4 ms·

You should not assume that the EU commission is stupid, as they have a large department which employs experts across many fields (mostly scientists as well) tha

You should not assume that the EU commission is stupid, as they have a large department which employs experts across many fields (mostly scientists as well) that informs policymakers about the risks and potential of these things. And concerning the potential risk of failure: Yes, everyone is aware of that. The flagship projects fund research, which means that there is a risk of failure and that we don't know all the details yet (otherwise it would be engineering). The funding bodies are fully aware of this and they do not expect that every project they fund will work out, but they know that today's research is tomorrow's revenue.

nabla9 10y ago
DJB is one of the leading experts in the field. Who are the security experts who think that quantum communication premises could lead to practical implementations? Even if the base research is successful, most experts agree that quantum communication is solution searching for problem. We can already transmit data securely trough bit-pipes using quantum resistant symmetric ciphers. Actual security problems are on different level (protocols etc.)
- ThePhysicist 10y ago
  As far as practical implementations are concerned, the Chinese already have a running quantum network between large cities, and are planning to launch a "quantum satellite" in June as well. There are companies selling this kind of equipment already, e.g. ID Quantique, so this technology is already quite mature and working. I don't understand why this should not count as a practical implementation. Also, to my knowledge it's the only technology that can (in principle) provide a fully secure key exchange over an insecure channel, and with states like the US investing heavily in quantum computing the possibility of decrypting RSA-based cryptography (and similar method) seems not so far-fetched anymore. Of course symmetric cryptography can be resilient against quantum attacks (as far as we know today) if this keys are sufficiently long, but the problem is to securely exchange those keys, and this is were quantum cryptography has its place (again, in my opinion). I would love to hear why this idea is flawed though, I just don't think that calling the other side "stupid" is a legitimate way of arguing.
  - acqq 10y ago
    > Of course symmetric cryptography can be resilient against quantum attacks (as far as we know today) if this keys are sufficiently long, but the problem is to securely exchange those keys, and this is were quantum cryptography has its place (again, in my opinion). I would love to hear why this idea is flawed though Because security-wise, according to djb claims in the original article (and Schneier too (2)), everything that the "quantum network" does can as well be implemented with the normal insecure internet and the symmetric ciphers, with the same security limitations (the secure channel, as per djb, initially is needed in both cases: "Quantum cryptography, like locked-briefcase cryptography, also relies on a preexisting secure channel (to authenticate choices of "bases" by Alice and Bob)" See also (1) ). So from the security standpoint it's a typical "snake oil" not improving anything but costing more, being much more complicated to maintain and therefore much less secure from the get-go. "The Manifesto says that it is "endorsed by a broad community of industries, research institutes and scientists in Europe" and is accompanied by an online list of thousands of signatories; but the list looks more like a rather narrow community of people who are hoping that the Manifesto makes money for them, such as quantum physicists and their students. Security review, like environmental review, requires experts who are skeptical." 1) https://en.wikipedia.org/wiki/Quantum_key_distribution https://en.wikipedia.org/wiki/Quantum_key_distribution "These proofs are unconditionally secure in the sense that no conditions are imposed on the resources available to the eavesdropper, however there are other conditions required: - Eve cannot physically access Alice and Bob's encoding and decoding devices. - The random number generators used by Alice and Bob must be trusted and truly random (for example a Quantum random number generator). - The classical communication channel must be authenticated using an unconditionally secure authentication scheme. - The message must be encrypted using one-time pad like scheme." 2) "Quantum Cryptography: As Awesome As It Is Pointless" https://www.schneier.com/essays/archives/2008/10/quantum_cryptography.html https://www.schneier.com/essays/archives/2008/10/quantum_cry...
    - ThePhysicist 10y ago
      but those requirements apply to the case where the attacker has unlimited classical and quantum computing capabilities. Under those conditions, all classical cryptographic methods fail (except one-time pad), because the attacker can just brute-force any key. That QKD still works under these assumptions is amazing in itself, and in any practically relevant scenario the limitations will probably not matter, as long as the key exchange is fast enough such that no decryption & manipulation of the classical channel is possible. Also, the attacker not having access to the decoding device is a reasonable assumption IMHO, as classical encryption won't do you any good either if the attacker has full access to your computer. All in all, I think that the critique is justified but it is not something that will keep QKD from being useful in the field (I could be wrong of course).
acqq 10y ago
Following nabla9's suggestion in the parallel reply: http://www.nist.gov/manuscript-publication-search.cfm?pub_id=901595 http://www.nist.gov/manuscript-publication-search.cfm?pub_id... "Bennet, Bernstein, Brassard, and Vazirani demonstrated that quantum computers cannot provide an exponential speedup for search algorithms, suggesting that symmetric encryption algorithms, one-way functions, and cryptographic hash algorithms should be resistant to attacks based on quantum computing [4]." (4: C. Bennett, E. Bernstein, G. Brassard, and U. Vazirani. Strengths and weaknesses of quantum computation. Special Issue on Quantum Computation of the Siam Journal of Computing, Oct. 1997.) Note, this was already known in 1997, two decades ago. After all the discussion up to now, I believe even more in djb's conclusion: "Ultimately the victims are the users. A quarter of a billion Euros, despite being explicitly aimed at communication security, will actually be devoted to quantum technologies that are much less secure than modern real-world cryptography. The occasional users who can afford to deploy quantum cryptography won't realize how easy it is to break. Meanwhile a similar level of funding will be sensibly devoted to quantum computing, but without a proper acknowledgment of the resulting security apocalypse, and without a corresponding level of funding for the most plausible plan to prevent this apocalypse." However it's sure that not only EU scientists make grandiose claims: http://www.macleans.ca/society/science/trudeau-versus-the-experts-quantum-computing-in-35-seconds/ http://www.macleans.ca/society/science/trudeau-versus-the-ex... "With a quantum computer, we hope to find a more efficient way to produce artificial fertilizer, having direct impact on food production around the world, and we hope to combat global warming." Ugh. And cure cancer and make your pennies bigger. Hey it's quantum. Anyway Chinese already sell the "quantum diagnostics devices" comparably "amazing": https://www.youtube.com/watch?v=iaDQgVwKO-Y https://www.youtube.com/watch?v=iaDQgVwKO-Y
- ThePhysicist 10y ago
  That quantum computers can't break symmetric cyphers efficiently is well-known, I just don't see why this makes quantum cryptography obsolete, as it is mostly about secure key exchange. Also, why are quantum algorithms less secure? There are some possible exploits (e.g. due to problems in the detector), but theoretically the encryption is unbreakable with our current understanding of Physics.
fh973 10y ago
Extrapolating from my involvement in FP6, I am pretty convinced that there are hardly an actual experts involved. Any random professor from Europe qualifies there as an expert and the expertise of this level of academia can be characterized by ignorance, inflated egos and outdated knowledge.

nabla9 10y ago

DJB is one of the leading experts in the field. Who are the security experts who think that quantum communication premises could lead to practical implementations? Even if the base research is successful, most experts agree that quantum communication is solution searching for problem. We can already transmit data securely trough bit-pipes using quantum resistant symmetric ciphers. Actual security problems are on different level (protocols etc.)

ThePhysicist 10y ago
As far as practical implementations are concerned, the Chinese already have a running quantum network between large cities, and are planning to launch a "quantum satellite" in June as well. There are companies selling this kind of equipment already, e.g. ID Quantique, so this technology is already quite mature and working. I don't understand why this should not count as a practical implementation. Also, to my knowledge it's the only technology that can (in principle) provide a fully secure key exchange over an insecure channel, and with states like the US investing heavily in quantum computing the possibility of decrypting RSA-based cryptography (and similar method) seems not so far-fetched anymore. Of course symmetric cryptography can be resilient against quantum attacks (as far as we know today) if this keys are sufficiently long, but the problem is to securely exchange those keys, and this is were quantum cryptography has its place (again, in my opinion). I would love to hear why this idea is flawed though, I just don't think that calling the other side "stupid" is a legitimate way of arguing.
- acqq 10y ago
  > Of course symmetric cryptography can be resilient against quantum attacks (as far as we know today) if this keys are sufficiently long, but the problem is to securely exchange those keys, and this is were quantum cryptography has its place (again, in my opinion). I would love to hear why this idea is flawed though Because security-wise, according to djb claims in the original article (and Schneier too (2)), everything that the "quantum network" does can as well be implemented with the normal insecure internet and the symmetric ciphers, with the same security limitations (the secure channel, as per djb, initially is needed in both cases: "Quantum cryptography, like locked-briefcase cryptography, also relies on a preexisting secure channel (to authenticate choices of "bases" by Alice and Bob)" See also (1) ). So from the security standpoint it's a typical "snake oil" not improving anything but costing more, being much more complicated to maintain and therefore much less secure from the get-go. "The Manifesto says that it is "endorsed by a broad community of industries, research institutes and scientists in Europe" and is accompanied by an online list of thousands of signatories; but the list looks more like a rather narrow community of people who are hoping that the Manifesto makes money for them, such as quantum physicists and their students. Security review, like environmental review, requires experts who are skeptical." 1) https://en.wikipedia.org/wiki/Quantum_key_distribution https://en.wikipedia.org/wiki/Quantum_key_distribution "These proofs are unconditionally secure in the sense that no conditions are imposed on the resources available to the eavesdropper, however there are other conditions required: - Eve cannot physically access Alice and Bob's encoding and decoding devices. - The random number generators used by Alice and Bob must be trusted and truly random (for example a Quantum random number generator). - The classical communication channel must be authenticated using an unconditionally secure authentication scheme. - The message must be encrypted using one-time pad like scheme." 2) "Quantum Cryptography: As Awesome As It Is Pointless" https://www.schneier.com/essays/archives/2008/10/quantum_cryptography.html https://www.schneier.com/essays/archives/2008/10/quantum_cry...
  - ThePhysicist 10y ago
    but those requirements apply to the case where the attacker has unlimited classical and quantum computing capabilities. Under those conditions, all classical cryptographic methods fail (except one-time pad), because the attacker can just brute-force any key. That QKD still works under these assumptions is amazing in itself, and in any practically relevant scenario the limitations will probably not matter, as long as the key exchange is fast enough such that no decryption & manipulation of the classical channel is possible. Also, the attacker not having access to the decoding device is a reasonable assumption IMHO, as classical encryption won't do you any good either if the attacker has full access to your computer. All in all, I think that the critique is justified but it is not something that will keep QKD from being useful in the field (I could be wrong of course).

acqq 10y ago

Following nabla9's suggestion in the parallel reply: http://www.nist.gov/manuscript-publication-search.cfm?pub_id=901595 http://www.nist.gov/manuscript-publication-search.cfm?pub_id... "Bennet, Bernstein, Brassard, and Vazirani demonstrated that quantum computers cannot provide an exponential speedup for search algorithms, suggesting that symmetric encryption algorithms, one-way functions, and cryptographic hash algorithms should be resistant to attacks based on quantum computing [4]." (4: C. Bennett, E. Bernstein, G. Brassard, and U. Vazirani. Strengths and weaknesses of quantum computation. Special Issue on Quantum Computation of the Siam Journal of Computing, Oct. 1997.) Note, this was already known in 1997, two decades ago. After all the discussion up to now, I believe even more in djb's conclusion: "Ultimately the victims are the users. A quarter of a billion Euros, despite being explicitly aimed at communication security, will actually be devoted to quantum technologies that are much less secure than modern real-world cryptography. The occasional users who can afford to deploy quantum cryptography won't realize how easy it is to break. Meanwhile a similar level of funding will be sensibly devoted to quantum computing, but without a proper acknowledgment of the resulting security apocalypse, and without a corresponding level of funding for the most plausible plan to prevent this apocalypse." However it's sure that not only EU scientists make grandiose claims: http://www.macleans.ca/society/science/trudeau-versus-the-experts-quantum-computing-in-35-seconds/ http://www.macleans.ca/society/science/trudeau-versus-the-ex... "With a quantum computer, we hope to find a more efficient way to produce artificial fertilizer, having direct impact on food production around the world, and we hope to combat global warming." Ugh. And cure cancer and make your pennies bigger. Hey it's quantum. Anyway Chinese already sell the "quantum diagnostics devices" comparably "amazing": https://www.youtube.com/watch?v=iaDQgVwKO-Y https://www.youtube.com/watch?v=iaDQgVwKO-Y

ThePhysicist 10y ago
That quantum computers can't break symmetric cyphers efficiently is well-known, I just don't see why this makes quantum cryptography obsolete, as it is mostly about secure key exchange. Also, why are quantum algorithms less secure? There are some possible exploits (e.g. due to problems in the detector), but theoretically the encryption is unbreakable with our current understanding of Physics.

fh973 10y ago

Extrapolating from my involvement in FP6, I am pretty convinced that there are hardly an actual experts involved. Any random professor from Europe qualifies there as an expert and the expertise of this level of academia can be characterized by ignorance, inflated egos and outdated knowledge.