done very slowly over many subsequent QKD runs, and thus it could be very difficult to detect [@mem_attack]. Obviously, this is a fatal loss of security for DI-QKD. Whenever a QKD system is reused for subsequent QKD sessions, the security of the keys generated in previous QKD runs might be compromised. This is particularly problematic in a network setting with multiple users (who may not all be trustworthy) due to the impostor attack [@mem_attack; @counter_mem_attack]. Moreover, note that in principle memory attacks could also work for non-DI-QKD. This is so because, in practice, it could be quite challenging to check wether or not a purchased QKD setup contains such memory. Therefore, in the following, whenever we refer to a QKD system, it will be implicitly understood that it could be either a DI-QKD scheme or a non-DI-QKD scheme, as our results apply to both frameworks.

Our view is that memory attacks constitute an example of covert channels [@covert], which have attracted massive attention in conventional cryptography. With covert channels, seemingly innocent communications in a protocol could leak crucial information that is fatal to its security. One main motivation of our work is indeed to counter covert channels, such as memory 