Faking photon number on a transition-edge sensor

TL;DR

This paper reveals security vulnerabilities in superconducting transition-edge sensors, demonstrating how an adversary can fake photon counts and blind the detector, potentially compromising quantum key distribution systems.

Contribution

It experimentally and theoretically shows how to manipulate a transition-edge sensor to fake photon numbers and blind it, exposing security flaws in quantum communication.

Findings

Adversaries can fake photon number results using longer wavelength photons.

Bright light can blind the detector, enabling controlled fake detections.

The attack can be used to steal keys in quantum key distribution systems.

Abstract

We study potential security vulnerabilities of a single-photon detector based on superconducting transition-edge sensor. In a simple experiment, we show that an adversary could fake a photon number result at a certain wavelength by sending a larger number of photons at a longer wavelength. In another experiment, we show that the detector can be blinded by bright continuous-wave light and then, a controlled response simulating single-photon detection can be produced by applying a bright light pulse. We model an intercept-and-resend attack on a quantum key distribution system that exploits the latter vulnerability and, under certain assumptions, succeeds to steal the key.