Reversed Space Attacks

Many quantum key distribution (QKD) schemes are based on sending and measuring qubits – two-dimensional quantum systems. Yet, in practical realizations and experiments, the measuring devices at the receiver’s (Bob) site commonly do not measure a two-dimensional system but rather a quantum space of a larger dimension. Such an enlargement sometimes results from imperfect devices. However, in various QKD protocols such enlargement exists even in the ideal scenario when all devices are assumed to be perfect. This issue is common, for instance, in QKD schemes implemented via photons, where the parties’ devices are based on Mach-Zehnder interferometers, as these inherently enlarge the quantum space in use. We show how space enlargement at Bob’s site exposes the implemented protocol to new kinds of attacks, attacks that have not yet been explicitly pinpointed nor rigorously analyzed. We name these the “reversed space attacks”. A key insight in formalizing our attacks, is the idea of taking all states defining Bob’s (large) measured space and reversing them in time in order to identify precisely the space that an eavesdropper may attack. We employ such attacks on two variants of intereferometric-based QKD recently experimented by several groups, and show how to get full information on the qubit sent by Alice, while inducing no errors at all. The technique we develop here has subsequently been used in a closely related work (Boyer, Gelles, and Mor, Physical Review A, 2014) to demonstrate a (weaker variant of) reversed-space attack on both interferometric-based and polarization-based QKD.

💡 Research Summary

The paper “Reversed Space Attacks” addresses a fundamental gap between the theoretical model of quantum key distribution (QKD) – which assumes that Alice sends ideal two‑dimensional qubits and Bob measures a two‑dimensional system – and the reality of most experimental implementations, where Bob’s measurement apparatus actually operates on a larger Hilbert space. This enlargement can arise from imperfect devices (e.g., detectors that cannot distinguish photon number) or from the intrinsic design of the apparatus (e.g., Mach‑Zehnder interferometers that introduce additional temporal or spatial modes). The authors argue that this discrepancy creates a previously uncharacterized class of vulnerabilities, which they call “reversed‑space attacks”.

The central idea is to define the “reversed space” H_P as the span of all states that, after being acted upon by Bob’s measurement unitary U_B, would lead to the basis states |j⟩_B that Bob actually records. Mathematically, H_P = span{U_B†|j⟩_B} over all measurement outcomes that Bob interprets as valid bits (or losses). Because Eve is assumed to have full knowledge of the protocol, she also knows U_B and the set of outcomes, and therefore she can target the entire reversed space rather than the ideal qubit space H_A. In this framework, Eve’s most general attack consists of appending an ancilla, applying a unitary U_E on the combined system, and sending the resulting state (now living in H_P) to Bob. The authors formalize the condition for an attack to be “oblivious” – i.e., to cause no detectable errors or invalid outcomes – as the vanishing of the overlap between the post‑attack state and any basis vector belonging to the error set J_error or the invalid set J_invalid. This condition is expressed compactly in Claim 1: for every Alice state |ψ_i⟩ and every Bob unitary U_B^s, the coefficients β·X·ε must be zero for all j ∈ J_error ∪ J_invalid.

Two illustrative examples are presented. In Example 1, Bob’s detector cannot differentiate a single photon from two photons; consequently the two‑photon state |2,0⟩ is indistinguishable from the single‑photon state |1,0⟩. Eve can deliberately inject two‑photon pulses; Bob’s measurement will still register a legitimate outcome, while Eve gains extra information from the photon‑number degree of freedom. In Example 2, the arrival time of the photon may be either t or t+δ, but Bob’s apparatus does not resolve the two time slots. The qubit is effectively embedded in a four‑dimensional space spanned by {|1,0,0,0⟩, |0,1,0,0⟩, |0,0,1,0⟩, |0,0,0,1⟩}. Eve can manipulate the delayed mode (t+δ) and hand it back to Bob as an unused ancilla, thereby controlling the entire reversed space without introducing errors.

Building on this formalism, the authors apply the attack to several recent interferometric BB84 implementations (references