Decoy States, Explained: The Fix That Made Weak-Laser QKD Practical

Idealized versions of discrete-variable QKD protocols like BB84 send one photon at a time. Most practical BB84 transmitters instead approximate that source with heavily attenuated laser pulses, some of which carry two or more photons. Those occasional multi-photon pulses create an opening an eavesdropper may exploit. The decoy-state method is the standard fix for that weakness in weak-coherent-pulse QKD, and it’s a big part of what made long-distance weak-laser QKD practical. It’s a clunky trick with an outsized payoff.

Here’s the problem it solves and how it does it.

The problem: pulses that leak copies

A dependable on-demand single-photon source would be ideal, but building one that meets all the requirements of a practical QKD system is difficult, so most deployed systems use a laser dimmed to a mean photon number below one.

That average is where the trouble is.

The photon count per pulse follows a random distribution. Most pulses are empty or carry a single photon, but a small share carry two or more. Those multi-photon pulses are the weak point. If a pulse leaves Alice carrying two photons in the same encoded state, an eavesdropper can quietly take one and let the other continue to Bob, and now she holds a perfect copy of part of the key without touching what Bob receives.

The photon-number-splitting attack

If you turn that idea into a full strategy, you’ll get the photon-number-splitting attack. The security model hands Eve powerful theoretical tools, so the proof holds against a worst case: a nondestructive measurement that reads a pulse’s photon number without disturbing it, and a lower-loss channel than the legitimate one, plus quantum memory to store what she skims. With those, Eve reads the photon number of each pulse.

If the legitimate channel is lossy enough, she can block some or all of the single-photon pulses and hide those missing detections inside the loss Bob already expects. From each multi-photon pulse, she keeps one photon in memory and forwards the rest to Bob through her low-loss channel. Later, when Alice and Bob announce their measurement bases, Eve measures her stored photons in the correct basis and reads those bits with no error introduced. Left unchecked, this forces Alice and Bob to assume every usable bit could have come from a multi-photon pulse, which crushes the secure key rate as distance grows.

The decoy-state fix

The fix is simple in outline. Alice randomly switches among a few mean photon numbers, usually one signal intensity and one or two weaker decoy settings, sometimes including an empty vacuum setting. She records which setting each pulse used and reveals those choices only after the transmission is done.

The security turns on a subtle point. After proper phase randomization, a signal pulse and a decoy pulse that contain the same number of photons are the same quantum state, apart from Alice’s private intensity label. Conditioned on containing the same number of photons, a signal pulse and a decoy pulse must be indistinguishable to Eve in every other relevant degree of freedom.

She can measure a pulse’s photon number, but she can’t make an n-photon signal pulse behave differently from an n-photon decoy pulse without shifting the statistics Alice and Bob compare afterward. The detection and error rates at each intensity therefore constrain how selectively Eve could have treated the multi-photon pulses.

From those detection rates and error rates across the intensities, Alice and Bob don’t learn which individual clicks came from single photons. What they get instead is a conservative bound on the yield and error rate of the single-photon component. They then compress the raw key through privacy amplification, and shrink it enough to wipe out whatever an eavesdropper could have learned from the multi-photon pulses. The result recovers the favorable scaling of an ideal single-photon system, even though the source is an ordinary laser.

Why it made weak-laser QKD practical

Before decoy states, weak-laser QKD faced a brutal choice over distance. You could run the pulses bright enough to reach, and hand a photon-number-splitting attacker the key, or dim them for safety and watch the rate collapse.

The decoy-state method broke that trade. In the standard asymptotic analysis of weak-coherent-pulse BB84, it changes the optimized key rate from scaling with about the square of the channel transmittance to scaling close to linearly with it, the same favorable dependence an ideal single-photon source would give. Deployed rates are lower because of finite data, detector noise, optical misalignment, and other implementation losses.

Won-Young Hwang proposed the idea in 2003, and two 2005 papers, one from Lo, Ma, and Chen, and one from Wang, developed the practical security analyses. Decoy states are now widely used in weak-coherent-pulse discrete-variable QKD, the Micius satellite included.

The remaining engineering challenges show up in experiments such as an 18-kilometer air-to-fiber QKD link, where adaptive optics helped collect light distorted by atmospheric turbulence.

What it doesn’t fix

Decoy states aren’t magic, and they lean on their own assumptions. They work only when Alice’s intensity levels are well-characterized, with the uncertainty in those values bounded, and when her pulses are properly phase-randomized, so an attacker can’t tell decoys from signals through a side channel or exploit sloppy randomization.

Weak spots in the hardware can chip away at those assumptions, which is one reason the laser-damage attacks that push a transmitter out of its calibrated range are taken seriously. And decoy states address the photon-number weakness of the source. They don’t close every side channel in Alice’s transmitter, and they don’t protect Bob’s detectors, which are separate problems with separate fixes.

That makes hardware testing a separate requirement: Quantum Optics Jena reported that its ELVIS system passed an independent QKD security evaluation targeting attacks on the equipment.

What it means for your wallet

Decoy states are the reason weak-laser QKD holds up over distance instead of falling apart, which makes them foundational plumbing rather than a headline. And like the rest of QKD, they deliver a key between two points and do nothing for the signature that authorizes a transaction.

Decoy states let Alice and Bob detect or bound the risk of an eavesdropper skimming spare photons from a quantum link, and they don’t touch the elliptic-curve math your wallet relies on.

When a quantum computer threatens that math, the fix is post-quantum cryptography. Decoy states are important to learn about for a different reason: they’re the quiet engineering that helped turn weak-laser QKD into a practical technology for long fiber links and satellite connections, though larger networks still need more infrastructure.

This article is educational and does not constitute security or investment advice.