Measurement-device-independent QKD (MDI-QKD) is a quantum key distribution protocol that removes every detector side channel. It does this by handing all measurements to a relay in the middle that nobody has to trust. Alice and Bob only send light. A third party, who may be the eavesdropper, does the detecting, and the security proof still holds.
The protocol was a direct answer to a practical problem. QKD is often called provably secure, yet commercial systems were broken through their detectors. This article covers the attack that prompted MDI-QKD, how the protocol produces a key, the distance and network records it has set, and what it still leaves exposed.
The 2010 hack: how bright light took over commercial QKD detectors
In August 2010, Lars Lydersen, Carlos Wiechers, Christoffer Wittmann, Dominique Elser, Johannes Skaar and Vadim Makarov posted “Hacking commercial quantum cryptography systems by tailored bright illumination”. It was later published in Nature Photonics 4, 686–689 (2010). They showed that the detectors in two commercial QKD systems could be fully remote-controlled with specially shaped bright light.
The result was serious. An eavesdropper could obtain the entire secret key without being detected. The authors proposed an eavesdropping device built from off-the-shelf parts. They also argued that the weakness is likely present in most QKD systems that use avalanche photodiodes as detectors.
According to Redmond Magazine’s coverage at the time, the affected products were ID Quantique’s Clavis2 (id3110) and MagiQ’s QPN 5505. The attack did not break the mathematics of QKD. It broke the gap between the idealised devices in the security proof and the hardware actually built.
Why the detector is QKD’s weakest point
In prepare-and-measure protocols such as BB84, which we explain in detail here, Bob’s receiver has to detect single photons that arrive from a channel the attacker controls. Photon detectors are complex analogue devices. Their behaviour depends on timing, bias voltage, temperature and how much light hits them. Each of these is something an attacker can try to manipulate from the fibre.
The review of MDI-QKD by Feihu Xu, Marcos Curty, Bing Qi and Hoi-Kwong Lo is direct about this. It calls the measurement unit “arguably the most vulnerable part in QKD systems” and says Bob’s measurement system “can be considered as the Achilles heel of QKD implementations.”
There are two ways to respond. One is to patch each discovered side channel with countermeasures, which starts an open-ended cat-and-mouse game. The other is to redesign the protocol so the detector’s behaviour no longer matters to security. MDI-QKD takes the second route.
How the MDI-QKD protocol works: an untrusted Charlie in the middle
Hoi-Kwong Lo, Marcos Curty and Bing Qi introduced the scheme in “Measurement-device-independent quantum key distribution”. It was submitted to arXiv on 7 September 2011 and published in Phys. Rev. Lett. 108, 130503 (2012). Their central claim: “It not only removes all detector side channels, but also doubles the secure distance with conventional lasers.”
The setup has three parties:
- Alice and Bob are both transmitters. Neither one detects anything.
- Charlie sits between them and runs the only detectors in the system. He may be the eavesdropper, Eve.
- The public channel carries Charlie’s announcements and Alice and Bob’s basis comparison.
According to the full paper, Charlie’s detection system “can be arbitrarily flawed without compromising security.” Any attack on the detectors, including blinding, therefore gives the attacker nothing beyond what an untrusted measurement station already offers. The security proof covers that case. The authors say the proof was inspired by a “time reversed EPR-based” protocol proposed by Inamori.
Why not go fully device-independent?
Full device-independent QKD removes trust in every device, not only the detectors. The cost is steep. It requires near-unity detector efficiency, qubit amplifiers or quantum non-demolition photon counting. MDI-QKD needs none of these. Lo, Curty and Qi state that its key rate is “many orders of magnitude higher” than that of full device-independent QKD.
Bell state measurement and bit flipping, step by step
The protocol, as described by Lo, Curty and Qi, runs like this:
- Alice and Bob each prepare phase-randomised weak laser pulses in one of the four BB84 polarisation states. They use decoy states, as in practical BB84, to bound what an attacker can learn from multi-photon pulses.
- Both send their pulses to Charlie.
- Charlie performs a Bell state measurement. His setup can identify only two of the four Bell states, |ψ−⟩ and |ψ+⟩. A success is recorded when two detectors with orthogonal polarisations click.
- Charlie publicly announces which events succeeded and which of the two Bell states he obtained.
- Alice and Bob publicly compare bases and keep only the successful events in which they used the same basis.
- One of them flips their bit according to a fixed rule, and their bits now match.
The flip rules depend on the basis:
| Basis used by Alice and Bob | Charlie announces |ψ−⟩ | Charlie announces |ψ+⟩ | Role |
|---|---|---|---|
| Rectilinear | Flip | Flip | Key generation |
| Diagonal | Flip | No flip | Eavesdropping test |
Charlie’s announcement tells Alice and Bob how their bits relate to each other. It does not tell anyone what those bits are. Charlie learns whether the two bits were the same or different, but not their values. The rectilinear-basis events become the key. The diagonal-basis events are used to estimate the error rate and detect tampering.
Records: from about 200 km in theory to 404 km in fibre
In the original paper, Lo, Curty and Qi estimated that with the relay in the middle, the scheme “can tolerate a high optical loss of more than 40dB (i.e., 200km of optical fibers).” Their simulation assumed 14.5% detection efficiency at the relay, 0.2 dB/km fibre loss and 1.5% misalignment. The paper also reported a proof-of-concept that measured a Hong-Ou-Mandel dip of 0.534 ± 0.005 using two independent lasers. This matters because Charlie’s measurement only works if photons from two separate sources interfere.
In 2016, Hua-Lei Yin and colleagues, including Jian-Wei Pan, pushed this much further. Their paper, Phys. Rev. Lett. 117, 190501 (2016), tested MDI-QKD over 404 km of ultralow-loss fibre and 311 km of standard fibre using a four-intensity decoy method. The authors described it as a new distance record both for MDI-QKD and for all types of QKD at the time. They also said it reached a distance that BB84 could not reach with the same detectors, even with ideal single-photon sources.
The full results show the price of that distance:
| Fibre length | Result |
|---|---|
| 404 km (ultralow-loss) | 2,584-bit final key, about 3.2×10⁻⁴ bps, accumulated over roughly three months |
| 311 km (standard) | 3,135 bits over 336.6 hours, with 59.05 dB loss |
| 207 km | 9.55 bps |
The setup used superconducting nanowire single-photon detectors (SNSPDs) cooled to 2.05 K, with 66% and 64% efficiency. It ran on a 75 MHz clock and used a finite-key failure probability of 10⁻¹⁰. Lucamarini and colleagues later put the 404 km figure in more intuitive units: “1.16 bit/hour … in a measurement-device-independent configuration.” For how this compares with more recent long-distance QKD results, see our article on how far quantum key distribution can reach.
MDI-QKD networks: one untrusted relay shared by many users
Because all detectors sit at the relay, MDI-QKD fits a star topology well. Users only need transmitters, and the expensive cryogenic detectors are concentrated in one place that does not have to be trusted.
Yan-Lin Tang and colleagues demonstrated this in Hefei in “MDI-QKD over untrustful metropolitan network”, Phys. Rev. X 6, 011024 (2016). Three users across a 200 km² metro area connected to one untrusted central relay. According to the full paper:
- Links to the relay: User 1 at 17 km (5.1 dB), User 2 at 25 km (9.2 dB), User 3 at 30 km (8.1 dB).
- Detectors: only the relay had any, two SNSPDs at 2.1 K.
- Runtime: continuous operation for one week.
- Average session key rates: 17.1 bps (U1–U2), 6.4 bps (U1–U3) and 4.2 bps (U3–U2).
- Improvement: a key rate 10 times the previous result.
The architecture is appealing because the network operator runs the most delicate hardware but cannot read the keys. Users never need to trust the central node.
Gigahertz systems and the key-rate problem
The numbers above show MDI-QKD’s main practical weakness: low key rates. A two-photon interference measurement between independent sources needs precise matching of timing, wavelength and polarisation, and that adds complexity.
A 2021 Toshiba Cambridge paper by R. I. Woodward, Y. S. Lo, M. Pittaluga, M. Minder, T. K. Paraïso, M. Lucamarini, Z. L. Yuan and A. J. Shields addresses this directly. “Gigahertz MDI-QKD using directly modulated lasers” (npj Quantum Information 7, 58, 2021) notes that MDI-QKD has been held back by “implementation complexity and low secure key rates.”
Their system runs at a gigahertz clock with free-running lasers and needs no phase or polarisation modulators. It reached up to 8 bps at 54 dB channel loss and 2 kbps, finite-size, at 30 dB. The authors describe this as about an order of magnitude better than the previous state of the art. That is real progress, but kilobits per second is still slow next to classical key exchange.
What measurement-device-independent QKD does not protect
MDI-QKD closes the detector side channels completely. It does not close every side channel. The Xu, Curty, Qi and Lo review lists a “characterised source” as a requirement for MDI-QKD that device-independent QKD does not have. In the review’s words, “a key assumption in mdiQKD is that Alice’s and Bob’s sources can be trusted,” and “Alice and Bob need to know which states they send to Charles.”
In practice, this moves the trust boundary rather than removing it:
- Removed: every attack on the measurement apparatus, including blinding, timing and efficiency-mismatch attacks on detectors.
- Still assumed: that the transmitters prepare the states they are supposed to prepare and that their behaviour is well characterised.
- Only addressed by full device independence: trust in the sources as well, at a much lower key rate and with much stricter hardware requirements.
Where twin-field QKD fits
Twin-field QKD, introduced by Lucamarini and colleagues in Nature 557, 400–403 (2018), is a related scheme that also routes signals to a central measuring station. The authors write that its key rate scales the same way “irrespective of whom is in control of the measuring station.” It shares MDI-QKD’s idea of an untrusted middle node but uses a different measurement and should be understood as a separate protocol.
Should anyone deploying QKD care?
If you are evaluating QKD hardware, yes. The 2010 blinding attack showed that a security proof only covers the devices it models. A vendor whose architecture relies on trusted detectors is asking you to trust the component that researchers have described as the Achilles heel of the system. MDI-QKD removes that component from the trust model. The cost is more complex optics and, historically, lower key rates.
QKD of any kind still needs dedicated optical links and special hardware. That is one reason some national security agencies prefer software-based post-quantum cryptography, as covered in our piece on the NSA’s position on quantum key distribution. Hadamard takes that software route with BB84, an Ethereum Layer 2 named after the original QKD protocol. It does not use quantum hardware. Instead, its accounts rely on hash-based one-time addresses rather than ECDSA keys.
FAQ
Does MDI-QKD make quantum key distribution unhackable?
No. It removes all detector side channels, so attacks such as detector blinding no longer compromise the key. Alice’s and Bob’s sources must still be trusted and characterised, and attacks on the transmitters remain outside its protection.
What is the difference between MDI-QKD and device-independent QKD?
Full device-independent QKD removes trust in all devices. It needs near-unity detector efficiency or comparable advanced components, and its key rates are much lower. MDI-QKD trusts the sources but works with conventional lasers and arbitrarily flawed detectors, with key rates that its inventors put at “many orders of magnitude higher.”
How far and how fast can MDI-QKD go?
A 2016 experiment reached 404 km of ultralow-loss fibre at about 3.2×10⁻⁴ bps, collecting a 2,584-bit key over roughly three months. A 2021 Toshiba gigahertz system reached 2 kbps at 30 dB channel loss and up to 8 bps at 54 dB.
Is twin-field QKD a type of MDI-QKD?
Twin-field QKD is a related scheme that also measures at a central station whose operator does not need to be trusted. Its key rate scales the same way “irrespective of whom is in control of the measuring station,” according to Lucamarini and colleagues.
Sources
- Lydersen et al., “Hacking commercial quantum cryptography systems by tailored bright illumination”, arXiv / Nature Photonics, 2010
- “Quantum Crypto Products Cracked by Researchers”, Redmond Magazine, 13 September 2010
- Lo, Curty and Qi, “Measurement-device-independent quantum key distribution”, arXiv / Phys. Rev. Lett., 2011–2012
- Lo, Curty and Qi, full text, ar5iv, 2012
- Yin et al., MDI-QKD over 404 km of optical fibre, arXiv / Phys. Rev. Lett., 2016
- Yin et al., full text, ar5iv, 2016
- Tang et al., “MDI-QKD over untrustful metropolitan network”, arXiv / Phys. Rev. X, 2016
- Tang et al., full text, ar5iv, 2016
- Woodward et al., “Gigahertz MDI-QKD using directly modulated lasers”, arXiv / npj Quantum Information, 2021
- Lucamarini et al., twin-field quantum key distribution, arXiv / Nature, 2018
- Xu, Curty, Qi and Lo, review of measurement-device-independent QKD, arXiv 1409.5157, 2014