A Prototype QKD Box Leaked State-Dependent Radio Signals at 3 Metres
Researchers detected distinct RF patterns from four generated quantum states outside an unshielded prototype. A closed rack cut the measured leakage by 21.2 dB on average.
Quantum key distribution is designed to reveal eavesdropping on the quantum channel. A new hardware study shows why that promise does not remove the need to secure the electronics around it: one prototype transmitter radiated radio-frequency patterns that changed with the quantum state it was preparing.[1][2]
The researchers tested a time-bin decoy-state BB84 device inside an anechoic chamber. Its transmitter prepared four states, labelled Y0, Y1, Z0 and Z1, while antennas measured emissions beside the rack and three metres away. The receiver contributed less radiation; the transmitter dominated because its state-generation electronics used large, high-frequency modulation signals.[1]
The clearest differences appeared near the third harmonic of the transmitter's 1241.6 MHz clock, about 3.725 GHz. The four states produced distinguishable spectra and time-domain waveforms, and the Z-basis signals were larger than the Y-basis signals. That is a warning sign: information meant for an optical quantum channel was leaving through an ordinary electromagnetic side channel.[1]
A preliminary classifier makes the warning more concrete. Using PCA and linear discriminant analysis on continuous transmissions of one state at a time, the team reported per-state identification accuracies of 72.7%, 76.7%, 75.8% and 52.2%. That setup was easier than practical random traffic, and the study did not recover secret key bits or report an end-to-end attack success rate.[1]
The mitigation result is just as important as the leak. Closing the shielding rack reduced selected peaks by 12.7 to 36.6 dB, averaging 21.2 dB. Signals other than the clock component fell below minus 100 dBm in the reported setup. The experiment therefore points to a fixable implementation problem rather than a failure of the underlying QKD protocol.[1]
Decoy-state QKD was developed to make practical weak-pulse systems more robust against photon-number-splitting attacks on the optical channel. That protection and the new radio-frequency finding address different layers. A mathematically sound protocol still depends on transmitters, modulators, racks and operating procedures that do not reveal useful state information by another route.[1][2]
For operators, the useful checklist is physical: suppress emissions at the circuit, contain what remains with shielding, and make any residual signal independent of the encoded state. The paper also suggests symmetric drive schemes and uncorrelated electromagnetic masking, but says combinations of countermeasures and standards are needed to verify that they work.[1]
The next test is an adversarial one: move beyond continuous single-state transmissions and measure how accurately a model can infer previously unseen random states or key material at realistic distances and noise levels. Until that happens, the study establishes detectable state dependence, preliminary classification and a measurable shielding benefit—not a completed break of QKD.[1]