3 ms·

Alright, so my initial response is this: Luckily I'm not in charge of setting up a QKD network at the moment. I have no idea what the actual usecase is for thes

by tinco 5y ago

Alright, so my initial response is this: Luckily I'm not in charge of setting up a QKD network at the moment. I have no idea what the actual usecase is for these things. I fully agree that simply sending a "runner" with the PSK in some sort of tamper proof container (glitter nail polish?) achieves basically the same thing, and about a thousand orders of magnitude cheaper. But then I thought about it for a while longer, and I came up with this: Maybe the advantage is that the private key never actually can be read by anyone, not even the two communicating parties, thus basically eradicating the possibility of spies or betrayal within your engineering ranks. If you can guarantee the physical integrity of the line for the entire 600km, you're also basically set. The only actual attack on QKD is setting up those MITM's, maybe even only during the initial set up? I don't know how often the entanglement has to be reset, are they permanently entangled or is there a reestablishing every so often?

cryptonector 5y ago
> Maybe the advantage is that the private key never actually can be read by anyone [...] You're going to be using classical crypto for bulk no matter what, so, no, you don't get that advantage, and anyways, what does anyone care what a session key is when they can get the session plaintext? Worried about decryption of ciphertext the attacker did not earlier get the plaintext to? Just re-key often. > If you can guarantee the physical integrity of the line for the entire 600km, you're also basically set. You must be joking. With classical crypto I just don't have to care if the physical link is secure (except for DoS concerns -- please don't backhoe-cut my links!). For bulk symmetric crypto PQ is not even that much of a concern. And if we ever get to a PQ world, the lack of quantum authentication technology means that QKD will not be a solution to our PQ problems. No matter how hard anyone tries to find QKD to be better than classical crypto, it just isn't.
- tinco 5y ago
  > You're going to be using classical crypto for bulk no matter what, so, no, you don't get that advantage, and anyways, what does anyone care what a session key is when they can get the session plaintext? You're right, there's no fundamental advantage there it seems. It could still just be a convenient way of rekeying very often (assuming it can "conveniently" be verified to be free of mitm) > You must be joking. Only half, for my day job I work with UAV operations, and inspecting 600km of lines daily would be peanuts for something with military scale funding. > No matter how hard anyone tries to find QKD to be better than classical crypto Well I hope you don't think I was doing that, I'm just trying to figure out a use for it.
  - cryptonector 5y ago
    > It could still just be a convenient way of rekeying very often (assuming it can "conveniently" be verified to be free of mitm) No. ECDH is just fine. PQ crypto is also just fine. And no, QKD cannot be "conveniently" verified to be free of MITMs -- this is more important than whether QKD can be a "convenient way of rekeying very often" (which it isn't anyways). > Only half, for my day job I work with UAV operations, and inspecting 600km of lines daily would be peanuts for something with military scale funding. A UAV cannot police 600km of fiber optics 24/7. 10 UAVs cannot either. The cost of this is nuts compared to the cost of using classical crypto -- and for what benefit?! There is no benefit to QKD, not any benefit at all. > Well I hope you don't think I was doing that, I'm just trying to figure out a use for it. It may be useful to train quantum physicists. Hmm, that may be its only use -- I can't think of any others.
    - nullc 5y ago
      The idea behind QKD is that it's secure if you have a MITM proof (but not passive observation proof) channel, even if all asymmetric algorithms are broken by quantum computers. Of course, this depends on your equipment not leaking extra photons or having other sidechannels... which seems harder than ordinary asymmetric crypto. But you would combine QKD with asymmetric crypto so that both would have to be broken to lose your link security. I don't think it's that generally interesting, but if you already have dedicated private fiber between your super secret secure facilities, -- why not?
      - cryptonector 5y ago
        QKD is trivially vulnerable to MITMs who have compatible QKD devices. QKD is only immune to eavesdroppers and active attacks by attackers who don't have QKD compatible devices. QKD only works for point-to-point links. If PQ happens and we have no PQ classical asymmetric algorithms, QKD cannot save us. We do not have time to rebuild the Internet around hop-by-hop security in a world of QKD, and anyways, QKD can be trivially MITMed, so this just doesn't work. Fortunately we do have some PQ classical algs. Fortunately we're not in a PQ world yet. If we end up being unfortunate (PQ happens before we deploy PQ classical algs) then QKD cannot help us. > I don't think it's that generally interesting, but if you already have dedicated private fiber between your super secret secure facilities, -- why not? Because I might as well use classical symmetric keying and not worry about PQ.

by tinco 5y ago

cryptonector 5y ago

> Maybe the advantage is that the private key never actually can be read by anyone [...] You're going to be using classical crypto for bulk no matter what, so, no, you don't get that advantage, and anyways, what does anyone care what a session key is when they can get the session plaintext? Worried about decryption of ciphertext the attacker did not earlier get the plaintext to? Just re-key often. > If you can guarantee the physical integrity of the line for the entire 600km, you're also basically set. You must be joking. With classical crypto I just don't have to care if the physical link is secure (except for DoS concerns -- please don't backhoe-cut my links!). For bulk symmetric crypto PQ is not even that much of a concern. And if we ever get to a PQ world, the lack of quantum authentication technology means that QKD will not be a solution to our PQ problems. No matter how hard anyone tries to find QKD to be better than classical crypto, it just isn't.

tinco 5y ago
> You're going to be using classical crypto for bulk no matter what, so, no, you don't get that advantage, and anyways, what does anyone care what a session key is when they can get the session plaintext? You're right, there's no fundamental advantage there it seems. It could still just be a convenient way of rekeying very often (assuming it can "conveniently" be verified to be free of mitm) > You must be joking. Only half, for my day job I work with UAV operations, and inspecting 600km of lines daily would be peanuts for something with military scale funding. > No matter how hard anyone tries to find QKD to be better than classical crypto Well I hope you don't think I was doing that, I'm just trying to figure out a use for it.
- cryptonector 5y ago
  > It could still just be a convenient way of rekeying very often (assuming it can "conveniently" be verified to be free of mitm) No. ECDH is just fine. PQ crypto is also just fine. And no, QKD cannot be "conveniently" verified to be free of MITMs -- this is more important than whether QKD can be a "convenient way of rekeying very often" (which it isn't anyways). > Only half, for my day job I work with UAV operations, and inspecting 600km of lines daily would be peanuts for something with military scale funding. A UAV cannot police 600km of fiber optics 24/7. 10 UAVs cannot either. The cost of this is nuts compared to the cost of using classical crypto -- and for what benefit?! There is no benefit to QKD, not any benefit at all. > Well I hope you don't think I was doing that, I'm just trying to figure out a use for it. It may be useful to train quantum physicists. Hmm, that may be its only use -- I can't think of any others.
  - nullc 5y ago
    The idea behind QKD is that it's secure if you have a MITM proof (but not passive observation proof) channel, even if all asymmetric algorithms are broken by quantum computers. Of course, this depends on your equipment not leaking extra photons or having other sidechannels... which seems harder than ordinary asymmetric crypto. But you would combine QKD with asymmetric crypto so that both would have to be broken to lose your link security. I don't think it's that generally interesting, but if you already have dedicated private fiber between your super secret secure facilities, -- why not?
    - cryptonector 5y ago
      QKD is trivially vulnerable to MITMs who have compatible QKD devices. QKD is only immune to eavesdroppers and active attacks by attackers who don't have QKD compatible devices. QKD only works for point-to-point links. If PQ happens and we have no PQ classical asymmetric algorithms, QKD cannot save us. We do not have time to rebuild the Internet around hop-by-hop security in a world of QKD, and anyways, QKD can be trivially MITMed, so this just doesn't work. Fortunately we do have some PQ classical algs. Fortunately we're not in a PQ world yet. If we end up being unfortunate (PQ happens before we deploy PQ classical algs) then QKD cannot help us. > I don't think it's that generally interesting, but if you already have dedicated private fiber between your super secret secure facilities, -- why not? Because I might as well use classical symmetric keying and not worry about PQ.