Quantum key distribution (QKD)^[1,2] is a novel routine of sharing secret key between two distant parties (called Alice and Bob) in the presence of an eavesdropper Eve. The unconditional security of QKD protocol is guaranteed by the nature of quantum physics, which has been proved via different methods.^[3–5] Some experimental demonstrations are also carried out and advances are achieved.^[6–9] However, practical devices may be imperfect by comparing with the ideal protocol. For example, an imperfect phase modulator may be remote controlled by an eavesdropper Eve and introduce a phase remapping attack.^[10,11] For practical single photon detectors (SPDs), detection efficiency mismatch between several SPDs would introduce time-shift attack^[12] or faked state attack.^[13–15] One single SPD may also be blinded by bright illumination and controlled by Eve.^[16–20] Recently, the avalanche-transition region of SPD has also been utilized to hack the QKD system.^[21] But not only that, the imperfections in real devices may open security loopholes and be utilized by Eve to get secret key information.

High-dimensional quantum key distribution (HD-QKD),^[22–26] which is an expansion to common qubit-based QKD, is capable of encoding multiple bits on one single photon and has many advantages such as high photon information efficiency (PIE) and strong tolerance to channel noise. So HD-QKD has attracted much attention since its proposal. Ali-Khan et al.^[27] put forward the first HD-QKD protocol based on time–energy entanglement but did not prove its security. Afterwards, Mower et al.^[28] proved the security of time–energy entanglement-based HD-QKD against collective attack using dispersive optics. Zhang et al.^[29] applied decoy-state method^[30–32] to HD-QKD to defeat photon-number-splitting (PNS) attack^[33,34] and proved its security against collective attacks. The security of decoy-state HD-QKD against collective attacks^[35] and coherent attacks^[36] in the finite-key scenario has also been established. However, the practical HD-QKD system may have imperfect devices, which can be utilized by the eavesdropper to get the final secret key.

In Ref. [37], the fiber beam splitter (BS) was discovered to possess a wavelength-dependent property. Making use of this property, Eve has the ability to control the outputs of the fiber beam splitter and then remotely control Bobʼs measurement basis choice. Utilizing this security loophole, a polarization-encoded BB84 QKD system was attacked successfully. Subsequently, Huang et al.^[38,39] and Ma et al.^[40] independently extended this so-called wavelength attack to practical continuous-variable QKD (CV-QKD) systems, regardless of whether Bob employs intensity monitoring. Afterwards, few investigations about wavelength attack have been constructed.

In this work, we apply wavelength attack towards HD-QKD system. We take four-dimensional time-bin HD-QKD system for example.^[41] The eavesdropper Eve can control the measurement bases by just choosing two certain wavelengths, then she can apply the man-in-the-middle attack to get the final secret key. We calculate the final quantum bit error rate introduced by this attack and design a concrete implementation on a practical time-bin HD-QKD system. We also demonstrate that this attacking strategy is universally applicable towards any d-dimensional QKD system and higher-dimensional QKD system is more vulnerable to this attack.

The rest of this paper is organized as follows. In Section 2, we present a brief introduction on time-bin HD-QKD system and wavelength-dependent beam splitter. In Section 3, we demonstrate how to perform wavelength attack on time-bin HD-QKD system and calculate the quantum bit error rate caused by this attack. Some further discussion is put forward in Section 4 and conclusions are summarized in Section 5.

With regard to time-bin HD-QKD system mentioned above, the coupling ratio of BS is 0.90 for 1550 nm. In this protocol, the 90/10 beam splitter directs of the incident photons out of output port 1 to temporal basis measurement device. The other 10% are directed out of output port 2 to phase-basis measurement device. To attack this system via wavelength attack, Eveʼs measurement setup is the same as Bobʼs. After measuring the state sent from Alice, Eve prepares a new state with a certain wavelength which has a different coupling ratio according to her measurement result. Afterwards, Eve sends this remodulated state to Bob. More precisely, Eve will send remodulated photon state with ( ) source if her measurement result occurs at temporal (phase) basis measurement device side. That is to say there is a requirement that and photons pass through the BS from output port 1 and output port 2, respectively. Furthermore, the coupling ratios and which correspond to wavelengths and should satisfy and . It is much more likely that photon passes from output port 1 and photon from output port 2 if and have large deviations from 0.9. Then this attack is more likely to be realized. In the practical setup, it is not difficult to find two wavelengths which satisfy and since FBT-fabricated beam splitter always has a wavelength-dependent property.^[39]

Considering that wavelength attack has been carried out by Eve to time-bin HD-QKD system with the assumption that only the beam splitter is imperfect, the final quantum bit error rate (QBER) is given by 2 this error rate value can be intuitively obtained by the probability tree of the state transformation as shown in Fig. 2. Using the analysis results in Ref. [44], Alice and Bob can obtain secret key if the QBER introduced by Eve is lower than 18.9%. As illustrated in Fig. 3, when is just a little more than 0.9 and is a little less than 0.9, the QBER reaches the maximal Err value 13.5%, lower than the maximal tolerable QBER value. Hence, Alice and Bob will not discover Eveʼs existence. In the asymptotic case where and , the QBER is much lower and Eve can get much more secret key even the full secret key bit. We should notice that even zero QBER can distill no secret key in the extreme case where and . What is more, since the tolerable QBER for four-dimensional time-bin QKD system is 18.9% (compared to 11% for BB84), the presence of Eve is more difficult to discover. This potential threat is detrimental to time-bin HD-QKD system.

Fig. 2.

	Figure Option ViewDownloadNew Window
	Fig. 2. Probability tree of the state transformation. Alice sends the prepared photon state to the quantum channel, Eve gets the detection result with probability or in the middle stage, then Bob preserves his detection result after the sifting protocol with probability or , with different measurement bases. Different colors represent different probabilities.

Fig. 3.

	Figure Option ViewDownloadNew Window
	Fig. 3. The final QBER as a function of coupling ratios and where and are coupling ratios corresponding to wavelengths and .

Utilizing the analysis above, a detailed schematic diagram of this attacking model is illustrated in Fig. 4. If Eve gets a detection result of 00/01/10/11 with the temporal basis , she will prepare the photon state again with the source. Conversely, if she obtains an emergence from detector , she will prepare the photon state again with the source, where For instance, if Alice sends the quantum state , then Eve gets a detection result of in the temporal basis with a probability of 90%, then she will prepare a remodulated quantum state using a source to the receiver Bob, since the wavelength laser can mainly pass through output port 1 of the BS on Bobʼs side, and Bob can detect in the temporal basis with a % success probability. Conversely, if Eve gets a detection result in the phase basis with a probability of 10%, then she will prepare a remodulated quantum state using a source to the receiver Bob, since the wavelength laser can pass through output port 2 of the BS on Bobʼs side with a probability less than 90%, and Bob can get the detection result in the phase basis with a success probability. It is worth noting that in the realistic setup, the detection efficiency of the single photon detector also has a correlation with wavelength, leading to different detection counts on Bobʼs side. Then, Bob will realize an eavesdropperʼs existence. To settle this problem, we can just add different attenuations after and sources, hence Bob can get a similar amount of detection results with and without the eavesdropper. Therefore, the wavelength attack is insusceptible to detection efficiency distinction.

Fig. 4.

	Figure Option ViewDownloadNew Window
	Fig. 4. Attacking time-bin HD-QKD system. The red area is controlled by the eavesdropper Eve.

We consider wavelength attack towards arbitrary d-dimensional QKD system where the BS has an arbitrary coupling ratio r. In the d-dimensional QKD system, Alice prepares two sets of mutually unbiased bases and which satisfy 3 A-basis states and B-basis states are prepared with probabilities of and ( ), respectively. After the propagation through a quantum channel, a ) beam splitter ( ) directs % of the incident quantum states to A-basis measurement setup and % to B-basis measurement setup. When Eve carries out the wavelength attack by an intercept-and-resend strategy, her measurement setup is the same as Bobʼs. What she also needs are two certain wavelengths and for which the coupling ratios are and , satisfying and . Similar to the discussion in Section 2, we can calculate the final QBER by the probability tree of the state transformation as shown in Fig. 5. The final QBER is given by 4 Substituting d = 2, p=0.50, r=50% (classical BB84 protocol) or d = 4, p=0.90, r=90% (four-dimensional time-bin HD-QKD system mentioned above) into Eq. (4), we can obtain QBER results which accord with those in Ref. [37] and Eq. (2).

Fig. 5.

	Figure Option ViewDownloadNew Window
	Fig. 5. Probability tree of the state transformation for arbitrary d-dimensional QKD system.

From Eq. (4), we can make out that wavelength attack is a universal attack strategy towards arbitrary d-dimensional QKD systems. As long as the final QBER is lower than the tolerable value, two legitimate parties will not be conscious of the presence of an eavesdropper, and Eve can acquire almost all of the secret key information. Eve can achieve this goal just in virtue of two certain wavelength sources.

Furthermore, we discuss the relationship between the dimension d and the coupling ratio . Considering the general case of unbiased-basis-selection, the preparation probability and coupling ratio of Bobʼs BS both equal 0.5. Then, equation (4) turns into 5 As illustrated in Fig. 6, for the sake of quantum bit error rate lower than the maximal tolerable value, there are requirements on both and .

Fig. 6.

	Figure Option ViewDownloadNew Window
	Fig. 6. Relationship between quantum bit error rate and coupling ratios. For dimensions d = 2, 4, 8, 16 [panels (a)–(d)], only data points ( , ) satisfying Err value less than the maximal tolerable error rate (11%, 18.9%, 24.7%, 28.9%)[44] can guarantee successful wavelength attack.

As a further discussion, we study the requirement for coupling ratios under different dimensions. For simplicity, we just suppose that we can find two wavelengths which satisfy . In reality, it is not easy to find two wavelengths exactly satisfy this assumption. Besides, even though this assumption is not satisfied, wavelength attack can also be settled successfully. Here, we just make this simplified assumption for intuitional illustration. Similar results can be achieved even if without this assumption by further calculation. Then, equation (5) turns into 6

To cover her presence, Eve should guarantee that the QBER value is lower than the maximal tolerable error rate. Therefore, should be larger than a certain value. Here, we calculate the maximal tolerable error rate by employing the security analysis in Ref. [44]. The secret key rates for different dimensions are given by , where When error rate e reaches the maximal tolerable value, the secret key rate reaches 0. As illustrated in Fig. 7, we can figure out that for different dimensions, the requirements for differ. For two-dimensional QKD system, for the sake of hiding Eveʼs attack, the coupling ratio should be larger than 0.78. With increasing the dimension d, the requirement for decreases. When d reaches 16, this requirement is only 0.6917. When d approaches infinity, the maximal tolerable QBER is 50% which corresponds to the value of 0.5, then the QKD system will be entirely insecure. Therefore, we can infer that higher-dimensional QKD system is more vulnerable to wavelength attack. Although HD-QKD is more robust against channel noise, it is sensitive to wavelength attack.

Fig. 7.

	Figure Option ViewDownloadNew Window
	Fig. 7. The relationship between the requirement for coupling ratio and QBER. Full lines represent relationships between coupling ratio and QBER while dotted lines denote secret key rates in infinite-key scenario. Colors red, yellow, blue, and purple correspond to dimensions d = 2, 4, 8, and 16, respectively.

Last but not least, we would mention the resistance of QKD systems with different basis choice methods towards wavelength attack. We again take four-dimensional time-bin HD-QKD system mentioned above for example. This system adopts biased basis choice,^[45] i.e., the preparation probabilities of two bases are unequal. Here biased ratio (defined as , , and are preparation probabilities) and coupling ratio are both selected as 0.90. As shown in Eq. (2) and Fig. 3, the QBER introduced by wavelength attack is no more than 13.5%. Even though Eve performs a simple intercept-and-resend attack, and are both 0.90. Substituting into Eq. (2), we find that the QBER is just 13.5%, still less than the maximal tolerable QBER value. Therefore, Eveʼs presence is hard to detect. Then, we consider unbiased basis choice , the QBER becomes according to Eq. (4). Thus, the maximal QBER when Eve performs wavelength attack is 37.5% ( is a little more than 0.50 and is a little less than 0.50), much more than security threshold value (18.9(%). If so, Alice and Bob can realize Eveʼs attacking behavior. By comparison, we can find that systems with biased basis choice are more vulnerable to wavelength attack, although biased basis choice is conducive to generate more secret key. By calculation, our analysis results apply to any dimension.

In summary, we successfully carry out wavelength attack towards time-bin high-dimensional QKD system by utilizing the imperfection of fiber beam splitter. The eavesdropper Eve can obtain secret key information without increasing the quantum bit error rate. Our results also demonstrate that wavelength attack is a universal attacking strategy towards arbitrary d-dimensional QKD systems. Furthermore, we demonstrate that higher-dimensional QKD system is more vulnerable to wavelength attack. Meanwhile, we should also note that this type of attacking protocol can be avoided by applying actively modulated QKD systems. Measurement-device-independent QKD (MDI-QKD) is also immune to wavelength attack.