Real single-photon sources barely exist, so QKD systems use weak coherent laser pulses: the photon number in each pulse follows a Poisson distribution with mean μ, P(n) = e−μμⁿ/n!. Some pulses carry 2+ photons — and an eavesdropper Eve can perform a photon-number-splitting (PNS) attack: block every single-photon pulse, but for a multi-photon pulse, keep one photon and forward the rest through a lossless channel, learning the key bit for free while the aggregate loss looks unremarkable.
Poisson source: P(n|μ) = e^-μ μⁿ / n!
Honest channel: Y(n) = p_dark + (1-p_dark)[1-(1-η)ⁿ]
η(L) = η_det · 10^(-0.2·L/10) (0.2 dB/km fiber)
The decoy-state method (Hwang 2003; Lo–Ma–Chen 2005) defeats this: Alice randomly sends pulses at a second, lower intensity ν as well as the signal intensity μ, mixed in and indistinguishable to Eve. Because a real, photon-number-independent channel would give the same per-photon yield Y(n) at both intensities, Alice and Bob can bound the single-photon yield Y₁ from the two measured overall yields Yμ and Yν:
Y₁ᴸ = μ/(μν−ν²) · [ Yν e^ν − Yμ e^μ (ν²/μ²) − ((μ²−ν²)/μ²)·Y₀ ]
Under an honest channel Y₁ᴸ tracks the true single-photon yield. Under a PNS attack, Eve forwards multi-photon pulses almost perfectly but starves single-photon pulses — since ν-pulses are mostly single-photon and μ-pulses are not, the two yields become inconsistent with any single photon-number-independent channel, and the formula collapses toward zero or negative. A negative or implausibly low Y₁ᴸ is the abort signal: Alice and Bob discard the key rather than trust a compromised channel.
- μ / ν sliders — signal and decoy mean photon numbers (kept ν < μ).
- Distance — sets the honest fiber transmittance η(L); longer links mean fewer detections even with no eavesdropper.
- Eve: PNS Attack — toggles the interception model at the midpoint node.
- Drag the beam line to pan, scroll (or pinch) to zoom.