Techniques

Non-Kinetic Physical Attack on quantum systems involves methods that cause physical damage or dysfunction without direct contact, typically through the use of electromagnetic pulses (EMPs), high-powered lasers, or high-powered microwaves, targeting quantum computers, networks, and sensors.

Direct Physical Attack on quantum systems involves physical actions aimed at directly damaging or destroying quantum computing, networking, or sensing devices, utilizing methods such as explosives, mechanical destruction, or disruption of critical components like optical fibers.

Threat actors may attempt to dazzle the quantum communication receiver, causing high noise on a single photon detector. Note that dazzling is the equivalent of jamming from the radio frequencies but in the optical domain.

The Photon-Number-Splitting (PNS) attack targets quantum communication systems that use multi-photon pulses. In this strategy, a threat actor (Eve) exploits the fact that these pulses can contain more than one photon carrying the same information, allowing them to split off one photon, measure it, and leave the communication seemingly undisturbed.

The naive intercept-and-resend attack on quantum communication involves a threat actor (Eve) intercepting quantum bits (qubits) being transmitted between two parties, measuring them, and then sending replacement qubits to the receiver. This attack fundamentally compromises the security of quantum communication by attempting to gain information about the key being established between the transmitter (Alice) and receiver (Bob).

The Quantum Trojan-Horse Attack (THA), also known as the "Large Pulse Attack" or "Backflash Attack," is a sophisticated attack in quantum communication systems where a threat actor (Eve) exploits the return path of quantum signals to gain information. This method involves sending bright pulses to the legitimate receiver and analyzing the back-reflected signals to extract key information without detection.

Enabling light-injection attacks through the application of external magnetic fields represents a method where manipulation of the optical components, such as an optical isolator or circulator, can lead to abnormal functionality and allow subsequent THA attacks by injecting a pulse.

The Phase-Remapping Attack targets the phase encoding schemes of QKD systems, exploiting vulnerabilities in the phase modulators used for encoding quantum information. This attack manipulates the phase of the quantum states as they travel between the transmitter (Alice) and the receiver (Bob), potentially allowing the threat actor (Eve) to alter or gain knowledge of the quantum key without detection.

The Non-Random Phase Attack is a sophisticated strategy targeting decoy-state-based QKD, e.g. BB84, protocols, where it exploits the lack of randomness in the relative phase between emitted quantum states. By discerning the global phase of quantum states, a threat actor (Eve) can perform unambiguous state discrimination (USD) measurements to differentiate signal from decoy states without disturbing the transmitted quantum information. This vulnerability opens a pathway for a photon number splitting (PNS) attack.

In the Partially-Random-Phase Attack, the threat actor (Eve) manipulates the phase encoding process by replacing legitimate laser pulses with her own, specifically timed to exploit imperfections in the transmitter's (Alice's) phase modulator. This results in a controlled reduction of the global phase's randomness, facilitating an intercept-and-resend attack where Eve can more accurately guess the encoded information.

The Frequency-Shift Attack is a sophisticated strategy where the threat actor (Eve) replaces the receiver's (Bob's) optical pulses with time-shifted ones - in the two-way QKD scheme, aiming to modulate these pulses at the rising edge of the transmitter's (Alice's) phase modulator. This manipulation results in a frequency shift of Alice's signals that correlates with the selected quantum state, enabling Eve to decipher the key by simply analyzing the frequency of the returned signals.

The Wavelength-Selected Photon-Number-Splitting (WSPNS) attack targets quantum key distribution systems using decoy states using a two-way scheme, exploiting the properties of intensity modulators to distinguish between decoy and signal states. By timing the pulse to coincide with the intensity modulator's rising edge, the threat actor (Eve) induces a frequency shift in the pulse. This specificity allows Eve to selectively measure the wavelength of decoy pulses using wavelength division multiplexing (WDM) technology, enabling a subsequent photon number splitting (PNS) attack on the signal pulses without introducing errors.

The Double-click attack in quantum key distribution systems exploits simultaneous detection events in both detectors of a chosen basis at the receiver's (Bob's) end. By employing an intercept-and-resend strategy with re-sent states as intense multi-photon pulses, the threat actor (Eve) can induce double-click events when Bob's basis selection is incompatible with the re-sent state. Properly leveraging these events allows Eve to gain knowledge of the key, as the double-clicks, often discarded by QKD protocols, filter out non-manipulated detection events, leaving only those controlled by Eve.

The Detector Efficiency Mismatch Attack exploits the differential response times and sensitivities of the detectors in a quantum key distribution system. By manipulating the timing of the pulses, the threat actor (Eve) can ensure that only one of the two detectors is active at any given moment, allowing her to control the detection events and thereby gain knowledge of the key material without detection.

In the Blinding and Faked States Attack on quantum key distribution systems, the threat actor (Eve) uses a combination of blinding techniques to manipulate the receiver's (Bob's) single-photon detectors from operating in their sensitive Geiger mode to a less sensitive linear mode. This manipulation allows Eve to resend light pulses, either classical or quantum, that force Bob's detectors to click only when his basis matches Eve's intended choice, effectively allowing Eve to control the key generation process without introducing errors.

The Detector Control via After-Gate Pulses Attack targets the transient operational state of gated Avalanche Photodiodes (APDs) used in DV-QKD systems. By sending bright, fake-state pulses immediately after the APDs' gating window, when the APDs switch from Geiger to linear mode, the threat actor (Eve) can manipulate detection outcomes to control the key generation process without detection errors unless afterpulsing exposes the attack.

The Detector Control, by Exploiting Superlinearity attack, targets QKD systems by leveraging the unexpected behaviour of single-photon detectors, specifically gated Avalanche Photodiodes (APDs) and Superconducting Nanowire Single-Photon Detectors (SNSPDs), where detection efficiency anomalously increases with multiple simultaneous photon impacts. This superlinear detection window allows an attacker to manipulate detection outcomes using carefully timed faint light pulses, subtly influencing the QKD process.

The Blinding Attack Using Dead Time exploits the inherent dead time of Avalanche Photodiodes (APDs) in QKD systems to gain knowledge of the key without needing to detect legitimate quantum signals. By selectively blinding all detectors except one during their dead time, the attacker can ascertain which detector remains active during a legitimate detection event, bypassing the need for complex faked-state strategies.

The blinding attack on self-differencing Avalanche Photodiodes (SD APDs) exploits the detector's inability to discriminate between avalanche signals caused by legitimate quantum signals and those resulting from afterpulsing when subjected to increased photon flux. This attack leverages the SD technique's vulnerability, rendering the APDs blind to genuine quantum communications and enabling intercept-and-resend attacks.

The Illuminating and Faked States Attack on Superconducting Nanowire Single Photon Detectors (SNSPDs) manipulates detector outcomes in quantum key distribution systems by using intense light to force SNSPDs into a non-responsive latched state or by prolonging their dead time. This control allows for the strategic insertion of faked states to dictate detection events, undermining the security of the QKD system.

The Backflash Attack exploits the phenomenon where Avalanche Photodiodes (APDs) used in QKD systems emit photons—known as backflash photons—during detection events. These photons can leak back into the quantum channel, allowing the threat actor (Eve) to potentially gather critical information about the detection settings without alerting the users of the QKD system. 

This attack leverages spatial distinguishability between signal states caused by angular misalignment of laser diodes in free-space quantum key distribution systems. By exploiting these misalignments, the threat actor (Eve) can distinguish between signal states based on their different angles of arrival at a detector array, potentially gaining full knowledge of the key.

The Wavelength Manipulation Attack in free-space Quantum Key Distribution systems involves using an external laser to alter the wavelength of the laser diodes used in state preparation. By precisely controlling the wavelength of emitted photons, the threat actor (Eve) can distinguish and decode the quantum states, gaining unauthorized access to the cryptographic key without detection.

This attack targets inherent imperfections in the light sources of Quantum Key Distribution systems, exploiting passive side channels to discern information about the key. By analyzing the distinguishability of signal states arising from these imperfections, the threat actor (Eve) can perform sophisticated attacks with reduced error rates, enhancing their ability to decode the transmitted key without detection.

The Passive Faraday Mirror Attack targets phase-encoded QKD systems by exploiting imperfections in Faraday mirrors (FMs), which fail to provide perfect polarization rotation. This vulnerability allows the threat actor (Eve) to partially discern the polarization state of the quantum signals, thereby gaining partial knowledge of the cryptographic key.

The Dead Time Correlation Attack leverages the inherent dead time of Avalanche Photodiodes (APDs) (but can be generalised to all Single-Photon Detectors) in QKD systems to induce correlations or anti-correlations in the sifted key, especially under high detection rate conditions. This manipulation occurs because when one APD is inactive due to dead time, only the active APDs can detect photons, leading to predictable patterns in the key generation process.

The Timing Attack via Detector Response Time leverages the slight differences in detector response times or optical path lengths in QKD systems to deduce which detector was triggered by a signal photon. By analyzing publicly shared detection times and correlating them with known detector response characteristics, the threat actor (Eve) can gain unauthorized insights into the quantum key generation process.

The Timing Mismatch Attack exploits differences in emission timing between signal and decoy states generated by gain-switched laser diodes in QKD systems. This timing variation, arising from modulation of the laser’s pump current, allows the threat actor (Eve) to distinguish between signal and decoy states, enabling a more effective Photon Number Splitting (PNS) attack.

The Frequency Side Channel Attack exploits imperfections in intensity modulation within Twin-Field Quantum Key Distribution (TF-QKD) systems, leading to frequency-based distinguishability between signal and decoy states. This vulnerability allows an eavesdropper to identify key information by observing frequency shifts induced by the modulation process.

The threat actor (Eve) measures the electromagnetic radiation emitted by the transmitter (Alice) and/or receiver (Bob) to infer information about the generated key in a Quantum Key Distribution system.

The threat actor (Eve) exploits the wavelength dependence of the beamsplitter in the receiver's (Bob's) QKD receiver to control measurement results and obtain information about the key.

The threat actor (Eve) exploits the wavelength dependence of the beamsplitter in the receiver's (Bob's) Continuous-Variable (CV) QKD receiver to control measurement results and mask the noise added by an intercept-and-resend attack.

The threat actor (Eve) can infer quantum states prepared by the transmitter (Alice) by analyzing the power consumption of the integrated electrical control circuit, using machine learning to correlate power with the transmitted states.

The threat actor (Eve) injects bright light into the signal port of a CV-QKD receiver (Bob) to saturate the detector electronics, masking other attacks and gaining complete knowledge of the key.