Svoboda | Graniru | BBC Russia | Golosameriki | Facebook
Next Article in Journal
Dual-Tower Counterfactual Session-Aware Recommender System
Previous Article in Journal
A Symmetric Form of the Clausius Statement of the Second Law of Thermodynamics
Previous Article in Special Issue
Entangled-Based Quantum Wavelength-Division-Multiplexing and Multiple-Access Networks
 
 
Search for Articles:
Title / Keyword
Author / Affiliation / Email
Journal
Article Type
 
 
Advanced Search
 
Section
Special Issue
Volume
Issue
Number
Page
 
Journals
Entropy
Volume 26
Issue 6
10.3390/e26060515
entropy-logo
Submit to this Journal Review for this Journal Propose a Special Issue
► Article Menu

Article Menu

share Share announcement Help format_quote Cite question_answer Discuss in SciProfiles thumb_up
...
Endorse textsms
...
Comment
first_page
settings
Order Article Reprints
Font Type:
Arial Georgia Verdana
Font Size:
Aa Aa Aa
Line Spacing:
Column Width:
Background:
Article

Underwater Wavelength Attack on Discrete Modulated Continuous-Variable Quantum Key Distribution

by
Kangyi Feng
1,
Yijun Wang
1,
Yin Li
1,
Yuang Wang
1,*,
Zhiyue Zuo
1,* and
Ying Guo
1,2
1
School of Automation, Central South University, Changsha 410083, China
2
School of Computer Science, Beijing University of Posts and Telecommunications, Beijing 100876, China
*
Authors to whom correspondence should be addressed.
Entropy 2024, 26(6), 515; https://doi.org/10.3390/e26060515
Submission received: 9 May 2024 / Revised: 6 June 2024 / Accepted: 12 June 2024 / Published: 14 June 2024
(This article belongs to the Special Issue Quantum Communications Networks: Trends and Challenges)
Browse Figures
Versions Notes

Abstract

:
The wavelength attack utilizes the dependence of beam splitters (BSs) on wavelength to cause legitimate users Alice and Bob to underestimate their excess noise so that Eve can steal more secret keys without being detected. Recently, the wavelength attack on Gaussian-modulated continuous-variable quantum key distribution (CV-QKD) has been researched in both fiber and atmospheric channels. However, the wavelength attack may also pose a threat to the case of ocean turbulent channels, which are vital for the secure communication of both ocean sensor networks and submarines. In this work, we propose two wavelength attack schemes on underwater discrete modulated (DM) CV-QKD protocol, which is effective for the case with and without local oscillator (LO) intensity monitor, respectively. In terms of the transmittance properties of the fused biconical taper (FBT) BS, two sets of wavelengths are determined for Eve’s pulse manipulation, which are all located in the so-called blue–green band. The derived successful criterion shows that both attack schemes can control the estimated excess noise of Alice and Bob close to zero by selecting the corresponding condition parameters based on channel transmittance. Additionally, our numerical analysis shows that Eve can steal more bits when the wavelength attack controls the value of the estimated excess noise closer to zero.

1. Introduction

One of the most famous applications of quantum mechanics is quantum key distribution (QKD), which can protect distant communication with unconditional security [1]. Generally, QKD has two main categories: the discrete-variable (DV) version [2,3,4] and the continuous-variable (CV) version [5,6,7]. In detail, DV-QKD encodes the information on the polarization of a photon and uses a single-photon detector for receiver detection, while CV-QKD encodes the information on the quadrature of the optical field and uses coherent detection. Compared with the DV version, CV-QKD is a younger category but has the advantages of lower cost detection and higher compatibility with the current optical communication system [8,9,10].
To date, many CV-QKD protocols have been proposed. By using different quantum states, CV-QKD has a coherent-state protocol and a squeezed-state protocol [5,11]. By using various modulation formats, CV-QKD has a Gaussian-modulated protocol and a discrete modulated (DM) protocol [5,12]. Among these protocols, research on the Gaussian-modulated coherent-state (GMCS) protocol, whose security has been proven under individual attacks [13], collective attacks [14], and coherent attacks [15], is the most advanced. However, unbounded Gaussian modulation can only be implemented to a certain degree in practice. Moreover, for the GMCS protocol, it is hard to achieve highly efficient error correction at a low signal-to-noise ratio (SNR). Therefore, the DM protocol was first proposed in 2009 to improve error correction efficiency in low-SNR cases [16]. In detail, the discrete signals are loaded symmetrically on the quadrature phase, similar to phase-shift keying (PSK) in digital communication systems.
When we develop a security proof, no matter the GMCS protocol or DM protocol, we assume that all devices follow their ideal mathematical models. In the real world, however, the device may deviate from the ideal model and introduce practical security loopholes because of Eve’s manipulation, such as saturation attacks [17], Trojan-horse attacks [18], and so on. In Ref. [19], the authors proposed a local oscillator (LO) calibration attack, where Eve manipulates the linear relationship between the variance in the measurement and the intensity of the LO by changing the shape of the LO signal. In detail, the calibration attack makes the legitimate users overestimate the shot noise so that they underestimate the channel excess noise. Therefore, Eve can perform an intercept–resend attack without being detected. To defend systems against this attack, the authors suggest randomly attenuating the signal intensity to monitor the shot noise [19]. However, this defense method was demonstrated not to hold when the wavelength attack was proposed [20]. The wavelength attack uses the imperfection of the beam splitter (BS) to make the users overestimate the shot noise again and even perform shot noise monitoring. Recently, the wavelength attack on CV-QKD in a free-space atmospheric channel, as well as in the fiber case, was analyzed and proven to be effective [21]. As discussed in many papers [22,23,24,25], the atmospheric channel is an important part of building a global quantum network, especially at present, when quantum relay technology is not yet mature [26].
The free-space seawater channel, like the atmospheric channel, is also an important part of the global quantum network, as it can be used for ocean exploitation and modern communication [27]. Even if the communication capability of the seawater quantum channel has been discussed in Ref. [28], seawater research lags behind that of the atmosphere. In fact, the seawater channel is a promising channel for quantum tasks, as free-space water is a uniform isotropic medium which does not lead to massive polarization rotation or depolarization of single photons [29]. Motivated by the previous idea, in this work, we explore the wavelength attack on CV-QKD in a seawater channel. We consider the four-state DM protocol with homodyne detection, while the central wavelength of Alice and Bob is located in the blue–green band for lower attenuation [30]. In terms of the determined central wavelength and the transmittance properties of fused biconical taper (FBT) BSs, we determine two sets of wavelengths for Eve, which are randomly selected by Eve when she manipulates the pulse. Numerical analysis shows that the wavelength attack can steal the secret key without being detected by manipulating the estimated excess noise of Alice and Bob.
The paper is organized as follows: In Section 2, we show the influences of horizontal seawater links, including extinction losses and ocean turbulence. In Section 3, we review the principle of the four-state protocol and FBT BSs and then propose two wavelength attack schemes. In Section 4, we derive the successful criteria of both attack schemes. In Section 5, we show the impact of wavelength attack on the security of the four-state protocol. Finally, Section 6 draws a conclusion.

2. Seawater Channel

In this section, we present a brief introduction to transmittance in seawater channels. The channel model used in our manuscript has been discussed in our previous works [28]. Specifically, this model considers the effects caused by extinction and turbulence in a horizontal seawater link.

2.1. Extinction Losses

The extinction-induced losses are caused by the absorption and scattering of both soluble and insoluble impurities, such as chlorophyll, inorganic salts, sediment particles, microorganisms, etc. Specifically, absorption causes energy loss while scattering leads to the divergence of the laser beam [31,32], and they are quantified by absorption coefficient a λ and scattering coefficient b λ , respectively. Here, λ denotes the wavelength of quantum light, while the details of a λ and b λ are shown in Appendix A of Ref. [28]. In detail, a λ and b λ are related to both the ocean type and the submarine depth d. The total extinction coefficient β λ is defined as the sum of a λ and b λ . Finally, extinction-induced transmittance is characterized by the Lambert–Beer law given by [28].
η ext = e − β ( λ ) L ,
where L is the transmission distance. For less attenuation, we use a 532 nm laser in the blue–green band in the following. In addition, the ocean type of our manuscript is set to S6 as an example.

2.2. Ocean Turbulence

In general, ocean turbulence is caused by the combined effect of two fluctuating scalars: temperature and salinity. In our manuscript, these scalars can be characterized by the classical Kolmogorov power spectrum given by [33].
Φ ( κ ) = A ω ξ − 1 3 κ − 11 3 ,
where A is the order of unity, ω is related to the dissipation rate of temperature or salinity variance, ξ is the kinetic energy dissipation rate, and κ is the spatial frequency. In terms of this power spectrum, the elliptical model of free-space quantum light can be used for analyzing the beam evolution of ocean turbulent channels. Finally, transmittance in a seawater channel with an initial beam radius w 0 can be estimated as
η ch = η ext η 0 exp − r / a Q ( 2 w eff ( ϕ − φ ) ) Y 2 w eff ( ϕ − φ ) ,
where η 0 is the transmittance without either extinction and beam wandering effects, r is the beam-centroid vector, a is the receiver telescope radius, w eff ( · ) is the effective spot-radius with deformation effects, ϕ is the beam–ellipse orientation angle, φ denotes the angle between vector r and the x-axis, and Q ( · ) and Y ( · ) are scale and shape functions, respectively. The details of the above parameters are shown in Appendix B of Ref. [28]. In our manuscript, the value of the above parameters are a = 0.25 m, w 0 = 80 mm, ω = 10 − 11 , and ξ = 10 − 3 .

3. Seawater Wavelength Attack on Discrete Modulated CV-QKD

In this section, we have a quick review of the four-state DM protocol and the principle of FBT BSs. Then, two wavelength attack schemes in seawater channels are proposed.

3.1. The Four-State Protocol

The four-state protocol with homodyne detection will be used in the following, and its steps can be described as follows:
(1)
State preparation and transmission: For the j-th round, Alice randomly prepares one of the quantum states from | ϕ j 〉 ∈ { | α e i ( 2 k − 1 ) π / 4 〉 : k ∈ 1 , 2 , 3 , 4 } and sends it to Bob via a thermal-loss channel, which is characterized by transmittance η ch and excess noise ε . Here, α is the amplitude of the quantum state, and the states | α e i ( π / 4 ) 〉 , | α e i ( 3 π / 4 ) 〉 , | α e i ( 4 π / 4 ) 〉 , and | α e i ( 7 π / 4 ) 〉 correspond to the data 00, 10, 11, and 01, respectively. Along with the quantum state, Alice also prepares and sends a strong LO by multiplexing technology for homodyne detection on Bob’s side.
(2)
Measurement: With the help of the multiplexed LO, Bob performs homodyne detection on the q or p quadrature of the arriving quantum state for the raw key. In detail, Bob generates a uniform random number b j ∈ 1 , 2 so that b j = 0 ( b j = 1 ) measures q (p).
(3)
Parameter estimation: To obtain a practical secret key rate, Alice and Bob choose a part of the data for parameter estimation. In detail, Alice publishes part of the quantum states she sends, and Bob publishes the corresponding measurement results. Based on the public information, both parties can estimate the practical secret key rate. If this secret key rate is below zero, both parties abort the protocol; otherwise, they proceed to the data post-processing.
(4)
Data post-processing: General data post-processing has two steps: error correction and privacy amplification. Error correction is to correct the keys that are inconsistent between the two parties. Private amplification reduces the amount of information to which Eve has access to with the secret key. After the appropriate private amplification, Alice and Bob generate the final secret key.
Note that the above description is based on the prepare-and-measure scheme, which is widely used in experiments. For the security analysis, one usually uses an equivalent entanglement-based (EB) scheme, as shown in Section 5.

3.2. The Principle of Beam Splitters

Generally, the BS used in the CV-QKD system is an FBT BS, which combines the ends of two bare fibers in a high-temperature environment to form a biconical waveguide structure. The splitting ratio of this BS is related to the wavelength of the input, which can be expressed as [34]
T ( λ ) = F 2 sin 2 c λ 2.5 w F ,
where F 2 denotes the fraction of power coupled, c λ 2.5 represents the coupling coefficient of the FBT BS, and w is the width of the heat source. As discussed in Section 2.1, our manuscript uses a central wavelength λ 0 = 532 nm for less attenuation. Therefore, we have T ( λ 0 ) = sin 2 c λ 0 2.5 w = 0.5 . Here, we set F = 1 for simplicity. Based on Equation (4), we find that only when the input is located at the central wavelength, the splitting ratio of the BS is 50:50. In other words, the splitting ratio is no longer balanced when the input’s wavelength deviates from the center wavelength. In what follows, we will discuss how Eve uses the wavelength dependence of such BS for the so-called wavelength attack.

3.3. Wavelength Attack Scheme

Figure 1 shows the general wavelength attack scheme. To implement the wavelength attack, Eve first intercepts and measures both the q and p quadrature of Alice’s quantum states | ϕ j 〉 by heterodyne detection. Then, Eve prepares and sends two groups of pulses at the same time to Bob: { F s , F l o } and { P s , P l o } . In detail, the wavelength of { F s , F l o } is the same as Alice, while the wavelength of { P s , P l o } is changed by Eve. In the first group, the signal pulse F s is modulated according to Eve’s measurement results { q E , p E } , and the LO pulse F l o is manipulated by Eve in terms of Bob’s monitoring method. In the second group, the wavelengths of { P s , P l o } (i.e., λ s and λ l o ) are randomly selected from two sets of wavelengths with equal probability. In terms of the central wavelength λ 0 , the two sets of wavelengths in our manuscript are shown in Table 1, which also shows the corresponding transmittance, i.e., T s and T l o [35].
On the receiver side, the differential current measured by the homodyne detector comes from the signal photocurrent i s and LO photocurrent i l o , whose intensities are I s and I l o , respectively. In general, Bob will attenuate the quantum signal with randomly selected coefficient r i (i = 1, 2), which equals 0 or 1, to resist the LO calibration attack [19]. In detail, when r 1 ≈ 0 , the differential current is primarily contributed by i l o . If T l o = 0.5, which correspond to Bob measuring { F s , F l o } , only the differential current remains.
i s n = η l o I l o η l o δ X ^ ϕ + 1 − η l o X ^ v 2 − X ^ v 1 2 ,
where δ X ^ ϕ , X ^ v 1 , and X ^ v 2 are irrelevant vacuum states and η l o is the detection efficiency when the wavelength is λ l o . Note that the variance in Equation (5) is used as the normalized shot noise unit given by
N 0 = η l o I l o = η l o α lo 2 ,
where α lo = I l o is the amplitude of the LO. If T l o ≠ 0.5 , which means that Bob measures { P s , P l o } , the differential current (without shot noise part) is approximately equal to [20]
D l o = 2 T l o − 1 η l o I l o .
When r 2 ≈ 1 , the differential current is contributed by both i s and i l o . If Bob measures { F s , F l o } , we have T s = T l o = 0.5 and obtain the q E or p E quadrature. If Bob measures { P s , P l o } , we have T s ≈ T l o ≠ 0.5 (see Table 1), and the differential current (without shot noise part) is approximately equal to
D s = 1 − 2 T s η s I s ,
where η s is the detection efficiency when wavelength is λ s .
As mentioned above, the LO pulse F l o is manipulated by Eve in terms of Bob’s monitoring method. Next, we discuss two attack schemes where Bob is without and with LO intensity monitoring ability, i.e., attack scheme A and attack scheme B, respectively. Figure 2 shows the differences in Eve’s manipulation between attack scheme A and attack scheme B. In attack scheme A, both the amplitudes of the signal and the LO are manipulated, while attack scheme B only manipulates the wave shape of the LO.
Attack scheme A: If Bob does not measure the intensity of the LO, Eve performs the intercept–resend attack along with the wavelength attack. In this case, Bob uses the shot noise unit obtained before key distribution to normalize the measurement result. This scheme has two parts, as follows.
Part 1: Eve performs the intercept–resend attack and obtains the heterodyne detection results { q E , p E } . Then, Eve sends { F s , F l o } according to { q E , p E } and keeps their polarization unchanged. The amplitude of F s is set to N η ch q E + i p E / 2 , where N is larger than 1. For the amplitude of F l o , Eve changes it from α lo to α lo / N .
Part 2: Eve sends { P s , P l o } at the same time as { F s , F l o } , and the wavelengths of { P s , P l o } are chosen randomly from Table 1.
In Part 1, Eve reduces the amplitude of F l o , which will decrease the shot noise unit. In this case, Bob can detect Eve’s attack by shot noise monitoring if Eve has no other steps. Therefore, Eve needs to add { P s , P l o } in Part 2 to compensate the total shot noise unit to a normal level, i.e., N 0 . In detail, the variance in these pulses’ differential current is considered the added shot noise. However, if Eve only uses one set of wavelengths, such as Set 1, the variance in the corresponding differential current D 1 l o will equal zero. This is the reason why we use two sets of wavelengths with random selection. In addition to the variance, the mean value of D l o should be zero because a normal shot noise quadrature is considered a random variable with zero mean value. Therefore, we set T 1 l o ≈ 1 − T 2 l o to make D 1 l o = − D 2 l o so that 〈 D l o 〉 = 〈 D 1 l o 〉 + 〈 D 2 l o 〉 = 0 . Finally, the mean value of D s should also be zero, so that we set D 1 s = − D 2 s . In total, we can make D 1 s = − D 1 l o = − D 2 s = D 2 l o ≡ D for simple.
Attack scheme B: If Bob measures the intensity of the LO, Eve cannot reduce the amplitude of F l o anymore. In this case, Eve combines the LO calibration attack and wavelength attack. Note that attack scheme B also uses D 1 s = − D 1 l o = − D 2 s = D 2 l o ≡ D to meet the requirements mentioned above. The two parts of this scheme are as follows.
Part 1: Eve performs the intercept–resend attack and sends F s according to { q E , p E } , whose amplitude is η ch X E + i P E / 2 . Then, Eve performs an LO calibration attack, which changes the shape of the LO to delay Bob’s detector response time. This change makes Bob overestimate the shot noise unit with the correct LO intensity.
Part 2: Same as Part 2 in attack scheme A.

4. The Successful Criterion of the Wavelength Attack

Considering the random coefficient r i , the variance in Bob’s homodyne detection data under the linear channel assumption is
〈 y ^ 2 〉 i = r i η η ch V A + ε N 0 + N 0 + v el N 0 ,
where V A is the modulation variance and v el is the electronic noise. Then, Bob can estimate the shot noise unit and the excess noise as
N ^ 0 = r 2 y ^ 2 1 − r 1 y ^ 2 2 r 2 − r 1 / 1 + v el ,
ε ˜ = y ^ 2 2 − y ^ 2 1 r 2 − r 1 η η ch − V A N ^ 0 / N ^ 0 .
To ensure the success of the attack without being detected, the following two conditions must be met: N ^ 0 = N 0 and ε ˜ ≤ ε . Next, we derive the specific success criteria of the two attack schemes. In the following, the values of the parameters are V A = 0.3 [36], ε = 0.1 , v el = 0.01 , η 1 s = η 2 s = η 1 l o = η 2 l o = η = 0.5 , I l o = 1 × 10 8 , r 1 = 0.001 , r 2 = 1 , and N 0 = η I l o = 5 × 10 7 .

4.1. Attack Scheme A

The differential current measured by the homodyne detector is the sum of the currents from two parts, which can be expressed as
δ ^ i tot , i = δ ^ i part 1 , i + δ ^ i part 2 , i ,
where i = { 1 , 2 } corresponds to the coefficients { r 1 , r 2 } , respectively. In detail, the variance in δ ^ i part 1 , i is given by
V part 1 , i A = η α L O 2 N r i η η ch N V A + 2 + 1 + r i η η ch ε N 0 + v e l N 0 = r i η η ch V A + 2 + ε N 0 + N 0 N + v el N 0 .
Then, the variance in δ ^ i part 2 , i can be expressed as
V part 2 , i A = 1 − r i 2 D 2 + η 〈 I j l o 〉 + η r i 2 〈 I j s 〉 ,
where 〈 I j l o 〉 and 〈 I j s 〉 denote the mean values of I j l o and I j s in the seawater channel, respectively. Since we randomly select the coefficient r i , 〈 I j l o 〉 and 〈 I j s 〉 are given by
〈 I j l o 〉 = I 1 l o 2 + I 2 l o 2 = D 1 l o 2 η 2 T 1 l o − 1 + D 2 l o 2 η 2 T 2 l o − 1 = 45.854 D ,
〈 I j s 〉 = I 1 s 2 + I 2 s 2 = D 1 s 2 η 1 − 2 T 1 s + D 2 s 2 η 1 − 2 T 2 s = 45.170 D .
Therefore, Equation (14) can be rewritten as
V part 2 , i A = 1 − r i 2 D 2 + 22 . 927 + 22 . 585 r i 2 D .
Thus, the variance in the differential current can be expressed as
〈 y ^ 2 〉 i A = V part 1 , m A + V part 2 , m A = r m η η ch V A + 2 + ε N 0 + N 0 N + v el N 0 + 1 − r m 2 D 2 + 22.927 + 22.585 r m 2 D .
Finally, Bob estimates the shot noise unit and excess noise by Equations (10) and (11), which can be expressed as
N ^ 0 = 1 N + v el N 0 + 1 − r 1 r 2 D 2 + 22.927 − 22.585 r 1 r 2 D 1 + v el , ε ˜ = ( 2 + ε ) N 0 N ^ 0 + V A N 0 N ^ 0 − 1 + r 1 + r 2 − 2 D 2 η η ch N ^ 0 + 22.585 r 1 + r 2 D η η ch N ^ 0 .
To make the wavelength attack successful, the parameters N and D should satisfy
N = − N 0 1 − r 1 r 2 D 2 + 22.927 − 22.585 r 1 r 2 D − N 0 ,
− 2 + ε η η ch N ^ 0 < r 1 + r 2 − 2 D 2 + 22.585 r 1 + r 2 D ≤ − 2 η η ch N ^ 0 .
We find that these two formulas are not related to V A , which implies that Eve can perform the attack without knowing the modulation variance.

4.2. Attack Scheme B

In this scheme, since Eve performs the LO calibration attack, the shot noise unit is γ N 0 ( γ < 1). Then, the variance in δ ^ i part 1 , m is given by
V part 1 , m B = γ r m η η ch ′ V A + 2 + ε + 1 N 0 + v el N 0 ,
where η ch ′ = η ch / γ can be considered the virtual channel transmittance simulated by Eve. Next, the expression of V part 2 , m B is the same as that in attack scheme A. Therefore, the variance in the differential current is
〈 y ^ 2 〉 i B = V part 1 , m B + V part 2 , m B = γ r m η η ch ′ V A + 2 + ε + 1 N 0 + v el N 0 + 1 − r m 2 D 2 + 22 . 927 + 22 . 585 r m 2 D .
Based on Equation (10), Bob estimates the variance in the shot noise given by
N ^ 0 = γ + v el N 0 + 1 − r 1 r 2 D 2 + 22.927 − 22.585 r 1 r 2 D 1 + v el ;
thus, γ should satisfy
γ = 1 − 1 − r 1 r 2 D 2 + 22.927 − 22.585 r 1 r 2 D N 0 .
Based on Equation (11), we find that the estimation of ε ˜ is the same as that of attack scheme A. We find that the above formulas are still not related to V A .

5. Simulation

In this section, we first show the effectiveness of our two attack schemes. Then, the secret key rate and Holevo bound of the four-state protocol are discussed. The simulation parameters are the same as in Section 4. As discussed in Section 4, the condition parameters in attack scheme A and attack scheme B are N and γ , respectively. Figure 3 shows the relationship of these two parameters with various ε ˜ and transmittance η ch . Here, the green lines represent the case ε ˜ = ε = 0.1 , which means Eve cannot obtain more information by the wavelength attack. We find that both schemes can control ε ˜ close to zero. To a target ε ˜ , the corresponding N of attack scheme A increases as the transmittance increases, as shown in Figure 3a. Moreover, for each transmittance value, Eve needs to use a lager N for a lower ε ˜ . In contrast, Figure 3b shows that the required value of γ decreases as the transmittance grows, while a lower γ obtains a lower ε ˜ for each transmittance.
As described in Section 3.1, in parameter estimation, Bob calculates the practical secret key rate according to the estimated channel parameters. Here, we use the equivalent EB scheme instead of the prepare-and-measure scheme for security analysis. In the equivalent EB scheme, Alice generates a two-mode entangled state, which can be characterized by its covariance matrix given by [36].
γ A B = V I 2 Z 4 σ z Z 4 σ z V I 2 ,
where I 2 = diag 1 , 1 , σ z = diag 1 , 1 , V = V A + 1 , and
Z 4 = 2 α 2 p 0 3 / 2 p 1 1 / 2 + p 1 3 / 2 p 2 1 / 2 + p 2 3 / 2 p 3 1 / 2 + p 3 3 / 2 p 0 1 / 2 ,
with
p 0 , 2 = 1 2 e − α 2 cosh α 2 ± cos α 2 ,
p 1 , 3 = 1 2 e − α 2 sinh α 2 ± sin α 2 .
Then, mode A of the entangled state stays on Alice’s side for heterodyne measurement, while mode B is transferred to Bob by the quantum channel. When mode B reaches Bob, the covariance matrix of the arriving entangled states can be expressed as [36]
γ A B = V I 2 η ch Z 4 σ z η ch Z 4 σ z η ch V − 1 + 1 + η ch ε ˜ I 2 .
In the asymptotic case with reverse reconciliation, the secret key rate can be expressed as
K η ch , ε ˜ = β 0 I A B η ch , ε ˜ − χ B E η ch , ε ˜ ,
where 〈 · 〉 means the mean value, I A B is the classic mutual information between Alice and Bob, χ B E is the Holevo bound, and β is the reconciliation efficiency (see Appendix A for details).
Figure 4 shows the relationship between the stolen bits, i.e., K ( 〈 η ch 〉 , ε ˜ ) − K ( 〈 η ch 〉 , ε ) , and transmission distance L when using the four-state protocol with submarine depth d = 200 m. Here, we use reverse reconciliation with reconciliation efficiency β 0 = 0.95, while the real excess noise is ε = 0.1. We find that Alice and Bob cannot generate a secret key when ε = 0.1. However, after the wavelength attack, Alice and Bob use the estimated excess noise ε ˜ for the estimation of the secret key rate. In this case, the users will believe the keys are secure when the estimation result is above zero. For example, when Eve reduces the estimated excess noise to zero, the users will believe that the secure transmission distance is above 30 m. In fact, the real secure transmission distance is zero so that Eve can obtain these secret keys without being detected. In addition, the estimated secret key rate increases when ε ˜ decreases. For example, the estimated secure transmission distance increases from 2 m to above 30 m when ε ˜ decreases from 0.03 to 0. Figure 5 shows the relationship of the real Holevo bound χ B E ( 〈 η ch 〉 , ε ) and the estimated Holevo bound χ B E ( 〈 η ch 〉 , ε ˜ ) under different seawater types with various submarine depth d and transmission distance L. Here, the estimated Holevo bound is calculated with an estimated excess noise ε ˜ = 0. We find that there is a big difference in the performance of the two seawater types.

6. Conclusions and Discussion

In this paper, we have proposed two wavelength attack schemes for the underwater four-state protocol with and without LO intensity monitoring. Transmittance in underwater channels is affected by both extinction and ocean turbulence, so it fluctuates randomly over time. Different from both the fiber and atmosphere cases, the communication wavelength of underwater channels is not 1550 nm but is located in the so-called blue–green band. To meet this change, we have proposed two sets of wavelengths for Eve’s pulse manipulation based on the transmittance properties of FBT BSs. We have calculated the successful criteria of both attack schemes and found that Eve can manipulate the estimated excess noise of Alice and Bob close to zero by slightly changing the corresponding condition parameters, i.e., N or γ . Numerical analysis shows that the secure transmission distance is overestimated by Alice and Bob when Eve performs the wavelength attack.
To avoid the wavelength attack, a direct idea is that one can design and use a wavelength-independent BS instead of a wavelength-dependent one. In addition, narrow wavelength filtering on Bob’s side can also avoid the wavelength attack. Note that wavelength filtering needs LO intensity monitoring to work together. This is because practical wavelength filtering has an upper limit of attenuation for any specific wavelength so that Eve can beat it by increasing the pulse intensity. Moreover, Ref. [20] has proposed a method by using a third attenuation ratio in the shot noise monitoring module. In this method, Alice and Bob ensure they avoid a wavelength attack when the polynomial function of the total noise-to-attenuation ratio is almost linear. To avoid increasing the complexity and decreasing the final secret key rate in the above method, Ref. [37] has proposed another data post-processing method via peak–valley seeking and Gaussian postselection.

Author Contributions

Conceptualization, Y.W. (Yuang Wang) and Y.L.; writing—original draft preparation, K.F.; writing—review, Y.G. and Z.Z.; writing—editing, Y.W. (Yijun Wang) and Y.W. (Yuang Wang). All authors have read and agree to the published version of the manuscript.

Funding

This work was supported by National Natural Science Foundation of China (grant No. 61871407) and Special Funds for the Construction of an Innovative Province in Hunan (grant No. 2022GK2016).

Data Availability Statement

All data generated or analyzed during this study are included in this article.

Acknowledgments

We would like to thank Jingzheng Huang and Zhe He for the helpful discussion.

Conflicts of Interest

The authors declare no conflicts of interest.

Appendix A

In terms of Equation (30), when using homodyne detection, the mutual information between Alice and Bob can be expressed as
I A B η ch , ε ˜ = 1 2 log 2 1 1 − η ch 2 V − 1 η ch V + χ tot ,
where χ tot = χ line + χ hom / 〈 η ch 〉 with the total channel-added noise χ line = 1 / 〈 η ch 〉 − 1 + ε ˜ and the detection-added noise χ hom = ( 1 − η + v el ) / η . Then, the estimated Holevo bound χ B E ( 〈 η ch 〉 , ε ˜ ) can be expressed by
χ B E η ch , ε ˜ = ∑ i = 1 2 G λ i − 1 2 − ∑ i = 3 5 G λ i − 1 2 ,
where G ( x ) = ( x + 1 ) log 2 ( x + 1 ) − x log 2 x and λ i represents the symplectic eigenvalues given by
λ 1 , 2 2 = 1 2 A ± A 2 − 4 B , λ 3 , 4 2 = 1 2 C ± C 2 − 4 D , λ 5 = 1 ,
where
A = V 2 + η ch 2 V + 1 − η ch η ch + ε ˜ 2 − 2 η ch 2 Z 4 2 , B = η ch V 2 + η ch χ line V − η ch 2 Z 4 2 2 , C = A χ hom + V B + η ch V + χ line η ch V + χ tot , D = B V + B χ hom η ch V + χ tot .

References

  1. Pirandola, S.; Andersen, U.L.; Banchi, L.; Berta, M.; Bunandar, D.; Colbeck, R.; Englund, D.; Gehring, T.; Lupo, C.; Ottaviani, C.; et al. Advances in quantum cryptography. Adv. Opt. Photonics 2020, 12, 1012–1236. [Google Scholar] [CrossRef]
  2. Ekert, A.K. Quantum cryptography based on Bell’s theorem. Phys. Rev. Lett. 1991, 67, 661. [Google Scholar] [CrossRef] [PubMed]
  3. Lucamarini, M.; Yuan, Z.L.; Dynes, J.F.; Shields, A.J. Overcoming the rate–distance limit of quantum key distribution without quantum repeaters. Nature 2018, 557, 400–403. [Google Scholar] [CrossRef] [PubMed]
  4. Liao, S.K.; Cai, W.Q.; Liu, W.Y.; Zhang, L.; Li, Y.; Ren, J.G.; Yin, J.; Shen, Q.; Cao, Y.; Li, Z.P.; et al. Satellite-to-ground quantum key distribution. Nature 2017, 549, 43–47. [Google Scholar] [CrossRef] [PubMed]
  5. Grosshans, F.; Grangier, P. Continuous variable quantum cryptography using coherent states. Phys. Rev. Lett. 2002, 88, 057902. [Google Scholar] [CrossRef] [PubMed]
  6. Pirandola, S.; Ottaviani, C.; Spedalieri, G.; Weedbrook, C.; Braunstein, S.L.; Lloyd, S.; Gehring, T.; Jacobsen, C.S.; Andersen, U.L. High-rate measurement-device-independent quantum cryptography. Nat. Photonics 2015, 9, 397–402. [Google Scholar] [CrossRef]
  7. Pirandola, S.; Mancini, S.; Lloyd, S.; Braunstein, S.L. Continuous-variable quantum cryptography using two-way quantum communication. Nat. Phys. 2008, 4, 726–730. [Google Scholar] [CrossRef]
  8. Weedbrook, C.; Pirandola, S.; García-Patrón, R.; Cerf, N.J.; Ralph, T.C.; Shapiro, J.H.; Lloyd, S. Gaussian quantum information. Rev. Mod. Phys. 2012, 84, 621. [Google Scholar] [CrossRef]
  9. Qi, B. Simultaneous classical communication and quantum key distribution using continuous variables. Phys. Rev. A 2016, 94, 042340. [Google Scholar] [CrossRef]
  10. Jain, N.; Chin, H.M.; Mani, H.; Lupo, C.; Nikolic, D.S.; Kordts, A.; Pirandola, S.; Pedersen, T.B.; Kolb, M.; Ömer, B.; et al. Practical continuous-variable quantum key distribution with composable security. Nat. Commun. 2022, 13, 4740. [Google Scholar] [CrossRef]
  11. Derkach, I.; Usenko, V.C.; Filip, R. Squeezing-enhanced quantum key distribution over atmospheric channels. New J. Phys. 2020, 22, 053006. [Google Scholar] [CrossRef]
  12. Ghalaii, M.; Ottaviani, C.; Kumar, R.; Pirandola, S.; Razavi, M. Discrete-modulation continuous-variable quantum key distribution enhanced by quantum scissors. IEEE J. Sel. Areas Commun. 2020, 38, 506–516. [Google Scholar] [CrossRef]
  13. Grosshans, F.; Cerf, N.J. Continuous-variable quantum cryptography is secure against non-Gaussian attacks. Phys. Rev. Lett. 2004, 92, 047905. [Google Scholar] [CrossRef] [PubMed]
  14. Navascués, M.; Grosshans, F.; Acin, A. Optimality of Gaussian attacks in continuous-variable quantum cryptography. Phys. Rev. Lett. 2006, 97, 190502. [Google Scholar] [CrossRef] [PubMed]
  15. Renner, R.; Cirac, J.I. de Finetti representation theorem for infinite-dimensional quantum systems and applications to quantum cryptography. Phys. Rev. Lett. 2009, 102, 110504. [Google Scholar] [CrossRef] [PubMed]
  16. Leverrier, A.; Grangier, P. Unconditional security proof of long-distance continuous-variable quantum key distribution with discrete modulation. Phys. Rev. Lett. 2009, 102, 180504. [Google Scholar] [CrossRef] [PubMed]
  17. Qin, H.; Kumar, R.; Alléaume, R. Quantum hacking: Saturation attack on practical continuous-variable quantum key distribution. Phys. Rev. A 2016, 94, 012325. [Google Scholar] [CrossRef]
  18. Pereira, J.; Pirandola, S. Hacking Alice’s box in continuous-variable quantum key distribution. Phys. Rev. A 2018, 98, 062319. [Google Scholar] [CrossRef]
  19. Jouguet, P.; Kunz-Jacques, S.; Diamanti, E. Preventing calibration attacks on the local oscillator in continuous-variable quantum key distribution. Phys. Rev. A 2013, 87, 062313. [Google Scholar] [CrossRef]
  20. Huang, J.Z.; Kunz-Jacques, S.; Jouguet, P.; Weedbrook, C.; Yin, Z.Q.; Wang, S.; Chen, W.; Guo, G.C.; Han, Z.F. Quantum hacking on quantum key distribution using homodyne detection. Phys. Rev. A 2014, 89, 032304. [Google Scholar] [CrossRef]
  21. Tan, X.; Guo, Y.; Zhang, L.; Huang, J.; Shi, J.; Huang, D. Wavelength attack on atmospheric continuous-variable quantum key distribution. Phys. Rev. A 2021, 103, 012417. [Google Scholar] [CrossRef]
  22. Sidhu, J.S.; Joshi, S.K.; Gündoğan, M.; Brougham, T.; Lowndes, D.; Mazzarella, L.; Krutzik, M.; Mohapatra, S.; Dequal, D.; Vallone, G.; et al. Advances in space quantum communications. IET Quantum Commun. 2021, 2, 182–217. [Google Scholar] [CrossRef]
  23. Zuo, Z.; Wang, Y.; Huang, D.; Guo, Y. Atmospheric effects on satellite-mediated continuous-variable quantum key distribution. J. Phys. A Math. Theor. 2020, 53, 465302. [Google Scholar] [CrossRef]
  24. Pirandola, S. Satellite quantum communications: Fundamental bounds and practical security. Phys. Rev. Res. 2021, 3, 023130. [Google Scholar] [CrossRef]
  25. Ghalaii, M.; Bahrani, S.; Liorni, C.; Grasselli, F.; Kampermann, H.; Wooltorton, L.; Kumar, R.; Pirandola, S.; Spiller, T.P.; Ling, A.; et al. Satellite-Based Quantum Key Distribution in the Presence of Bypass Channels. PRX Quantum 2023, 4, 040320. [Google Scholar] [CrossRef]
  26. Azuma, K.; Economou, S.E.; Elkouss, D.; Hilaire, P.; Jiang, L.; Lo, H.K.; Tzitrin, I. Quantum repeaters: From quantum networks to the quantum internet. Rev. Mod. Phys. 2023, 95, 045006. [Google Scholar] [CrossRef]
  27. Ji, L.; Gao, J.; Yang, A.L.; Feng, Z.; Lin, X.F.; Li, Z.G.; Jin, X.M. Towards quantum communications in free-space seawater. Opt. Express 2017, 25, 19795–19806. [Google Scholar] [CrossRef]
  28. Zuo, Z.; Wang, Y.; Mao, Y.; Ruan, X.; Guo, Y. Security of quantum communications in oceanic turbulence. Phys. Rev. A 2021, 104, 052613. [Google Scholar] [CrossRef]
  29. Chen, Y.; Shen, W.G.; Li, Z.M.; Hu, C.Q.; Yan, Z.Q.; Jiao, Z.Q.; Gao, J.; Cao, M.M.; Sun, K.; Jin, X.M. Underwater transmission of high-dimensional twisted photons over 55 meters. PhotoniX 2020, 1, 1–11. [Google Scholar] [CrossRef]
  30. Kaushal, H.; Kaddoum, G. Underwater optical wireless communication. IEEE Access 2016, 4, 1518–1547. [Google Scholar] [CrossRef]
  31. Wiscombe, W.J. Improved Mie scattering algorithms. Appl. Opt. 1980, 19, 1505–1509. [Google Scholar] [CrossRef]
  32. Lock, J.A.; Gouesbet, G. Generalized Lorenz–Mie theory and applications. J. Quant. Spectrosc. Radiat. Transf. 2009, 110, 800–807. [Google Scholar] [CrossRef]
  33. Hou, W.W. A simple underwater imaging model. Opt. Lett. 2009, 34, 2688–2690. [Google Scholar] [CrossRef] [PubMed]
  34. Huang, J.Z.; Weedbrook, C.; Yin, Z.Q.; Wang, S.; Li, H.W.; Chen, W.; Guo, G.C.; Han, Z.F. Quantum hacking of a continuous-variable quantum-key-distribution system using a wavelength attack. Phys. Rev. A 2013, 87, 062329. [Google Scholar] [CrossRef]
  35. Available online: http://www.thorlabschina.cn (accessed on 1 April 2024).
  36. Leverrier, A.; Grangier, P. Continuous-variable quantum-key-distribution protocols with a non-Gaussian modulation. Phys. Rev. A 2011, 83, 042312. [Google Scholar] [CrossRef]
  37. Huang, P.; Huang, J.; Wang, T.; Li, H.; Huang, D.; Zeng, G. Robust continuous-variable quantum key distribution against practical attacks. Phys. Rev. A 2017, 95, 052302. [Google Scholar] [CrossRef]
Entropy 26 00515 g001
Figure 1. Seawater wavelength attack scheme using homodyne detector. LD, laser diode; WT-LD, wavelength-tunable laser diode; PP, polarizing prism; BS1, 1:99 beam splitter; BS2, 10:90 beam splitter; PBS, polarization beam splitter; AM, amplitude modulator; PM, phase modulator; Δ t , a very small time interval; f, repetition rate.
Figure 1. Seawater wavelength attack scheme using homodyne detector. LD, laser diode; WT-LD, wavelength-tunable laser diode; PP, polarizing prism; BS1, 1:99 beam splitter; BS2, 10:90 beam splitter; PBS, polarization beam splitter; AM, amplitude modulator; PM, phase modulator; Δ t , a very small time interval; f, repetition rate.
Entropy 26 00515 g001
Entropy 26 00515 g002
Figure 2. Differences in Eve’s manipulation between attack scheme A and attack scheme B. Red and blue colors represent signal pulse and LO pulse, respectively.
Figure 2. Differences in Eve’s manipulation between attack scheme A and attack scheme B. Red and blue colors represent signal pulse and LO pulse, respectively.
Entropy 26 00515 g002
Entropy 26 00515 g003
Figure 3. (a) N of attack scheme A vs. transmittance for various ε ^ . (b) γ of attack scheme B vs. transmittance for various ε ^ .
Figure 3. (a) N of attack scheme A vs. transmittance for various ε ^ . (b) γ of attack scheme B vs. transmittance for various ε ^ .
Entropy 26 00515 g003
Entropy 26 00515 g004
Figure 4. The stolen bits in the S6 ocean for various estimated excess noise values ε ˜ . The submarine depth is set to d = 200 m.
Figure 4. The stolen bits in the S6 ocean for various estimated excess noise values ε ˜ . The submarine depth is set to d = 200 m.
Entropy 26 00515 g004
Entropy 26 00515 g005
Figure 5. The relationship of the real Holevo bound χ B E ( 〈 η ch 〉 , ε ) (red surface) and the estimated Holevo bound χ B E ( 〈 η ch 〉 , ε ˜ ) (blue surface) with various submarine depths and transmission distances. The estimated excess noise is set to ε ˜ = 0. (a) S1 seawater. (b) S6 seawater.
Figure 5. The relationship of the real Holevo bound χ B E ( 〈 η ch 〉 , ε ) (red surface) and the estimated Holevo bound χ B E ( 〈 η ch 〉 , ε ˜ ) (blue surface) with various submarine depths and transmission distances. The estimated excess noise is set to ε ˜ = 0. (a) S1 seawater. (b) S6 seawater.
Entropy 26 00515 g005
Table 1. Two sets of wavelengths with corresponding transmittance.
Table 1. Two sets of wavelengths with corresponding transmittance.
Set λ s ( nm ) T s λ lo ( nm ) T lo
15260.478056320.47837
25380.522336370.52199
Disclaimer/Publisher’s Note: The statements, opinions and data contained in all publications are solely those of the individual author(s) and contributor(s) and not of MDPI and/or the editor(s). MDPI and/or the editor(s) disclaim responsibility for any injury to people or property resulting from any ideas, methods, instructions or products referred to in the content.

Share and Cite

MDPI and ACS Style

Feng, K.; Wang, Y.; Li, Y.; Wang, Y.; Zuo, Z.; Guo, Y. Underwater Wavelength Attack on Discrete Modulated Continuous-Variable Quantum Key Distribution. Entropy 2024, 26, 515. https://doi.org/10.3390/e26060515

AMA Style

Feng K, Wang Y, Li Y, Wang Y, Zuo Z, Guo Y. Underwater Wavelength Attack on Discrete Modulated Continuous-Variable Quantum Key Distribution. Entropy. 2024; 26(6):515. https://doi.org/10.3390/e26060515

Chicago/Turabian Style

Feng, Kangyi, Yijun Wang, Yin Li, Yuang Wang, Zhiyue Zuo, and Ying Guo. 2024. "Underwater Wavelength Attack on Discrete Modulated Continuous-Variable Quantum Key Distribution" Entropy 26, no. 6: 515. https://doi.org/10.3390/e26060515

Note that from the first issue of 2016, this journal uses article numbers instead of page numbers. See further details here.

Article Metrics

Back to TopTop