4 ms·

This is not quite correct. QKD could in principle be safe against eavesdropping (even though the track record so far has been very poor due to experimental impe

by fsh 5y ago

This is not quite correct. QKD could in principle be safe against eavesdropping (even though the track record so far has been very poor due to experimental imperfections), but it has no inherent protection against man-in-the-middle attacks. If you think about it, this is fundamentally not possible. There is no way of authenticating who sits on the other end of your fiber connection without having previously exchanged a key. This could either be a shared secret key, or standard public key cryptography. From an it-security perspective, QKD is simply a very expensive and impractical stream cipher that (slowly) grows a short shared secret key into an arbitrarily long one. The only fundamental advantage over a symmetric encryption algorithm like AES is that an attack would have to happen during the QKD process when the (signed) basis settings are exchanged. It is not possible to simply record all the communication with the hope to maybe being able to break the algorithm in the far future.

heavenlyblue 5y ago
Yeah, the only reason this is possible in the situation is because you already know there’s only one possible person on the other end (you have already exchanged some meta-information about the channel). QE doesn’t stop anyone from creating a new node in the middle of a single edge and then re-establishing the QE channel in between.
wholinator2 5y ago
The way it was explained to me was that three key was sent in some kind of quantum superposition that only resolved when observed. And that somehow at the receiving end, they could tell if the quantum state had been collapsed. Not surprisingly we didn't get too much into the quantum mechanics in a cryptography class but that's how it was explained
- gliptic 5y ago
  But the man in the middle would just do the receiving and then resending it to the real recipient with a new key.
  - baby 5y ago
    No but see, they would need to have QKD technology which is too complex and expensive.
    - bitwize 5y ago
      If the "man" in the middle is the NSA, no expense will be spared.
  - arksingrad 5y ago
    MITM can only re-send the correct key if he knows the correct basis to measure in for every qubbit. The probability that he measures in the correct basis for every qubit is exponentially unlikely as the length of the bitstring grows. He can't just forward along the proper qubit to the receiver in this case.
    - gliptic 5y ago
      But he has man-in-the-middle'd the channel over which that is communicated too. If the benefit is merely that he would need to hijack two different channels, you could just do classical crypto and splitting the key into two parts (e.g. XOR with random bits) and send those over two channels.
- devwastaken 5y ago
  Quantum fluffery. We as humans simply don't know what the state of the entangled particle is. There's no communication between the particles. All it guarantees is that if 1 particle spins in a direction, it's entangled partner spins in another. There is no measurement of collapse, you have to trust it just the same.
- arksingrad 5y ago
  You (Alice and Bob, where Alice is Tx/Bob is Rx) need to have agreed upon the basis in which you measure for each bit ahead of time. If you get MITM'd and they don't know the basis to measure in, then: - They have a 50% chance of measuring in the correct basis and re-sending the proper qubit - They have a 50% change of measuring in the incorrect basis, in which case their measurement means nothing and the qubit they send is in a superposition in the correct basis, leading to a chance Bob measures the wrong value Over a very long string, it becomes exponentially unlikely that the MITM could guess the proper basis and then re-send the proper qubit to Bob. As that binary string grows in length, it's essentially impossible to MITM with any meaningful likelihood.
  - tinco 5y ago
    I don't know why someone downvoted you, but the flaw people are pointing out is that the initial agreeing upon a basis is equivalent to exchanging a preshared key. If you've got a preshared key, then why go through the trouble of setting up a QKD for sending PSK's? There's bound to be good reasons, but you're comment doesn't address this.

by fsh 5y ago

heavenlyblue 5y ago

Yeah, the only reason this is possible in the situation is because you already know there’s only one possible person on the other end (you have already exchanged some meta-information about the channel). QE doesn’t stop anyone from creating a new node in the middle of a single edge and then re-establishing the QE channel in between.

wholinator2 5y ago

The way it was explained to me was that three key was sent in some kind of quantum superposition that only resolved when observed. And that somehow at the receiving end, they could tell if the quantum state had been collapsed. Not surprisingly we didn't get too much into the quantum mechanics in a cryptography class but that's how it was explained

gliptic 5y ago
But the man in the middle would just do the receiving and then resending it to the real recipient with a new key.
- baby 5y ago
  No but see, they would need to have QKD technology which is too complex and expensive.
  - bitwize 5y ago
    If the "man" in the middle is the NSA, no expense will be spared.
- arksingrad 5y ago
  MITM can only re-send the correct key if he knows the correct basis to measure in for every qubbit. The probability that he measures in the correct basis for every qubit is exponentially unlikely as the length of the bitstring grows. He can't just forward along the proper qubit to the receiver in this case.
  - gliptic 5y ago
    But he has man-in-the-middle'd the channel over which that is communicated too. If the benefit is merely that he would need to hijack two different channels, you could just do classical crypto and splitting the key into two parts (e.g. XOR with random bits) and send those over two channels.
devwastaken 5y ago
Quantum fluffery. We as humans simply don't know what the state of the entangled particle is. There's no communication between the particles. All it guarantees is that if 1 particle spins in a direction, it's entangled partner spins in another. There is no measurement of collapse, you have to trust it just the same.
arksingrad 5y ago
You (Alice and Bob, where Alice is Tx/Bob is Rx) need to have agreed upon the basis in which you measure for each bit ahead of time. If you get MITM'd and they don't know the basis to measure in, then: - They have a 50% chance of measuring in the correct basis and re-sending the proper qubit - They have a 50% change of measuring in the incorrect basis, in which case their measurement means nothing and the qubit they send is in a superposition in the correct basis, leading to a chance Bob measures the wrong value Over a very long string, it becomes exponentially unlikely that the MITM could guess the proper basis and then re-send the proper qubit to Bob. As that binary string grows in length, it's essentially impossible to MITM with any meaningful likelihood.
- tinco 5y ago
  I don't know why someone downvoted you, but the flaw people are pointing out is that the initial agreeing upon a basis is equivalent to exchanging a preshared key. If you've got a preshared key, then why go through the trouble of setting up a QKD for sending PSK's? There's bound to be good reasons, but you're comment doesn't address this.