3 ms·

> You're going to be using classical crypto for bulk no matter what, so, no, you don't get that advantage, and anyways, what does anyone care what a session key

by tinco 5y ago

> You're going to be using classical crypto for bulk no matter what, so, no, you don't get that advantage, and anyways, what does anyone care what a session key is when they can get the session plaintext? You're right, there's no fundamental advantage there it seems. It could still just be a convenient way of rekeying very often (assuming it can "conveniently" be verified to be free of mitm) > You must be joking. Only half, for my day job I work with UAV operations, and inspecting 600km of lines daily would be peanuts for something with military scale funding. > No matter how hard anyone tries to find QKD to be better than classical crypto Well I hope you don't think I was doing that, I'm just trying to figure out a use for it.

cryptonector 5y ago
> It could still just be a convenient way of rekeying very often (assuming it can "conveniently" be verified to be free of mitm) No. ECDH is just fine. PQ crypto is also just fine. And no, QKD cannot be "conveniently" verified to be free of MITMs -- this is more important than whether QKD can be a "convenient way of rekeying very often" (which it isn't anyways). > Only half, for my day job I work with UAV operations, and inspecting 600km of lines daily would be peanuts for something with military scale funding. A UAV cannot police 600km of fiber optics 24/7. 10 UAVs cannot either. The cost of this is nuts compared to the cost of using classical crypto -- and for what benefit?! There is no benefit to QKD, not any benefit at all. > Well I hope you don't think I was doing that, I'm just trying to figure out a use for it. It may be useful to train quantum physicists. Hmm, that may be its only use -- I can't think of any others.
- nullc 5y ago
  The idea behind QKD is that it's secure if you have a MITM proof (but not passive observation proof) channel, even if all asymmetric algorithms are broken by quantum computers. Of course, this depends on your equipment not leaking extra photons or having other sidechannels... which seems harder than ordinary asymmetric crypto. But you would combine QKD with asymmetric crypto so that both would have to be broken to lose your link security. I don't think it's that generally interesting, but if you already have dedicated private fiber between your super secret secure facilities, -- why not?
  - cryptonector 5y ago
    QKD is trivially vulnerable to MITMs who have compatible QKD devices. QKD is only immune to eavesdroppers and active attacks by attackers who don't have QKD compatible devices. QKD only works for point-to-point links. If PQ happens and we have no PQ classical asymmetric algorithms, QKD cannot save us. We do not have time to rebuild the Internet around hop-by-hop security in a world of QKD, and anyways, QKD can be trivially MITMed, so this just doesn't work. Fortunately we do have some PQ classical algs. Fortunately we're not in a PQ world yet. If we end up being unfortunate (PQ happens before we deploy PQ classical algs) then QKD cannot help us. > I don't think it's that generally interesting, but if you already have dedicated private fiber between your super secret secure facilities, -- why not? Because I might as well use classical symmetric keying and not worry about PQ.
    - freemint 5y ago
      You are ignoring one important aspect, namely timing. The speed of light is well known so if the latency suddenly increases when accessing information that is not available at the MITM you know the connection is compromised.
      - cryptonector 5y ago
        Well, so how much latency would an MITM add? If it's small enough, then forget it, this won't do.
        freemint 5y ago
        If think the sender can force an arbitrary latency in decoding with a signal with noise added but i might be wrong. If the MITM sends a signal before the measurement is complete (ccertainty that the noise is leaning one way is above threshold) he either produces unlikely signals (detectable, since all the information is sent after the decode, htus the signals entropy will vay with time n a stair step way) or he occasionally transmits a wrong signal.
    - nullc 5y ago

by tinco 5y ago

cryptonector 5y ago

> It could still just be a convenient way of rekeying very often (assuming it can "conveniently" be verified to be free of mitm) No. ECDH is just fine. PQ crypto is also just fine. And no, QKD cannot be "conveniently" verified to be free of MITMs -- this is more important than whether QKD can be a "convenient way of rekeying very often" (which it isn't anyways). > Only half, for my day job I work with UAV operations, and inspecting 600km of lines daily would be peanuts for something with military scale funding. A UAV cannot police 600km of fiber optics 24/7. 10 UAVs cannot either. The cost of this is nuts compared to the cost of using classical crypto -- and for what benefit?! There is no benefit to QKD, not any benefit at all. > Well I hope you don't think I was doing that, I'm just trying to figure out a use for it. It may be useful to train quantum physicists. Hmm, that may be its only use -- I can't think of any others.

nullc 5y ago
The idea behind QKD is that it's secure if you have a MITM proof (but not passive observation proof) channel, even if all asymmetric algorithms are broken by quantum computers. Of course, this depends on your equipment not leaking extra photons or having other sidechannels... which seems harder than ordinary asymmetric crypto. But you would combine QKD with asymmetric crypto so that both would have to be broken to lose your link security. I don't think it's that generally interesting, but if you already have dedicated private fiber between your super secret secure facilities, -- why not?
- cryptonector 5y ago
  QKD is trivially vulnerable to MITMs who have compatible QKD devices. QKD is only immune to eavesdroppers and active attacks by attackers who don't have QKD compatible devices. QKD only works for point-to-point links. If PQ happens and we have no PQ classical asymmetric algorithms, QKD cannot save us. We do not have time to rebuild the Internet around hop-by-hop security in a world of QKD, and anyways, QKD can be trivially MITMed, so this just doesn't work. Fortunately we do have some PQ classical algs. Fortunately we're not in a PQ world yet. If we end up being unfortunate (PQ happens before we deploy PQ classical algs) then QKD cannot help us. > I don't think it's that generally interesting, but if you already have dedicated private fiber between your super secret secure facilities, -- why not? Because I might as well use classical symmetric keying and not worry about PQ.
  - freemint 5y ago
    You are ignoring one important aspect, namely timing. The speed of light is well known so if the latency suddenly increases when accessing information that is not available at the MITM you know the connection is compromised.
    - cryptonector 5y ago
      Well, so how much latency would an MITM add? If it's small enough, then forget it, this won't do.
      - freemint 5y ago
        If think the sender can force an arbitrary latency in decoding with a signal with noise added but i might be wrong. If the MITM sends a signal before the measurement is complete (ccertainty that the noise is leaning one way is above threshold) he either produces unlikely signals (detectable, since all the information is sent after the decode, htus the signals entropy will vay with time n a stair step way) or he occasionally transmits a wrong signal.
  - nullc 5y ago