27, 23], time-side-channel [28], channel
calibration [29], laser damage [30, 31], spatial mismatch [33, 32], detector
saturation [34], and polarization shift [35] attacks. More interestingly, the
single-photon detectors (SPDs) of the receiver (Bob), normally operating in
the Geiger mode [36], can be turned by Eve into linear mode, which allows for
various blinding and remote-control attacks [37, 38, 39, 40, 41, 42, 43, 44].
Among the detection-side attacks, the latter is widely known to be the most
powerful [20], with successful demonstrations on various types of SPDs,
including passively and actively quenched avalanche photodetectors (APDs) [37,
45], gated/non-gated APDs [46, 38], and superconducting nanowire single-photon
detectors (SNSPDs) [47].

Since the inception of quantum encryption [1], the intercept-resend strategies
have been developed through many quantum hacking paradigms. Its original
version based on resending single photons was easily neutralized by QKD [3].
Employing detector imperfections, more crafty intercept-resend versions have
evolved via resending faked multiphoton states either solitarily (e.g., the
after-gate attack [42], the faint-after-gate attack [47], and the detector-
control attack under specific laser damage [30]) or teamed with a blinding
light (e.g., continuous-wave blinding attack [38, 39], sinkhole blinding
attack [48], thermal blinding attack [48, 45], and pulsed illumination attack
[44]).

Currently, there exist two main approaches against the intercept-resend and
detector-control hacking strategies. The first is based on monitoring some
detector measures, such as its photocurrent, for anomalously excessive values
[49, 50, 51]. This includes also observing the detector’s count rates versus
random variations of either the detection efficiency [52, 53], or the
attenuation in front of the detector [54]. These security patches could defeat
the original attacks they were designed for, but unfortunately they fail
against subsequent ad-hoc modified attacks [46, 55].

The second is the measurement-device-independent QKD (MDI-QKD) approach [56],
which enables elimination of all detector side-channels [57], offering
security regardless of the nature of the detection apparatus. However, MDI QKD
builds on performing a remote Bell-state measurement, which requires high-
visibility two-photon interference between independent photons from Alice’s
and Bob’s laser sources, a practically challenging procedure.

In this paper, we present a scheme to protect practical QKD systems against
various attacks based on faked-state light, including the detector-control
attacks and more generally the class of intercept–resend attacks. The scheme
uses phase encoding and a two-way configuration, similar to the plug-and-play
configuration [58, 59, 60], which uses polarization-assisted routing through
Bob’s transceiver, and a Faraday mirror at Alice’s site. In our scheme,
however, the polarization qubit serves a different function. A photon
generated at Bob’s transceiver is transmitted through a polarization
randomizer, which assigns it a random state of polarization, and upon
reflection from the Faraday mirror it passes once more through the same
randomizer, in a state orthogonal to its original state, and is directed to a
specific path, whereupon the photon is detected in accordance with the phase-
encoded BB84 protocol. Light pulses generated by an intruder must pass through
the randomizer at the gateway to Bob’s transceiver, and since they pass only
once, they acquire a random state and end up in a different path, whereupon
their detection triggers an alert. The randomizer is fixed during the course
of the photon roundtrip and is refreshed after every cycle of photon
transmission and detection. Thus, the polarization qubit serves as a carrier
of a password that allows genuine photons to be directed to the secured
detectors, while an intruder’s fake photons are randomized and possibly end up
at the alert detectors.

We further consider the case that Eve launches a generalized detector-control
attack. To render her attack unnoticeable, she tailors the parameters of
triggering pulses and blinding light in order to meet two requirements: (i) to
avoid triggering alert detectors, and (ii) to be able to sometimes trigger the
secured detectors in the right way. These two requirements lead us to a
necessary and sufficient condition that Bob’s secured and alert detectors have
to satisfy. We note that commercially available detectors can violate this
necessary and sufficient condition and thereby guarantee that these two
requirements are impossible to meet simultaneously. We experimentally
demonstrate how various faked states by Eve fail to simultaneously meet these
two requirements of unnoticeable attack. Security analysis of the system shows
that for various types of attacks Eve cannot diminish the alert rate, even if
she has complete control over Bob’s secured detectors.

Figure 1:  (a) Optical layout of the QKD system. Bob creates single photons
with time-bin (key) and polarization (ancillary) qubits. The polarization
qubit is randomized by an operator $\mathrm{U}$, only known to Bob. Alice’s
phase modulator (PM) encodes the time-bin state by a phase
$\phi_{A}\in\\{0,\pi\\}$ or $\\{\pi/2,3\pi/2\\}$. A Faraday mirror (FM)
compensates Bob’s back-tracing photon for all encountered polarization
variations, including the randomization $\mathrm{U}$. The polarization-based
Mach-Zehnder interferometer (PMZI) swaps the time-bin/polarization qubits for
polarization/path qubits. Therefore, the key qubit is measured in path $b$ in
either diagonal-antidiagonal ($D/A$) or right-left ($R/L$) circular
polarization bases. The polarization randomizer $\mathrm{U}$ – which may be
implemented by means of high-speed electro-optic polarization controller – is
active against Eve’s fake photons and may direct them, without Eve’s notice,
to the alert detectors in path $a$. A click of the alert detectors in path $a$
is a sign for Eve’s intrusion. The polarization switch $\mathrm{U}_{a}$
alternates between measurements bases: $D/A$ and $R/L$. BS: beam splitter;
PBS: polarization beam splitter; PC: polarization controller; Cir: optical
circulator; VA: variable attenuator; BF: narrow band-pass filter. (b) The
timeline for the operations on qubits of the three photonic degrees of
freedom, path, time bin, and polarization, during the course of a roundtrip
from Bob to Alice and back along a channel $\mathrm{U}_{c}$. The operator
$\mathrm{U}$ describes the polarization transformation, when light enters
Bob’s system. In the opposite direction, it encounters a transformation
$\mathrm{U}^{T}$. (c) Optical setup demonstrating Eve’s system. The half-wave
plate HWP1 and the following polarization-based two-path system control the
purity of the polarization state via mixing orthogonal polarization components
of two subsequent laser pulses. The subsequent half- and quarter-wave plates,
HWP2 and QWP, alter the polarization state unitarily. The two-path system in
the last stage performs the time-bin phase encoding.

##  2 QKD scheme

As shown in Fig. 1(a), Bob employs a single photon with two encoded qubits: a
time-bin qubit communicating the key, and an ancillary polarization qubit
serving as a security pass [61]. As in typical interferometric QKD systems,
the photon undergoes a roundtrip from Bob to Alice, where the time-bin qubit
is modulated, and sent back to Bob whereupon it is directed to two sets of
detectors depending on its state of polarization. Entry into Bob’s receiver is
secured by a polarization randomizer applying a random transformation
$\mathrm{U}$ (based on Haar measure) that changes every photon-roundtrip
duration. Alice uses a Faraday mirror (FM) that switches the polarization
qubit into an orthogonal state so that as the photon crosses the polarization
randomizer in the opposite direction, the randomization is cleared. Since its
state is only known to Bob, the randomizer is a secure polarization-based
gateway that directs the photon to specific detectors in the receiver.

The process begins as shown in Fig. 1(a) with Bob sending single-photon pulses
along path $a$ in a polarization-path state:

$\left|\psi_{1}\right>={1}/{\sqrt{2}}(\left|H\right>+\left|V\right>)\left|a\right>.$
(1)

This is subsequently swapped for a time-polarization state

$\left|\psi_{2}\right>={1}/{\sqrt{2}}(\left|t_{l}\right>+\left|t_{s}\right>)\left|H\right>$
(2)

by use of an unbalanced polarization-based Mach-Zehnder interferometer (PMZI)
with a polarization controller (PC) placed in its short arm, converting the V
(H) polarization into H (V) polarization.

On Alice’s side, the leading time bin $\left|t_{s}\right>$ is encoded with a
phase shift $\phi_{A}$ of $0$ or $\pi$, and $\pi/2$ or $3\pi/2$. Upon
reflection from the FM, the photon polarization is flipped to its orthogonal
state. This compensates for the undesired polarization changes accompanying
the phase modulation [62], and also for the birefringence-based polarization
fluctuations along the optical fiber [63, 64]. Upon re-entry into Bob’s
transceiver, since $\mathrm{U}$ is fixed during the photon roundtrip, its
effect is also cancelled out by transmission in the opposite direction. The
state is now:

$\left|\psi_{3}\right>=\tfrac{1}{\sqrt{2}}(\left|t_{l}\right>+e^{i\phi_{A}}\left|t_{s}\right>)\left|V\right>.$
(3)

Bob’s receiver is gated to select roundtrip passage via the short-long and the
long-short arms of the PMZI arms. It is also configured such that with single-
photon interference in the PMZI, the time-polarization state
$\left|\psi_{3}\right>$ is swapped back to a polarization-path state

$\left|\psi_{4}\right>={1}/{\sqrt{2}}(\left|H\right>+e^{i\phi_{A}}\left|V\right>)\left|b\right>.$
(4)

The photon is therefore directed to path $b$, which we call the secure path.
As will be shown later, detection of a photon in path $a$ is an indication
that the system has been tampered with, and path $a$ is therefore called the
alert path.

After swapping the key qubit back to polarization, the BB84 measurement is
performed passively in one of the conjugate bases: diagonal-antidiagonal
($D/A$) or right-left ($R/L$) circular polarization. The system’s action on
the different degrees of freedom (path, time, and polarization) of the photon
during its roundtrip course is illustrated in Fig. 1(b).

In yet another measure of added security, Bob randomly directs the received
photon – in a managed way – to path $a$ instead of path $b$ for measurement.
This is accomplished by appropriate control of the polarization randomizer.
This random-switching tactic unveils types of attacks that can bias triggering
actions to path $b$ such as pulsed-blinding [44, 55, 22] and wavelength-
dependent attacks [69].

Alice’s phase coding and Bob’s gated detection require precise time
synchronization between the two sides which is done via a wavelength-
multiplexed classical channel carrying bright pulses. A portion of the power
received by Alice is monitored to detect Trojan horse attacks [63].

Here, an ideal single-photon source is assumed for convenience. To defend
against the PNS attack, Bob applies a decoy-state technique [65, 66, 67];
verifying that his produced decoy pulses encounter the same single-photon
loss.

##  3 Randomized routing of faked-state light

Eve’s goal is to signal the detectors in the secure path $b$ without
registering a click on the detectors of the alert path $a$. In a typical
intercept–resend strategy, Eve would measure Alice’s encoded state and then
send faked-state light in a phase modulated state
$(\left|t_{l}\right>+e^{i\phi_{E}}\left|t_{s}\right>)/{\sqrt{2}}$, mimicking
the measured key qubit, together with a polarization qubit in a state
$\rho_{p}$. Upon transmission through the PMZI, and within the detection
window (centered at: $t_{s}+t_{l}$), the state of Eve’s photon(s) becomes

$\begin{split}\tfrac{1}{2}|H\rangle\langle
H|&(\left|b\right>X+e^{i\phi_{E}}\left|a\right>)\mathrm{U}\rho_{p}\mathrm{U}^{+}\\\
&\times(X\langle b|+e^{-i\phi_{E}}\langle a|)|H\rangle\langle H|\\\
+\tfrac{1}{2}|V\rangle\langle
V|&(\left|a\right>X+e^{i\phi_{E}}\left|b\right>)\mathrm{U}\rho_{p}\mathrm{U}^{+}\\\
&\times(X\langle a|+e^{-i\phi_{E}}\langle b|)|V\rangle\langle V|.\end{split}$
(5)

The NOT operator $X$ is due to action of the PC in the PMZI. To obtain the
which-path statistics, we trace over polarization and obtain the reduced
density operator of the path states

$\begin{split}&p_{a}|a\rangle\langle a|+\cos\phi_{E}\langle
H|\mathrm{U}\rho_{p}\mathrm{U}^{+}|V\rangle|a\rangle\langle b|\\\
+&\cos\phi_{E}\langle
V|\mathrm{U}\rho_{p}\mathrm{U}^{+}|H\rangle|b\rangle\langle
a|+p_{b}|b\rangle\langle b|.\end{split}$ (6)

The probabilities that Eve’s photon(s) ends up in the alert path $a$ is
$p_{a}=\langle H|\mathrm{U}\rho_{p}\mathrm{U}^{+}|H\rangle$, while that of
reaching path $b$ is $p_{b}=1-p_{a}=\langle
V|\mathrm{U}\rho_{p}\mathrm{U}^{+}|V\rangle$. If Eve were to know the operator
$\mathrm{U}$, she would be able to make $p_{a}=0$ by use of a pure state
$\rho_{p}=\mathrm{U}^{+}|V\rangle\langle V|\mathrm{U}$. Not knowing
$\mathrm{U}$, if she runs the conventional intercept-resend attack [1, 68] by
measuring the Alice-encoded photon and re-sending a new photon prepared in
accordance with the measurement outcome to Bob, then the average probability
that it passes to path $a$ is 25% (obtained by averaging over the continuum of
random realizations of $\mathrm{U}$ based on Haar measure, assuming ideal
single-photon sources, measurements, and detection). This alert rate is on top
of the normal 25% quantum bit error rate (QBER) of the BB84 key qubit.

##  4 Necessary criteria for Bob’s detectors

###  4.1 Criteria formulation

A more stealth intercept–resend strategy that we now investigate in more
details is Eve’s use of blinding light together with triggering multi-photon
pulses [38, 39, 48, 45, 44]. Upon blinding, the SPD in the linear mode never
clicks when the triggering pulse energy is below a threshold $E_{never}$, and
always clicks when the energy is greater than a threshold $E_{always}$ [46,
44]. When the energy falls between these two levels, the detector clicks with
a probability between 0 and 1.

For hacking the BB84 QKD system, it is required that $E_{always}<2E_{never}$
so that if the trigger pulse has energy $E_{T}\in[E_{always},2E_{never})$, the
detector will always click in the compatible basis, but will never click in
the conjugate basis. Bob’s detectors can then be fully controlled without
elevating the QBER [38].

The reason for the potential of this hacking strategy is shown by noting that
upon blinding, the alert SPDs in path $a$ will receive double the blinding
power –on average– relative to the SPDs in path $b$ [see Fig. 1(a)]. Because
$E_{always}(I)$ and $E_{never}(I)$ are monotonic increasing functions of the
blinding power $I$ [46], higher blinding power for the alert SPDs generally
elevates their operation thresholds. As a result, one might think that the
alert SPDs would be more insensitive to the triggering pulses, which could be
exploited to produce an unnoticeable intrusion.

To investigate this attack further, let us consider that Eve uses triggering
pulses of energy $E_{T}$ carrying her measured key (time-bin) qubit together
with an ancillary (polarization) state $\rho_{T}$. This is accompanied by
blinding light of power $I_{B}$ and polarization state $\rho_{B}$. Eve would
like to optimize the attack parameters — $E_{T},\rho_{T},I_{B}$, and
$\rho_{B}$— aiming to perform selective triggering of detectors in path $b$
without registering a click in the alert SPDs in path $a$. In the following
analysis, we show that such goal can be made impossible if Bob’s SPDs are
appropriately selected.

Eve’s photons of the trigger pulse will be split into paths $a$ and $b$ with
the probabilities $p_{a}$ and $p_{b}$, and then split again equally between
the two polarization paths of $b$. If the total energy of Eve’s time-bin
pulses is $E_{T}$, then within the gated time window there will be a portion
$\tfrac{1}{2}p_{a}E_{T}$ in path $a$ (this is also the maximum energy received
by any detector $D_{ai},i\in\\{1,2\\}$), and portions $\tfrac{1}{4}p_{b}E_{T}$
in each arm of path $b$ (the maximum energy received by any detector
$D_{bj},j\in\\{1,2,3,4\\}$).

To develop a successful detector control, Eve’s triggering pulse and blinding
light have to satisfy concurrently the following two conditions for all
possible realizations of $\mathrm{U}$:

(A): The maximum trigger pulse energy that may strike an alert detector
$D_{ai}$ is less than the minimum $E_{never}^{ai}$, i.e.,

$\tfrac{1}{2}p_{\max}E_{T}<E_{never}^{ai}(\min\\{I_{a}\\}),$ (7)

where $\min\\{I_{a}\\}$ is the minimum blinding power received by a detector
$D_{ai}$ and $p_{\mathrm{max}}$ is the maximum value of $p_{a}$ obtained over
any state $\mathrm{U}\rho_{T}\mathrm{U}^{+}$ (see Appendix 7.3), which is
given by

$p_{\mathrm{max}}=\tfrac{1}{2}(1+\sqrt{2\mathcal{P}_{T}-1}),$ (8)

with $\mathcal{P}_{T}$ being the purity of the polarization state $\rho_{T}$.

(B): The maximum pulse energy that may strike a detector $D_{bj}$ must be at
least greater than the minimum $E_{never}^{bj}$, i.e.,

$\tfrac{1}{4}p_{\max}E_{T}>E_{never}^{bj}(\min\\{I_{b}\\}),$ (9)

where $\min\\{I_{b}\\}$ is the minimum blinding power received by a detector
$D_{bj}$, and $p_{\mathrm{max}}$ is the maximum of $p_{b}$ taken over any
state $\mathrm{U}\rho_{T}\mathrm{U}^{+}$ [same as in (8)].

Condition (A) guarantees that even if the maximum triggering-pulse energy
passes to a detector $D_{ai}$, which is blinded with the minimum light power,
this should not lead to a click. Condition (B) offers a necessary condition
for detectors $D_{bj}$ to trigger.

As shown by (7) and (9), for Eve who does not know about the transformation
$\mathrm{U}$, the maximum pulse energy (over all possible settings of
$\mathrm{U}$) that may impinge on a detector $D_{bj}$ is half that for an
alert detector $D_{ai}$. Consequently, conditions (A) and (B) cannot be
satisfied unless the detectors $D_{ai}$ and $D_{bj}$ strictly comply with the
necessary and sufficient condition:

$\frac{E_{never}^{bj}(\min\\{I_{b}\\})}{E_{never}^{ai}(\min\\{I_{a}\\})}<\frac{1}{2},~{}~{}\forall~{}i,j$
(10)

Because Eve does not know the current $\mathrm{U}$, she does not have the
ability to reliably control the ratio of the maximum pulse energies delivered
to the detectors $D_{ai}$ and $D_{bj}$. Thus, Bob’s setup restricts this ratio
in operation to ½ as in (7) and (9) due to the balanced beamsplitting in path
$b$.

Aiming to avoid the alert SPDs in path $a$, Eve will gain no benefit by
assigning a specific time-bin state for the blinding light. We therefore
assume, without loss of generality, that the blinding light is in a mixed
time-bin state. For an input blinding light of power $I_{B}$ and a state of
polarization $\rho_{B}$, the power received by the SPDs $D_{ai}$ and $D_{bj}$
are, respectively, $I_{a}=\tfrac{1}{2}r_{a}I_{B}$ and
$I_{b}=\frac{1}{4}r_{b}I_{B}$, where $r_{a}=\langle
H|\mathrm{U}\rho_{B}\mathrm{U}^{+}|H\rangle$ and $r_{b}=\langle
V|\mathrm{U}\rho_{B}\mathrm{U}^{+}|V\rangle$. The probabilities $r_{a}$ and
$r_{b}$ are bounded over all settings of $\mathrm{U}$ by the same minimum
value: $\tfrac{1}{2}(1-\sqrt{2\mathcal{P}_{B}-1})$ (see Appendix 7.3), where
$\mathcal{P}_{B}$ is the purity of the state $\rho_{B}$. It follows that:

$\frac{\min\\{I_{b}\\}}{\min\\{I_{a}\\}}=\frac{1}{2}.$

Note that the variations in $\mathrm{U}$ for each roundtrip alters the value
of the blinding power illuminating the SPDs. Here, we assumed that the
threshold $E_{never}$ depends on the instantaneous blinding power. However due
to the electronics of the SPD, there may be a cumulative dependence. In this
case, the same 1:2 ratio is still expected due to the randomness of
$\mathrm{U}$ along with the balanced beamsplitting in path $b$.

Therefore, back to (10), Eve’s detector control attack can be effectively
thwarted if Bob uses detectors $D_{ai}$ and $D_{bj}$ for which

$\frac{E_{never}^{bj}(I/2)}{E_{never}^{ai}(I)}>\frac{1}{2},$ (11)

for any value of $I$. We show next that this requirement for Bob’s detectors
is realizable in practice.

###  4.2 Experimental verification of the criteria

We demonstrate that meeting conditions (A) and (B) concurrently can be made
impossible in practice by the right choice of Bob’s detectors. In our
demonstration, we consider an arrangement of two detectors used in the
commercial QKD system Clavis2 from ID Quantique, with the values of the
threshold parameters obtained from reported results of an experiment by Huang
et al. [46].

Eve’s source [Fig. 1(c)] consists of a pulsed laser (vertically polarized,
attenuated to $\sim 0.6$ pJ/pulse) along with the polarization purity control,
unitary polarization transformation, and phase encoding (see Appendix 7.1).
The source prepares triggering multi-photon pulses with a time-bin state
encoded by Eve’s measured phase $\phi_{E}$ and a polarization state that can
be tuned to any pure or mixed state. The produced state writes:

$\begin{split}&(\cos^{2}\theta_{1}|e\rangle\langle
e|+\sin^{2}\theta_{1}|\bar{e}\rangle\langle\bar{e}|)\\\
\otimes~{}\tfrac{1}{2}&(|t_{l}\rangle+e^{i\phi_{E}}|t_{s}\rangle)(\langle
t_{l}|+e^{-i\phi_{E}}\langle t_{s}|).\end{split}$ (12)

with the polarization part be an incoherent mixture of the two arbitrary
orthogonal states $|e\rangle$ and $|\bar{e}\rangle$ along with a pure-state
time-bin part.

To assess the alert possibility, the phase $\phi_{E}$ was set to zero which
corresponds to Bob’s detection in the basis state $|D\rangle$ in either path
$a$ or $b$. Therefore, the alert possibility due to Eve’s faked-state photons
can be analyzed by placing the detectors: $D_{a1}$ and $D_{b1}$ in the alert
and secure paths.

Since Eve’s source is able to scan over all points of the Poincaré sphere,
there is no loss of generality in fixing the randomizer $\mathrm{U}$ of Bob’s
system to a value, unknown to Eve, which we took to be

$\mathrm{U}=\frac{1}{\sqrt{2}}\begin{bmatrix}i&i\\\ 1&-1\end{bmatrix}.$ (13)

This matrix is equivalent to the product of Jones matrices of QWP and HWP,
fixed at angles $45^{\circ}$ and $112.5^{\circ}$ w.r.t. the vertical axis,
respectively. We used Eve’s source to prepare triggering multiphoton states
with purity levels: $\mathcal{P}_{T}=\\{1,0.78,0.63,0.53,0.5\\}$. For each
purity setting, HWP2 was rotated from $0^{\circ}$ to $180^{\circ}$, with the
QWP fixed at $-45^{\circ}$. During the polarization sweep, the received
energies of trigger pulses $E_{a1}$and $E_{b1}$ that reach detectors $D_{a1}$
and $D_{b1}$, respectively, were measured within the superposition time-bin
window.

The threshold function $E_{never}(I)$ is a monotonic increasing function of
the blinding power $I$ with a slightly compressive behavior [46]. The
requirement in (11) can be satisfied based on this compressive behavior, and
by assigning the detectors of higher sensitivity in the linear mode to the
alert path [this higher sensitivity is exhibited by the relatively lower
profile of $E_{never}(I)$]. Therefore, based on the measurements of their
thresholds (see Appendix 7.2), we choose to assign the SPDs $D0$ and $D1$ of
Clavis2 system, respectively, to the secure detector $D_{b1}$ and the alert
detector $D_{a1}$.

Because conditions (A) and (B) rely on the minimum blinding power over all
possibilities of $\mathrm{U}$ regardless of the polarization state $\rho_{B}$,
we considered an unpolarized blinding light, without loss of generality. The
levels in Fig. 2(a) and Fig. 2(b) are the thresholds:
$E^{a1}_{never}(I_{B}/4)$ and $E^{b1}_{never}(I_{B}/8)$, respectively, taken
at blinding powers:
$I_{B}=\\{0.72,0.78,0.86,1.02,1.09,1.27,1.51,1.78,2.02,2.26,2.5\\}$ mW, with
the detector gate applied. Eve’s objective is then to find out the blinding
power for which the threshold in Fig. 2(a) is greater than the maximum pulse
energy received by $D_{a1}$, and concurrently, the corresponding threshold in
Fig. 2(b) is less than the maximum pulse energy received by $D_{b1}$ (for the
same purity level).

Figure 2:  Measured energies of the triggering pulses: (a) $E_{a1}$ at alert
detector $D_{a1}$, and (b) $E_{b1}$at secure detector $D_{b1}$; for five
purity levels of Eve’s polarization state. The dashed and dotted levels are
the detectors thresholds: (a) $E_{never}^{a1}(I_{B}/4)$, and (b)
$E_{never}^{b1}(I_{B}/8)$ at blinding powers $I_{B}=\\{0.72,0.78,$
$0.86,1.02,1.09,$ $1.27,1.51,1.78,$ $2.02,2.26,$ $2.5\\}$ mW, in bottom-up
order. The measurements of pulse energies were selectively performed at the
superposition time window. In the measurements, the state is controlled by
rotating HWP2 from $0^{\circ}$ to $180^{\circ}$ with the QWP fixed at
$-45^{\circ}$. The measured energies was fit to sinusoidal functions of
variable visibility. The measurements error is smaller than the marker size.

Figure 2 shows the results. It is evident from Fig. 2 that Eve cannot meet her
objective for any of these levels. Although this is not a complete
polarization sweep test (i.e., not covering the entire volume of the Poincaré
sphere), it is sufficient to evaluate the ability of a traceless attack. This
is because it spans the entire visibility range for arbitrary (pure or mixed)
polarization state. Taking into account that $E_{never}(I)$ is a monotonic
increasing function of $I$, it can also be verified that this cannot be
possible for any other level of blinding power.

Figure 2 shows the results for Eve’s attack using pulses of fixed energy that
reach Bob’s system while the detectors gate is applied. Eve may also change
the energy level of triggering pulses or launch her attack when the gate of
the detector is not applied. Figure 3 shows the results in the presence and
absence of the detector gate for a span of trigger pulse energies. It depicts
the operational-ratio line which specifies the strict 1:2 relation between the
maximum pulse energies reachable to path-$b$ and path-$a$ detectors, as
constrained by Bob’s system.

Figure 3 shows also intersection points between the threshold lines
$E_{never}^{a1}(I_{B}/4)$ and $E_{never}^{b1}(I_{B}/8)$ (parallel to $y$ and
$x$ axes, respectively), combining the thresholds of the two detectors at
different values of total blinding power $I_{B}$. Every intersection point is
associated with a camouflage region, where Eve’s detector–control can be
enacted tracelessly. As shown in Fig. 3(a) for a good arrangement of alert and
secure detectors, all threshold points are above the operational-ratio line.

Figure 3:  Measurements of the maximum pulse energies reaching a secure-path
detector: $\hat{E}_{b1}$ and an alert-path detector: $\hat{E}_{a1}$ showing
the 1:2 ratio operational line below which the protection fails (yellow area).
Intersection points of the thresholds $E_{never}^{a1}(I_{B}/4)$ (vertical) and
$E_{never}^{b1}(I_{B}/8)$ (horizontal) are shown in the presence (+) and the
absence (×) of the detector gate. Each threshold point has a camouflage region
(red- and grey-colored areas) within which the maximum pulse energy delivered
to $D_{a1}$ is less than $E_{never}^{a1}(I_{B}/4)$, while the maximum pulse
energy for $D_{b1}$ is higher than $E_{never}^{b1}(I_{B}/8)$. (a) SPD $D1$,
which is the more sensitive of the two Clavis2 detectors, is assigned to
$D_{a1}$, while the less-sensitive $D0$ is assigned to $D_{b1}$ (see Appendix
7.2). In this case all threshold points lie above the operational-ratio line,
and the camouflage region does not overlap the unsafe area (marked in yellow).
This renders Eve’s unnoticeable attack impossible. (b) SPDs $D1$ and $D0$ are
assigned unwisely to $D_{b1}$ and $D_{a1}$, respectively. In this case, a
small overlap exists between the camouflage area and the unsafe area
indicating a possibility for Eve to adjust the parameters:
$E_{T},\rho_{T},I_{B},$ and $\rho_{B}$ and launch a successful attack.

This prohibits any overlap between the operational-ratio line of camouflage
regions and therefore disallows unnoticeable intrusion. In this arrangement,
the necessary and sufficient condition for successful intrusion in (10) is not
satisfied for any threshold point. It is then impossible to avoid triggering
the alert detectors, no matter what faked-state of light Eve uses.

To show how the unwise choice of Bob’s alert and secure detectors may allow
for unnoticeable intrusion, we considered interchanging $D0$ and $D1$ of
Clavis2 system to be the alert detector $D_{a1}$ and the secure detector
$D_{b1}$, respectively. In this case, some threshold points lied under the
operational-ratio line [Fig. 3 (b)]. This creates a valid camouflage region
(in overlap with the operational-ratio line) for Eve who can then, in
principle, selectively trigger path-$b$ detectors, but not path-$a$ detectors
(see Appendix 7.2).

##  5 Attack model and security analysis

We assume that Eve can introduce photons into Bob’s receiver only through the
polarization randomizer. She is acquainted with the configuration of the
system, including timing and other classical information, but has no
information on the specific random transformation $\mathrm{U}$ applied at any
time. We consider a large number of quantum signals between Alice and Bob, so
that all finite-size corrections required in security analysis are negligible
(see, e.g., Ref. [9]).

Eve interacts identically and independently with each quantum signal. She
measures the pulse encoded by Alice in one of the two bases. The outcome of
Eve’s measurement is described by three probabilities: 1)
$P_{e}^{c}\approx\tfrac{1}{2}e^{-\mu(1-F_{e})\eta_{e}}(1-e^{-\mu
F_{e}\eta_{e}})$ is the probability that Eve’s measurement is in a compatible
basis and gives results in a single click in the correct detector. 2)
$P_{e}^{w}\approx\tfrac{1}{2}e^{-\mu
F_{e}\eta_{e}}(1-e^{-\mu(1-F_{e})\eta_{e}})$ is the corresponding probability
of a click in the wrong detector only. 3)
$P_{e}^{nc}\approx\tfrac{1}{2}e^{-\tfrac{\mu\eta_{e}}{2}}(1-e^{-\tfrac{\mu\eta_{e}}{2}})$
is the probability that Eve’s measurement is in incompatible basis and gives a
click in a single detector. In these expressions, $\mu$ is the mean number of
photons per pulse, $F_{e}$ is the fidelity of Eve’s measurement, and
$\eta_{e}$ is the overall detection efficiency. We specify in the following
some possible Eve’s attacks.

###  5.1 Quantum attack

In this attack, Eve always forwards single-photon pulses to Bob. Bob performs
a squashing operation whenever multiple clicks occur [70, 71, 72]; that is
double clicks in different bases do not count, while if in the same basis,
they give a random value [32].

In order to determine the sifted key rate and the QBER under quantum attack,
we begin by writing expressions for the raw probabilities $p_{bj}(k)$ that
Bob’s detector $D_{bj},j=1,2,3,4,$ clicks if Eve uses the phase
$k\in\\{0,\pi,\pi/2,3\pi/2\\}$ to encode her pulse. For $k=0$,

$\begin{split}&p_{b1}(0)\approx
c_{b1}+1-\exp{\left(-\frac{\mu_{e}p_{b}F\eta_{b1}}{4}\right)},\\\
&p_{b2}(0)\approx
c_{b2}+1-\exp{\left(-\frac{\mu_{e}p_{b}(1-F)\eta_{b2}}{4}\right)},\\\
&p_{b3(b4)}(0)\approx
c_{b3(b4)}+1-\exp{\left(-\frac{\mu_{e}p_{b}\eta_{b3(b4)}}{8}\right)},\end{split}$
(14)

where $c_{bj}$ is the total background rate of detector $D_{bj}$ within the
gate slot, $F$ is the fidelity of Bob’s measurement, $\eta_{bj}$ is the
overall detection efficiency of $D_{bj}$, and $p_{b}$ is the probability that
Eve’s photon passes into the secure path as given in (6). Similar expressions
apply for other phases $k\in\\{\pi,\pi/2,3\pi/2\\}$.

After the squashing operation, the probability that Bob registers a click in
the $D/A$ basis, given that Eve sent a phase-encoded state for $k=0$ is

$\begin{split}P_{DA}(0)=&[p_{b1}(0)+p_{b2}(0)-p_{b1}(0)p_{b2}(0)]\\\
&\times[1-p_{b3}(0)][1-p_{b4}(0)].\end{split}$ (15)

Also, after squashing, the probability that Bob registers a click on $D_{bj}$
given that Eve sent a state coded by the phase $k$ is $P_{bj}(k)$, where, for
example,

$P_{b1}(\pi)=p_{b1}(\pi)[1-\tfrac{1}{2}p_{b2}(\pi)][1-p_{b3}(\pi)][1-p_{b4}(\pi)],$
(16)

and where $P_{DA}(k)=P_{b1}(k)+P_{b2}(k)$.

Therefore, given that Alice’s phase $k=0$, the sifted key rate (in path $b$)
is

$\begin{split}R_{b}(0)\approx&P_{e}^{c}P_{DA}(0)+P_{e}^{w}P_{DA}(\pi)\\\
&+P_{e}^{nc}[P_{DA}(\pi/2)+P_{DA}(3\pi/2)]\\\
&+(1-P_{e}^{c}-P_{e}^{w}-2P_{e}^{nc})(c_{b1}+c_{b2}-c_{b1}c_{b2}).\end{split}$
(17)

The corresponding error in Bob’s measurement (in path b) is

$\begin{split}E_{b}(0)\approx&P_{e}^{c}P_{b2}(0)+P_{e}^{w}P_{b2}(\pi)\\\
&+P_{e}^{nc}[P_{b2}(\pi/2)+P_{b2}(3\pi/2)]\\\
&+(1-P_{e}^{c}-P_{e}^{w}-2P_{e}^{nc})[c_{b2}-(c_{b1}c_{b2})/2].\end{split}$
(18)

The sifted key rates and the errors – conditioned on Alice’s state with a
phase $k\in\\{\pi,\pi/2,3\pi/2\\}$ – can be similarly obtained. Consequently,
the total sifted key rate and the QBER under Eve’s quantum attack are

$\begin{split}&R_{b}^{Q}=\frac{1}{4}\sum_{k=\\{0,\pi,\frac{\pi}{2},\frac{3\pi}{2}\\}}R_{b}(k),\\\
&\mathrm{QBER}_{b}^{Q}=\frac{1}{4R_{b}^{Q}}\sum_{k=\\{0,\pi,\frac{\pi}{2},\frac{3\pi}{2}\\}}E_{b}(k).\end{split}$
(19)

Bob does not apply the squashing operation on the alert detections, so that
the overall alert rate is

$\begin{split}R_{a}^{Q}\approx c_{a1}+&c_{a2}+2\\\
-\frac{1}{2}\Big{[}&\exp{\left(-\frac{\mu_{e}p_{a}F\eta_{a1}}{2}\right)}+\exp{\left(-\frac{\mu_{e}p_{a}F\eta_{a2}}{2}\right)}\\\
&+\exp{\left(-\frac{\mu_{e}p_{a}\eta_{a1}}{4}\right)}+\exp{\left(-\frac{\mu_{e}p_{a}\eta_{a2}}{4}\right)}\Big{]}.\end{split}$
(20)

While no obvious change appears in the sifted key rate and the QBER compared
to the BB84 protocol, the presence of an alert rate, which is significantly
higher than the background rate, provides an additional clear sign of Eve’s
attack.

###  5.2 Blinding attack

In this attack, Eve blinds Bob’s detectors using nonpolarized light, then
sends a bright pulse encoded by her measurement outcome. The bright trigger
pulse has a pure polarization state. The assumption of nonpolarized blinding
light is logical since it is optimal for Eve to render the blinding of all
SPDs unaffected by the randomization $\mathrm{U}$. We assume that Eve has
complete control over Bob’s measurement in the secure path so that she can
limit the QBER; however, as will be shown later, this is not sufficient to
limit the rate of the alert. The following analysis is presented in three
cases: i) no randomization, ii) randomization, iii) randomization and
switching.

i) No randomization. For simplicity, let us first consider the case:
$\mathrm{U}=I$. Aiming to trigger Bob’s secure SPDs in the matched basis and
avoid clicks in the unmatched one, Eve sends a trigger pulse energy $E_{T}$
such that

$2E_{never}^{b_{j}}>\frac{1}{4}E_{T}>E_{never}^{b_{j}},~{}~{}\forall~{}j.$
(21)

Note that half the pulse energy $E_{T}$ will pass while the gate is off (which
we assume to result in no action). The lower bound in (21) assigns a threshold
to enable the triggering of matched-basis detectors. The upper bound puts a
limit for not triggering the ones in unmatched basis. Because an alert
detector receives double the blinding power of a secure detector, and due to
the compressive nature of $E_{never}(I)$ and the higher sensitivity of alert
detectors, we can infer that
$E_{never}^{ai}<2E_{never}^{bj},~{}\forall~{}i,j,$ which can be substituted
into the lower bound of (21) to give

$\frac{1}{2}E_{T}>E_{never}^{ai},~{}~{}\forall~{}i.$ (22)

The lower bound in (21) and (22) signifies that the minimal trigger energy
that enables the detectors control in the secure path will also enable
triggering of the alert detectors.

Figure 4:  (a) Portions of the trigger pulse energy $E_{T}$ that strike two
detectors $D_{ai}$ and $D_{bj}$ in matched basis plotted versus the
probability $p_{a}$. (b) Ramp-step approximation of the APD click probability
versus the trigger pulse energy under blinding attack. Shown is the case of
alert detector $D_{ai}$ when the bases are matched.

ii) Randomization. Let us now move to the general case with a random
transformation U, but without switching the paths $a$,$b$. In this case, the
values of $p_{a}$ are uniformly distributed between 0 and 1. Figure (4)a
sketches the energies delivered to SPDs $D_{ai}$ and $D_{bj}$ in matched
basis, which equal $\tfrac{1}{2}p_{a}E_{T}$ and $\tfrac{1}{4}(1-p_{a})E_{T}$,
respectively.

For simplicity, we approximate the click probability of blinded detectors by a
ramp-step function as plotted in fig. (4)b. Therefore, the alert rate on a
detector $D_{ai}$ can be obtained by averaging the click probability in fig.
(4)b over $p_{a}$ as

$R_{ai}^{Bl}\approx\frac{1}{2}\max\left\\{1-\frac{E_{never}^{ai}+E_{always}^{ai}}{E_{T}},0\right\\},$
(23)

where the factor $\tfrac{1}{2}$ is attributed to the probability that Eve’s
and Bob’s alert-path bases match. The trigger rate of a secure detector
$D_{bj}$ is obtained similarly by averaging its click probability over $p_{a}$
as

$R_{bj}^{Bl}\approx\mathrm{max}\left\\{1-\frac{2(E_{never}^{bj}+E_{always}^{bj})}{E_{T}},0\right\\},$
(24)

Therefore, in the absence of switching paths $a$,$b$, the total alert and
secure detection rates are

$R_{a}^{Bl}=\frac{1}{2}\sum_{i=1}^{2}R_{ai}^{Bl},~{}~{}R_{secure}^{Bl}=\frac{1}{4}\sum_{j=1}^{4}R_{bj}^{Bl}.$
(25)

iii) Randomization and switching. When Bob switches the alert and secure
paths, secure-path detections are counted as alert events and vice versa. If
$R_{sw}$ is the switching rate, then the total alert and secure detection
rates become

$\begin{split}&R_{a}^{Bl}=\frac{1}{2}(1-R_{sw})\sum_{i=1}^{2}R_{ai}^{Bl}+\frac{1}{4}R_{sw}\sum_{j=1}^{4}R_{bj}^{Bl},\\\
&R_{secure}^{Bl}=\frac{1}{2}R_{sw}\sum_{i=1}^{2}R_{ai}^{Bl}+\frac{1}{4}(1-R_{sw})\sum_{j=1}^{4}R_{bj}^{Bl}.\end{split}$
(26)

This yields the sifted key rate and QBER:

$R_{b}^{Bl}=(P_{e}^{c}+P_{e}^{w})R_{secure}^{Bl},~{}~{}\mathrm{QBER}_{b}^{Bl}=\frac{P_{e}^{w}}{P_{e}^{c}+P_{e}^{w}}.$
(27)

Remarkably, while this complete blinding attack can keep the level of QBER
unaffected by Eve’s interception [as shown by (27)], it is not capable of
diminishing the alert rate. Recalling that
$E_{never}^{ai}<2E_{never}^{b_{j}},\forall~{}i,j,$ Eqs. (23), (24), (25) show
that the alert and secure rates are related by
$R_{a}^{Bl}\geq\frac{1}{2}R_{secure}^{Bl}$. The alert rate increases
proportionally with $R_{sw}$. For example, if $R_{sw}=\frac{1}{2}$, it leads
to $R_{a}^{Bl}=R_{secure}^{Bl}$ as given in (26).

###  5.3 Wavelength-dependent blinding attack

While narrow-band filters can be used to limit a wavelength-dependent attack,
it is still possible that Eve elevates the power values of her out-band
signals to allow passage of a finite power level [69]. Such attack may target
the (polarizing and non-polarizing) beam splitters and the polarization
randomizer. In the former, Eve may exploit the wavelength-dependent deviation
from the coupling ratio of the 3-dB coupler and the extinction ratio of the
PBS. In the latter, she may exploit the dispersive nature of polarization
transformers/controllers, which typically use cascaded birefringent
components.

We conservatively assume that Eve can develop a wavelength-dependent blinding
attack that enables the right control of secure SPDs and always avoids ticking
alert SPDs (or at least keeping it below the background rate $c_{ai}$ within
the gate slot). Under these conditions, the alert and sifted key rates and
QBER are

$\begin{split}&R_{a}^{W|Bl}=R_{sw},\\\
&R_{b}^{W|Bl}=(P_{e}^{c}+P_{e}^{w})(1-R_{sw}),\\\
&\mathrm{QBER}_{b}^{W|Bl}=\frac{P_{e}^{w}}{P_{e}^{c}+P_{e}^{w}}.\end{split}$
(28)

If Bob keeps $R_{sw}\gg c_{ai},\forall~{}i,$ Eve’s presence will be unveiled
by the alert rate.

The rates in (28) are also valid for other attack approaches that enable
biasing the triggers to the secure detectors. Examples are the attacks
exploiting the detector’s efficiency mismatch (e.g., time-shift attacks [26,
27]) or dead time (e.g., the dead-time attack [22]). Other examples are the
pulsed blinding attacks (see, e.g., Refs. [44, 55, 22]), where the linear-mode
operation of the double-blinded alert detectors last for a longer period [44];
enabling to bias the triggers to secure detectors.

###  5.4 Integrated attacks

Eve might select one of her menu of attacks at random. If she launches a
quantum attack with probability $p_{Q}$, a blinding attack with probability
$p_{Bl}$, or a wavelength-dependent blinding attack with probability
$p_{W|Bl}$, then the overall sifted key rate, the QBER, and the alert rate
are:

$\begin{split}&R_{b}^{e}=p_{Q}R_{b}^{Q}+p_{Bl}R_{b}^{Bl}+p_{W|Bl}R_{b}^{W|Bl},\\\
&\mathrm{QBER}_{e}=p_{Q}\mathrm{QBER}_{b}^{Q}+(p_{Bl}+p_{W|Bl})\frac{P_{e}^{w}}{P_{e}^{c}+P_{e}^{w}},\\\
&R_{a}^{e}=p_{Q}R_{a}^{Q}+p_{Bl}R_{a}^{Bl}+p_{W|Bl}R_{a}^{W|Bl}.\end{split}$
(29)

##  6 Discussion and Conclusion

We have introduced a QKD scheme that nullifies the class of practical hacking
strategies exploiting faked-state light, including the detector-control
attacks and more generally the intercept-resend strategies. The scheme uses a
roundtrip arrangement exploiting the three optical degrees of freedom:
polarization, time-bin, and path. Thanks to continuous randomization of the
polarization state at the gateway to Bob’s transceiver, only the genuine
photon – originally created by Bob – can reliably avoid triggering the alert
detectors. We have analytically proven and experimentally verified that this
feature can be made unrealizable by Eve’s faked-state light.

It is essential to emphasize that the randomization of the ancillary
(polarization) qubit is not by itself sufficient to securely exchange a key
without relying on the BB84 protocol to encode the key (time-bin) qubit.
Without BB84, Eve could, in principle, extract the information in the time-bin
qubit in a reliable manner without disturbing the single-photon state
forwarded to Bob.

##  7 Appendices

###  7.1 Eve’s state preparation

In order to generate light pulses with a prepared state of polarization,
mimicking that potentially employed by Eve, we have used the three-stage
optical system in Fig. 1(c). The first stage produces mixed-state pulses with
a polarization purity set by a half-wave plate HWP1 followed by a heavily
unbalanced polarization-based Mach-Zehnder interferometer (PMZI). The
propagation times through the two PMZI arms differ by the period of the pulsed
laser, which is longer than its coherence time. The PMZI thus mixes pairs of
mutually incoherent pulses of orthogonal polarization with a ratio set by the
rotation angle $\theta_{1}$ of HWP1. The polarization purity is then given by

$\mathcal{P}_{T}=1-\tfrac{1}{2}\sin^{2}4\theta_{1},$ (30)

with the values $\mathcal{P}_{T}=\\{1,0.78,0.63,0.53,0.5\\}$ used in the
experiment corresponding to HWP1 angles:
$\theta_{1}=\\{0^{\circ},10.4^{\circ},15^{\circ},18.9^{\circ},22.5^{\circ}\\}$.

The second stage of the system uses a half-wave plate HWP2 (its rotation angle
is $\theta_{2}$) and a quarter-wave plate QWP to perform the unitary rotation
over the Poincaré sphere (see Fig. 5) and create the polarization state in
(12). After preparing the polarization state, the third stage creates phase-
encoded time bin state using a Mach-Zehnder interferometer (MZI) identical to
the one used by Bob.

Figure 5:  Evolution of the state of polarization (SOP) of Eve’s faked state
on the Poincaré sphere. (a) Mixed state is generated with different purities
by rotating HWP1 (black dots). Rotation of HWP2 from $0^{\circ}$ to
$180^{\circ}$ moves the SOP to span the blue dotted circles in the plane
orthogonal to the $|R\rangle$-$|L\rangle$ axis (b) QWP with axis at
$-45^{\circ}$ performs $90^{\circ}$rotation in the plane orthogonal to the
$|D\rangle$-$|A\rangle$ axis (red dotted circles). Arbitrary transformation
can be done by rotating HWP2 and QWP. Eve’s transformation arrangement along
with the measurement in Bob’s system work in a way similar to a de Sénarmont
compensator.

###  7.2 Triggering thresholds of “Clavis2” SPDs

Figures 2 and 3 depict the threshold values:
$E_{never,0}^{gate},E_{never,1}^{gate},E_{never,0}^{no-gate}$, and
$E_{never,1}^{no-gate}$ for the two Clavis2 detectors $D0$ and $D1$ at
different values of blinding power. This data was reproduced from the
experimental results in [46] and supplemented by interpolations to deduce some
missed points. Figure 6(a) shows these thresholds versus the power $I_{B}$
(total Eve’s blinding power input to Bob’s system), when the two SPDs $D1$ and
$D0$ are inserted into the alert path $a$ and the secured path $b$,
respectively. Figure 6(b) shows the other unwise alternative when $D0$ and
$D1$ are in path $a$ and path $b$, respectively. It is obvious that the
condition in (10), which is necessary and sufficient for a traceless attack,
is not satisfied at all points in the first case of Fig. 6(a). This verifies
the security of Bob’s system against Eve’s detector-side attack. By contrast
for the alternative arrangement, the condition (10) is satisfied at some
points (particularly, the first three points of gated detection) of Fig. 6(b).
This enables the overlap between the camouflage regions of these points and
the operational-ratio line and allows for a traceless detector-side attack by
Eve, as depicted in Fig. 3(b).

Figure 6:  Thresholds $E_{never}$ of the two SPDs $D0$ and $D1$ used in the
Clavis2 system in the presence and the absence of the gate, plotted versus the
blinding power $I_{B}$ of unpolarized light injected into Bob’s system. (a)
$D0$ and $D1$ are assigned to paths $b$ and $a$, respectively. (b) $D0$ and
$D1$ are switched to paths $a$ and $b$.

###  7.3 Bounds for the overlap between pure and mixed states

We show here that the maximum and minimum overlaps between a pure state
$|\psi\rangle$ and a mixed state $\rho$ after the application of an arbitrary
unitary operator $\mathrm{U}$, are given by

$\begin{split}\max\\{\langle\psi|\mathrm{U}\rho\mathrm{U}^{+}|\psi\rangle\\}=\frac{1}{2}\left(1+\sqrt{2\mathcal{P}-1}\right),\\\
\min\\{\langle\psi|\mathrm{U}\rho\mathrm{U}^{+}|\psi\rangle\\}=\frac{1}{2}\left(1-\sqrt{2\mathcal{P}-1}\right),\end{split}$
(31)

where $\mathcal{P}$ is the purity of the state $\rho$. Let us express the
mixed state $\rho$ as a mixture $\lambda|v\rangle\langle
v|+(1-\lambda)|\bar{v}\rangle\langle\bar{v}|$ of two orthogonal states
$|v\rangle$ and $|\bar{v}\rangle$, then, after applying $\mathrm{U}$, the
overlap with the state $|\psi\rangle$ writes

$\begin{split}\langle\psi|\mathrm{U}\rho\mathrm{U}^{+}|\psi\rangle&=\langle\psi|\mathrm{U}~{}\big{[}\lambda|v\rangle\langle
v|+(1-\lambda)|\bar{v}\rangle\langle\bar{v}|\big{]}~{}\mathrm{U}^{+}|\psi\rangle\\\
&=\lambda\left|\langle\psi|\mathrm{U}|v\rangle\right|^{2}+(1-\lambda)\left|\langle\psi|\mathrm{U}|\bar{v}\rangle\right|^{2}.\end{split}$
(32)

Since
$|\langle\psi|\mathrm{U}|v\rangle|^{2}=1-|\langle\psi|\mathrm{U}|\bar{v}\rangle|^{2}$,
Eq. (32) describes the overlap as an interpolation between the two
complementary probabilities $\lambda$ and $(1-\lambda)$, where the
interpolation weights $|\langle\psi|\mathrm{U}|v\rangle|^{2}$ and
$|\langle\psi|\mathrm{U}|\bar{v}\rangle|^{2}$ vary according to $\mathrm{U}$.
Hence the probabilities $\lambda$ and $(1-\lambda)$ give the maximum and
minimum overlaps between the states $\mathrm{U}\rho\mathrm{U}^{+}$ and
$|\psi\rangle$. The purity of $\rho$ is
$\mathcal{P}=\mathrm{tr}(\rho^{2})=\lambda^{2}+(1-\lambda)^{2}$, which offers
two values for $\lambda$ based on $\mathcal{P}$, and leads directly to the two
bounds in (31).

## References

  * [1] C. H. Bennett and G. Brassard, "Quantum cryptography: public key distribution and coin tossing," Proc. IEEE Int. Conf. on Comp. Sys. Signal Process (ICCSSP), 175–179, 1984.
  * [2] A. K. Ekert, "Quantum cryptography based on Bell’s theorem," Phys. Rev. Lett., vol. 67, 661, 1991.
  * [3] C. Bennett, G. Brassard, R. Jozsa, D. Mayers, A. Peres, B. Schumacher, and W. Wootters, "Reduction of quantum entropy by reversible extraction of classical information," J. Mod. Opt., vol. 12, 2307–2314, 1994.
  * [4] P. W. Shor and J. Preskill, "Simple proof of security of the BB84 quantum key distribution protocol," Phys. Rev. Lett., vol. 85, 441-444, 2000.
  * [5] D. Mayers, "Unconditional security in quantum cryptography," J. ACM, vol. 48, 351-406, 2001.
  * [6] R. Renner, "Security of quantum key distribution," Int. J. Quantum Inf., vol. 6, 1-127, 2008.
  * [7] D. Gottesman, H.-K. Lo, N. Lütkenhaus, and J. Preskill, "Security of quantum key distribution with imperfect devices," Quantum Info. Comput., vol. 4, 325–360, 2004.
  * [8] H. Inamori, N. Lütkenhaus, and D. Mayers, "Unconditional security of practical quantum key distribution," Eur. Phys. J. D, vol. 41, pp. 599-627, 2007.
  * [9] M. Tomamichel, C. C. W. Lim, N. Gisin, and R. Renner, "Tight finite-key analysis for quantum cryptography," Nat. Commn., vol. 3, 634, 2012.
  * [10] G. Brassard, N. Lütkenhaus, T. Mor, and B. C. Sanders, "Limitations on Practical Quantum Cryptography," Phys. Rev. Lett., vol. 85, pp. 1330-1333, 2000.
  * [11] N. Lütkenhaus, "Security against individual attacks for realistic quantum key distribution," Phys. Rev. A, vol. 61, 052304, 2000.
  * [12] C.-H. F. Fung, B. Qi, K. Tamaki, and H.-K. Lo, "Phase-remapping attack in practical quantum-key-distribution systems," Phys. Rev. A, vol. 75, 032314, 2007.
  * [13] F. Xu, B. Qi, and H.-K. Lo, "Experimental demonstration of phase-remapping attack in a practical quantum key distribution system," New. J. Phys., vol. 12, 113026, 2010.
  * [14] M.-S. Jiang, S.-H. Sun, C.-Y. Li, and L.-M. Liang, "Wavelength-selected photon-number-splitting attack against plug-and-play quantum key distribution systems with decoy states," Phys. Rev. A, vol. 86, 032310, 2012.
  * [15] K.-i. Yoshino et al., "Quantum key distribution with an efficient countermeasure against correlated intensity fluctuations in optical pulses," Npj Quantum Inf., vol. 4, 8, 2018.
  * [16] Y.-L. Tang et al., "Source attack of decoy-state quantum key distribution using phase information," Phys. Rev. A, vol. 88, 022308, 2013.
  * [17] S.-H. Sun, F. Xu, M.-S. Jiang, X.-C. Ma, H.-K. Lo, and L.-M. Liang, "Effect of source tampering in the security of quantum cryptography," Phys. Rev. A, vol. 92, 022304, 2015.
  * [18] X. L. Pang, A. L. Yang, C. N. Zhang, J. P. Dou, H. Li, J. Gao, and X. M. Jin, "Hacking quantum key distribution via injection locking," Phys. Rev. App., vol. 13, 034008, 2020.
  * [19] A. Huang, Á. Navarrete, S. H. Sun, P. Chaiwongkhot, M. Curty, and V. Makarov, "Laser-seeding attack in quantum key distribution," Phys. Rev. App., vol. 12, 064043, 2019.
  * [20] F. Xu, X. Ma, Q. Zhang, H. K. Lo, and J. W. Pan, "Secure quantum key distribution with realistic devices," Rev. Mod. Phys., vol. 92, 025002, 2020.
  * [21] R. Newman, "Visible light from a silicon p-n junction," Phys. Rev., vol. 100, 700, 1955.
  * [22] H. Weier, H. Krauss, M. Rau, M. Fürst, S. Nauerth, and H. Weinfurter, "Quantum eavesdropping without interception: an attack exploiting the dead time of single-photon detectors," New J. Phys., vol. 13, 073024, 2011.
  * [23] Y. Zhao, C. H. F. Fung, B. Qi, C. Chen, and H. K. Lo, "Quantum hacking: Experimental demonstration of time-shift attack against practical quantum-key-distribution systems," Phys. Rev. A, vol. 78, 042333, 2008.
  * [24] C. Kurtsiefer, P. Zarda, S. Mayer, and H. Weinfurter, "The breakdown flash of silicon avalanche photodiodes-back door for eavesdropper attacks," J. Mod. Opt., vol. 48, pp. 2039-2047, 2001.
  * [25] V. Makarov, A. Anisimov, and J. Skaar, "Effects of detector efficiency mismatch on security of quantum cryptosystems," Phys. Rev. A, vol. 74, 022313, 2006.
  * [26] V. Makarov, and D. R. Hjelme, "Faked states attack on quantum cryptosystems," J. Mod. Opt., vol. 52, pp. 691-705, 2005.
  * [27] B. Qi, C.-H. F. Fung, H. K. Lo, and X. Ma, "Time-shift attack in practical quantum cryptosystems," Quantum Info. Comput., vol. 7, pp. 73-82, 2007.
  * [28] A. Lamas-Linares, and C. Kurtsiefer, "Breaking a quantum key distribution system through a timing side channel," Opt. Express, vol. 15, pp. 9388-9393, 2007.
  * [29] N. Jain et al., "Device calibration impacts security of quantum key distribution," Phys. Rev. Lett., vol. 107, 110501, 2011.
  * [30] A. N. Bugge et al., "Laser damage helps the eavesdropper in quantum cryptography," Phys. Rev. Lett., 112, 070503, 2014.
  * [31] V. Makarov et al., "Creation of backdoors in quantum communications via laser damage," Phys. Rev. A, vol. 94, 030302, 2016.
  * [32] S. Sajeed, P. Chaiwongkhot, J. P. Bourgoin, T. Jennewein, N. Lütkenhaus, and V. Makarov, "Security loophole in free-space quantum key distribution due to spatial-mode detector-efficiency mismatch," Phys. Rev. A, vol. 91, 062301, 2015.
  * [33] P. Chaiwongkhot et al., "Eavesdropper’s ability to attack a free-space quantum-key-distribution receiver in atmospheric turbulence," Phys. Rev. A, vol. 99, 062315, 2019.
  * [34] H. Qin, R. Kumar, and R. Alléaume, "Quantum hacking: Saturation attack on practical continuous-variable quantum key distribution," Phys. Rev. A, vol. 94, 012325, 2016.
  * [35] K. Wei, W. Zhang, Y. L. Tang, L. You, and F. Xu, "Implementation security of quantum key distribution due to polarization-dependent efficiency mismatch," Phys. Rev. A, vol. 100, 022325, 2019.
  * [36] R. H. Hadfield, "Single-photon detectors for optical quantum information applications," Nat. Photon., vol. 3, pp. 696-705, 2009.
  * [37] V. Makarov, "Controlling passively quenched single photon detectors by bright light," New. J. Phys, vol. 11, 065003, 2009.
  * [38] L. Lydersen, C. Wiechers, C. Wittmann, D. Elser, J. Skaar, and V. Makarov, "Hacking commercial quantum cryptography systems by tailored bright illumination," Nat. Photon., vol. 4, pp. 686-689, 2010.
  * [39] I. Gerhardt, Q. Liu, A. Lamas-Linares, J. Skaar, C. Kurtsiefer, and V. Makarov, "Full-field implementation of a perfect eavesdropper on a quantum cryptography system," Nat. Commn., vol. 2, 349, 2011.
  * [40] I. Gerhardt, Q. Liu, A. Lamas-Linares, J. Skaar, V. Scarani, V. Makarov, and C. Kurtsiefer, "Experimentally faking the violation of Bell’s inequalities," Phys. Rev. Lett., vol. 107, 170404, 2011.
  * [41] L. Lydersen, M. K. Akhlaghi, A. H. Majedi, J. Skaar, and V. Makarov, "Controlling a superconducting nanowire single-photon detector using tailored bright illumination," New. J. Phys, vol. 13, 113042, 2011.
  * [42] C. Wiechers et al., "After-gate attack on a quantum cryptosystem," New. J. Phys, vol. 13, 013043, 2011.
  * [43] Y. J. Qian, D. Y. He, S. Wang, W. Chen, Z. Q. Yin, G. C. Guo, and Z. F. Han, "Hacking the quantum key distribution system by exploiting the avalanche-transition region of single-photon detectors," Phys. Rev. Appl., vol. 10, 064062, 2018.
  * [44] Z. Wu et al., "Hacking single-photon avalanche detectors in quantum key distribution via pulse illumination," Opt. Express, vol. 28, pp. 25574-25590, 2020.
  * [45] S. Sauge, L. Lydersen, A. Anisimov, J. Skaar, and V. Makarov, "Controlling an actively-quenched single photon detector with bright light," Opt. Express, vol. 19, pp. 23590-23600, 2011.
  * [46] A. Huang, S. Sajeed, P. Chaiwongkhot, M. Soucarros, M. Legré, and V. Makarov, "Testing random-detector-efficiency countermeasure in a commercial system reveals a breakable unrealistic assumption," IEEE J. Quantum Elect., vol. 52, 8000211, 2016.
  * [47] L. Lydersen et al., "Superlinear threshold detectors in quantum cryptography," Phys. Rev. A, vol. 84, 032320, 2011.
  * [48] L. Lydersen, C. Wiechers, C. Wittmann, D. Elser, J. Skaar, and V. Makarov, "Thermal blinding of gated detectors in quantum cryptography," Opt. express, vol. 18, pp. 27938-27954, 2010.
  * [49] Z. L. Yuan, J. F. Dynes, and A. J. Shields, "Avoiding the blinding attack in QKD," Nat. Photon., vol. 4, pp. 800-801, 2010.
  * [50] Z. L. Yuan, J. F. Dynes, and A. J. Shields, "Resilience of gated avalanche photodiodes against bright illumination attacks in quantum cryptography," Appl. Phys. Lett., vol. 98, 231104, 2011.
  * [51] T. F. da Silva, G. B. Xavier, G. P. Temporão, and J. P. von der Weid, "Real-time monitoring of single-photon detectors against eavesdropping in quantum key distribution systems.," Opt. Express, vol. 20, pp. 18911-18924, 2012.
  * [52] M. Legre and G. Ribordy, "Apparatus and method for the detection of attacks taking control of the single photon detectors of a quantum cryptography apparatus by randomly changing their efficiency," U.S. Patent No. 10,020,937. 10 Jul. 2018.
  * [53] C. C. W. Lim, N. Walenta, M. Legré, N. Gisin, and H. Zbinden, "Random variation of detector efficiency: A countermeasure against detector blinding attacks for quantum key distribution," IEEE J. Sel. Top. Quantum Electron., vol. 21, 6601305, 2015.
  * [54] Y. J. Qian, D. Y. He, S. Wang, W. Chen, Z. Q. Yin, G. C. Guo, and Z. F. Han, "Robust countermeasure against detector control attack in a practical quantum key distribution system," Optica, vol. 6, pp. 1178-1184, 2019.
  * [55] Z. Wu, A. Huang, X. Qiang, J. Ding, P. Xu, X. Fu, and J. Wu, "Robust countermeasure against detector control attack in a practical quantum key distribution system: comment," Optica, vol. 7, pp. 1391-1393, 2020.
  * [56] H. K. Lo, M. Curty, and B. Qi, "Measurement-device-independent quantum key distribution," Phys. Rev. Lett., vol. 108, 130503, 2012.
  * [57] S. L. Braunstein and S. Pirandola, "Side-channel-free quantum key distribution," Phys. Rev. Lett., vol. 108, 130502, 2012.
  * [58] D. Stucki, N. Gisin, O. Guinnard, G. Ribordy, and H. Zbinden, "Quantum key distribution over 67 km with a plug&play system," New J. Phys., vol. 4, pp. 41.1–41.8, 2002.
  * [59] D. S. Bethune, and W. P. Risk, "Autocompensating quantum cryptography," New J. Phys., vol. 4, pp. 42.1-42.15, 2002.
  * [60] C. H. Park et al., "Practical Plug-and-Play Measurement-Device-Independent Quantum Key Distribution With Polarization Division Multiplexing," IEEE Access, vol. 6, pp. 58587-58593, 2018.
  * [61] S. F. Hegazy, and B. E. A. Saleh, "Quantum key distribution system to overcome intercept-resend and detector-control quantum hacking," US Patent application 63/296,711.
  * [62] A. Muller, T. Herzog, B. Huttner, W. Tittel, H. Zbinden, and N. Gisin, ""Plug and play” systems for quantum cryptography," Appl. phys. lett., vol. 70, pp. 793-795, 1997.
  * [63] N. Gisin, G. Ribordy, W. Tittel, H. Zbinden, "Quantum cryptography," Rev. Mod. Phys., vol. 74, pp. 145-195, 2002.
  * [64] D. B. Souto, J. Liñares, and X. Prieto-Blanco, "Phase auto-compensating high-dimensional quantum cryptography in elliptical-core few-mode fibres," J. Mod. Opt., vol. 66, no. 9, pp. 947-957, 2019.
  * [65] W. Y. Hwang, "Quantum key distribution with high loss: toward global secure communication," Phys. Rev. Lett., vol. 91, 057901, 2003.
  * [66] H. K. Lo, X. Ma, K. Chen, Decoy state quantum key distribution. Phys. Rev. Lett., vol. 94, 230504, 2005.
  * [67] X. B. Wang,  "Beating the photon-number-splitting attack in practical quantum cryptography," Phys. Rev. Lett., vol. 94, 230503, 2005.
  * [68] C. H. Bennett, F. Bessette, G. Brassard, L. Salvail, and J. Smolin, "Experimental quantum cryptography," J. cryptol., vol. 5, pp. 3-28, 1992.
  * [69] H.-W. Li et al. "Attacking a practical quantum-key-distribution system with wavelength-dependent beam-splitter and multiwavelength sources," Phys. Rev. A, vol. 84, p. 062308, 2011.
  * [70] N. J. Beaudry, T. Moroder, and N. Lütkenhaus, "Squashing models for optical measurements in quantum communication," Phys. Rev. Lett., vol. 101, 093601, 2008.
  * [71] T. Tsurumaru and K. Tamaki, "Security proof for quantum-key-distribution systems with threshold detectors," Phys. Rev. A , vol. 78, 032302, 2008.
  * [72] O. Gittsovich, N. J. Beaudry, V. Narasimhachar, R. R. Alvarez, T. Moroder, and N. Lütkenhaus, "Squashing model for detectors and applications to quantum-key-distribution protocols," Phys. Rev. A , vol. 89, 012325, 2014.