Techniques

The threat actor (Eve) may collect information on the victim's quantum communication module, which could be useful or necessary for future campaigns. This information may encompass various details such as software, firmware, post-processing techniques, quantum protocols, interfaces, electronics, optics, and more.

The threat actor (Eve) may collect information on the victim's quantum channel, which could be useful or necessary for future campaigns. This information may encompass various details, for example, about the optic fibre or free-space channel, its properties, and more.

Threat actors may gather information about the victim's quantum network that can be used or required for future campaigns. Information about the quantum network may include a variety of details about topology, control and management, etc.

The threat actor (Eve) may buy, lease, or rent infrastructure that can be used for future campaigns or to perpetuate other techniques. A wide variety of infrastructure exists for hosting and orchestrating adversary operations.

The threat actor (Eve) may compromise third-party infrastructure that can be used for future campaigns or to perpetuate other techniques. By using compromised infrastructure, Eve may make it difficult to tie their actions back to them.

The threat actor (Eve) may initially compromise the quantum channel in order to access the quantum communication. Once compromised, the threat actor can perform a multitude of quantum attack techniques.

The threat actor (Eve) aims to access or compromise the classical communication channels used alongside quantum transmissions in quantum communication systems, exploiting these channels to perform own quantum attack.

Supply Chain Compromise involves the manipulation or interception of the components and processes used in the development, delivery, and maintenance of quantum systems, threatening the integrity and security of both their quantum and classical components.

Non-Kinetic Physical Attack on quantum systems involves methods that cause physical damage or dysfunction without direct contact, typically through the use of electromagnetic pulses (EMPs), high-powered lasers, or high-powered microwaves, targeting quantum computers, networks, and sensors.

Direct Physical Attack on quantum systems involves physical actions aimed at directly damaging or destroying quantum computing, networking, or sensing devices, utilizing methods such as explosives, mechanical destruction, or disruption of critical components like optical fibers.

Threat actors may attempt to dazzle the quantum communication receiver, causing high noise on a single photon detector. Note that dazzling is the equivalent of jamming from the radio frequencies but in the optical domain.

Adversary Post-Processing is a technique where the threat actor (Eve), having surreptitiously obtained the raw key material during a quantum key distribution (QKD) session, mimics the legitimate post-processing steps performed by the original communicating parties to derive the same final encryption key.

Threat actors may exfiltrate data from the raw quantum data, such as keys from the QKD, through the application of post-processing (key distillation) after being gathered using obtained information during Reconnaissance.

The Photon-Number-Splitting (PNS) attack targets quantum communication systems that use multi-photon pulses. In this strategy, a threat actor (Eve) exploits the fact that these pulses can contain more than one photon carrying the same information, allowing them to split off one photon, measure it, and leave the communication seemingly undisturbed.

The naive intercept-and-resend attack on quantum communication involves a threat actor (Eve) intercepting quantum bits (qubits) being transmitted between two parties, measuring them, and then sending replacement qubits to the receiver. This attack fundamentally compromises the security of quantum communication by attempting to gain information about the key being established between the transmitter (Alice) and receiver (Bob).

The threat actor (Eve) may have successfully executed a series of (quantum) techniques to obtain the cryptographic key and use this key to access, decrypt, or manipulate secure communications facilitated by QKD systems.

Denial refers to the technique where the threat actor (Eve) deploys measures to temporarily suspend the use, access, or operation of a system, generally without causing physical damage to the system involved.

Destruction in quantum systems refers to measures taken by the threat actor (Eve) to permanently eliminate the functionality of quantum computing, quantum key distribution (QKD), quantum sensing systems, etc., often through physical damage or irreversible data manipulation.

The Quantum Trojan-Horse Attack (THA), also known as the "Large Pulse Attack" or "Backflash Attack," is a sophisticated attack in quantum communication systems where a threat actor (Eve) exploits the return path of quantum signals to gain information. This method involves sending bright pulses to the legitimate receiver and analyzing the back-reflected signals to extract key information without detection.

Enabling light-injection attacks through the application of external magnetic fields represents a method where manipulation of the optical components, such as an optical isolator or circulator, can lead to abnormal functionality and allow subsequent THA attacks by injecting a pulse.

The Phase-Remapping Attack targets the phase encoding schemes of QKD systems, exploiting vulnerabilities in the phase modulators used for encoding quantum information. This attack manipulates the phase of the quantum states as they travel between the transmitter (Alice) and the receiver (Bob), potentially allowing the threat actor (Eve) to alter or gain knowledge of the quantum key without detection.

The Non-Random Phase Attack is a sophisticated strategy targeting decoy-state-based QKD, e.g. BB84, protocols, where it exploits the lack of randomness in the relative phase between emitted quantum states. By discerning the global phase of quantum states, a threat actor (Eve) can perform unambiguous state discrimination (USD) measurements to differentiate signal from decoy states without disturbing the transmitted quantum information. This vulnerability opens a pathway for a photon number splitting (PNS) attack.

In the Partially-Random-Phase Attack, the threat actor (Eve) manipulates the phase encoding process by replacing legitimate laser pulses with her own, specifically timed to exploit imperfections in the transmitter's (Alice's) phase modulator. This results in a controlled reduction of the global phase's randomness, facilitating an intercept-and-resend attack where Eve can more accurately guess the encoded information.

The Frequency-Shift Attack is a sophisticated strategy where the threat actor (Eve) replaces the receiver's (Bob's) optical pulses with time-shifted ones - in the two-way QKD scheme, aiming to modulate these pulses at the rising edge of the transmitter's (Alice's) phase modulator. This manipulation results in a frequency shift of Alice's signals that correlates with the selected quantum state, enabling Eve to decipher the key by simply analyzing the frequency of the returned signals.

The laser damage attack employs high-power laser pulses to compromise specific components within a quantum communication system. This type of attack can result in various outcomes, including the creation of backdoors for further quantum attacks like photon number splitting (PNS) or Trojan-horse attacks, degradation of system performance (e.g., reduced detector efficiency), or a Denial-of-Service (DoS) situation, such as completely blinding a detector.

The Laser Seeding Attack (LSA) involves manipulating the intensity of the light emitted by a laser diode in a QKD system's transmitter (Alice) by injecting continuous-wave (CW) laser light at a specific wavelength. This injection stimulates the emission, boosting the transmitter's output power and altering the characteristics of the emitted pulses, thereby compromising the security of QKD protocols by enabling attackers to gain knowledge of the light's phase and potentially opening doors for further quantum attacks.

In the Laser Seeding Attack tailored for two-way quantum key distribution schemes, the threat actor (Eve) manipulates the intensity of the optical pulses within the system by intercepting and replacing the pulses the receiver (Bob) sends to the transmitter (Alice) with ones of higher intensity. This strategic replacement forces Alice to encode her information on these intensified pulses, inadvertently increasing the intensity of the signals she sends back to Bob, compromising the system's security.

The Injection-Locking Attack (ILA) on quantum key distribution systems involves the threat actor (Eve) injecting a strong laser beam into the transmitter's (Alice's) laser source. This forced synchronization makes Alice's laser resonate at Eve's designed frequency, subtly altering the emitted pulses' frequency based on their polarization states. This manipulation enables Eve to infer the polarization used by Alice, laying the groundwork for direct key extraction or facilitating subsequent photon number splitting (PNS) attacks.

The Wavelength-Selected Photon-Number-Splitting (WSPNS) attack targets quantum key distribution systems using decoy states using a two-way scheme, exploiting the properties of intensity modulators to distinguish between decoy and signal states. By timing the pulse to coincide with the intensity modulator's rising edge, the threat actor (Eve) induces a frequency shift in the pulse. This specificity allows Eve to selectively measure the wavelength of decoy pulses using wavelength division multiplexing (WDM) technology, enabling a subsequent photon number splitting (PNS) attack on the signal pulses without introducing errors.

The Double-click attack in quantum key distribution systems exploits simultaneous detection events in both detectors of a chosen basis at the receiver's (Bob's) end. By employing an intercept-and-resend strategy with re-sent states as intense multi-photon pulses, the threat actor (Eve) can induce double-click events when Bob's basis selection is incompatible with the re-sent state. Properly leveraging these events allows Eve to gain knowledge of the key, as the double-clicks, often discarded by QKD protocols, filter out non-manipulated detection events, leaving only those controlled by Eve.

The Detector Efficiency Mismatch Attack exploits the differential response times and sensitivities of the detectors in a quantum key distribution system. By manipulating the timing of the pulses, the threat actor (Eve) can ensure that only one of the two detectors is active at any given moment, allowing her to control the detection events and thereby gain knowledge of the key material without detection.

In the Blinding and Faked States Attack on quantum key distribution systems, the threat actor (Eve) uses a combination of blinding techniques to manipulate the receiver's (Bob's) single-photon detectors from operating in their sensitive Geiger mode to a less sensitive linear mode. This manipulation allows Eve to resend light pulses, either classical or quantum, that force Bob's detectors to click only when his basis matches Eve's intended choice, effectively allowing Eve to control the key generation process without introducing errors.

The Detector Control via After-Gate Pulses Attack targets the transient operational state of gated Avalanche Photodiodes (APDs) used in DV-QKD systems. By sending bright, fake-state pulses immediately after the APDs' gating window, when the APDs switch from Geiger to linear mode, the threat actor (Eve) can manipulate detection outcomes to control the key generation process without detection errors unless afterpulsing exposes the attack.

The Detector Control, by Exploiting Superlinearity attack, targets QKD systems by leveraging the unexpected behaviour of single-photon detectors, specifically gated Avalanche Photodiodes (APDs) and Superconducting Nanowire Single-Photon Detectors (SNSPDs), where detection efficiency anomalously increases with multiple simultaneous photon impacts. This superlinear detection window allows an attacker to manipulate detection outcomes using carefully timed faint light pulses, subtly influencing the QKD process.

The Blinding Attack Using Dead Time exploits the inherent dead time of Avalanche Photodiodes (APDs) in QKD systems to gain knowledge of the key without needing to detect legitimate quantum signals. By selectively blinding all detectors except one during their dead time, the attacker can ascertain which detector remains active during a legitimate detection event, bypassing the need for complex faked-state strategies.

The blinding attack on self-differencing Avalanche Photodiodes (SD APDs) exploits the detector's inability to discriminate between avalanche signals caused by legitimate quantum signals and those resulting from afterpulsing when subjected to increased photon flux. This attack leverages the SD technique's vulnerability, rendering the APDs blind to genuine quantum communications and enabling intercept-and-resend attacks.

The Illuminating and Faked States Attack on Superconducting Nanowire Single Photon Detectors (SNSPDs) manipulates detector outcomes in quantum key distribution systems by using intense light to force SNSPDs into a non-responsive latched state or by prolonging their dead time. This control allows for the strategic insertion of faked states to dictate detection events, undermining the security of the QKD system.

The Backflash Attack exploits the phenomenon where Avalanche Photodiodes (APDs) used in QKD systems emit photons—known as backflash photons—during detection events. These photons can leak back into the quantum channel, allowing the threat actor (Eve) to potentially gather critical information about the detection settings without alerting the users of the QKD system. 

This attack leverages spatial distinguishability between signal states caused by angular misalignment of laser diodes in free-space quantum key distribution systems. By exploiting these misalignments, the threat actor (Eve) can distinguish between signal states based on their different angles of arrival at a detector array, potentially gaining full knowledge of the key.

The Wavelength Manipulation Attack in free-space Quantum Key Distribution systems involves using an external laser to alter the wavelength of the laser diodes used in state preparation. By precisely controlling the wavelength of emitted photons, the threat actor (Eve) can distinguish and decode the quantum states, gaining unauthorized access to the cryptographic key without detection.

This attack targets inherent imperfections in the light sources of Quantum Key Distribution systems, exploiting passive side channels to discern information about the key. By analyzing the distinguishability of signal states arising from these imperfections, the threat actor (Eve) can perform sophisticated attacks with reduced error rates, enhancing their ability to decode the transmitted key without detection.

The Passive Faraday Mirror Attack targets phase-encoded QKD systems by exploiting imperfections in Faraday mirrors (FMs), which fail to provide perfect polarization rotation. This vulnerability allows the threat actor (Eve) to partially discern the polarization state of the quantum signals, thereby gaining partial knowledge of the cryptographic key.

The Dead Time Correlation Attack leverages the inherent dead time of Avalanche Photodiodes (APDs) (but can be generalised to all Single-Photon Detectors) in QKD systems to induce correlations or anti-correlations in the sifted key, especially under high detection rate conditions. This manipulation occurs because when one APD is inactive due to dead time, only the active APDs can detect photons, leading to predictable patterns in the key generation process.

The Timing Attack via Detector Response Time leverages the slight differences in detector response times or optical path lengths in QKD systems to deduce which detector was triggered by a signal photon. By analyzing publicly shared detection times and correlating them with known detector response characteristics, the threat actor (Eve) can gain unauthorized insights into the quantum key generation process.

The Timing Mismatch Attack exploits differences in emission timing between signal and decoy states generated by gain-switched laser diodes in QKD systems. This timing variation, arising from modulation of the laser’s pump current, allows the threat actor (Eve) to distinguish between signal and decoy states, enabling a more effective Photon Number Splitting (PNS) attack.

The Frequency Side Channel Attack exploits imperfections in intensity modulation within Twin-Field Quantum Key Distribution (TF-QKD) systems, leading to frequency-based distinguishability between signal and decoy states. This vulnerability allows an eavesdropper to identify key information by observing frequency shifts induced by the modulation process.

The threat actor (Eve) measures the electromagnetic radiation emitted by the transmitter (Alice) and/or receiver (Bob) to infer information about the generated key in a Quantum Key Distribution system.

The threat actor (Eve) exploits the wavelength dependence of the beamsplitter in the receiver's (Bob's) QKD receiver to control measurement results and obtain information about the key.

The threat actor (Eve) exploits the wavelength dependence of the beamsplitter in the receiver's (Bob's) Continuous-Variable (CV) QKD receiver to control measurement results and mask the noise added by an intercept-and-resend attack.

The threat actor (Eve) injects light into the CV-QKD receiver (Bob) to saturate the detector, masking the increase of excess noise from an intercept-and-resend attack.

The threat actor (Eve) manipulates the Local Oscillator (LO) parameters to exploit the relationship between vacuum-noise variance and LO power, masking the excess noise from other attacks.

The threat actor (Eve) can exploit an imperfect channel transmittance model in continuous-variable quantum key distribution (CV-QKD) systems to overestimate the secret key length by biasing parameter estimation through intercept-and-resend attacks, leveraging issues like atmospheric turbulence and background noise.

The threat actor (Eve) can infer quantum states prepared by the transmitter (Alice) by analyzing the power consumption of the integrated electrical control circuit, using machine learning to correlate power with the transmitted states.

The threat actor (Eve) injects bright light into the signal port of a CV-QKD receiver (Bob) to saturate the detector electronics, masking other attacks and gaining complete knowledge of the key.

The threat actor (Eve) manipulates the classical signal used for phase-reference alignment in CV-QKD systems, exploiting the trusted phase noise model to increase correlations with the secret key while masking her influence.