attacks, in QKD.

Another key weakness in standard QKD security proofs is that they all implicitly assume that the classical post-processing units are trusted. These units are supposed to distill a secure secret key from the raw data generated by the QKD modules by applying techniques such as post-selection of data (or so-called sifting), parameter estimation, error correction, error verification and privacy amplification. However, in view of the many hardware [@covert2; @covert2b; @covert2c] and software [@covert3] Trojan Horse attacks that have been performed recently in conventional cryptographic systems, such trust is a very strong and unjustified assumption. This scenario is illustrated in Fig. \[fig0\]. Indeed, hardware and software Trojans constitute today a key threat to the security of conventional cryptographic devices and this threat is expected to only rise with time, so it cannot be neglected when analysing the security of a QKD implementation.

![Schematic representation of a hardware/software Trojan Horse attack against a QKD system. In QKD, it is commonly and implicitly assumed that the classical post-processing units CP$_{\rm A}$ and CP$_{\rm B}$ are trusted. However, due to the many hardware [@covert2; @covert2b; @covert2c] and software [@covert3] Trojan Horse attacks that have been performed against conventional cryptographic systems, this 