\documentclass[pra,amsmath,amssymb,twocolumn]{revtex4}
%\documentclass[amsmath,amssymb]{revtex4}
%\documentclass[a4paper,10pt]{article}
\usepackage{amsmath}
\usepackage{amssymb}

%Pagestyle commands
\renewcommand{\footnoterule}{\rule{70mm}{0.2mm}\vspace{5mm}}
\setlength{\footnotesep}{5mm}
\setlength{\topmargin}{-20mm}
\setlength{\headsep}{1.2cm}
\setlength{\oddsidemargin}{-5mm}
\setlength{\evensidemargin}{-5mm}
\setlength{\textheight}{240mm}
\setlength{\textwidth}{165mm}
\setlength{\parindent}{0 em}%


\usepackage{graphicx}
\input epsf.tex
\usepackage{amsthm}

% Environment commands
\newcommand{\be}{\begin{equation}}
\newcommand{\ee}{\end{equation}}
\newcommand{\ba}{\begin{eqnarray}}
\newcommand{\ea}{\end{eqnarray}}
\newcommand{\ban}{\begin{eqnarray*}}
\newcommand{\ean}{\end{eqnarray*}}

% Quantum
\newcommand{\braket}[2]{\mbox{$ \langle #1 | #2 \rangle $}}
\newcommand{\moy}[1]{\langle #1 \rangle}
\newcommand{\sandwich}[3]{\mbox{$ \langle #1 | #2 | #3 \rangle $}}
\newcommand{\ket}[1]{\mbox{$ | #1 \rangle $}}
\newcommand{\bra}[1]{\mbox{$ \langle #1 | $}}
\newcommand{\com}[2]{\left[ #1\,,\,#2 \right]}
\newcommand{\acom}[2]{\left\{ #1\,,\,#2 \right\}}

\newcommand*{\Hmin}{H_{\infty}}
\newcommand*{\EC}{\mathrm{EC}}
\newcommand*{\PA}{\mathrm{PA}}
\newcommand*{\PE}{\mathrm{PE}}
\newcommand*{\leak}{\mathrm{leak}}
\newcommand*{\eps}{\varepsilon}
\newcommand*{\epsb}{\bar{\eps}}

\newcommand{\si}{\sigma}
\newcommand{\demi}{\frac{1}{2}}
\newcommand{\compl}{\begin{picture}(8,8)\put(0,0){C}\put(3,0.3){\line(0,1){7}}\end{picture}}
\newcommand{\real}{\begin{picture}(8,8)\put(0,0){R}\put(0,0){\line(0,1){7}}\end{picture}}
\newcommand{\ration}{\begin{picture}(8,8)\put(0,0){Q}\put(3,0.3){\line(0,1){7}}\end{picture}}
%\newcommand{\integers}{\begin{picture}(8,8)\put(0,0){Z}\put(4,0){\line(1,-1){7}}\end{picture}}
%\newcommand{\nat}{\begin{picture}(8,8)\put(0,0){N}\put(0,0){\line(0,1){7}}\end{picture}}
\newcommand{\oldone}{\begin{picture}(8,8)\put(0,0){1}\put(4.8,0){\line(0,1){7}}\end{picture}}
\newcommand{\one}{\leavevmode\hbox{\small1\normalsize\kern-.33em1}}
\newcommand{\prob}{\begin{picture}(8,8)\put(0,0){P}\put(0,0){\line(0,1){7}}\end{picture}}



\begin{document}

\title{The black paper of quantum cryptography: real implementation problems}

\author{Valerio Scarani, Christian Kurtsiefer}
\affiliation{Centre for Quantum Technologies \& Department of Physics,
National University of Singapore, Singapore}



\date{\today}

\begin{abstract}
Write
\end{abstract}
\maketitle

In their seminal 1984 paper \cite{bb84}, Bennett and Brassard argued that some basic laws of physics may prove useful in cryptographic tasks. They considered first the task of \textit{key distribution} between distant partners and noticed that quantum signals are ideal trusted couriers: if the eavesdropper Eve tries to obtain some information, her action cannot remain concealed, because measurement modifies the state or, equivalently, because of the no-cloning theorem. In the second part of their paper, they turned to the task of bit-commitment and proposed a quantum solution relying on entanglement. In 1991, Ekert independently re-discovered quantum key distribution \cite{eke91}: his intuition was based on entanglement, more specifically on Bell's inequalities.

The fact that security is based on physical laws lead to the hope that quantum cryptography may provide the highest possible level of security, called \textit{unconditional security}. Further research vindicated only one of the two conjectures of Bennett and Brassard: key distribution can indeed be made unconditionally secure \cite{may96,lo99b,sho00}, while bit commitment cannot \cite{bitcom}. Most of the subsequent developments in quantum cryptography have therefore been devoted to \textit{quantum key distribution (QKD)}; several review papers are available \cite{gis02,dus06,sca08,lo08}.

But what does ``unconditional security'' actually mean? The expression itself conveys the meaning of ``something that can be trusted blindly'' and the fact that the security of QKD is ``based on the laws of physics'' reinforces the same impression. But this cannot be the case. For instance, the laws of physics do not prevent someone from reading the outcomes of a detector; however, if Eve has access to that information, security is clearly compromised! In fact,``unconditional security'' has the same meaning in QKD as it has in the usual jargon of cryptography, namely: security can be guaranteed against an eavesdropper with unrestricted computational power, \textit{provided the devices and procedures of the authorized partners Alice and Bob are well characterized}. This paper has been written to emphasize this point. 

\section{All that the laws of physics don't take care of}
\label{sec2}

\subsection{Leakage of quantum information: side channels}

In the usual QKD protocols, the laws of physics do not take care of side channels. A side channel is, in short, some component of the real quantum signal that one happens to neglect. For clarity, let us go through the most famous examples of such undesired effects:
\begin{enumerate}
\item For some years, at the beginning of QKD, it was believed that attenuated lasers were good practical approximations of single-photon states. Then L\"utkenhaus and coworkers stressed that the presence of multi-photon components in a laser pulse opened a serious gap in security \cite{pns}. For the specific side channel consisting of the photon number, variations of the protocol have been proposed \cite{decoy,sarg}. Security proofs were later adapted to take into account the effect of this and similar side channels \cite{gllp}.
\item About the same implementation, it was later noticed that the proofs applied only under the assumption of complete phase randomization between successive pulses \cite{lopresk}, and did not apply to plug-and-play systems because one cannot guarantee which state enters Alice's device \cite{gis06}. A security proof coping with the latter has since been given \cite{zha08}, while for the first issue the only known solution consists in implementing active phase randomization.
\item Another kind of side channel is the possibility of spectral distinguishability between different states. \textbf{Christian complete this}
\item A particularly serious side channel was discovered at some point for continuous-variable QKD. In the usual implementations, the local oscillator providing the phase reference for the homodyne measurement is sent from Alice to Bob. In this case, security is entirely compromised if the intensity of this beam is not monitored at Bob's side \cite{hae08}.
\end{enumerate}



\subsection{Leakage of classical information: bad design and hacking}

\begin{enumerate}
\item Kurtsiefer back-flashing of some diodes
\item Makarov faked states
\item Lo time-shift; Kurtsiefer-Lamas: reveal too many digits
\item Makarov reloaded: saturate and control detectors
\end{enumerate}

\subsection{A balance}

We have reviewed the most prominent discoveries of side channels, leakage and hacking in real implementations of QKD. We stressed how, once identified, each of the issues above can be coped with, either by adapting the security proofs or by hardware modifications. In this sense, the security of those implementations has increased in the last years, and the ultimate security of QKD does not seem to be under threat. Before being identified, however, each of the issues above represented a serious potential breach of security.

The development of QKD has therefore clearly shown that \textit{``unconditional security'' and ``security based only on the laws of physics'' are two distinct notions}. Unconditional security, in its jargon sense, can be and has been proved for many QKD protocols --- this is of course remarkable, and would be impossible without quantum physics. However, the application of a security proof to a real device requires an additional level of trust: one must be confident that the leakage of both quantum information (through side channels) and classical information (through bad design or hacking) has been correctly bounded.

\section{Paths for the future}

Only time will tell what we will do in the future \cite{constantin}. But the facts sketched above, combined with some tendencies within the QKD community, allow a guess of two directions in which the field may evolve in the coming years.

\subsection{Option 1: reasonable security of a device}

Although they do not provide ``security based only on the laws of physics'', usual QKD devices do provide a quite reasonable level of security. After all, classical devices must be trusted on not leaking too much information out too; and once the trust is there, QKD offers something that classical devices cannot offer. Moreover, thanks to the technological developments of the last years, for some applications QKD devices may also be competitive in terms of reliability, speed, cost...

Here we have therefore a first possible stance: give up claims of ultimate security, find a competitive edge and try to produce better devices than those based on classical information processing. This stance implies the admission that QKD is not going to be ``the solution for (almost) every secret communication'', as it is still presented sometimes. But the niche character of QKD is not new: see for instance the comprehensive analysis of the place of QKD within cryptography given by the \textit{SECOQC White Paper} of 2007 \cite{all07}.


\subsection{Option 2: device-independent security and its price}

Recently, some authors have come up with a new class of QKD protocols that come as close as possible to the claim of ``security based only on the laws of physics'' \cite{devindep}. The idea was already present in Ekert's 1991 seminal paper \cite{eke91}, but went unnoticed for many years. The key ingredient is that \textit{Bell's theorem is independent of quantum physics}. As a consequence, it is also independent of the details of the physical systems under study: its Hilbert space, its state, the measurements that are performed... In other words, whenever a Bell-type inequality is violated without sending a signal, the correlations that are created must contain some secrecy (because if a third party had full information, this information would be a local hidden variable).

Therefore, a protocol that estimates Eve's information through the amount of violation of a Bell-type inequality is ``device-independent''. By definition, this approach takes automatically care of all side channels, because there is no need of specifying anything about the quantum signal anyway. It is also sensitive to hacking strategies in which Eve tries to force a result chosen by herself. For a comprehensive review of the benefits of device-independent QKD as understood today, we refer the reader to Ref.~\cite{pironio}. Here, we want to highlight the remaining level of trust and the price one has to pay for such a general level of security (for the sake of this paper, we assume that ``unconditional security'' will be proved one day for device-independent protocols, though the issue is still open at the moment of writing).

The \textit{level of trust} is defined by some obvious requirements, namely (i) quantum physics must be correct, (ii) Eve must not have access to the data, (iii) Eve must not have provided the random number generator that makes the choice of setting. These are common to all of QKD. A fourth requirement is less obvious: although, as we said, one does not need to know the details of how the devices operate, one must make sure that (iv) the violation of Bell's inequality is not be due to the exchange of a signal. In principle, one might think that this last requirement can be guaranteed by arranging space-like separated detections. But this is not evident in a black-box scenario: even if the outcomes are perceived as exactly simultaneous, one of them might have been created earlier and just kept in a memory for the convenient amount of time.

Anyway, before even addressing those issues, there is a further crucial concern: one must be sure to observe a \textit{real} violation of Bell's inequalities in the first place. In a black-box scenario and in the presence of an adversary, the \textit{detection loophole} becomes a natural option. Indeed, as soon as the fraction of detected correlations is below the required threshold, the observed violation of Bell-type inequality could have been created by pre-established agreement: the black-box may just contain a computer with a pre-determined program! Furthermore, the detection loophole is not only about the efficiency of the detectors: \textit{all the losses}, and in particular the losses in the transmission, must lie below the threshold. This means that device-independent QKD can in no case be demonstrated over long distances!


\textbf{Give numbers, conclude on distances!}


\section{Conclusion}

\section*{Acknowledgments}

This work is supported by the National Research Foundation and Ministry of Education, Singapore.



\begin{thebibliography}{19}
\expandafter\ifx\csname natexlab\endcsname\relax\def\natexlab#1{#1}\fi
\expandafter\ifx\csname bibnamefont\endcsname\relax
  \def\bibnamefont#1{#1}\fi
\expandafter\ifx\csname bibfnamefont\endcsname\relax
  \def\bibfnamefont#1{#1}\fi
\expandafter\ifx\csname citenamefont\endcsname\relax
  \def\citenamefont#1{#1}\fi
\expandafter\ifx\csname url\endcsname\relax
  \def\url#1{\texttt{#1}}\fi
\expandafter\ifx\csname urlprefix\endcsname\relax\def\urlprefix{URL }\fi
\providecommand{\bibinfo}[2]{#2}
\providecommand{\eprint}[2][]{\url{#2}}


\bibitem{bb84}
\bibinfo{author}{\bibfnamefont{C.}~\bibnamefont{Bennett}} \bibnamefont{and}
  \bibinfo{author}{\bibfnamefont{G.}~\bibnamefont{Brassard}}, in
  \emph{\bibinfo{booktitle}{Proceedings of IEEE International Conference on
  Computers, Systems and Signal Processing, Bangalore, India, December 1984,
  pp. 175 - 179.}} (\bibinfo{year}{1984}).
  
\bibitem{eke91} A.K. Ekert, Phys. Rev. Lett. \textbf{67}, 661 (1991)

\bibitem{may96}%%uncondsec
\bibinfo{author}{\bibnamefont{D. Mayers}}, in: \emph{\bibinfo{booktitle}{Advances in Cryptology \,---\, Proceedings of Crypto '96}} (\bibinfo{publisher}{Springer Verlag, Berlin, 1996}), p. 343.

\bibitem{lo99b}%%uncondsec with q-computer
\bibinfo{author}{\bibnamefont{H.-K. Lo, H.F. Chau}},
\bibinfo{journal}{Science} \textbf{\bibinfo{volume}{283}},
\bibinfo{pages}{2050} (1999).

\bibitem{sho00}%%uncond sec BB84
\bibinfo{author}{\bibnamefont{P.W. Shor, J. Preskill}},
\bibinfo{journal}{Phys. Rev. Lett.} \textbf{\bibinfo{volume}{85}},
\bibinfo{pages}{441} (2000).

\bibitem{bitcom} Interestingly, the impossibility of bit commitment also derives from a deep physical law: the fact that the correlations obtained by measuring an entangled state do not arise from a time-ordered chain of events. Here, it implies that Bob cannot be sure that Alice has actually performed her measurement and thus committed to her bit. For the formal proof, see: H.-K. Lo, H.F. Chau, Phys. Rev. Lett. \textbf{78}, 3410 (1997); D. Mayers, Phys. Rev. Lett. \textbf{78}, 3414 (1997).

\bibitem{gis02} N. Gisin, G. Ribordy, W. Tittel, H.
Zbinden, Rev. Mod. Phys. \textbf{\bibinfo{volume}{74}},
\bibinfo{pages}{145} (2002)

\bibitem{dus06} M. Du\v{s}ek, N. L\"utkenhaus, M. Hendrych, Progress in Optics \textbf{\bibinfo{volume}{49}}, Edt. E. Wolf (Elsevier), \bibinfo{pages}{381} (2006)

\bibitem{sca08} V. Scarani, H. Bechmann-Pasquinucci, N.J. Cerf, M. Du\v{s}ek, N. L\"utkenhaus, M. Peev, arXiv:0802.4155

\bibitem{lo08} H.-K. Lo, Y. Zhao, arXiv:0803.2507

\bibitem{pns} N. L\"{u}tkenhaus, Phys. Rev. A \textbf{\bibinfo{volume}{61}}, \bibinfo{pages}{052304} (2000); G. Brassard, N. L\"{u}tkenhaus, T. Mor, B.C. Sanders, Phys. Rev. Lett. \textbf{\bibinfo{volume}{85}}, \bibinfo{pages}{1330} (2000).


\bibitem{sarg} V. Scarani, A. Ac\'{\i}n, G. Ribordy, and N. Gisin, \bibinfo{journal}{Phys. Rev. Lett.} \textbf{\bibinfo{volume}{92}}, \bibinfo{pages}{057901} (2004).

\bibitem{decoy} W.-Y. Hwang, W.-Y., \bibinfo{journal}{Phys. Rev. Lett.} \textbf{\bibinfo{volume}{91}}, \bibinfo{pages}{057901} (2003).

\bibitem{gllp} D. Gottesman, H.-K. Lo, N. L\"utkenhaus, J. Preskill, Quant. Inf. Comput. \textbf{\bibinfo{volume}{4}}, \bibinfo{pages}{325} (2004).

\bibitem{lopresk} H.-K. Lo, J. Preskill, \bibinfo{journal}{Quant. Inf. Comput.} \textbf{\bibinfo{volume}{8}}, \bibinfo{pages}{431} (2007).

\bibitem{gis06} N. Gisin, S. Fasel, B. Kraus, H. Zbinden, G. Ribordy, \bibinfo{journal}{Phys. Rev. A} \textbf{\bibinfo{volume}{73}}, \bibinfo{pages}{022320} (2006).

\bibitem{zha08} Y. Zhao, B. Qi, H.-K. Lo, \bibinfo{journal}{Phys. Rev. A} \textbf{\bibinfo{volume}{77}}, \bibinfo{pages}{052327} (2008).

\bibitem{hae08} H. H\"aseler, T. Moroder, N. L\"utkenhaus, \bibinfo{journal}{Phys. Rev. A} \textbf{\bibinfo{volume}{77}}, \bibinfo{pages}{032303} (2008).

\bibitem{constantin} Freely translated from ``L'avenir nous dira ce qu'on va faire dans le futur'', a by now famous truism by Swiss soccer tycoon Christian Constantin, Prix Champignac d'Or 2007.

\bibitem{all07}
R. All\'eaume, J. Bouda, C. Branciard, T. Debuisschert, M. Dianati, N. Gisin, 
M. Godfrey, P. Grangier, T. L\"{a}nger, A. Leverrier, N. L\"{u}tkenhaus, P. Painchault, M. Peev, A. Poppe, 
T. Pornin, J. Rarity, R. Renner, G. Ribordy, M. Riguidel, L. Salvail, A. Shields, H. Weinfurter, A. 
Zeilinger, \textit{SECOQC White Paper on Quantum Key Distribution and Cryptography}, \eprint{quant-ph/0701168}

\bibitem{devindep} We do not delve here into the detailed sequence of discoveries and claims that lead to device-independent QKD. The most meaningful references are: J. Barrett, L. Hardy, A. Kent, \bibinfo{journal}{Phys. Rev. Lett.} \textbf{\bibinfo{volume}{95}}, \bibinfo{pages}{010503} (2005); A. Ac\'{\i}n, N. Gisin, L. Masanes, \bibinfo{journal}{Phys. Rev. Lett.} \textbf{\bibinfo{volume}{97}}, \bibinfo{pages}{120405} (2006); A. Ac\'{\i}n, N. Brunner, N. Gisin, S. Massar, S. Pironio, V. Scarani, \bibinfo{journal}{Phys. Rev. Lett.} \textbf{\bibinfo{volume}{98}}, \bibinfo{pages}{230501} (2007).

\bibitem{pironio} S. Pironio, A. Ac\'{\i}n, N. Brunner, N. Gisin, S. Massar, V. Scarani, New J. Phys. \textbf{ACCEPTED} (2009)

\end{thebibliography}

\end{document}





So, unconditional security proofs can be worked out provided you have not neglected anything important in the description of your setup, and provided that the hardware itself is not vulnerable to hacking.

We do not insist on the fact that the mathematical proofs themselves may contain technical assumptions: squashing, infinite key, equal detectors...