[Paper Review] A directional coupler attack against the Kish key distribution system

Lachlan J. Gunn, Andrew Allison+1 more|arXiv (Cornell University)|Feb 12, 2014

Advanced Statistical Modeling Techniques1 references7 citations

TL;DR

This paper demonstrates a novel directional wave measurement attack against the Kish key distribution (KKD) system, exploiting finite resistance and signal propagation delays in transmission lines to extract secret keys with over 99.9% accuracy. The attack uses wave-based analysis and directional coupling to detect correlations between forward and reverse waves, undermining the system's claimed security even at low losses.

ABSTRACT

The Kish key distribution system has been proposed as a class ical alternative to quantum key distribution. The idealized Kish scheme elegantly promise s secure key distribution by exploiting thermal noise in a transmission line. However, we demonstrate that it is vulnerable to nonidealities in its components, such as the finite resistance of the transmission line connecting its endpoints. We introduce a novel attack against this nonideality using directional wave measurements, and experimentally demonstrate its efficacy. Our attack is based on causality: in a spatially distributed system, propagation is needed for thermodynamic equilibration, and that leaks information.

Motivation & Objective

• To investigate the vulnerability of the Kish key distribution system to physical-layer attacks arising from nonideal transmission line properties.
• To challenge the theoretical claim that low-frequency signals below the cutoff frequency cannot support wave propagation in KKD systems.
• To design and experimentally validate a directional wave measurement technique that exploits wave correlation and propagation delay to extract secret keys.
• To demonstrate that even minimal line losses (e.g., <0.1 dB) enable eavesdroppers to recover a majority of transmitted bits with high accuracy.

Proposed method

• The attack models the KKD system using transmission line theory, analyzing forward and reverse-traveling waves via reflection coefficients ΓA and ΓB.
• It derives the mean-squared voltages of injected waves using thermal noise relations: ⟨V′²⟩ = kTBZ₀(1 − Γ²), linking resistance values to measurable wave amplitudes.
• A directional wave measurement device estimates the spatial derivative ∂v/∂x of the voltage wave, enabling separation of forward and reverse components through wave-based signal processing.
• The method uses correlation-based estimation of wave components and computes log-likelihood ratios to distinguish between high and low resistance states at Alice and Bob.
• A compensated derivative circuit is implemented to remove DC offset from wire resistance, validating wave propagation behavior via frequency response measurements.
• The attack is experimentally validated using a 2 m coaxial cable with resistances Rₗ = 1 kΩ and Rₕ = 10 kΩ, and a 5 kHz bandwidth, measuring bit-error rates over 10⁵ samples.

Experimental results

Research questions

• RQ1 Can finite resistance in transmission lines be exploited to mount a practical eavesdropping attack on the Kish key distribution system?
• RQ2 Does wave propagation occur below the theoretical cutoff frequency f_c = ν/(2L) in the KKD system, contrary to prior claims?
• RQ3 Can directional wave measurements detect correlations between forward and reverse waves to infer resistance states with high accuracy?
• RQ4 To what extent do low signal losses (e.g., <0.1 dB) compromise the security of the KKD system?
• RQ5 Can a practical, experimentally validated attack achieve bit-error rates low enough to extract more than 99.9% of transmitted bits?

Key findings

• The attack successfully recovers more than 99.9% of transmitted bits over a 2 m transmission line within 20 correlation times, demonstrating high eavesdropping efficiency.
• Even with losses as low as 0.1 dB, the eavesdropper achieves a bit-error rate below 0.1% after sufficient averaging, indicating strong statistical distinguishability.
• Experimental validation confirms that the ∂v/∂x estimation circuit exhibits a linear magnitude response with a +90° phase shift, consistent with wave propagation and contradicting claims of non-propagation at low frequencies.
• The attack outperforms prior finite-resistance attacks by exploiting wave correlation and common-mode signal rejection, rather than relying only on variance measurements.
• The results show that reducing losses below 0.1 dB is impractical for securing long or high-bitrate KKD links, making the system vulnerable in real-world implementations.
• The study invalidates the theoretical claim that low-frequency operation below f_c prevents wave-based attacks, confirming that TEM modes propagate without cutoff in coaxial cables.