In 2010, Lars Lydersen and colleagues, including Vadim Makarov, took remote control of the single-photon detectors in two commercial quantum key distribution systems, ID Quantique’s Clavis2 and MagiQ Technologies’ QPN 5505, by shining tailored bright light into them. In quantum key distribution, or QKD, two parties build a shared encryption key from quantum states of light in a way designed to expose eavesdropping. Lydersen’s team wrote that this control made it possible to “tracelessly acquire the full secret key” and proposed an eavesdropping apparatus to do so.
Measurement-device-independent QKD, or MDI-QKD, was designed to make that class of attack useless. In the protocol that Hoi-Kwong Lo, Marcos Curty, and Bing Qi published in 2012, the two users send light to a relay between them that makes every measurement. The authors wrote that the relay’s “detection system can be arbitrarily flawed without compromising security.”
MDI-QKD removes the detector attacks that defeated earlier commercial QKD, but users must still trust their own transmitters and accept lower key rates. With MDI-QKD, the gap between QKD’s security proofs and its hardware is narrower but still open.
Quantum Observer’s companion analysis covers the requirements that MDI-QKD shares with other forms of QKD, including authentication and, on long routes, trusted nodes, along with certification and cost.
Detector attacks
Both systems that Lydersen’s team attacked counted photons with avalanche photodiodes, detectors that register a click when a single photon arrives. Bright light switched the detectors out of that single-photon mode. An eavesdropper could then intercept and measure each pulse before sending the receiver bright flashes that made its detectors click only for the results she chose.
In the preprint version of the 2010 paper, the authors wrote that both vendors were notified before publication. They also wrote that ID Quantique “has implemented countermeasures” and that MagiQ had discontinued the QPN 5505.
In 2011, Ilja Gerhardt and colleagues, Makarov among them, ran a complete attack of this kind on a running QKD connection, a 290 m research link across four buildings of the National University of Singapore. “An installed eavesdropper obtains the entire ‘secret’ key,” they wrote. They added that none of the parameters the legitimate parties monitored would “indicate a security breach.”
How the relay works
In MDI-QKD, the two users, conventionally named Alice and Bob, each prepare weak laser pulses in randomly chosen states. They send the pulses to a relay operated by a third party, usually called Charlie, who may be the eavesdropper.
Charlie interferes each pair of pulses at a beam splitter and announces which of his detectors clicked. Lo and his co-authors called this operation a Bell-state measurement and wrote that a successful one “corresponds to the observation of precisely two detectors.”
From the announcement, Alice and Bob learn whether the states they sent were correlated or anticorrelated. Next, they compare their encoding bases over the classical channel, the ordinary authenticated link that runs beside every QKD connection. One of them flips bits where needed. The two then hold matching raw bits. They turn those bits into a final key by estimating the error rate, correcting errors, and shortening the result with privacy amplification, or they discard the bits if the errors are too high. Charlie cannot read that final key.
A Bell-state measurement is also the step behind entanglement swapping. In swapping, researchers jointly measure one photon from each of two entangled pairs. The two remaining photons then become entangled with each other, although they never interacted. Qunnect and Cisco researchers performed entanglement swapping over 17.6 km of deployed New York fiber in February 2026, as Quantum Observer reported.
Samuel Braunstein and Stefano Pirandola proposed a related scheme, which they called side-channel-free QKD, in the preceding article of the same Physical Review Letters issue.
What the users must still trust
Lo, Curty, and Qi stated the condition in their 2012 paper. MDI-QKD “requires the additional assumption that Alice and Bob have almost perfect state preparation,” they wrote. They called it a minor drawback and wrote that the users’ states can be verified “in a fully protected laboratory environment.”
Feng-Yu Lu and colleagues at the University of Science and Technology of China, or USTC, tested that condition on a working system in 2023. Decoy-state MDI-QKD, in which the users vary pulse brightness to detect attacks on pulses with more than one photon, is “physically immune to all fatal detection-side attacks,” they wrote in Optica. They added that “the loopholes in the source side still open side channels to eavesdroppers.” By exploiting inaccurate decoy-state modulation in the transmitters, the team hacked an MDI-QKD system and “successfully obtained all final keys.”
Other transmitter components leak light of their own. In September 2026, a Guangxi University-led team found that silicon attenuators on chip-based QKD transmitters give off infrared light that an eavesdropper could split off, as Quantum Observer reported. MDI-QKD users must trust the transmitter that contains such an attenuator. The authors proposed extending their security analysis to MDI-QKD and twin-field QKD.
Device-independent QKD removes the need to trust the sources as well. Its users certify security from the violation of a Bell inequality, a statistical limit that measurement results from separate devices can exceed only if the devices share entanglement. Researchers led by Jian-Wei Pan at USTC reported in Science in 2026 that two single-atom nodes produced positive asymptotic key rates, calculated as if the data were unlimited, over fiber up to 100 km.
At 11 km, the team prepared 1.2 million heralded Bell pairs over 624 hours. In each, a detector signal confirmed that two atoms had become entangled. Accounting for the limited number of runs, they estimated a finite-size secure key rate of 0.112 bits per event from that data.
In July 2026, Konstantin Zaitsev and Polina Acheva posted a preprint titled “Insecurity of Measurement-Device-Independent Quantum Key Distribution.” In their attack, an eavesdropper replaces Charlie’s relay with a modified measurement setup and alters the photons that Bob sends, leaving Alice’s unchanged. The authors presented the result as a security failure of the MDI model. They concluded that the protocol’s security proof “does not fully account for all attack strategies included in its own adversarial model.”
The sifted key is the set of bits that Alice and Bob keep before correcting errors and shortening the key. For one detector pattern that they worked through in detail, the authors calculated that the eavesdropper “correctly identifies the sifted-key bit with probability 69.4%,” where a random guess would succeed half the time. They put the attack’s quantum bit error rate, the share of bits on which Alice and Bob disagree, at 5.6%. In the abstract, they summarized the result as recovery of “up to 70% of the sifted key.”
Zaitsev and Acheva describe their model as idealized and report calculations, without an experiment. They assumed “ideal single-photon states,” although they noted that practical systems use weak laser pulses. They also assumed “unit detection efficiency, lossless channels, and noiseless optical components.”
The authors did not calculate a final key length. They wrote that the attack’s 5.6% error rate “exceeds typical values reported in experimental MDI-QKD demonstrations” but “remains within the operational regime where positive secret-key generation is generally still possible.” In a section on the attack’s limitations, they argued that if its error statistics enter the finite-key parameter estimation of practical systems, the secret key length becomes zero or negative. In that case, they wrote, “no secret key can be extracted within the standard MDI-QKD security framework.” A proof of insecurity would have to show that an eavesdropper learns part of a final key that Alice and Bob accept. An attack that only forces them to abort blocks the service and leaves the secrecy guarantee intact.
Zaitsev and Acheva co-wrote the 2023 detector-testbench study that the companion analysis cites, with affiliations at the Russian Quantum Center and the University of Vigo’s Vigo Quantum Communication Center. Their 2026 preprint has not been peer reviewed, and Quantum Observer found no published reply to it by November 13, 2026.
What MDI-QKD costs
Every key bit in MDI-QKD requires photons from both Alice and Bob to reach the relay in the same time slot. The linear-optics relay in the 2012 paper “only identifies two of the four Bell states,” Lo and his co-authors wrote, so at most half of those coincidences can yield key. The key rate therefore falls with the combined loss of both fiber legs, the same total loss a direct link between Alice and Bob would face.
Hua-Lei Yin and colleagues reported MDI-QKD over 404 km of ultralow-loss fiber in 2016 at 3.2×10⁻⁴ bits per second. They needed three months of data to produce a final key of 2,584 bits, according to the preprint version.
In 2020, Kejin Wei and colleagues reported a 1.25 GHz system built on silicon photonic chips that produced 31 bits per second over 36 dB of channel loss, the equivalent of 180 km of standard fiber. That figure is a finite-key rate, which means the team accounted for the limited number of pulses. The authors called it higher than the rates of earlier MDI-QKD experiments.
In 2022, researchers at QuTech, a quantum research institute in Delft, ran MDI-QKD with collaborators between Delft and The Hague through a relay in a KPN exchange in Rijswijk, over 14.7 km and 10.2 km of fiber. They reported in Communications Physics that the system ran autonomously for two weeks beside more than 10 Gb/s of classical data. From their measurements they estimated 4×10⁻⁸ secret key bits per pulse.
The authors also wrote that they had not run the post-processing algorithms and that a full finite-key analysis was still needed before the key could protect a real channel. The paper lists Remon Berrevoets and Thomas Middelburg as equal first authors and Joshua Slater as its last and corresponding author. Wolfgang Tittel was among the co-authors.
The relay’s measurement depends on pulses from two independent lasers matching each other closely. In the Dutch test, the photons “must be indistinguishable in all degrees of freedom,” the authors wrote.
The users aligned their pulses to timing windows set by a 200 MHz master clock at the relay “with a precision of 10 ps.” Temperature controllers kept the two lasers’ frequency difference below 25 MHz, and electronic polarization trackers corrected drift in the fiber.
Lo and his co-authors counted a gain alongside these costs. In their simulations, MDI-QKD could “essentially double the transmission distance” of a standard decoy-state BB84 setup, they wrote. Charles Bennett and Gilles Brassard proposed BB84, the first QKD protocol, in 1984. In it, one user prepares photon states and the other measures them.
Twin-field QKD
Marco Lucamarini and colleagues at Toshiba Research Europe in Cambridge, England, proposed twin-field QKD in 2018. Alice and Bob send phase-randomized weak pulses to a central station that combines them. A key event needs only a single photon, from either user, to reach the station. Pulses with the same random phase act as “twins,” the authors wrote.
They wrote that the key rate scales “with the square-root of the channel transmittance,” the same dependence on distance as a quantum repeater, “irrespective of who (malicious or otherwise) is in control of the measuring station.” Twin-field QKD keeps MDI-QKD’s untrusted relay in the middle of the link. With square-root scaling, the protocol can exceed the repeaterless bound, the highest key rate a direct link can reach, which Pirandola and colleagues derived in 2017.
Yang Liu and colleagues reported twin-field QKD over 1,002 km of ultralow-loss fiber wound on spools in a laboratory in 2023, in a paper published in Physical Review Letters. They gave an asymptotic rate of 9.53×10⁻¹² bits per pulse at that distance and wrote that they had to suppress their system’s noise “to around 0.02 Hz.”
Their system ran at 1 GHz, but the team gave part of each cycle to phase-reference light, so the effective signal frequency in the long-distance runs was 351 MHz. The team later reoptimized its settings for distances of 202 km to 398 km, which raised the effective signal frequency to 900 MHz. At 202 km, the team then obtained up to 47.06 kbit/s, according to the preprint version.
In April 2025, Toshiba Europe researchers, working with the research network operators GÉANT and PSNC, reported twin-field QKD over 254 km of a commercial telecom network between Frankfurt and Kehl in Germany, at 110 bits per second. The team used a method for distributing optical coherence across the network and stabilized the lasers’ phase with light outside the quantum signal’s band, according to the paper.
In a joint release on April 24, 2025, Toshiba Europe, GÉANT, PSNC, and Anglia Ruskin University wrote that the system “features measurement-device-independent properties.” They called the trial “the first effective quantum repeater implementation on telecom infrastructure.” The twin-field relay stores no quantum state, although its key rate depends on distance the way a repeater’s would. The paper’s authors called the result repeater-like quantum communication.
In February 2026, Yun Zheng and colleagues in Jianwei Wang’s group at Peking University reported a chip-based twin-field QKD network in Nature. In a conference abstract, they described 20 integrated indium phosphide transmitter chips and a server-side silicon nitride microcomb, a source of evenly spaced laser frequencies. They ran twin-field QKD between pairs of the 20 users in turn, over 10 wavelength channels, each exceeding the repeaterless bound at 370 km of fiber on spools.
The team multiplied the 10 channels by 370 km to report a “networking capability” of 3,700 km. The Chinese Academy of Sciences described the same network as “covering a total distance of 3,700 kilometers.”
Twin-field QKD requires the same trusted sources as MDI-QKD, plus two distant lasers held in phase with each other.
Products and networks in November 2026
Falqon Systems was founded in Delft in 2022 by quantum-communication researchers from QuTech and TU Delft. It operated as Q*Bird until September 2026. In its September 2026 announcement of the new name, the company said MDI-QKD “remains the technological foundation” of its products. It described MDI-QKD as an architecture “designed to support scalable network deployments and remove the majority of attack vectors against QKD.”
The company said it supports deployments in the Netherlands, Belgium, Luxembourg, Ireland, Austria, and Spain. Its website lists 1,419 km of deployed quantum network and more than 50 network devices, without dates.
In January 2026, Universidad Politécnica de Madrid and Q*Bird announced a network that joins one Interior Ministry site and two sites of INTA, Spain’s National Institute for Aerospace Technology, through a hub at the university. Each user is connected to the hub by 30 km to 50 km of fiber. A single relay can serve many users this way. Falqon builds its networks around a central hub that reaches user nodes through an optical switch, according to the announcement.
In March 2026, Ireland’s Walton Institute and Q*Bird announced four end nodes in two Dublin data centers with a central hub, for IrelandQCI, a €10 million national program. Neither announcement included a key rate.
Two of Falqon’s co-founders, Berrevoets and Slater, co-wrote the 2022 Dutch field-test paper. In that test, the team estimated key rates from measurements without running the post-processing that turns raw data into a usable key.
ETSI’s Common Criteria protection profile for QKD, GS QKD 016, defines a prepare-and-measure protocol as one “in which one QKD module prepares quantum states and the other measures quantum states.” In MDI-QKD, neither user module measures, so the profile does not cover Falqon’s networks or any other MDI design. The companion analysis describes how far QKD certification has progressed for the designs the profile does cover.
The case for MDI-QKD
Lo and his co-authors wrote in their abstract that MDI-QKD “removes all detector side channels.” Ingrid Romijn, Falqon’s chief executive, made the commercial case when the Dublin network was announced in March 2026. “National security cannot depend on laboratory-grade assumptions,” she said.
On detectors, that case matches the documented record. Lydersen’s team took control of two commercial systems’ detectors in 2010. Gerhardt’s team took a full key undetected from a research link in 2011, also through the receiver’s detectors.
The MDI-QKD proof covers any flaw in the detectors at the relay. An MDI-QKD network also needs detectors at only one hub, which a single operator can maintain for many users.
In 2023, the USTC team attacked an MDI-QKD system through a transmitter. MDI-QKD users can set detector attacks aside, yet their transmitters need the same depth of testing that researchers have applied to detectors since 2010.
What would change this assessment
If a vendor had a product certified against a Common Criteria protection profile that covers MDI networks, independent evaluators would have tested its security claims. If the operators of deployed networks such as those in Madrid and Dublin published finite-key rates, users would know what key rates they actually receive.
If more independent teams attacked MDI transmitters the way the USTC team did in 2023, researchers would learn whether source-side flaws are rare exceptions or a second long list. Specialists in MDI-QKD security proofs who reply to the Zaitsev and Acheva preprint, or its peer reviewers, would show whether the standard analysis has to be amended.
MDI-QKD removes the detector attacks documented against commercial QKD since 2010. A device-independent system with practical key rates would remove the need for a trusted model of the sources as well. Until such systems reach practical key rates, MDI-QKD users still have to check their transmitters, their key rate, and their classical channel.
