Introduction

Quantum key distribution (QKD) is a method for sharing secret cryptographic keys between two parties (Alice and Bob) with an unprecedented level of security1, 2, 3, 4, 5, 6, 7. This level of security is ensured by the laws of quantum mechanics and does not depend on the technological resources available to an eavesdropper (Eve), provided that the QKD implementation does not deviate from the theoretical model. However, the security of a practical system (just as for any other cryptographic system) strongly depends on its device implementation. Any deviation of a QKD device from the theoretical model can be exploited as a side channel or back door 8, 9, 10.

In 2010, two zero-error attacks on commercial QKD systems were reported that exploited defects in quantum signal encoding8 and detection9. Shortly after, a plethora of quantum hacking attacks were implemented using existing technologies to exploit device imperfections in a number of QKD designs (with different protocols, modules and systems)10, 11, 12, 13, 14, 15, 16. To guarantee security, each practical implementation must be carefully analyzed and tested for its robustness against zero-error attacks.

Single-photon avalanche diodes (SPADs) are the most widespread commercial solution for single-photon detection in practical QKD implementations17, 18, 19, 20, 21, 22, 23, 24, 25, 26. They can also be the most vulnerable components because they are optically exposed to Eve through the open quantum channel. Eve can inject strong light to take control of these detectors, thereby compromising the security of an entire QKD system. Alternatively, Eve can also passively measure any backflash light arising from avalanching carriers27 to learn the detected bit value (Figure 1). Backflashes have been shown to exist in both InGaAs/InP and Si SPADs27, 28, 29, 30. However, these demonstrations are limited to free-space detectors, and no experiments have been performed on fiber-pigtailed SPADs, which are the detectors of choice in all existing commercial QKD systems because of their practicality.

Figure 1
figure 1

Representation of an eavesdropper attack exploiting backflash light. Alice sends the photons of the key to Bob; when the photons are detected by Bob using a SPAD, a flash of light, the backflash, is emitted back to the channel. Eve can use a circulator to intercept this spot of light to acquire information about the detector that has clicked.

Full size image

Here, we present the first characterization of backflash light in fiber-pigtailed InGaAs SPADs from various manufacturers. We construct a reconfigurable optical time-domain reflectometer (OTDR) operating at the single-photon level31, 32, 33, 34, 35 with exceptional sensitivity. This OTDR enables unambiguous identification of detector backflashes from conventional light back reflections and provides a practical way to bound the information leakage, i.e., a fundamental step toward QKD security. Furthermore, we show that information can be leaked through backflashes when two detectors produce temporally distinguishable secondary emissions.

Materials and methods

The experimental setup used to analyze backflash light is depicted in Figure 2. A strongly attenuated pulsed laser sends photons at 1550 nm to the InGaAs/InP SPAD under test (DUT). The back-reflected light is analyzed using our photon-counting OTDR to quantify the amount of secondary emission photons that could serve as an information side channel to Eve. The source is a commercial 1550-nm pulsed diode laser with pulse width of 300 ps and an energy per pulse lower than 1 fJ. The laser output is sent to a single-mode optical fiber and attenuated to the single-photon level by exploiting a fiber-coupled variable optical attenuator (with a maximum attenuation of 60 dB) combined with an additional 20-dB attenuation from a 99:1 fiber coupler.

Figure 2
figure 2

A schematic representation of our experimental setup. A photon-counting OTDR observes backflash light from the SPAD under test. The source is an attenuated pulsed laser emitting at 1550 nm. The backflash light is detected by a free-running InGaAs/InP detector. Time stamping of detected light is obtained by means of a time-correlated single-photon counting (TCSPC) apparatus.

Full size image

We analyzed the back-reflected and backflash light of two different InGaAs/InP detectors. The first one, DUT1, is a prototype single-photon detection module36; the second one, DUT2, is the commercial IdQuantique ID201, widely used in research laboratories. Both detectors are pigtailed and operate in gated mode. These devices are highly configurable in terms of detection efficiency, gate duration, and dead time. They also exploit active quenching and allow long avalanche durations (~10 ns). Their configurability and long avalanche durations make them ideal for studying backflashes. The repetition rate of the laser pulses and of the trigger rate of the DUTs were set to fpg=50 kHz using an external pulse generator. Both back reflections and the DUT backflashes were directed by the circulator to the measuring detector, a free-running single-photon InGaAs/InP SPAD (IdQuantique ID220). The detector was operated with a low dark count rate (5 kHz), a nominal quantum efficiency of 10% and a timing resolution of 130 ps. The output electrical signals from the OTDR detector and the DUT were sent to time-correlated single photon-counting (TCSPC) electronics. Figure 3a and 3b shows traces corresponding to the OTDR signals triggered by the laser pulses, with an acquisition time of 60 min, for DUT1 and DUT2, respectively. The histogram represents the returned photons (due to either backflashes or back reflections) as a function of the time delay between the emission of a laser pulse and its detection by the OTDR detector. The horizontal axis represents the time for which a detected photon has traveled. In Figure 3, the sharp peaks arise from backreflection at the connections between different slices of fiber or between the fiber and other optical elements in the path (e.g., the circulator). There is also a rectangular or trapezoidal feature that appears only when the DUT is switched on. We attribute this feature to the backflash light emitted by the DUT during avalanches.

Figure 3
figure 3

(a, b) The traces of the optical correlator after 60 min of acquisition for DUT1 and DUT2, respectively. A backflash peak that is unique to the particular DUT type is visible when an avalanche is triggered. For DUT1, we set an excess bias voltage of 7 V, corresponding to a detection efficiency higher than 35% and a gate width of 20 ns, whereas for DUT2, the efficiency is 10% and the gate width is 100 ns. On observing zoomed views of the backflash peaks for DUT1 and for DUT2, different peak shapes are evident.

Full size image

Each type of DUT has a unique, identifiable temporal profile, which reveals the type of detector and its manufacturer. We confirmed this finding by testing four additional devices of the DUT1 type and two of the DUT2 type. Such identifiable backflash profiles can be exploited by Eve to launch attacks tailored to a specific detector type.

Results and discussion

Here, we evaluate the maximum possible information leakage PL due to backflash light for QKD systems implemented with detectors of either the DUT1 type or the DUT2 type. We consider a poorly designed QKD system that allows complete temporal discrimination of backflashes between different detectors. PL is estimated starting from the ratio between the number of detected backflashes, NB, and the corresponding total number of valid counts, NP, of the DUT. NB refers only to backflash events, i.e., after background subtraction. We consider the worst-case scenario in which Eve has ideal equipment, i.e., equipment that is lossless and with an ideal (unit) photon detection efficiency. Thus PL is evaluated as

where corrections for losses and inefficiencies of the OTDR system are applied, i.e., for the detection efficiency of the OTDR detector, ηdet, and for the losses in the optical channel connecting the DUT and the OTDR detector due to the circulator and the fiber connections, ηch. To be conservative, we slightly overestimate these losses and inefficiencies by assuming ηchηdet=0.05 based on their approximate evaluations. We obtain an information leakage PL of 9.8% for DUT1 and a PL of 6% for DUT2. These results suggest that the information that Eve can obtain by observing backflash light is not negligible and that countermeasures must be put in place.

The backflash light is a consequence of the carrier avalanches that are triggered by an absorbed photon when the device is biased beyond its breakdown voltage. This light is quenched, together with the avalanche itself, when the detector bias is lowered below the breakdown voltage. Thus, the backflash intensity strongly depends on the parameter settings of the quenching electronics. We investigated the information leakage percentage in DUT1 for different detector operating conditions by varying the detection efficiency, gate width, and so on. The results are summarized in Figures 4 and 5. In Figure 4, the information leakage of DUT1 is presented as a function of the excess bias voltage. We used three different excess bias voltage settings, namely, 3, 4.5 and 7 V, corresponding to nominal detection efficiencies of 15%, 22% and 35%, respectively. As shown, the backflash intensity increases as the excess bias of the detector increases because the number of carriers also increases.

Figure 4
figure 4

Information leakage PL as a function of the excess bias voltage for the prototype detector DUT1. The peaks of the back-reflected light is presented in the inset (the continuous, dashed and dot-dashed lines represent the cases of 7, 4.5 and 3 V, respectively); the smaller peak due to the reflection of the laser light from the diode surface is relatively more evident at low excess bias voltages.

Full size image
Figure 5
figure 5

Information leakage as a function of the arrival time of laser photons with respect to the gate window that triggers the DUT. The data were collected for DUT1 operating at different bias voltages of 7 and 3 V.

Full size image

Figure 5 shows the information leakage as a function of the DUT gate delay relative to the incident laser pulse (measured for delays of 2, 10 and 18 ns after the beginning of the gating window). The two sets of data were collected for DUT1 operating at different bias voltages of 7 and 3 V. A decrease in the information leakage is observed when the laser photons arrive at the end of the gating window. This is because late avalanches are quenched by the falling edge of the gate window rather than by the active quenching circuit. The same effect explains the behavior observed when the laser peak is centered with respect to the gating window but different gating window widths are used. The information leakage is reduced when the width of the gating window is comparable to the width of the temporal profile of the backflash emission in DUT1 (i.e., 5 ns or less). To study the spectral distribution of the backflash emission, we integrated a fiber-optic tunable optical filter (Santec OTF-970) into our OTDR system before the OTDR measuring detector. The spectral range of the filter was from 1530 to 1600 nm, and we set a passband bandwidth of 10 nm. The results are presented in Figure 6a; the four presented profiles are the temporal distributions of the backflash counts centered at 1530, 1550, 1570 and 1600 nm. The temporal emission profile is similar to the one obtained without spectral filtering (Figure 3a) for all wavelengths. When the filter is centered at 1550 nm, the reflection peak dominates.

Figure 6
figure 6

(a) Temporal distributions of the backflash counts after spectral filtering, with the filter centered at 1530, 1550, 1570 and 1600 nm. (b) Total counts of backflash light in the observed spectral range (from 1530 to 1600 nm). All measurements were performed using filters with a 10-nm bandwidth.

Full size image

Figure 6b presents the total backflash counts as a function of the center wavelength of the filter. The subtraction of the back-reflected light was performed by measuring the laser light back reflected by DUT1 with a bias voltage applied but in the absence of a gate signal. The backflash emission is broadband, or at least it extends beyond the spectral range of our tunable filter, because it originates from the relaxation of hot carriers generated in the multiplication region28, 29, 30. In the spectral region of our tunable filter, it is reasonably uniform, except in the region around 1550 nm (1545–1555 nm), where a peak is observed even after the subtraction of the laser light back reflected by the DUT (see the sharp peak in Figure 6a). It is reasonable to suppose that the sharp peak that is present even after background subtraction is due to back-reflected laser light, since we observed that the reflectivity of the diode varies with the applied bias (in particular, a relative in reflectivity increase of almost one order of magnitude of the SPAD surface was observed in the case of non-polarized versus polarized, but non-gated, detector) and we attribute this to the refractive index change in the semiconductor material37.

This was confirmed by measurements of the backflash spectrum performed with a pulsed laser operating at 1570 nm as source of our spectrally filtered OTDR. In this configuration, we expected to observe the sharp peak disappearing at 1550 nm and appearing at 1570 nm, and indeed, this was exactly what occurred, confirming that the sharp peak was just due to the change in the reflectivity of the SPAD surface caused by the change in its bias voltage.

Conclusions

We proved that significant backflash emission occurs in commercial InGaAs/InP single-photon detectors operating at telecom wavelengths. These backflashes could potentially allow a severe security breach in a poorly designed QKD system. Proper design and testing of QKD systems should be implemented to avoid attacks based on backflashes. Possible solutions can be based on passive optical devices38 such as isolators, circulators or spectral filters to prevent backflashes leaking out of a QKD system. We emphasize that these countermeasures should consider the wide bandwidth of backflash light emission. For example, the use of a 1-nm-wide spectral filter centered at 1550 nm can reduce the information leakage of a DUT1-type device from 9.8% to 0.12%, under the assumption that the intensity of the backflash light is uniformly distributed throughout the spectral range under investigation (1530–1600 nm). Adding an isolator will result in a further attenuation of the backflash signal by ~30 dB.

Careful characterization of the spectral behavior of these optical components is necessary to ensure their operation as countermeasures.

Following this line of thought, a combination of circulators or isolators with interference optical filters at the input of the QKD system should essentially nullify the information leakage due to backflash light at the cost of some additional optical loss (the insertion losses of the optical filter and of the circulator) in the QKD signal. Eve may also attempt to intercept the backflash light just at the output of Bob’s QKD box (or Bob’s security perimeter). Thus, QKD engineers should also prevent the possibility of backflash light propagating in the cladding modes by implementing cladding-mode suppression solutions when necessary (in our case, the bending of our long single-mode fiber and the FC connectors essentially nullify the possibility of detecting backflash light propagating in the cladding). Furthermore, as discussed in connection with Figure 3, the use of gates that are as short as possible and small avalanches will reduce the emitted backflash light. In this sense, fast-gated detectors39, 40, 41, 42, 43, 44 represent an interesting solution for QKD systems, not only in terms of speed but also because of their much lower avalanche charges (as much as 100 times lower). In fact, it is expected that they should produce significantly lower backflash light emission. In addition, the use of short gates makes it more difficult for Eve to temporally discriminate the backflash light. Thus, testing the backflash behavior of fast-gated detectors would be an interesting research direction.

For QKD applications, superconducting-nanowire single-photon detectors are an excellent option. Indeed, in addition to their high detection efficiency, their low dark count rate, and their short recovery time45, 46, 47, it is expected that they should not produce any backflash light (and thus should not allow any related information leakage). Unfortunately, they require cryogenic temperatures for operation, and because of the high cost of cryogenic equipment, they currently appear unsuitable for the practical deployment of QKD systems in the real world.

In a complete analysis of the security of a realistic QKD system design, other sources of information leakage must be considered in addition to backflashes. Eve can obtain information about the key by, for example, measuring the spatial, spectral or temporal properties of the transmitted qubits, exploiting the detector dependence of the signal basis and channel losses, or manipulating the detectors9, 48, 49. Once information leakage has been reduced as much as possible with dedicated hardware-based countermeasures, the residual information leakage can be overcome by applying privacy amplification protocols49, 50, 51, 52.

Author contributions

IPD, AT and ZY conceived the idea of the experiment, which was discussed and designed with input from all authors. AM, IPD and GB realized the experimental setup and collected the data in the INRIM Quantum Optics Labs, coordinated by MG. All authors discussed the results and contributed to the writing of the paper.