← Back to Blog Cryptography

SARG04 and Decoy-State QKD

Q: What is the photon-number-splitting attack in plain language?

A real laser sometimes emits multiple photons per pulse instead of just one. An attacker can split off the extra photons and read them later when the basis is announced, learning the secret without introducing detectable errors. SARG04 and decoy states are two different defenses against this attack.

Q: Is SARG04 more secure than decoy-state BB84?

Both are provably secure against PNS. Decoy-state BB84 is preferred in commercial deployments because it offers higher key rates, more mature security proofs, and easier implementation in fielded systems. SARG04 is conceptually elegant but less commonly deployed.

Q: Can decoy states be combined with E91 or B92?

Yes. Decoy-state ideas have been generalized to many QKD protocols. Decoy-state E91 and decoy-state B92 have been studied in academic papers, though they are less commonly deployed than decoy-state BB84.

Q: Why does SARG04 have lower sift rate?

SARG04's pair-announcement scheme requires Bob's measurement to be conclusive (orthogonal to one of the announced pair). This conclusive event happens roughly half as often as basis-match events in BB84, halving the sift rate.

Q: Does QNSQY relate to SARG04 or decoy states?

No. QNSQY is post-quantum cryptography software running on standard hardware. It does not use quantum channels, photon pulses, or decoy states. Its security model relies on computational hardness assumptions for lattice and hash problems, plus hybrid combination with classical primitives, not on physical-layer quantum effects.

12 min read

SARG04 and Decoy-State QKD - QNSQY post-quantum encryption guide

By the early 2000s, BB84 had been studied and demonstrated in laboratories for nearly two decades, and the first commercial systems were just appearing. Researchers had spent that decade looking for chinks in its armor, and the most prominent one was the photon-number-splitting (PNS) attack. Real BB84 systems use attenuated laser pulses, not true single-photon sources, so a small fraction of pulses contain two or more photons. Eve can split off the extra photon, store it, and learn the bit value once Alice's basis is announced. PNS turns laser-based BB84 into a leaky protocol over long distances. In 2004, Valerio Scarani, Antonio Acin, Gregoire Ribordy, and Nicolas Gisin proposed a clever modification, now called SARG04, that defeated PNS using only the original four BB84 states. Around the same time, decoy-state methods proposed by Hwang (2003) and refined by Lo-Ma-Chen (2005) provided a different defense. Together, SARG04 and decoy states form the modern toolkit for practical QKD over realistic channels.

Why This Matters

Picture a delivery service that hides letters inside opaque envelopes. If a thief intercepts a stack of envelopes and randomly opens half of them, they will learn half the messages. Now imagine the thief gets clever: they only open envelopes that look thicker, hoping to find ones with multiple letters inside. PNS is the photon-channel version of this attack. Defending against it requires either hiding the "thickness" (decoy states) or making the protocol robust to multi-photon emissions (SARG04).

The 2004 paper

Scarani, Acin, Ribordy, and Gisin published "Quantum cryptography protocols robust against photon number splitting attacks for weak laser pulse implementations" in Physical Review Letters 92, 057901, on February 6, 2004. The paper showed that by changing only the classical post-processing of BB84, the same four polarization states could be made resistant to PNS at the cost of a lower sift rate.

The Photon-Number-Splitting Attack

A locksmith using a master key system worries that an attacker who gets a copy of the master can open every lock. PNS is the optical analog: if Alice's "single photon" is actually two photons, Eve can keep one and pass the other through. Once Alice announces her basis, Eve measures her stored photon in the right basis and learns the bit.

Technical setup

Real lasers do not emit perfectly one photon at a time. Attenuated coherent pulses follow a Poisson distribution: the probability of n photons per pulse is e^{-mu} mu^n / n!, where mu is the mean photon number per pulse. Typical operating values are mu = 0.1 to 0.5, giving meaningful probabilities of multi-photon emission.

How PNS works

Eve performs a quantum non-demolition measurement to count photons in each pulse without disturbing them.
For pulses with two or more photons, Eve splits off one photon, stores it in a quantum memory, and forwards the rest to Bob over a lossless channel.
For pulses with one photon, Eve blocks them entirely (since channel loss is expected anyway).
After Alice announces her basis publicly, Eve measures her stored photons in that basis and learns the bit values.

The result: Eve knows the bit values for all multi-photon pulses, while contributing no detectable QBER. Over realistic channel distances (where loss is significant), this attack can compromise a substantial fraction of the key.

How SARG04 Works

A safety inspector switches from naming what tool was used to naming which tool was definitely not used. SARG04 makes the same change in QKD: instead of announcing the basis used to encode each photon, Alice announces a pair of states, one of which she did use. Bob keeps only the photons where his measurement result is incompatible with one of the announced states, leaving him with information that Alice can decode and Eve mostly cannot.

Step by step

Alice prepares photons using the four BB84 polarization states (horizontal, vertical, +45, -45) but assigns them differently:

Bit 0 = horizontal or +45 (Alice picks randomly).
Bit 1 = vertical or -45 (Alice picks randomly).

Alice sends each photon over the quantum channel.
Bob measures each photon in one of the two BB84 bases (rectilinear or diagonal), randomly chosen.
For each photon, Alice announces a pair of non-orthogonal states from the four she used: one is the actual encoded state, the other is from the opposite bit value but in the opposite basis.
Bob keeps only photons whose measurement result is conclusive (i.e., orthogonal to one of the announced pair). This event tells Bob the announced pair, and his measurement reveals which one Alice used.
The kept bits constitute the sifted key, then go through error correction and privacy amplification.

Why this defeats PNS

PNS gives Eve a copy of the photon, but the security argument changes. To learn the bit, Eve needs to know not just the photon's state but also which announcement Alice will make. The pair-announcement scheme makes single-photon information insufficient for Eve to distinguish bits, even with full basis information. The protocol effectively trades sift rate for security against multi-photon attacks.

Aspect	BB84	SARG04
State space	Same 4 states	Same 4 states
Encoding	Bit determines basis and value	Bit determines value across bases
Sift rate	~50%	~25%
PNS resistance	Weak	Strong
Maximum tolerable QBER	~11%	~10%

Decoy States: A Different Approach

A clever traveler conceals valuables in a bag full of decoy items. If a thief opens the bag, they cannot tell which items matter. Decoy states do this with photon pulses.

Hwang's 2003 idea

Won-Young Hwang published "Quantum Key Distribution with High Loss: Toward Global Secure Communication" in Physical Review Letters 91, 057901, in 2003. He proposed that Alice randomly choose between two pulse intensities: a signal intensity (mu) and a decoy intensity (nu). The photons in both pulses look identical to Eve, but their photon-number statistics differ. By comparing the gain and QBER between signal and decoy pulses, Alice and Bob can detect PNS-style attacks that affect different intensities differently.

Lo-Ma-Chen 2005 refinement

Hoi-Kwong Lo, Xiongfeng Ma, and Kai Chen published "Decoy State Quantum Key Distribution" in Physical Review Letters 94, 230504, in 2005. Their refinement made the decoy-state method practical, with explicit formulas for estimating the single-photon yield and the secure key rate. The Lo-Ma-Chen analysis is now the standard for decoy-state BB84 deployments.

How decoy states work

Alice randomly assigns each pulse one of three intensities: signal (mu), decoy 1 (nu1 < mu), and decoy 2 (nu2 = 0, the vacuum).
After all pulses are sent, Alice publicly announces which intensity each pulse used.
Alice and Bob compute the gain (fraction of pulses Bob detected) and QBER for each intensity separately.
If Eve has performed PNS, the per-intensity gains and errors will deviate from the values predicted by uniform attenuation.
Detection of these deviations triggers an abort or a tighter privacy amplification.

The standard signal-and-two-decoys configuration is provably secure against general PNS-class attacks under reasonable assumptions on the source and channel.

Comparison: SARG04 vs Decoy-State BB84

A specialty tool comparison: SARG04 changes the post-processing; decoy states change the photon-source statistics. Both achieve PNS resistance, but they have different trade-offs.

Trade-offs

Aspect	SARG04	Decoy-state BB84
Source modification	None (same 4 states)	Multi-intensity laser
Post-processing change	Pair announcement	Per-intensity statistics
Sift rate	Lower (~25%)	Higher (~50% per signal)
Maximum distance	Limited	Higher
Implementation cost	Low	Moderate
Security proof maturity	Strong	Stronger (more mature)

In practice, decoy-state BB84 has come to dominate commercial deployments because it offers higher key rates over realistic channels with mature security proofs. SARG04 sees use in research and certain hybrid implementations.

Hardware Status

A racecar with new safety systems has to prove itself on the track. SARG04 and decoy-state methods have been deployed in fielded QKD networks since the late 2000s.

Notable deployments

DARPA Quantum Network (Boston, 2002-2007): early field demonstration of BB84.
SECOQC network (Vienna, 2004-2008): multi-vendor QKD network including decoy-state systems.
Tokyo QKD Network (2010-present): includes decoy-state BB84 deployments by NEC and others.
ID Quantique commercial systems: use decoy-state BB84 in production.
Toshiba QKD systems: decoy-state BB84.
Chinese national QKD backbone (Beijing-Shanghai, 2017): 2000 km network using decoy-state BB84 with trusted relay nodes.

SARG04 demonstrations have been published but are less common in commercial systems.

Side Channels and Attacks

A vault door is only as secure as its weakest hinge. Decoy-state BB84 and SARG04 both depend on hardware-level assumptions that have been attacked.

Notable attacks

Detector blinding (Lydersen, Wiechers, Wittmann, Elser, Skaar, Makarov 2010): Eve sends bright light to disable single-photon detectors and force them into a deterministic mode where she controls outcomes.
Time-shift attacks (Qi, Fung, Lo, Ma 2007): exploit timing differences between detector channels.
Wavelength attacks: exploit detector responses at unusual wavelengths.
Trojan-horse light injections: read source state by reflecting probe light off Alice's optics.

Each attack has driven new countermeasures (calibration, isolation, monitoring), but the cycle continues. Measurement-device-independent QKD (MDI-QKD, Lo-Curty-Qi 2012) is one major response: it removes detector-side attacks by moving all detection to a third party.

SARG04 and Decoy States vs Post-Quantum Cryptography

NSA's Cybersecurity Advisory on QKD applies to SARG04, decoy-state BB84, E91, and B92 alike. The reasons (specialized hardware, distance limits, authentication requirements, hardware attacks, network-scaling difficulties) do not depend on protocol choice.

For general-purpose secure communications and file storage, post-quantum cryptography is the right tool. QNSQY uses NIST-standardized PQC algorithms (ML-KEM, ML-DSA, SLH-DSA, FN-DSA, HQC, LMS) in hybrid mode with X25519 and Ed25519, runs on standard hardware, scales globally, and provides authentication.

When QKD Is Worth It

A specialty tool can still be worth deploying when the constraints fit. QKD makes sense when:

The endpoints are physically near each other (within 100 km of fiber, or with satellite line-of-sight).
The data is so high-value that information-theoretic security justifies hardware investment.
The deployment can accept the rate and distance limits.
There is operational tolerance for hardware-attack countermeasure cycles.

For everything else, PQC is the better fit. Most enterprises, governments, and individuals fall into "everything else."

Frequently Asked Questions

What is the photon-number-splitting attack in plain language?