7 ms·

There's a better article here (which is the source): https://www.toshiba.eu/pages/eu/Cambridge-Research-Laboratory/toshiba-announces-breakthrough-in-long-dista

• definataly 5y ago
  >> can not eaves drop More precisely, it is possible to know if someone is eavesdropping and halt the key sharing. QKD does not prevent it, but has a provable method to know that someone is listening (statistics of the measurements change).
  • guyomes 5y ago
    > QKD does not prevent it, but has a provable method to know that someone is listening Unless some breakthrough in physics of particles, where all is not fully understood yet. A bit like standard cryptographic protocol are safe unless some breakthrough in mathematics or computer science.
• fsh 5y ago
  This is not quite correct. QKD could in principle be safe against eavesdropping (even though the track record so far has been very poor due to experimental imperfections), but it has no inherent protection against man-in-the-middle attacks. If you think about it, this is fundamentally not possible. There is no way of authenticating who sits on the other end of your fiber connection without having previously exchanged a key. This could either be a shared secret key, or standard public key cryptography. From an it-security perspective, QKD is simply a very expensive and impractical stream cipher that (slowly) grows a short shared secret key into an arbitrarily long one. The only fundamental advantage over a symmetric encryption algorithm like AES is that an attack would have to happen during the QKD process when the (signed) basis settings are exchanged. It is not possible to simply record all the communication with the hope to maybe being able to break the algorithm in the far future.
  • heavenlyblue 5y ago
    Yeah, the only reason this is possible in the situation is because you already know there’s only one possible person on the other end (you have already exchanged some meta-information about the channel). QE doesn’t stop anyone from creating a new node in the middle of a single edge and then re-establishing the QE channel in between.
  • wholinator2 5y ago
    The way it was explained to me was that three key was sent in some kind of quantum superposition that only resolved when observed. And that somehow at the receiving end, they could tell if the quantum state had been collapsed. Not surprisingly we didn't get too much into the quantum mechanics in a cryptography class but that's how it was explained
    • gliptic 5y ago
      But the man in the middle would just do the receiving and then resending it to the real recipient with a new key.
      • 5y ago
• PartiallyTyped 5y ago
  This [1] is a great read about the chain of trust, it boils down to whether you can trust your UEFI, if you can trust your UEFI, then you can trust your OS and its trusted public keys and the chain doesn't break. From the essay > Now, no one has actually observed UEFI being compromised, nor has anyone captured any UEFI-compromising Trickbot code. The thinking goes that Trickbot only downloads the UEFI code when it finds a vulnerable system. > Running in UEFI would make Trickbot largely undetectable and undeletable. Even wiping and restoring the OS wouldn't do it. Remember, TPMs are designed to be unpatchable and tamper-resistant. The physical hardware is designed to break forever if you try to swap it out. [1] https://pluralistic.net/2020/12/05/trusting-trust/#thompsons-devil https://pluralistic.net/2020/12/05/trusting-trust/#thompsons...
• jl6 5y ago
  > With QKD you only have to trust that the person you want to talk to is on the other side of the quantum link you've established I can see how that would be an easy thing to trust if the only people capable of building such a link are your fellow scientists, but in a scenario where this technology becomes common, is it reasonable that users would ever be able to verify who is listening at the other end? If not, what’s the use case?
  • joconde 5y ago
    It would be useful for any organization that has the means to implement this. I can see AWS datacenters and rich governments rolling our their own QKD.
    • cryptonector 5y ago
      You can't authenticate it. It's not secure. Full stop.
      • joconde 5y ago
        Why would it be impossible for a government or large cloud company to control all the nodes in a QKD system? In that case, they could rely on the physics to detect eavesdropping. The problem for simple customers is that they can't be sure that the transmission isn't MITM'd somewhere, but that's only because they don't build and maintain the whole channel themselves.
• bsza 5y ago
  > With QKD you only have to trust that the person you want to talk to is on the other side of the quantum link you've established To trust that (without PKI), you have to meet your peer in person, don't you? If so, at that point you can just hand an HSM to them with your symmetric key on it. No need to use a quantum device.
  • dandanua 5y ago
    Yes, but what if you want to generate a new secret key? You can encrypt it and send through a channel. But, in theory, an eavesdropper can capture it and decrypt at some point in future. In QKD an eavesdropper is absolutely helpless, he can't capture traffic at all (it will be ruined otherwise).
    • bsza 5y ago
      But the same applies to the messages themselves, no? QKD is only for key exchange, so I assume the resulting keys themselves are just random (non-quantum) bits of data, and the encrypted messages are sent through plain old TCP/IP. If a message is intercepted, the same tactics of waiting until the encryption is no longer secure could work.
      • dandanua 5y ago
        I thought about the scenario when some old secret key is revealed. Sure, you can decrypt old messages with it if they were transmitted classically. But in a classical channel if you're capturing all the traffic then you can derive the current secret key and decrypt current messages as well. This is not possible in a quantum case.
        • bsza 5y ago
          What if you store a large number of keys on the module right from the start, and get all the new keys from that list. That way the key switch message only needs to contain the index of the new key. Even better, store a huge random seed and generate all subsequent keys from that. Then you can also change key size and algorithm as needed without ever having to meet your contact in person again.
• cryptonector 5y ago
  > Without QKD this process would have been done using public key encryption, which means the sender would have to have received the public key from a trusted source, ... > With QKD you only have to trust that the person you want to talk to is on the other side of the quantum link you've established, ... Re-read that please. How is that different? How do you know that there isn't a QKD MITM in your wire? It would be trivial to set one up. QKD is trivially vulnerable to MITM attacks because there's no quantum authentication system. All it costs is a pair of QKD devices, and physical access -- anywhere in the 600km will do. But with classical crypto we get to arrange authentication that works. You don't have to trust a third party, just the employees doing the set up. Anyone who tells you QKD is better than classical crypto is straight up lying to you.
  • tinco 5y ago
    Alright, so my initial response is this: Luckily I'm not in charge of setting up a QKD network at the moment. I have no idea what the actual usecase is for these things. I fully agree that simply sending a "runner" with the PSK in some sort of tamper proof container (glitter nail polish?) achieves basically the same thing, and about a thousand orders of magnitude cheaper. But then I thought about it for a while longer, and I came up with this: Maybe the advantage is that the private key never actually can be read by anyone, not even the two communicating parties, thus basically eradicating the possibility of spies or betrayal within your engineering ranks. If you can guarantee the physical integrity of the line for the entire 600km, you're also basically set. The only actual attack on QKD is setting up those MITM's, maybe even only during the initial set up? I don't know how often the entanglement has to be reset, are they permanently entangled or is there a reestablishing every so often?
    • cryptonector 5y ago
      > Maybe the advantage is that the private key never actually can be read by anyone [...] You're going to be using classical crypto for bulk no matter what, so, no, you don't get that advantage, and anyways, what does anyone care what a session key is when they can get the session plaintext? Worried about decryption of ciphertext the attacker did not earlier get the plaintext to? Just re-key often. > If you can guarantee the physical integrity of the line for the entire 600km, you're also basically set. You must be joking. With classical crypto I just don't have to care if the physical link is secure (except for DoS concerns -- please don't backhoe-cut my links!). For bulk symmetric crypto PQ is not even that much of a concern. And if we ever get to a PQ world, the lack of quantum authentication technology means that QKD will not be a solution to our PQ problems. No matter how hard anyone tries to find QKD to be better than classical crypto, it just isn't.
• amluto 5y ago
  I see this type of explanation frequently, and it’s misleading. QKD does roughly what Diffie-Hellman does. One way to look at Diffie-Hellman is that two parties have a public but tamper-proof communication channel: Alice and Bob can talk to each other, everyone can hear them, but no one can impersonate them. (This could be literal shouting in a crowded room, cryptography could be used to authenticate messages, etc.) Using Diffie-Hellman, Alice and Bob exchange secret shares over the public channel, derive a secret key, and, assuming no one has a mathematical breakthrough or a quantum computer, no one else knows the key. With QKD, Alice and Bob have the same public channel, but they also have a quantum communication channel, e.g. a fiber. This quantum channel is assumed to be completely insecure. Using both channels together and some math, Alice and Bob derive a secret key. For their trouble, they have a stronger sort of security compared to Diffie-Hellman — they don’t need to trust that their attacker doesn’t have some kind of breakthrough. There is an information theoretic proof that the scheme is secure as long as everyone plays by the rules. (Playing by the rules means no side channel or glitch attacks. A classical glitch might involve putting a very high voltage onto someone’s network cable to cause their NIC to malfunction. A quantum glitch attack might involve shining an extremely bright light into the fiber to cause someone’s hardware to misbehave.) This is all that QKD does. It’s not magic, and the tamper-proof classical channel is required.