Photon-Number-Splitting Attacks on BB84

June 16, 2026

Photon-Number-Splitting Attacks on a Noisy BB84 Channel

A computational quantum-cryptography project that models the Photon-Number-Splitting (PNS) attack on a practical BB84 link built from weak coherent pulses. It quantifies exactly how much of the key an eavesdropper can steal through multiphoton emissions, and finds the secrecy-capacity threshold: the fibre length and source intensity at which the distillable secret key vanishes.

Overview

The BB84 protocol is provably secure — if Alice owns a perfect single-photon source. Real transmitters do not. They use a laser attenuated to the single-photon level, and the number of photons in each pulse follows Poisson statistics. A stubborn fraction of pulses therefore carries two or more photons, and that is a gift to an eavesdropper.

This project simulates the attack that exploits exactly that gift. It covers:

1. Weak-coherent-pulse (WCP) photon statistics — the Poissonian source and its multiphoton tail.
2. A lossy, noisy channel model — fibre attenuation, detector efficiency, dark counts, and misalignment error.
3. The PNS eavesdropper — how much of the sifted key Eve learns with certainty and without introducing errors.
4. The GLLP secret-key rate — where secure communication survives, where it dies, and how decoy states rescue it.

Everything is benchmarked against a pulse-by-pulse Monte-Carlo simulation of the photon transport.

Physical Background

Weak coherent pulses

An attenuated laser emits a coherent state $|\alpha\rangle$ whose photon number $n$ is Poisson-distributed with mean $\mu = |\alpha|^2$:

$P(n \mid \mu) = \frac{\mu^n e^{-\mu}}{n!}$

Three regimes matter, and the third is the whole story:

The channel

The single-photon transmittance combines fibre attenuation with detector efficiency:

$\eta(L) = 10^{-\alpha L/10}\,\eta_d$

An $n$-photon pulse survives with probability $\eta_n = 1-(1-\eta)^n$, so its yield (including background/dark counts $Y_0$) is $Y_n = Y_0 + (1-Y_0)\,\eta_n$. Averaging over the Poisson distribution gives the closed-form gain and QBER that Bob actually measures:

$Q_\mu = Y_0 + (1-Y_0)\left(1-e^{-\eta\mu}\right)$

$E_\mu Q_\mu = e_0 Y_0 + e_{\text{det}}(1-Y_0)\left(1-e^{-\eta\mu}\right)$

where $e_{\text{det}} = 1.5\%$ is the intrinsic misalignment error and $e_0 = 1/2$ is the error of a random dark count.

What the eavesdropper learns

The only provably private resource is the single-photon detections. In the worst case Eve keeps a perfect copy of every multiphoton bit, so the fraction of the sifted key she knows for free — the tagged fraction — is

$\Delta = \min\!\left(1,\ \frac{p_{\text{multi}}}{Q_\mu}\right),\qquad p_{\text{multi}} = 1-e^{-\mu}(1+\mu)$

The provably single-photon gain and its error rate are then bounded by

$Q_1 \ge Q_\mu - p_{\text{multi}} = (1-\Delta)Q_\mu, \qquad e_1 \le \min\!\left(\tfrac12,\ \frac{E_\mu}{1-\Delta}\right)$

When $p_{\text{multi}} \ge Q_\mu$ (that is, $\Delta = 1$), Eve can forward only multiphoton pulses while still faking the expected count rate — she knows the entire key and no secrecy remains.

The secret-key rate (GLLP)

The distillable rate follows the Gottesman–Lo–Lütkenhaus–Preskill bound:

$R \ge q\left\{-Q_\mu\, f\, H_2(E_\mu) + Q_1\left[1 - H_2(e_1)\right]\right\}$

with $q = 1/2$ (four-state sifting), $f = 1.16$ (error-correction inefficiency), and $H_2$ the binary entropy. The first term is the price of error correction; the second is the privately amplifiable single-photon yield. The secrecy threshold is where $R = 0$.

Project Structure

simulation/
├── qkd_pns/
│   ├── entropy.py       # binary Shannon entropy H2(x)
│   ├── source.py        # WCP Poisson photon statistics
│   ├── channel.py       # lossy + noisy channel: yields, gain Q_mu, QBER E_mu
│   ├── pns_attack.py    # PNS eavesdropper: tagged fraction Δ, Q1/e1 bounds
│   ├── keyrate.py       # GLLP rate, decoy vs PNS, optimal μ, thresholds
│   └── montecarlo.py    # pulse-by-pulse validation of the analytic model
└── run_simulation.py    # reproduces all figures + summary.json

Run with:

cd simulation
pip install -r requirements.txt
python run_simulation.py

Default parameters (telecom fibre): $\alpha = 0.2$ dB/km, $\eta_d = 0.10$, $Y_0 = 10^{-5}$, $e_{\text{det}} = 1.5\%$, $e_0 = 0.5$, $f = 1.16$, $q = 0.5$.

Results

1. Validating the channel model

A 1.5-million-pulse Monte-Carlo (markers) samples $n\sim\text{Poisson}(\mu)$, transmits each photon independently as $\text{Binomial}(n,\eta)$, fires dark counts, and assigns errors. The gain tracks the analytic curve to within about 1% across the full range. The QBER matches at short distance but scatters at long distance (more on this below).

2. Photon statistics and the leaked fraction

The multiphoton term $P(n\ge2)\approx \mu^2/2$ grows quadratically with intensity — this is the resource Eve harvests. On the right, the tagged fraction $\Delta$ rises with distance (because $Q_\mu\propto\eta$ shrinks while $p_{\text{multi}}$ is fixed by $\mu$), reaching 1 sooner for larger $\mu$. This is the fundamental tension: turning up $\mu$ buys raw key rate but hands Eve quadratically more information.

3. Secure range and optimal intensity

Each fixed-distance curve has a sharp interior optimum: too little intensity is swamped by dark counts, too much floods Eve with multiphoton pulses. The optimum drifts to smaller $\mu$ with distance — the known scaling $\mu_{\text{opt}}\propto\eta$, which degrades the achievable rate from $O(\eta)$ to $O(\eta^2)$.

The secrecy map of $\log_{10} R_{\text{PNS}}$ over the $(L,\mu)$ plane. The red contour is the zero-key threshold; secure operation is confined to a small island of short distance and low intensity.

Headline numbers (from summary.json):

Key Results

• The WCP side channel is real and irreducible. Multiphoton pulses ($P(n\ge2)\approx\mu^2/2$) are baked into any Poissonian source and form a lossless channel Eve needs only a QND photon-number measurement, a quantum memory, and a better fibre to exploit.
• The leakage is quantifiable. The tagged fraction $\Delta = p_{\text{multi}}/Q_\mu$ gives the bits-per-sifted-bit Eve learns with certainty.
• PNS slashes the secure range. With these telecom parameters, non-decoy BB84 dies at ≈ 11.5 km at a naive fixed $\mu = 0.1$, and only reaches ≈ 47 km even when $\mu$ is re-optimised at every distance.
• Decoy states restore it. Using the true single-photon parameters recoverable with decoy states pushes the secure range beyond 120 km — the gap between the two curves in Figure 3 is the throughput sacrificed to the vulnerability, and it is exactly why decoy states are standard in every modern QKD deployment.

References

1. C. H. Bennett and G. Brassard, “Quantum cryptography: Public key distribution and coin tossing,” Proc. IEEE Int. Conf. Computers, Systems and Signal Processing (Bangalore, 1984), pp. 175–179; reprinted in Theor. Comput. Sci. 560, 7–11 (2014).
2. B. Huttner, N. Imoto, N. Gisin, and T. Mor, “Quantum cryptography with coherent states,” Phys. Rev. A 51, 1863 (1995).
3. G. Brassard, N. Lütkenhaus, T. Mor, and B. C. Sanders, “Limitations on practical quantum cryptography,” Phys. Rev. Lett. 85, 1330 (2000).
4. N. Lütkenhaus, “Security against individual attacks for realistic quantum key distribution,” Phys. Rev. A 61, 052304 (2000).
5. D. Gottesman, H.-K. Lo, N. Lütkenhaus, and J. Preskill, “Security of quantum key distribution with imperfect devices,” Quantum Inf. Comput. 4(5), 325 (2004).
6. W.-Y. Hwang, Phys. Rev. Lett. 91, 057901 (2003); H.-K. Lo, X. Ma, K. Chen, “Decoy state quantum key distribution,” Phys. Rev. Lett. 94, 230504 (2005); X.-B. Wang, “Beating the photon-number-splitting attack in practical quantum cryptography,” Phys. Rev. Lett. 94, 230503 (2005).
7. X. Ma, B. Qi, Y. Zhao, and H.-K. Lo, “Practical decoy state for quantum key distribution,” Phys. Rev. A 72, 012326 (2005).
8. V. Scarani et al., “The security of practical quantum key distribution,” Rev. Mod. Phys. 81, 1301 (2009).
9. N. Gisin, G. Ribordy, W. Tittel, and H. Zbinden, “Quantum cryptography,” Rev. Mod. Phys. 74, 145 (2002).