Decoy-State BB84: Defeating Photon-Number-Splitting Attacks

Pulse Intensities

Signal μ (mean photons) 0.50

Decoy ν (mean photons) 0.10

Channel distance L 50 km

Decoy-State Statistics

Y_μ measured

—

Y_ν measured

—

Y₁ lower bound

—

Pulses sent

0 / 0

How it works

Real single-photon sources barely exist, so QKD systems use weak coherent laser pulses: the photon number in each pulse follows a Poisson distribution with mean μ, P(n) = e^−μμⁿ/n!. Some pulses carry 2+ photons — and an eavesdropper Eve can perform a photon-number-splitting (PNS) attack: block every single-photon pulse, but for a multi-photon pulse, keep one photon and forward the rest through a lossless channel, learning the key bit for free while the aggregate loss looks unremarkable.

Poisson source:  P(n|μ) = e^-μ μⁿ / n!
Honest channel:  Y(n) = p_dark + (1-p_dark)[1-(1-η)ⁿ]
η(L) = η_det · 10^(-0.2·L/10)   (0.2 dB/km fiber)

The decoy-state method (Hwang 2003; Lo–Ma–Chen 2005) defeats this: Alice randomly sends pulses at a second, lower intensity ν as well as the signal intensity μ, mixed in and indistinguishable to Eve. Because a real, photon-number-independent channel would give the same per-photon yield Y(n) at both intensities, Alice and Bob can bound the single-photon yield Y₁ from the two measured overall yields Yμ and Yν:

Y₁ᴸ = μ/(μν−ν²) · [ Yν e^ν − Yμ e^μ (ν²/μ²) − ((μ²−ν²)/μ²)·Y₀ ]

Under an honest channel Y₁ᴸ tracks the true single-photon yield. Under a PNS attack, Eve forwards multi-photon pulses almost perfectly but starves single-photon pulses — since ν-pulses are mostly single-photon and μ-pulses are not, the two yields become inconsistent with any single photon-number-independent channel, and the formula collapses toward zero or negative. A negative or implausibly low Y₁ᴸ is the abort signal: Alice and Bob discard the key rather than trust a compromised channel.

μ / ν sliders — signal and decoy mean photon numbers (kept ν < μ).
Distance — sets the honest fiber transmittance η(L); longer links mean fewer detections even with no eavesdropper.
Eve: PNS Attack — toggles the interception model at the midpoint node.

Signal pulse (μ) Decoy pulse (ν) Detected at Bob Blocked / intercepted

⚠ Couldn't load the 3D engineThree.js failed to load from the CDN. Check your connection and reload.