Photon-Number-Splitting Attack

Every clean proof that quantum key distribution is secure begins with a lie of convenience: that Alice's source emits exactly one photon per signal. One photon carries one qubit, the no-cloning theorem forbids Eve from copying it, and any attempt to learn the bit disturbs it — so eavesdropping announces itself as errors. Real transmitters do not oblige. The workhorse source is a laser pulse attenuated to a mean photon number $\mu\sim0.1$ , and the photon count in such a pulse is Poisson-distributed, $p(n)=e^{-\mu}\mu^n/n!$ . A small but nonzero fraction of pulses therefore contain two or more photons — and, crucially, all in the same polarization or phase state. Those extra photons are flawless, undisturbing clones of the encoded qubit, handed to the channel by the source itself. The photon-number-splitting (PNS) attack turns this hardware leak into a total break on lossy channels. Eve, equipped with the tools of an ideal quantum optician, performs a quantum non-demolition measurement of photon number $n$ without touching the encoded state, blocks every single-photon pulse, and for each multi-photon pulse skims one photon into a quantum memory while forwarding the rest to Bob over a lossless line of her own. She only ever sends Bob states identical to Alice's, so she induces zero quantum bit error rate. After the public basis reconciliation she measures her stored photons in the now-known basis and reads those key bits exactly. The decisive question is bookkeeping: can Eve reproduce Bob's expected click rate? On a channel of transmittance $\eta$ Bob expects about $\mu\eta$ clicks per pulse. If the multi-photon fraction exceeds that rate, Eve supplies every click from split pulses while suppressing all single-photon pulses — and learns the entire sifted key. Security therefore rests only on single-photon detections, which is exactly what decoy-state QKD lets Alice and Bob measure.

Key takeaways

Practical QKD sources are attenuated lasers whose photon number is Poisson-distributed, so a fraction $p_{\text{multi}}=1-e^{-\mu}(1+\mu)$ of pulses carry two or more identically prepared photons.
Eve mounts the PNS attack: a quantum non-demolition count of $n$ , deterministic blocking of single-photon pulses, and beam-splitting of multi-photon pulses — storing one copy, forwarding the rest losslessly.
After basis reveal she measures her stored photon in the correct basis, learning the key bit with zero induced QBER — the disturbance-free signature that defeats the naive BB84 security argument.
The attack is catastrophic on lossy links: once $\eta\lesssim\mu/2$ (about 13 dB at $\mu=0.1$ ), Eve covers every click Bob expects and the sifted key is fully compromised.
Secure key can be distilled only from the single-photon gain $Q_1$ and its error $e_1$ via the GLLP / Devetak–Winter rate — never from the raw gain $Q_\mu$ .
Countermeasures: true single-photon sources, the SARG04 encoding, and above all decoy-state QKD, which pins down $Y_1$ by varying $\mu$ .
Key idea: a weak coherent pulse occasionally contains multiple identical photons; Eve skims one copy into memory and forwards the rest, learning the bit after basis reveal without raising the error rate, so security must be based only on the single-photon contribution — which decoy states let you estimate.

The core insight

A weak coherent pulse occasionally contains multiple identically prepared photons; Eve can losslessly skim one copy into quantum memory and forward the rest, learning the key bit after basis reveal without raising the error rate. Security must therefore be based only on the single-photon contribution, which decoy states let you estimate.

Where this lives today

PNS is no longer a theoretical worry — it is the design constraint that shaped every deployed QKD system. Decoy-state BB84 is now the de facto standard: Alice interleaves signal and decoy intensities pulse by pulse, and the consistency check on photon-number-resolved yields certifies $Y_1$ tightly enough to run secure links over hundreds of kilometres of fibre. The 2016–2017 Micius satellite experiments distributed keys over 1,200 km free-space links using exactly this decoy-state protocol precisely because a bare weak-coherent scheme would have been wide open to PNS at those loss budgets. Commercial systems from ID Quantique and Toshiba ship decoy-state modulation as standard, and metropolitan QKD networks in Beijing, Vienna, and Tokyo rely on it. The frontier has moved on to protocols that sidestep the source problem entirely — measurement-device-independent QKD, which closes detector side channels while still using decoy states for the source, and twin-field QKD, which beats the repeaterless rate-loss bound — but all of them inherit the same lesson PNS taught: trust only the single-photon component, and prove it. In parallel, PNS sets the engineering target for genuine single-photon sources: the second-order correlation $g^{(2)}(0)$ of quantum-dot and diamond-colour-centre emitters must be pushed well below the channel transmittance before the attack loses its bite, a benchmark that drives ongoing device development for both QKD and photonic quantum computing.

The physical picture

Think of the source as a leaky photocopier of secrets. Most of the time it produces a single classified document — one photon — that cannot be copied without smudging it, and that smudge is no-cloning protecting you. But every so often it spits out two or three identical copies. Eve quietly pockets one, lets the rest pass, and reads it later when Alice publicly announces which language — which basis — it was written in. No smudge appears anywhere along the way, so nothing flags the theft. The first figure lays out the mechanism and the numbers: at $\mu=0.1$ the single-photon pulses Eve throws away are twenty times more common than the multi-photon pulses she plunders, yet on a lossy channel the few she plunders are all she needs.

Figure

The PNS attack at μ = 0.1: single-photon pulses (p₁ ≈ 0.0905) are blocked, while multi-photon pulses (p₂ ≈ 0.0045) pass a quantum non-demolition count, are split at a beamsplitter with one photon stored in quantum memory, and the rest forwarded to Bob over Eve's lossless line — inducing zero QBER

The crucial resource is loss. A real channel already discards most photons, so Bob expects very few clicks to begin with. Eve replaces the honest lossy channel with a perfect one and uses her hoard of multi-photon pulses to manufacture exactly the click rate Bob would have seen anyway, dumping the single-photon pulses she could never have copied. The honest loss budget is precisely what hides her: she "pays for" the photons Bob would have lost by suppressing the pulses she could not exploit. The whole attack lives or dies on one inequality — whether the multi-photon fraction is at least as large as the honest signal rate. The second figure draws that crossover with real numbers.

Figure

The break condition at μ = 0.1: the honest gain ≈ μη (blue) climbs linearly with channel transmittance, while the multi-photon fraction ≈ μ²/2 = 0.005 (amber) is flat; they cross at η = μ/2 = 0.05, about 13 dB of loss, and below that transmittance Eve can supply every click Bob expects from split pulses and learn the whole sifted key

Because Eve's operation depends only on the photon number $n$ and is otherwise identical for every signal state, the per-photon-number yields $Y_n$ are constants she cannot fake differently for different intensities. That is the chink decoy states pry open: change $\mu$ and the only thing that moves is the Poisson weighting of fixed $Y_n$ , so an attack that selectively blocks $n=1$ betrays itself as a tell-tale nonlinear gain-versus- $\mu$ curve. The broader lesson is that QKD security is a statement about a model of your devices. Replace "single photon" with "Poissonian weak pulse" and the abstract proof no longer applies — you must prove security for the actual emitted state, conceding every multi-photon detection to Eve as the worst case.

The core equations

Everything starts with the photon statistics of the source. A phase-stabilized laser attenuated to mean photon number $\mu$ emits a coherent state, and the probability of finding exactly $n$ photons in a pulse is Poissonian. This single distribution is the entire attack surface.

p(n)=e^{-\mu}\,\frac{\mu^{n}}{n!} \qquad (1)

where: $n$ — number of photons in a given pulse; $\mu$ — mean photon number per pulse, equal to the coherent-state intensity $|\alpha|^2$ ; $p(n)$ — probability the pulse contains exactly $n$ photons. Reading: the vacuum term $p(0)=e^{-\mu}$ dominates, single photons scale as $\mu$ , and multi-photon pulses as $\mu^2$ and higher — the small tail Eve exploits. The quantity that decides the attack is how often a pulse carries a spare photon. Subtracting the vacuum and single-photon terms leaves the multi-photon fraction, the raw supply of copies available to Eve.

p_{\mathrm{multi}} = 1 - p(0) - p(1) = 1 - e^{-\mu}(1+\mu) \approx \tfrac{\mu^2}{2} \qquad (2)

where: $p_{\mathrm{multi}}$ — probability a pulse carries $\ge 2$ photons, the resource Eve skims; $p(0),p(1)$ — the vacuum and single-photon probabilities. Reading: for weak pulses this is second order in $\mu$ , so shrinking $\mu$ suppresses PNS quadratically while only linearly reducing the key rate. What actually leaves Alice for a symbol $x$ is not a qubit but a mixture over photon number, and every photon in a given pulse sits in the same one-photon state — the fact that makes the copies useful.

\rho_{\text{sent}} = \sum_{n=0}^{\infty} p(n)\,\big(|\psi_x\rangle\!\langle\psi_x|\big)^{\otimes n} \qquad (3)

where: $|\psi_x\rangle$ — the single-photon polarization or phase state encoding symbol $x$ ; $|\psi_x\rangle^{\otimes n}$ — $n$ identical copies of that state; $\rho_{\text{sent}}$ — the mixed state Alice really emits, diagonal in photon number. Reading: the photon-number degree of freedom is a public side channel that leaks the number $n$ without leaking $x$ . Eve reads that side channel with a quantum non-demolition (QND) measurement. The total photon-number operator commutes with the encoding, so measuring $n$ leaves $|\psi_x\rangle$ perfectly intact.

\hat{N}\,|\psi_x\rangle^{\otimes n} = n\,|\psi_x\rangle^{\otimes n} \qquad (4)

where: $\hat{N}$ — total photon-number operator Eve measures non-demolitionally; $n$ — the measured eigenvalue, revealed to Eve. Reading: because $[\hat N,\,\text{encoding}]=0$ , learning $n$ costs Eve nothing in disturbance — no error is imprinted on the state Bob receives. Bob's observable statistics are a Poisson average of photon-number-resolved yields and errors. This decomposition is the master identity for both the attack and its cure.

Q_\mu = \sum_{n=0}^{\infty} p(n)\,Y_n, \qquad E_\mu Q_\mu = \sum_{n=0}^{\infty} p(n)\,Y_n\,e_n \qquad (5)

where: $Q_\mu$ — overall gain, the probability Bob registers a detection per pulse at intensity $\mu$ ; $Y_n$ — yield, the conditional detection probability given $n$ photons were sent; $e_n$ — error rate of the $n$ -photon component; $E_\mu$ — the overall measured QBER. Reading: Eve's strategy fixes the set $\{Y_n,e_n\}$ ; only the Poisson weights $p(n)$ change when Alice varies $\mu$ . On an honest lossy channel of transmittance $\eta$ , an $n$ -photon pulse clicks unless every photon is lost, and summing over Poisson statistics collapses to a clean closed form.

Y_n^{\text{honest}} = 1-(1-\eta)^n \approx n\eta, \qquad Q_\mu^{\text{honest}} = 1-e^{-\mu\eta} \approx \mu\eta \qquad (6)

where: $\eta$ — combined channel-plus-detector transmittance; $1-(1-\eta)^n$ — probability at least one of $n$ independent photons survives; $Q_\mu^{\text{honest}}$ — expected gain with no eavesdropper, linear in $\mu$ for $\mu\eta\ll1$ . Reading: this linear-in- $\mu$ gain is the click budget Eve must reproduce, and its comparison with $p_{\mathrm{multi}}\approx\mu^2/2$ sets the break condition. Finally, the secure key rate concedes all multi-photon and background clicks to Eve and keeps only the single-photon contribution — the GLLP / Devetak–Winter bound.

R \ge q\big\{ Q_1\big[1-h(e_1)\big] - Q_\mu\, f(E_\mu)\,h(E_\mu) \big\},\qquad h(x)=-x\log_2 x-(1-x)\log_2(1-x) \qquad (7)

where: $R$ — secret key rate per pulse; $q$ — sifting efficiency ( $\tfrac12$ for symmetric BB84); $Q_1$ — single-photon gain, the only portion presumed secure; $e_1$ — single-photon error rate; $f(E_\mu)\ge1$ — reconciliation inefficiency; $h(x)$ — binary Shannon entropy. Reading: positive key demands that the single-photon secure fraction $Q_1[1-h(e_1)]$ beat the error-correction cost $Q_\mu f h(E_\mu)$ — impossible in the deep-loss PNS regime unless $Q_1$ can be certified, which is decoy states' job.

Derivation AThe photon-number-splitting break condition

The goal is to show precisely when channel loss is severe enough that Eve can learn the entire sifted key with no induced errors. We compare the click rate Bob honestly expects against the supply of multi-photon pulses Eve can exploit, and derive the transmittance threshold below which Eve's supply covers every one of Bob's detections. Eve's strategy is fixed: QND-measure each pulse's photon number $n$ ; block every $n=0$ and $n=1$ pulse; for each $n\ge2$ pulse split one photon into quantum memory and forward the remainder to Bob over a lossless line; finally throttle her forwarding so Bob's observed gain matches the honest expectation exactly.

Step 1. Compute the click budget Eve must reproduce. On the honest lossy channel Bob expects a gain $Q_\mu^{\text{honest}}\approx\mu\eta$ per pulse (equation 6, small- $\mu\eta$ limit). Why: Eve must hand Bob detections at this rate, or the drop in count rate would expose her as surely as any error would.

Step 2. Count Eve's available supply. She can only generate clicks from pulses she did not block — the multi-photon ones — and each of those delivers at least one photon to Bob with certainty over her lossless line. So her click supply is $p_{\mathrm{multi}}=1-e^{-\mu}(1+\mu)\approx\mu^2/2$ . Why: every forwarded pulse is a guaranteed click because Eve's line has no loss, unlike the honest channel that would have thinned it.

Step 3. Impose the matching condition. Eve covers every honest click when her supply meets or exceeds the budget: $\tfrac{\mu^2}{2}\ge\mu\eta$ , i.e. $\eta\le\mu/2$ . Why: this is a pure resource inequality — enough multi-photon pulses to fill Bob's demand — and it converts directly into a maximum tolerable transmittance, hence a maximum distance.

Step 4. Read off the information leak. Every click Bob records now originates from a multi-photon pulse of which Eve holds a stored copy; after the basis announcement she measures her copy in the correct basis and learns that bit exactly, with zero induced QBER. Effectively $Q_1\to0$ , so the GLLP rate (equation 7) gives $R\le0$ . Why: with no single-photon pulse reaching Bob, there is no unclonable contribution left to distill a secret from — the sifted key is wholly Eve's. *Verified: at $\mu=0.1$ the break sets in for $\eta\lesssim0.05$ , i.e. channel loss $\gtrsim-10\log_{10}(0.05)=13.0$ dB, consistent with the tens-of-kilometres fibre limit of non-decoy weak-coherent BB84.*

Go deeper · Derivation B · 2 minWhy only single-photon detections yield secure key

Derivation BWhy only single-photon detections yield secure key

The goal is to justify the central accounting rule behind equation 7 — that secret key may be extracted from the single-photon gain $Q_1$ alone — by tracking, pulse class by pulse class, exactly what Eve can learn in the worst case. We split Bob's observed gain into vacuum, single-photon, and multi-photon contributions, concede to Eve every contribution she can attack without disturbance, and assemble what remains into the Devetak–Winter rate. The argument is what makes GLLP a security proof rather than an optimistic estimate.

Step 1. Decompose the observed gain by photon number: $Q_\mu = Y_0\,p(0) + Y_1\,p(1) + \sum_{n\ge2} Y_n\,p(n)$ . Why: each term is a physically distinct pulse class with its own vulnerability, and lumping them together is exactly the error that overstates security.

Step 2. Concede the vacuum and multi-photon terms. Dark counts ( $n=0$ ) carry no signal Eve needs to respect, and every $n\ge2$ detection is one where Eve holds an undisturbed copy and learns the bit after basis reveal. Only $Q_1=Y_1\,p(1)=Y_1\,\mu e^{-\mu}$ is protected by no-cloning. Why: for multi-photon pulses the no-cloning theorem simply does not apply — the source already made the clone — so no privacy amplification can recover secrecy from them.

Step 3. Cost out the single-photon key. Eve's information about a single-photon bit with error rate $e_1$ is bounded by $h(e_1)$ through the phase-error / entropic-uncertainty argument, leaving $1-h(e_1)$ secure bits per single-photon click. Why: this is the standard privacy-amplification tax — the more Eve could have disturbed the qubit (higher $e_1$ ), the more must be hashed away.

Step 4. Subtract reconciliation. Error correction publicly reveals at least $h(E_\mu)$ bits per sifted bit, inflated by $f(E_\mu)\ge1$ for real codes, charged against the whole sifted key $Q_\mu$ . Assembling gives $R\ge q[Q_1(1-h(e_1)) - Q_\mu f h(E_\mu)]$ . Why: reconciliation runs over all detections, not just single-photon ones, so its cost scales with $Q_\mu$ while the yield scales only with $Q_1$ — the asymmetry that kills key rate under heavy loss. *Verified: setting $Q_1\to Q_\mu$ and $e_1\to E_\mu$ recovers the ideal single-photon BB84 rate $R\ge q\,Q_\mu[1-(1+f)h(E_\mu)]$ , the textbook limit — confirming the general formula degrades correctly to the perfect-source case.*

Go deeper · Derivation C · 1 minHow decoy states expose the attack

Derivation CHow decoy states expose the attack

The goal is to show that randomly varying the intensity $\mu$ turns Eve's own photon-number-selective strategy into a measurable inconsistency, letting Alice and Bob lower-bound the single-photon yield $Y_1$ and restore long-distance security. The key structural fact, established above, is that Eve cannot distinguish a signal pulse from a decoy pulse carrying the same photon number, so the yields $\{Y_n\}$ and errors $\{e_n\}$ are the same unknowns across all intensities. Sending several intensities then gives several independent equations in those fixed unknowns.

Step 1. Fix the unknowns across intensities. Because Eve acts only on $n$ , the same $Y_n$ appear in the gain at every intensity: $Q_\mu=\sum_n e^{-\mu}\tfrac{\mu^n}{n!}Y_n$ and $Q_\nu=\sum_n e^{-\nu}\tfrac{\nu^n}{n!}Y_n$ for a decoy $\nu<\mu$ . Why: this is the entire leverage of the method — one set of yields, many Poisson weightings, so the observed gains must be mutually consistent.

Step 2. Measure the background directly. Sending vacuum pulses ( $\mu=0$ ) reads off $Q_0=Y_0$ , the dark-count and stray-light yield, pinning the $n=0$ term. Why: removing $Y_0$ as an unknown tightens every subsequent bound and costs only a fraction of the pulses.

Step 3. Lower-bound the single-photon yield. Combining the signal and decoy gains with $Y_0$ known gives the two-decoy Lo–Ma–Chen bound $Y_1 \ge \tfrac{\mu}{\mu\nu-\nu^2}\big(Q_\nu e^{\nu}-Q_\mu e^{\mu}\tfrac{\nu^2}{\mu^2}-Y_0\tfrac{\mu^2-\nu^2}{\mu^2}\big)$ . Why: a selective attack that suppressed $n=1$ would drive $Y_1$ toward zero, which is flatly inconsistent with these equations — the attack cannot hide in the statistics.

Step 4. Restore the rate. A tight lower bound on $Y_1$ (hence $Q_1$ ) and an upper bound on $e_1$ make the GLLP rate (equation 7) positive over far greater distances, effectively neutralizing PNS with ordinary weak-coherent hardware. Why: with $Q_1$ certified rather than pessimistically guessed, the single-photon secure fraction can once again outrun the reconciliation cost. *Verified: in the limit of infinitely many decoy intensities the inequalities become equalities, recovering the exact $Y_n$ and the asymptotic single-photon BB84 performance — the known decoy-state result of Lo, Ma, and Chen.*

Limiting cases

How the attack's severity scales with the experimental knobs:

Case	Result	Meaning
Strong attenuation, $\mu\to0$	$p_{\mathrm{multi}}\approx\tfrac{\mu^2}{2}\ll\mu$	Multi-photon fraction is second order while the signal rate is first order, so very weak pulses are relatively safe — but the key rate falls with them. The basic pre-decoy mitigation.
High loss, $\eta\le\mu/2$	full PNS break, $R\le0$	Once transmittance drops below the multi-photon fraction, Eve supplies every click from split pulses and learns the whole sifted key with no errors — the maximum-distance limit of non-decoy BB84.
Ideal single-photon source	$p(n\ge2)=0$	With a true on-demand emitter there is nothing to split; security reverts to the clean no-cloning argument and PNS is irrelevant.
Decoy-state QKD	$R\ge q\{Q_1[1-h(e_1)]-Q_\mu f\,h(E_\mu)\}$ with $Q_1$ certified	Estimating $Q_1,e_1$ closes the loophole; secure distance returns to near the single-photon ideal because selective blocking can no longer hide.

Worked examples

1 · Where does a non-decoy link break? (fully worked)

A weak-coherent BB84 system runs at $\mu=0.1$ over standard telecom fibre with attenuation $0.2$ dB/km and negligible detector loss. Find the multi-photon fraction, the transmittance at which the full PNS break sets in, and the corresponding fibre length.

Step 1. Multi-photon supply. From equation 2, $p_{\mathrm{multi}}=1-e^{-0.1}(1.1)=1-0.904837\times1.1=1-0.995321=\mathbf{4.68\times10^{-3}}$ , matching the small- $\mu$ estimate $\mu^2/2=5.0\times10^{-3}$ to within a few percent. This is Eve's raw click supply per pulse.

Step 2. Break transmittance. The honest gain is $Q_\mu^{\text{honest}}\approx\mu\eta$ , and the break condition $p_{\mathrm{multi}}\ge\mu\eta$ gives $\eta\le p_{\mathrm{multi}}/\mu = 4.68\times10^{-3}/0.1=\mathbf{0.0468}$ , essentially the rule of thumb $\eta\le\mu/2=0.05$ . Below this transmittance Eve covers every click.

Step 3. Convert to loss and distance. In decibels, $-10\log_{10}(0.0468)=\mathbf{13.3\ dB}$ (or $13.0$ dB using the $\mu/2$ rule of thumb). At $0.2$ dB/km that is a fibre length of $L=13.3/0.2\approx\mathbf{67\ km}$ .

Step 4. Interpret. Beyond roughly $67$ km of fibre, an eavesdropper with QND capability and quantum memory can in principle read the entire sifted key of this non-decoy system without raising the error rate. The link is PNS-secure only out to about 67 km at μ = 0.1; decoy states are required to push further. Note the maximum secure distance improves only logarithmically if you lower $\mu$ , while the key rate falls linearly — which is exactly why brute-force attenuation is a poor fix and decoy states won the field.

2 · Reading the Poisson tail

For $\mu=0.5$ (a deliberately un-optimized intensity), what fraction of all pulses that contain any photons at all are multi-photon? Comment on why operators keep $\mu$ low.

Step 1. Non-empty pulses. The probability a pulse is non-empty is $1-p(0)=1-e^{-0.5}=1-0.6065=0.3935$ .

Step 2. Multi-photon fraction of the whole ensemble. $p_{\mathrm{multi}}=1-e^{-0.5}(1.5)=1-0.6065\times1.5=1-0.9098=0.0902$ .

Step 3. Conditional fraction. Among non-empty pulses, the multi-photon share is $0.0902/0.3935=\mathbf{0.229}$ — nearly one in four occupied pulses carries a spare photon for Eve. Compare $\mu=0.1$ , where the same ratio is $4.68\times10^{-3}/0.0952=\mathbf{0.049}$ , about one in twenty. Raising μ from 0.1 to 0.5 roughly quintuples the fraction of exploitable pulses, collapsing the tolerable loss budget and shortening the secure distance — the quantitative reason weak-coherent QKD runs at $\mu\sim0.1$ – $0.5$ and never at $\mu\gtrsim1$ .

Physics of the portrait

The photon-number-splitting attack is not the work of one mind but of a decade in which quantum cryptography grew up — from an elegant theorem about single photons to a hard-nosed engineering discipline about the states real lasers actually emit. If one figure sits at its centre it is Norbert Lütkenhaus, who more than anyone turned "is QKD secure?" into "is this device secure, against this attacker, at this loss?".

Origins · 1 minNorbert Lütkenhaus and how this was discovered

Norbert Lütkenhaus

practical QKD security theorist · Institute for Quantum Computing, Waterloo

Lütkenhaus is the theorist who insisted that a quantum-cryptographic security proof must be a statement about the hardware, not an idealization of it. Trained in the 1990s when BB84 was still proved secure only for perfect single-photon sources, he recognized that the attenuated lasers of every real experiment emit Poissonian light — and that the multi-photon pulses hand an eavesdropper undisturbing copies of the key. In a 1995 paper with Bernard Huttner, Nobuyuki Imoto, and Nicolas Gisin, the beam-splitting idea against coherent-state QKD was first laid out; five years later, with Gilles Brassard, Tal Mor, and Barry Sanders, Lütkenhaus sharpened it into the photon-number-splitting attack and derived the loss threshold beyond which non-decoy weak-coherent BB84 gives no secret key at all — the paper that named the problem and set the field's agenda. He then co-developed the GLLP framework (with Daniel Gottesman, Hoi-Kwong Lo, and John Preskill) that quantifies exactly how much key survives when only the single-photon component is trusted, providing the rate formula every practical analysis still uses. His larger contribution is a stance: attribute every imperfection you cannot rule out to the adversary, prove security for the state you truly send, and treat the gap between "no errors observed" and "no information leaked" as the thing an attacker lives in. That stance made decoy-state QKD, measurement-device-independent QKD, and the entire modern edifice of certified practical security possible.

History

1984

— Bennett and Brassard propose BB84, provably secure for a perfect single-photon source

1995

— Huttner, Imoto, Gisin, and Mor describe the beam-splitting attack on coherent-state QKD

2000

— Brassard, Lütkenhaus, Mor, and Sanders formalize the photon-number-splitting attack and its loss threshold

2003

— Hwang proposes the decoy-state method to defeat PNS

2005

— Lo, Ma, and Chen give practical decoy-state QKD, restoring near-ideal secure distance

Going further

Texts. Nielsen & Chuang, Quantum Computation and Quantum Information, 10th anniv. ed., Ch. 12 (quantum cryptography) · Preskill, Lecture Notes on Quantum Computation, Ch. 4 · Watrous, The Theory of Quantum Information, Ch. 3 (states and channels, for the QND and worst-case framing) · Gisin, Ribordy, Tittel, Zbinden, Quantum Cryptography, Rev. Mod. Phys. 74, 145 (2002) · Scarani et al., The security of practical quantum key distribution, Rev. Mod. Phys. 81, 1301 (2009).

Provenance. A verifier should: (1) confirm the coherent-state expansion and Poisson statistics $p(n)=e^{-\mu}\mu^n/n!$ against any quantum-optics text; (2) recompute the honest gain $Q_\mu=1-e^{-\mu\eta}$ from $Y_n=1-(1-\eta)^n$ ; (3) check the break condition $\eta\lesssim\mu/2$ from $p_{\mathrm{multi}}\approx\mu^2/2\ge\mu\eta$ , and the $13$ dB / $67$ km figures from $-10\log_{10}\eta$ at $0.2$ dB/km; (4) verify the GLLP rate against Scarani et al. RMP 2009 and Lo–Ma–Chen PRL 2005; (5) verify the decoy $Y_1$ bound against Lo, Ma, Chen, PRL 94, 230504 (2005). The attack itself is from Brassard, Lütkenhaus, Mor, Sanders, PRL 85, 1330 (2000), building on Huttner, Imoto, Gisin, Mor, PRA 51, 1863 (1995); the GLLP rate is Gottesman, Lo, Lütkenhaus, Preskill, Quant. Inf. Comput. 4, 325 (2004). No fabricated constants are used.

Prerequisites. BB84 Protocol · No-Cloning Theorem in Cryptography · Quantum Bit Error Rate and Sifting · Bell-State Measurement. Leads to. Decoy-State QKD · Six-State and SARG04 Protocols · Information Reconciliation and Privacy Amplification.

Ask the tutor: Ask me to walk through the break-condition inequality line by line, or to show exactly how varying the decoy intensity pins down the single-photon yield $Y_1$ .

If Eve induces no errors, how could Alice and Bob ever notice her?

On a bare weak-coherent link with no countermeasure, they largely cannot — that is precisely why PNS is dangerous. Eve's forwarded photons are genuine copies of Alice's states, so Bob's error statistics look exactly like an honest lossy channel. The only tell is a rate argument, not an error argument: if Alice varies her intensity, Eve's photon-number-selective attack cannot reproduce the correct gain at every $\mu$ simultaneously, because the yields $Y_n$ are fixed by her strategy. That inconsistency is what decoy states detect. Without decoy states, Alice and Bob have no in-band signature of the attack at all, which is why they must pessimistically assume it is happening and base security only on $Q_1$ .

Is a quantum non-demolition measurement of photon number actually realistic?

It is technologically demanding but not forbidden by physics, and security proofs must assume the adversary can do it. QND measurement of photon number has been demonstrated in cavity QED (microwave photons dispersively coupled to Rydberg atoms, the work recognized by the 2012 Nobel Prize) and in circuit QED. A fully lossless quantum memory and lossless channel are even harder, so today's real eavesdroppers cannot mount the ideal attack. But cryptographic security is a guarantee against future and best-case adversaries: if the only thing standing between Eve and your key is that QND detectors are currently inconvenient, the system is not secure. This is why the field moved to decoy states and single-photon sources rather than betting on Eve's hardware being poor.

Why not just use a true single-photon source and forget the whole problem?

Because "true single-photon source" is an engineering ideal that real emitters only approximate. On-demand sources such as semiconductor quantum dots and diamond nitrogen-vacancy centres still emit a residual multi-photon component, quantified by the second-order correlation $g^{(2)}(0)$ ; as long as $g^{(2)}(0)$ is not far below the channel transmittance, a reduced PNS attack remains possible. Such sources also have limited brightness, indistinguishability, and operating-temperature constraints. Decoy-state QKD, by contrast, achieves near-single-photon security using the same cheap attenuated laser everyone already has, which is why it — not exotic sources — became the deployed standard. Single-photon sources remain important for photonic quantum computing and for pushing QKD rates, but they did not have to solve PNS to make QKD practical.

How does SARG04 resist PNS without changing the hardware?

SARG04 uses the very same four BB84 states but changes the classical post-processing: instead of announcing a basis, Alice announces a pair of non-orthogonal states, one of which she sent. To decode a bit from a single split photon, Eve would have to distinguish two non-orthogonal states unambiguously — which she cannot do deterministically. So even when she holds a stored copy of a two-photon pulse, one photon is not always enough to fix the bit; she needs to split off two photons, meaning she can only fully exploit pulses with $n\ge3$ . That raises the multi-photon threshold and buys extra tolerable loss. SARG04 does not defeat PNS as completely as decoy states do, but it improves robustness for free on existing BB84 optics, which is its appeal.

Why is the key rate limited by Q₁ and not just reduced by some efficiency factor?

Because the multi-photon detections are not merely inefficient — they are fully compromised. For any pulse where Eve holds an undisturbed copy, no amount of privacy amplification can recover secrecy; she will learn that bit exactly after the basis reveal. So those detections contribute zero secure bits, not a fraction. The honest error-correction step, however, still runs over the entire sifted key including those multi-photon bits, so its cost scales with the full gain $Q_\mu$ . Secure key is therefore the single-photon yield $Q_1[1-h(e_1)]$ minus a reconciliation cost proportional to $Q_\mu$ — a difference, not a product. When loss is heavy enough that $Q_1$ shrinks below that cost, the difference goes negative and no key is possible.

Does PNS apply to entanglement-based protocols like E91 too?

The specific attack changes form because there is no bright coherent pulse to split, but the underlying lesson — that multi-photon or multi-pair emissions leak information — carries over. Entanglement sources based on spontaneous parametric down-conversion emit a Poisson-like distribution of photon pairs, and higher-order (multi-pair) emissions play a role analogous to multi-photon pulses, degrading security and requiring their own accounting. Measurement-device-independent QKD, which is entanglement-based in spirit, still uses weak coherent pulses with decoy states at the sources for exactly this reason. So while a textbook single-pair E91 is immune to PNS as described, no real photonic source is perfectly single-pair, and the same worst-case discipline applies.