2 ms·

but those requirements apply to the case where the attacker has unlimited classical and quantum computing capabilities. Under those conditions, all classical c

but those requirements apply to the case where the attacker has unlimited classical and quantum computing capabilities. Under those conditions, all classical cryptographic methods fail (except one-time pad), because the attacker can just brute-force any key. That QKD still works under these assumptions is amazing in itself, and in any practically relevant scenario the limitations will probably not matter, as long as the key exchange is fast enough such that no decryption & manipulation of the classical channel is possible. Also, the attacker not having access to the decoding device is a reasonable assumption IMHO, as classical encryption won't do you any good either if the attacker has full access to your computer. All in all, I think that the critique is justified but it is not something that will keep QKD from being useful in the field (I could be wrong of course).

acqq 10y ago
The problem is, from the point of view of that conventional security expert (and of me too) the only "usefulness in the field" is the possibility to sell the extremely expensive snake oil to the buyers who don't ask what the price is. Because even without the same snake oil, the equivalent system can be designed, maintained and be significantly cheaper. Getting money from those who can give a lot can also be a valid economic goal, or in this case an accepted approach to funding (I quoted that Microsoft researcher) but using "snake oil" can still be seen as the evil opposite of the established principles of honest security engineering, the classic entry for Schneier's "doghouse." The fair approach would be, "we're doing the basic research, no there's no too practical applicability of our research, but it's good to fund it anyway, that's why the research is different from engineering." It would also let engineers do their work and not force them to implement less secure directions "because policy." Which is the effect that certainly appears here and there on the EU level.

acqq 10y ago

The problem is, from the point of view of that conventional security expert (and of me too) the only "usefulness in the field" is the possibility to sell the extremely expensive snake oil to the buyers who don't ask what the price is. Because even without the same snake oil, the equivalent system can be designed, maintained and be significantly cheaper. Getting money from those who can give a lot can also be a valid economic goal, or in this case an accepted approach to funding (I quoted that Microsoft researcher) but using "snake oil" can still be seen as the evil opposite of the established principles of honest security engineering, the classic entry for Schneier's "doghouse." The fair approach would be, "we're doing the basic research, no there's no too practical applicability of our research, but it's good to fund it anyway, that's why the research is different from engineering." It would also let engineers do their work and not force them to implement less secure directions "because policy." Which is the effect that certainly appears here and there on the EU level.