# Signal fidelity from fiber optic crosstalk

I was watching a video about tapping fiber optic cables when it brought up some points from an early US govt document describing security concerns about fiber optic cables. The relevant part:

Tapping attacks are possible at several points within the network due to component crosstalk. For example, contemporary demultiplexers within network nodes separate each individual signal (or wavelength) received from a single fiber on to separate physical paths. These demultiplexers may exhibit cross-talk levels between 0.03% and 1.0%. These cross-talk levels allow a little of each signal to leak onto the wrong path. Yet these signals may have enough fidelity to permit an attacker to detect their presence and recover a portion of data.

If I'm understanding this correctly, this means that after some fiber station de-muxes the signals, the signal that gets sent to someone's house has some "noise" that is actually cross-talk from someone else's signal. I'm unfamiliar with signal processing, but it seems to me that it would be possible to glean some information from that "noise." That would essentially be like a low-quality copy of someone else's mail getting delivered to my mailbox.

Does modern fiber in homes (or businesses) send enough physical signal from cross-talk to be usable in some way? That seems...not great.

• Who do you think will be trying to something from the cross-talk? Your next-door neighbor? The FBI? The NSA? This makes a huge difference in what the word "usable" means. – Elliot Alderson Dec 29 '19 at 21:52
• I mean usable not in the sense of leveraging information against someone else, but in the sense of interpreting the signal into bytes of information. In that sense, I don't think it matters who is doing the interpreting, just whether it's possible – Indigenuity Dec 29 '19 at 21:56
• @Indigenuity, the difference is if your neighbor is trying to eavesdrop on you they probably won't spend more than $100 or$1000 to do it if they really hate you. If the FBI is trying to eavesdrop on you they might have a \$100,000 piece of equipment to do it. That could make a big difference in what is "possible". – The Photon Dec 29 '19 at 22:10
• How hard or expensive it might be to crack is irrelevant. The important thing is that you be afraid - very afraid - enough to pay us for even more advanced cryptographic services - which we will then show can be broken so you have to pay again, and... – Bruce Abbott Dec 30 '19 at 6:16

Does modern fiber in homes (or businesses) send enough physical signal from cross-talk to be usable in some way?

Fiber to the home (FTTH) /to the premises (FTTP) is typically a passive optical network (PON) – i.e. you and all your neighbors get every neighbor's downlink through passive splitters (if you remember the ethernet hubs: like that).

On the uplink, it's a slotted time-division multiplex scheme, so only one neighbor transmits at a time, and all others have to be silent for that time. I don't actually know how directive (i.e. only letting the user uplink through to the optical link terminal, not giving the other users much) splitters are, but I'd presume well, but not perfectly.

So, it's fair to assume that at least in the good (O)SNR case, a neighbor doesn't only get every neighbor's downlink, but at least a somewhat OK uplink of a few neighbors that are especially strong in splitter crosstalk / scattering further up.

However, don't underestimate the hardness of decoding that – you're losing a lot of information through the splitter side channel.

That seems...not great.

Why? That's a broadcast channel by physical constraints, yes, but that's why we have cryptography. See, for example, the commonly used GPON Standard, G.984.3's Transmission convergence layer specification, chapter 12, "Security", and especially "12.1 Basic Threat Model" on page 90 (emphasis mine):

The basic concern in PON is that the downstream data is broadcast to all ONUs attached to the PON. If a malicious user were to re-programme his ONU, then the malicious user could listen to all the downstream data of all the users. It is this 'eavesdropping threat' that the PON security system is intended to counter. Other, more exotic threats are not considered practically important because, in order to attempt these attacks, the user would have to expend more resources than it would be worth.

Furthermore, the PON itself has the unique property in that it is highly directional. So any ONU cannot observe the upstream traffic from the other ONUs on the PON. This allows privileged information (such as security keys) to be passed upstream in the clear. While there are threats that could jeopardize this situation, such as an attacker tapping the common fibres of the PON, these again are not considered realistic, since the attacker would have to do so in public spaces, and would probably impair the very PON being tapped.

All in all, from your neighbors, your downlink should cryptographically be pretty secure, your uplink pretty safe optically; as usual in security, you really need to come up with a threat model. Will someone with a 100 kilodollar device hook up to the next OLT box and try to log what you're sending? Would that someone not much more likely spend that money on getting onto your premises and bugging your meeting room? Or would that someone most likely be a secret service and simply force your provider to give them direct access to the data?

All in all: this is 2019. Internet traffic that's not end-to-end encrypted should be considered compromised, anyways. Even large providers are not immune to inserting their own ads into unencrypted http traffic, so I think you're worrying at the wrong end.

Use TLS.

If I'm understanding this correctly, this means that after some fiber station de-muxes the signals, the signal that gets sent to someone's house has some "noise" that is actually cross-talk from someone else's signal.

This refers to sense wavelength division multiplexing on undersea cables where huge numbers of channels are multiplexed into a common fiber due to the extreme cost of undersea cables and other long haul fiber links. For low speed fiber links to buildings, there are usually no other users multiplexed into the same fiber.

Does modern fiber in homes (or businesses) send enough physical signal from cross-talk to be usable in some way?

Not usually, but cable modems do work like that. It's not an issue unless you can decrypt the other channels.

• My home is served by a G-PON (Gigabit Passive Optical Network) fiber network, which means there are several houses on the same fiber, with passive taps. Not only do I get my own signal at full strength, I get several other peoples' signal at full strength too, and my home router filters it out. (Or at least I assume so - I haven't tried to tap it) – user253751 Dec 30 '19 at 13:21