Micius, the world’s first quantum communication satellite, was hackable

The decoy-state BB84 protocol for quantum key distribution (QKD) is used on Micius, the world’s first satellite for quantum communications. The method of decoy states can detect photon-number-splitting eavesdropping and thus enables, in theory, secure QKD using weak coherent pulses over long distances with high channel loss inherent in satellite communication systems. However, it is widely known that realistic QKD devices can be vulnerable to various types of side-channel attacks that rely on flaws in experimental implementation. In most free-space QKD systems, including that on board Micius, multiple semiconductor lasers with passive optics are utilized to randomly generate polarization states. Optical pulses from independent laser diodes can to some extent differ in their temporal, spectral, and/or spatial distribution, and the quantum states can thus be distinguishable. Such distinguishability of photons in additional non-operational degrees of freedom compromises unconditional security of QKD since an eavesdropper can exploit this loophole to improve their attack strategy. The author carried out a thorough analysis of the experimental data obtained during multiple communication sessions between Micius and one of the ground stations designed specifically for it. Relative time delays between all the eight laser diodes on board have been found. The typical desynchronization between the lasers exceeds 100 ps, which is comparable with their pulse duration of 200 ps. The largest time delay was observed between signal and decoy states for vertically polarized photons and is about 300 ps. With such mismatch in timing, a potential attacker using as perfect equipment as possible unless it violates the laws of physics was shown to be capable of distinguishing decoy states from signal ones in at least 98.7% of cases. It offers great potential for hacking since one of the assumptions that the security of the decoy-state protocol is based on is that intensity levels selected for transmission of qubits are not known in advance. Based on a prior theoretical study, where a photon number splitting attack strategy that leverages the benefits of distinguishable decoy states is proposed, the author shows that distribution of quantum keys from Micius was insecure.