Implementation vulnerabilities in general quantum cryptography

2.1.1. Identical-state-sharing

Reference [26] proposes a QDS protocol with a quantum-state sender, Alice, and two quantum-state receivers, Bob and Charlie. This protocol has been implemented over a distance of 102 km [7] as shown in figure 1. The protocol consists of two stages, a quantum stage, and a signing stage. In the quantum stage, for each future 1 bit message m = 0 or m = 1, Alice employs weak coherent states to randomly prepare two identical sequences of qubit states, and every individual state is in one of the Bennett–Brassard 1984 (BB84) polarization states $| H\rangle$, $| V\rangle$, $| +\rangle$ and $| -\rangle$ [2]. In addition, the decoy-state protocol [27] is used to randomly modulate the mean photon numbers of the weak coherent states, protecting the system from photon-number-splitting attacks [28]. Then one copy of the sequence is sent to Bob, and one copy to Charlie. A beam splitter is used to randomly and independently select the X or Z basis to measure the received states.

Zoom In Zoom Out Reset image size

In a sifting phase, Bob and Charlie announce in which slots they obtain detections. For each detection slot, Alice then announces two nonorthogonal states from different bases, for example, $| H\rangle$ and $| +\rangle$. One of them is the real state she sent. If Bob (Charlie) obtains a measurement result corresponding to a state that is orthogonal to one of the states Alice announced, such as $| V\rangle$, then Bob (Charlie) conclusively knows that it is the other announced state, $| +\rangle$.

In the next stage, the signing stage, only classical processing takes place. It starts by announcing some of the states shared between Alice and Bob (Charlie) during the quantum stage to calculate an authentication threshold T_a (T_v) for Bob (Charlie). The unannounced states form strings denoted as S_Am for Alice, S_Bm for Bob and S_Cm for Charlie, and will be used for the digital signature. To send a signed 1 bit message m, Alice sends the message and the corresponding data string, (m, S_Am), to one of the recipients, say, Bob. Bob will accept this message if the mismatch rate of sifted bits between S_Am and S_Bm is less than T_a. If Bob wishes to forward the message to Charlie, he forwards (m, S_Am) to Charlie. Charlie will accept this message as well if the mismatch rate of the sifted bits between S_Am and S_Cm is less than T_v.

2.1.2. Different-state-sharing

Reference [25] proposes another QDS protocol that sends different quantum states from Bob and Charlie to Alice. This protocol has subsequently been implemented based on an installed differential-phase-shift (DPS) QKD system, as shown in figure 2 [6]. This protocol is also divided into two stages, a distribution stage and a messaging stage. In the distribution stage, Bob and Charlie randomly and independently select two different n-bit strings. Then, they encode the bits into quantum states according to the DPS QKD protocol [29]. For each future message m = 0 or m = 1, Bob (Charlie) applies a key-generating protocol (KGP) to share the bit string with Alice. The KGP can be treated as a partial QKD procedure without error correction and privacy amplification. Alice and Bob (Charlie) estimate the quantum bit error rate by announcing a small part of the shared bits. The remaining L-bit key is denoted by K_m^B (K_m^C) at Bob's (Charlie's) side. At Alice's side, she obtains a signature ${{\rm{Sig}}}_{m}=({A}_{m}^{B},{A}_{m}^{C})$ for a future message m. Then, to guarantee transferability, Bob and Charlie randomly forward half of their keys, K_m^B and K_m^C, to each other. This classical bit exchange is encrypted by Bob and Charlie using a separate BB84 QKD system. This way, Alice receives no information on which bits have been forwarded and which bits have been kept. From her point of view, a bit she originally shared with Bob (Charlie) is now equally likely to be retained by Bob as by Charlie. Bob (Charlie) combine the non-exchanged part of K_m^B (K_m^C) and the received part of K_m^C (K_m^B) as a symmetric key, S_m^B (S_m^C).

Zoom In Zoom Out Reset image size

In the messaging stage, Alice signs a message m by ${{\rm{Sig}}}_{m}$, and then sends $(m,{{\rm{Sig}}}_{m})$ to Bob. Bob checks the mismatch rate between ${{\rm{Sig}}}_{m}$ and S_m^B. If the mismatch rate is lower than the threshold s_a, Bob accepts the message. If Bob wishes to forward the message to Charlie, he forwards $(m,{{\rm{Sig}}}_{m})$ to Charlie. Charlie also checks the mismatch rate between ${{\rm{Sig}}}_{m}$ and S_m^C, and accepts the message if the mismatch rate is lower than the threshold s_v. From Alices point of view, the situation is symmetric with respect to Bob and Charlie, so that if Bob accepts a signature, Charlie must accept it with high probability, provided acceptance thresholds are chosen correctly and differently for Bob and Charlie.

Both protocols have been proven to be information-theoretically secure, based on different assumptions [25, 26]. In this section, we analyse the security assumptions for both protocols and illustrate how these assumptions might be broken. Since QDS realizations are based on QKD schemes with similar optical components, similar vulnerabilities exist. That is, some known attacks on QKD systems are applicable also to the realisations of QDS. In our analysis, we assume an external attacker Eve who is not a legitimate participant (Alice, Bob or Charlie) in the QDS protocol.

2.2.1. Identical-state-sharing protocol

2.2.2. Different-state-sharing protocol

3.1.1. Entanglement-based protocol

In one scheme for entanglement-based QSS [15], Alice, Bob and Charlie first hold one photon each in a Greenberger–Horne–Zeilinger (GHZ) triplet, which is the state

$$\begin{eqnarray}&&{| \psi \rangle }_{{ABC}}=\displaystyle \frac{1}{\sqrt{2}}({| H\rangle }_{A}{| H\rangle }_{B}{| H\rangle }_{C}+{| V\rangle }_{A}{| V\rangle }_{B}{| V\rangle }_{C}).\end{eqnarray} \tag{ 1 }$$

Then, a projective measurement is performed on each photon randomly either in the X or Y basis, where the basis states are given by

$$\begin{eqnarray}&&| {X}_{\pm }\rangle =\displaystyle \frac{1}{\sqrt{2}}(| H\rangle \pm | V\rangle ),\,| {Y}_{\pm }\rangle =\displaystyle \frac{1}{\sqrt{2}}(| H\rangle \pm {\rm{i}}| V\rangle ).\end{eqnarray} \tag{ 2 }$$

The GHZ states can be written as

$$\begin{eqnarray}\begin{array}{rcl}{| \psi \rangle }_{{ABC}} & = & \displaystyle \frac{1}{2}[({| {X}_{+}\rangle }_{A}{| {X}_{+}\rangle }_{B}+{| {X}_{-}\rangle }_{A}{| {X}_{-}\rangle }_{B}){| {X}_{+}\rangle }_{C}+({| {X}_{+}\rangle }_{A}{| {X}_{-}\rangle }_{B}+{| {X}_{-}\rangle }_{A}{| {X}_{+}\rangle }_{B}){| {X}_{-}\rangle }_{C}].\end{array}\end{eqnarray} \tag{ 3 }$$

Thus, if each party measures in the X basis, the measurement results would show perfect correlations. Once any two measurement results are known, the third measurement result can be predicted with certainty. Similar correlation would be obtained for three other measurement combinations, X_AY_BY_C, Y_AX_BY_C, and Y_AY_BX_C. However, the remaining four basis combinations, X_AX_BY_C, X_AY_BX_C, Y_AX_BX_C, and Y_AY_BY_C, result in uncorrelated measurement results among the three parties. Thus, they could announce their basis choices to sift the basis combinations with perfect correlation. After that, Alice and Bob share their measurement results with each other to establish Charlie's key. Thus, a message encrypted by Charlie can be decrypted if Alice and Bob cooperate. The protocol implementation is shown in figure 3.

Zoom In Zoom Out Reset image size

3.1.2. Single-qubit protocol

Instead of using entangled states, [43] proposed an N -party QSS protocol that uses a single qubit, which is easily realizable and scalable compared to the entanglement-based protocol. On the other hand, this protocol completely removes the possibility to share quantum information in terms of an entangled state. The information shared is necessarily classical. Reference [5] demonstrated this protocol. An initial qubit $| x\rangle =(| 0\rangle +| 1\rangle )/\sqrt{2}$ is prepared by party R₁, and sent from R₂ to R_N sequentially. Each party R_i (i = 1, ..., N − 1) encodes information by applying a phase randomly chosen from two sets, {0, π} and {π/2, 3π/2}, to the $| 1\rangle$ component in the qubit $| x\rangle$. The party R_N randomly applies phase 0 or π/2 to the $| 1\rangle$ component before measuring the state $| \pm x\rangle =(| 0\rangle \pm | 1\rangle )/\sqrt{2}$. Thus, the detection probability of each detector is

$$\begin{eqnarray}\begin{array}{rcl}{P}_{D1} & = & \displaystyle \frac{1}{2}\left[1+\cos (\displaystyle \sum _{i=1}^{N}{\phi }_{i})\right],\\ {P}_{D2} & = & \displaystyle \frac{1}{2}\left[1-\cos (\displaystyle \sum _{i=1}^{N}{\phi }_{i})\right].\end{array}\end{eqnarray} \tag{ 4 }$$

Half of the time, there is destructive or constructive interference, when $\cos ({\phi }_{1}\,+\cdots +\,{\phi }_{N})=\pm 1$. If all parties announce which set of phase values their choice belonged to, then every party knows which detection results are deterministic. Using the knowledge of which measurement results are deterministic, multiple parties can then share a secret as follows. If any N − 1 parties collaborate and share their modulating phases, they would be certain about the phase applied by the Nth party for one slot of the deterministic measurement. To maintain stability in the experiment, a bidirectional scheme is applied to implement a 5-party protocol [5] as shown in figure 4. Alice prepares the initial pulse without phase encoding and acts as R₅ to measure the final reflected state. The rest of parties encode their information on the way back from the Faraday mirror, after the pulse is attenuated to the single-photon level by the amplitude modulator. This idea is similar to the plug and play QKD system [44].

Zoom In Zoom Out Reset image size

We discuss one type of known attack that may work for the implementation of each aforementioned QSS protocol. An external Eve is assumed to be the attacker. If an external Eve can compromise the security, any inside attacker (a protocol participant) could also compromise security and obtain the secret without the cooperation of the other participants, because inside attackers have at least as much information as an outside attacker.

3.2.1. Blinding attack on entanglement-based implementation

3.2.2. Trojan-horse attack on single-qubit implementation

In the SI QRNG protocol, an untrusted party Eve prepares single-qubit states $| +\rangle$ and sends them to Alice's measurement station [16]. Alice first projects the quantum states into qubits $| +\rangle$ and vacuum states, but it is unclear how to implement this operation in practice. Assume that n squashed qubits are obtained during the operation of the protocol. The resulting single qubits are then randomly measured either in the X basis, {$| +\rangle$, $| -\rangle$}, or the Z basis, {$| H\rangle$, $| V\rangle$}. If n_x out of the n squashed qubits are measured in the X basis, they should be detected as $| +\rangle$ ideally. The detection rate for $| -\rangle$ is treated as the estimated error rate e_bx. The remaining ${n}_{z}=n-{n}_{x}$ qubits are measured in the Z basis to generate n_z random bits. Alice then extracts the final secure random bits from n_z, which is equivalent to privacy amplification in QKD.

The experimental demonstration is shown in figure 5. Weak coherent pulses are prepared with $| +\rangle$ polarization by a linear polarizer and a polarization controller (PC1). At Alice's side, a beam splitter (BS1) with splitting ratio 2:98 is used to passively choose the X or Z basis. In figure 5, the upper and lower paths correspond to the X basis and Z basis respectively. A single-photon detector is time-division-multiplexed by using four time delays TD1–TD4. For each coherent state Eve sends, a click in the first detection slot indicates that Alice chooses the X basis and correctly detects the incoming pulse as $| +\rangle$, while a click in the second slot indicates a wrong detection, $| -\rangle$, which is used for the error estimation. Moreover, a click in the third slot indicates that Alice selects the Z basis and obtain the result $| H\rangle$, while a click in the fourth slot indicates the result $| V\rangle$.

Zoom In Zoom Out Reset image size

This SI QRNG protocol assumes that the source can be untrusted, but the measurement station is trusted and characterized [16]. However, it is not clear how to guarantee the latter requirement in practice. Therefore, Eve might be able to prepare fake states to generate nonrandom numbers. The detector blinding attack (see section 2.2.1) could force the SPD to work as a classical detector. Then Eve could send a strong bright pulse to trigger a detection in the first slot. Then she sends another bright pulse with either the state $| H\rangle$ or $| V\rangle$ to control the detection in the third or fourth slot. The attack can result in equal detection rates for $| H\rangle$ and $| V\rangle$, which looks like random clicks to Alice, while being precisely controlled by Eve. Eve actually thus controls the bit string.

Another potential issue is the wavelength-dependent attack, because the splitting ratio of a beam splitter might be sensitive to the wavelength of the incoming light (see section 2.2.1). All four beam splitters in the measurement station might be affected. By controlling the splitting ratio of BS1 and/or BS4, Eve can bias whether error checking or random bit generation happens. For BS2 and BS3, by manipulating the splitting ratio, Eve is able to partially control the results of error checking and bit generation. Please note that a wavelength filter alone will not protect the system from this attack, because Eve could send bright states to overcome the finite extinction ratio in the filter's stopband.

The DL04 protocol contains two phases of channel estimation and a phase of secret transmission. The first channel estimation checks the security of the channel from Alice to Bob. Alice prepares a sequence of photons randomly chosen from the set of states $| H\rangle$, $| V\rangle$, $| +\rangle$, and $| -\rangle$, and sends them to Bob. He randomly selects a portion of the received photons, and randomly measures them in the X or the Z basis. Then Bob announces the measurement results and compares them to Alice's prepared states to calculate an error rate. Only when the error rate is lower than a threshold, Alice and Bob trust the channel and continue to the next step. Bob randomly selects another small portion of the received photons, and applies one of two unitary operations to each of them: $U=| 0\rangle \langle 1| -| 1\rangle \langle 0|$ or $I=| 0\rangle \langle 0| +| 1\rangle \langle 1|$, i.e., flipping a state or not. These photons are employed to check the security of the channel from Bob to Alice. The rest of the photons received by Bob are used to encode secret information by randomly applying the operator U or I to each photon. All these photons are then sent to Alice, who measures these photons in the preparation bases. Regarding the photons used for the security check, Alice checks if her measurement result is compatible with Bob's operation to estimate the error rate. Once the error rate is lower than a threshold, they trust the channel from Bob to Alice. The remaining photons measured in their preparation bases allow Alice to deterministically know Bob's operation, obtaining the secret information.

The protocol is implemented by the setup shown in figure 6 [17]. Alice prepares the initial photon string and measures the photons encoded by Bob. She first prepares $| H\rangle$ and $| V\rangle$ using two laser diodes. The preparation and measurement bases are selected by ${\mathrm{PC}}_{1}$ and ${\mathrm{PC}}_{2}$ respectively. Bob encodes his information by ${\mathrm{PC}}_{3}$. All the basis choices are controlled by field programmable gate arrays. The channel from Alice to Bob is denoted forward channel, and the channel from Bob to Alice is denoted backward channel. A beamsplitter at Bob's side selects a small portion of the received photons, and then a control module is used to check the security of the forward channel. The control module's scheme is the same as the passive measurement station in BB84 QKD system. A delay line is used to store the photons during the forward-channel check. To tolerate photon loss during secret transmission, a special method named single-photon frequency encoding is used. Instead of encoding information on individual photons, this method encodes information on the spectrum of a sequence of photons. After Alice detects a sequence of photons and converts them to a binary bit string, the spectrum can be known by applying the Fourier transform to the bit string. During the detection, Alice might miss some photons due to channel loss and imperfect detection efficiency. Fortunately, because the information does not only rely on an individual photon, but is determined by the spectrum of the entire sequence, missing some photons just reduces the signal-to-noise ratio, but the feature of the spectrum still exists [17]. The calculated spectrum corresponds to the bit string that is the initial information Bob sent.

Zoom In Zoom Out Reset image size

The first phase of the DL04 QSDC protocol, the security check of the forward channel, is similar to the raw key exchange, sifting and error estimation phases in the BB84 QKD protocol [2]. The security check of the backward channel and secret direct transmission are quantum versions of the one-time pad, which randomly flips the bit information [54]. Just as for QKD, the implementation [17] may contain side channels.

The first potential side channel is that detectors may be attacked by the detector blinding attack (see section 2.2.1). During the check of the forward channel, Eve blinds the detectors in the control module and conducts an attack with fake states [56] to control Bob's detection results. Since this attack introduces no errors, the security check is passed. During the second check of the backward channel and information transmission, Eve uses classical optical detectors to measure her bright pulses modulated by Bob. Since these are states resent by Eve during the previous phase, Eve could apply the same basis as in the previous step to know with certainty what operation Bob performed. Then, she sends the same states with proper brightness to Alice's blinded detectors, such that only when Alice selects the same bases as Eve, Alice obtains detections. This attack results in full control of Alices measurement outcomes. Again, no extra errors are introduced. Furthermore, Eve learns the secret information between Alice and Bob. This breaks the security of QSDC. Please note that because this implementation uses an active basis choice (the basis is actively selected by the polarization controller), Eve's measurement basis can only match Alice's/Bob's measurement basis half the time. However, when the basis matches the click probability in Bob under attack can be unity, while his single-photon detection efficiency is typically much lower than unity [9]. This may compensate for the extra loss introduced by the attack.

The second possible side channel exists in the polarization controllers that might be vulnerable to the Trojan-horse attack (see section 2.2.2). In this QSDC implementation [17], Eve can conduct the Trojan-horse attack on ${\mathrm{PC}}_{1}$ or ${\mathrm{PC}}_{3}$. From an attack on ${\mathrm{PC}}_{1}$, Eve would know Alice's basis choice in the state preparation and measurement, as ${\mathrm{PC}}_{2}$ applies the same basis as ${\mathrm{PC}}_{1}$. The difference between the prepared and the measured state is Bob's secret information (flip or not). On the other hand, Bob's encoded information could be directly known by hacking ${\mathrm{PC}}_{3}$ (similarly to section 3.2.2). Once Eve knows the original states prepared by Alice or what Bobs modulation was, she could obtain the secret information.

BQC is based on entangled multiparticle cluster states [18]. In the BQC protocol, qubits are first prepared as $| {\theta }_{j}\rangle =(| 0\rangle +{{\rm{e}}}^{{\rm{i}}{\theta }_{j}}| 1\rangle )/\sqrt{2}$ by a client, where ${\theta }_{j}$ is randomly selected from {0, π/4, ..., 7π/4}. Then the single-photon qubits are sent to a quantum server that entangles them with each other by applying controlled-phase gates, so that the qubits form a cluster state. Then the cluster state is measured by the quantum server, which performs single-qubit measurements in the basis $| {\pm }_{{\delta }_{j}}\rangle =(| 0\rangle +{{\rm{e}}}^{{\rm{i}}{\delta }_{j}}| 1\rangle )/\sqrt{2}$. The measurement basis is instructed by the client: δ_j = ϕ_j + θ_j + πr_j, where ϕ_j is the desired rotation and r_j is randomly chosen from {0, 1}. Since θ_j is the initial phase hidden from the quantum server, the server is not able to calculate the desired rotation ϕ_j from the measurement result. It is remarkable that for the cluster state, its shape, such as the dimension, also may leak information about the operation gates. Thus, also the shape of the cluster state is required to be hidden, which can be accomplished by choosing, for example, brickwork states [18]. The BQC protocol then completes a quantum computation while preserving the client's privacy.

Theoretically, the client only needs to have a single-photon source to generate a state $| {\theta }_{j}\rangle$ and send it to the server. However, implementing a single-photon source is challenging so far, as standard parametric down-conversion sources always also have higher-order emissions, meaning that instead of one pair, two or more pairs are emitted at the same time. An initial demonstration of the BQC protocol with current technology is shown in figure 7 [18]. Note that in the current implementation, entangled pairs are first prepared on the client's side, and the cluster state is generated on the server's side. The laser beam passes a BBO crystal to first generate the entangled pair traveling forwards. Then the beam is reflected and passes the BBO crystal again to generate the entangled pair traveling backwards. The initial phase θ_j is applied by rotating the angles of half-wave plates and quarter-wave plates, serving as modulators. Then the entangled states are sent to the quantum server's side, where a cluster state is generated. The states are measured in different bases, as instructed by the client. In this BQC protocol, the setup of the client is relatively simple, but the setup of the quantum server would have more capabilities once a real quantum computer is available. Here we take one type of BQC protocol as an example. There also exist other versions of BQC where the server generates entangled cluster states and the measurements are done by the client [59, 60].

Zoom In Zoom Out Reset image size

In the above subsection, a proof-of-principle implementation of BQC was introduced. Although in the future the technology available to implement the quantum server for BQC will be more mature and comprehensive, the client setup is already relatively clear. It is foreseeable that future client station will likely still consist of a photon source and modulators. Unfortunately, in practice, any kind of modulator is susceptible to the Trojan-horse attack [12, 19, 41, 42]. This vulnerability breaks an important assumption in BQC: the initial phase θ_j should be unknown to the untrusted quantum server. Specifically, regarding the implementation shown in figure 7, the phase modulation is done by the wave plates. The reflected light from the wave plates may leak information about θ_j. Instead of wave plates, an advanced setup in the future could be using phase modulators to randomly modulate the phase θ_j, which is a technique widely used in quantum cryptography [5, 6, 61]. Unfortunately, the Trojan-horse attack might still be applied to phase modulators, as we have discussed in section 2.2.2.

Except for imperfect phase modulation, another possible issue is the photon source itself. For the current version of implementation, the entanglement source sometimes might simultaneously emit multiple pairs of entangled states. In this case, Eve could split off a copy of entangled states from the source. Then measuring her copy would give Eve information about the state itself. Even in future implementations, when ideal single-photon sources are available, one still needs to pay attention to state generation. For instance, the BQC protocol needs indistinguishable multiple photons [18]. Thus, careful source design is crucial to avoid any distinguishability in the generated photons (this can, in principle, occur in any degree of freedom, for example wavelength).

For other variations of BQC protocols, where the measurements are done on the client's side [59, 60], attacks that leak information about the measurement settings are applicable. So, in a setting where the client uses wave plates to choose a measurement basis [60], the Trojan-horse attack could be applied as well.

Properly implementing the quantum-state source in the above protocols requires that any other degrees of freedom are uncorrelated with the degree of freedom where information is encoded. However, for the states prepared by different laser diodes (see section 2.1.1), the laser diodes may show the inherent difference in the spectrum and emission time. These types of difference hint which laser diode is on, i.e., which state is prepared. The mismatch in a certain degree of freedom could be a side channel for Eve who tries to distinguish different quantum states [31, 32]. To avoid this inherent mismatch among different laser diodes, quantum state preparation could use only one laser diode followed by optical modulators (figure 8), as shown in many QKD implementations [62–64]. The laser diode generates identical pulses. Then different states are modulated by a phase modulator [62], intensity modulator [63], or polarization modulator [64].

Zoom In Zoom Out Reset image size

The external modulation method could be applied to the implementation of double-receiver QDS (see section 2.1.1). However, this modification might open another loophole: the Trojan-horse attack on the modulators. Once a system uses a modulator, countermeasures against Trojan-horse attack are required. For a unidirectional system that only sends states from one party to another but never back, a possible countermeasure is adding enough isolation between the modulator and the output port connected to the quantum channel, as shown in figure 8. The amount of isolation is defined by the combination of bidirectional attenuation from attenuators, the unidirectional attenuation from isolators and total reflection probability from lasers and modulators. For example, in a BB84 QKD system, the isolation has been quantified as the following [65]. Suppose Eve injects pulsed light into the party preparing the state. The injected power is limited by the maximum power transmitted safely through standard single-mode fiber (assumed to be 12.8 W in [65]). The amount of reflection then is obtained after the injected light is attenuated by the system isolation. Taking this amount of reflection into account in the calculation of the key rate, one could obtain the final secure key rate. To obtain a key rate under the Trojan-horse attack that is close to the rate without an attack, 170 dB isolation is required [65].

A similar methodology could be applied to single-receiver QDS, QSDC, and BQC, which may be vulnerable to the Trojan-horse attack. In each implementation, attenuators and isolators could be added between the modulators and system output, and the reflectivity of modulator and laser diodes should be quantified. Then the required amount of isolation should be calculated according to the security models of the corresponding protocol as has already been done for QKD [65]. The chosen amount of isolation should maintain the system's security properties. We notice that in the implementation of single-receiver QDS in [25], an attenuator is already included to weaken the output power to single-photon level. However, this amount of attenuation is probably not sufficient to provide isolation to counter the Trojan-horse attack.

For a bidirectional plug and play QSS system (see section 3.1.2) and pass-through QSDC (see section 5), the system's isolation in the previous countermeasure is not applicable, because it would block transmission of the states. In the bidirectional system, single-photon monitors would be needed to observe the incoming light [41]. It is not clear if implementing such countermeasure securely is realistic. Nevertheless, a patent by Trifonov and Vig [66] proposes a scheme against Trojan-horse attack with a single-photon watchdog detector. This countermeasure could be adapted for the single-qubit QSS implementation. Alice could employ a watchdog detector for the received light. The rest of parties in the scheme could use two watchdog detectors to observe two fiber connection ports at each side of the PM. Any alarm would abort the protocol. Please note that the single-photon detector might be vulnerable to the detector blinding attack. Thus, a corresponding countermeasure against detector control attacks is necessary, which is discussed in the next subsection.

In a party that makes measurements, characteristics of passive optical components, such as beam splitters, might be sensitive to wavelength. That is, the component's behavior for unexpected wavelengths may deviate from what is assumed. To provide practical security, wavelength dependence should be eliminated. A possible method is using a wavelength filter to block unexpected wavelengths, and only pass a narrow range around the working wavelength [65]. In the implementation of double-receiver QDS (see section 2.1.1), this filter could be added before the beam splitter in Bob and Charlie, i.e., right at their input ports. The filter's transmission should be verified in a wide range of wavelengths. However, there is a limitation to this approach: Eve can simply increase her light power to pass through the stopband. Therefore, as a more robust countermeasure, we suggest utilizing active basis choice in the measurement station.

Another major vulnerability in measurement setups is imperfections in single-photon detectors (see section 2.2.1). A proposed countermeasure for QKD systems is calibrating the characteristics of detectors in real time, avoiding Eve's manipulation [67]. In this receiver design, a calibrated light source is locally included in the measurement unit, in combination with several other countermeasures. By randomly activating this local source to send photons to the detectors, the corresponding detection efficiency can be calibrated during the system operation. The characterized detection efficiency can then be used in the security proof to calculate the secure key rate. A similar design might be applicable to measurement stations in the other quantum cryptographic protocols. However, incorporating the calibration procedure into their security models should be studied in each case.

Another approach to entirely avoid the effect of imperfect detectors and other measurement imperfections are measurement-device-independent (MDI) quantum cryptographic protocols [68], such as MDI QKD [69], MDI QSS [70] and MDI QDS [71, 72]. In the MDI protocols, the party making measurements is untrusted: there are no security assumptions regarding the measurements. Even if Eve makes the measurements, the secret information (provided the protocol produces it) can still be distributed among the rest of the authenticated parties. This is a promising idea to avoid security loopholes related to the measurements. However, state preparation remains trusted and still needs to be carefully designed to avoid loopholes.