Light-injection attack against practical continuous-variable measurement-device-independent quantum key distribution systems.

Continuous-variable measurement-device-independent quantum key distribution (CV-MDI QKD) can defend all detection-side attacks effectively. Therefore, the source side is the final battlefield for performing quantum hacking attacks. This paper investigates the practical security of a CV-MDI QKD system under a light-injection attack. Here, we first describe two different light-injection attacks, i.e., the induced-photorefractive attack and the strong-power injection attack. Then, we consider three attack cases where Eve only attacks one of the parties or both parties of the CV-MDI QKD system. Based on the analysis of the parameter estimation, we find that the legitimate communication parties will overestimate the secret key rate of the system under the effect of a light-injection attack. This opens a security loophole for Eve to successfully obtain secret key information in a practical CV-MDI QKD system. In particular, compared to the laser-damage attack, the above attacks use a lower power of injected light and have a more serious effect on the security of the system. To eliminate the above effects, we can enhance the practical security of the system by doping the lithium niobate material with various impurities or by using protective devices, such as optical isolators, circulators, optical power limiters, and narrow-band filters. Apart from these, we can also use an intensity monitor or a photodetector to detect the light-injection attack.