2 ms·

> Without QKD this process would have been done using public key encryption, which means the sender would have to have received the public key from a trusted so

> Without QKD this process would have been done using public key encryption, which means the sender would have to have received the public key from a trusted source, ... > With QKD you only have to trust that the person you want to talk to is on the other side of the quantum link you've established, ... Re-read that please. How is that different? How do you know that there isn't a QKD MITM in your wire? It would be trivial to set one up. QKD is trivially vulnerable to MITM attacks because there's no quantum authentication system. All it costs is a pair of QKD devices, and physical access -- anywhere in the 600km will do. But with classical crypto we get to arrange authentication that works. You don't have to trust a third party, just the employees doing the set up. Anyone who tells you QKD is better than classical crypto is straight up lying to you.

tinco 5y ago
Alright, so my initial response is this: Luckily I'm not in charge of setting up a QKD network at the moment. I have no idea what the actual usecase is for these things. I fully agree that simply sending a "runner" with the PSK in some sort of tamper proof container (glitter nail polish?) achieves basically the same thing, and about a thousand orders of magnitude cheaper. But then I thought about it for a while longer, and I came up with this: Maybe the advantage is that the private key never actually can be read by anyone, not even the two communicating parties, thus basically eradicating the possibility of spies or betrayal within your engineering ranks. If you can guarantee the physical integrity of the line for the entire 600km, you're also basically set. The only actual attack on QKD is setting up those MITM's, maybe even only during the initial set up? I don't know how often the entanglement has to be reset, are they permanently entangled or is there a reestablishing every so often?
- cryptonector 5y ago
  > Maybe the advantage is that the private key never actually can be read by anyone [...] You're going to be using classical crypto for bulk no matter what, so, no, you don't get that advantage, and anyways, what does anyone care what a session key is when they can get the session plaintext? Worried about decryption of ciphertext the attacker did not earlier get the plaintext to? Just re-key often. > If you can guarantee the physical integrity of the line for the entire 600km, you're also basically set. You must be joking. With classical crypto I just don't have to care if the physical link is secure (except for DoS concerns -- please don't backhoe-cut my links!). For bulk symmetric crypto PQ is not even that much of a concern. And if we ever get to a PQ world, the lack of quantum authentication technology means that QKD will not be a solution to our PQ problems. No matter how hard anyone tries to find QKD to be better than classical crypto, it just isn't.
  - tinco 5y ago
    > You're going to be using classical crypto for bulk no matter what, so, no, you don't get that advantage, and anyways, what does anyone care what a session key is when they can get the session plaintext? You're right, there's no fundamental advantage there it seems. It could still just be a convenient way of rekeying very often (assuming it can "conveniently" be verified to be free of mitm) > You must be joking. Only half, for my day job I work with UAV operations, and inspecting 600km of lines daily would be peanuts for something with military scale funding. > No matter how hard anyone tries to find QKD to be better than classical crypto Well I hope you don't think I was doing that, I'm just trying to figure out a use for it.
    - cryptonector 5y ago
      > It could still just be a convenient way of rekeying very often (assuming it can "conveniently" be verified to be free of mitm) No. ECDH is just fine. PQ crypto is also just fine. And no, QKD cannot be "conveniently" verified to be free of MITMs -- this is more important than whether QKD can be a "convenient way of rekeying very often" (which it isn't anyways). > Only half, for my day job I work with UAV operations, and inspecting 600km of lines daily would be peanuts for something with military scale funding. A UAV cannot police 600km of fiber optics 24/7. 10 UAVs cannot either. The cost of this is nuts compared to the cost of using classical crypto -- and for what benefit?! There is no benefit to QKD, not any benefit at all. > Well I hope you don't think I was doing that, I'm just trying to figure out a use for it. It may be useful to train quantum physicists. Hmm, that may be its only use -- I can't think of any others.
      - nullc 5y ago
        The idea behind QKD is that it's secure if you have a MITM proof (but not passive observation proof) channel, even if all asymmetric algorithms are broken by quantum computers. Of course, this depends on your equipment not leaking extra photons or having other sidechannels... which seems harder than ordinary asymmetric crypto. But you would combine QKD with asymmetric crypto so that both would have to be broken to lose your link security. I don't think it's that generally interesting, but if you already have dedicated private fiber between your super secret secure facilities, -- why not?

tinco 5y ago

Alright, so my initial response is this: Luckily I'm not in charge of setting up a QKD network at the moment. I have no idea what the actual usecase is for these things. I fully agree that simply sending a "runner" with the PSK in some sort of tamper proof container (glitter nail polish?) achieves basically the same thing, and about a thousand orders of magnitude cheaper. But then I thought about it for a while longer, and I came up with this: Maybe the advantage is that the private key never actually can be read by anyone, not even the two communicating parties, thus basically eradicating the possibility of spies or betrayal within your engineering ranks. If you can guarantee the physical integrity of the line for the entire 600km, you're also basically set. The only actual attack on QKD is setting up those MITM's, maybe even only during the initial set up? I don't know how often the entanglement has to be reset, are they permanently entangled or is there a reestablishing every so often?

cryptonector 5y ago
> Maybe the advantage is that the private key never actually can be read by anyone [...] You're going to be using classical crypto for bulk no matter what, so, no, you don't get that advantage, and anyways, what does anyone care what a session key is when they can get the session plaintext? Worried about decryption of ciphertext the attacker did not earlier get the plaintext to? Just re-key often. > If you can guarantee the physical integrity of the line for the entire 600km, you're also basically set. You must be joking. With classical crypto I just don't have to care if the physical link is secure (except for DoS concerns -- please don't backhoe-cut my links!). For bulk symmetric crypto PQ is not even that much of a concern. And if we ever get to a PQ world, the lack of quantum authentication technology means that QKD will not be a solution to our PQ problems. No matter how hard anyone tries to find QKD to be better than classical crypto, it just isn't.
- tinco 5y ago
  > You're going to be using classical crypto for bulk no matter what, so, no, you don't get that advantage, and anyways, what does anyone care what a session key is when they can get the session plaintext? You're right, there's no fundamental advantage there it seems. It could still just be a convenient way of rekeying very often (assuming it can "conveniently" be verified to be free of mitm) > You must be joking. Only half, for my day job I work with UAV operations, and inspecting 600km of lines daily would be peanuts for something with military scale funding. > No matter how hard anyone tries to find QKD to be better than classical crypto Well I hope you don't think I was doing that, I'm just trying to figure out a use for it.
  - cryptonector 5y ago
    > It could still just be a convenient way of rekeying very often (assuming it can "conveniently" be verified to be free of mitm) No. ECDH is just fine. PQ crypto is also just fine. And no, QKD cannot be "conveniently" verified to be free of MITMs -- this is more important than whether QKD can be a "convenient way of rekeying very often" (which it isn't anyways). > Only half, for my day job I work with UAV operations, and inspecting 600km of lines daily would be peanuts for something with military scale funding. A UAV cannot police 600km of fiber optics 24/7. 10 UAVs cannot either. The cost of this is nuts compared to the cost of using classical crypto -- and for what benefit?! There is no benefit to QKD, not any benefit at all. > Well I hope you don't think I was doing that, I'm just trying to figure out a use for it. It may be useful to train quantum physicists. Hmm, that may be its only use -- I can't think of any others.
    - nullc 5y ago
      The idea behind QKD is that it's secure if you have a MITM proof (but not passive observation proof) channel, even if all asymmetric algorithms are broken by quantum computers. Of course, this depends on your equipment not leaking extra photons or having other sidechannels... which seems harder than ordinary asymmetric crypto. But you would combine QKD with asymmetric crypto so that both would have to be broken to lose your link security. I don't think it's that generally interesting, but if you already have dedicated private fiber between your super secret secure facilities, -- why not?