3 ms·

Colleagues of mine are really hyped about this, but I don't understand why it's necessary. QKDS requires classical symmetric key crypto still, so this is only f

Colleagues of mine are really hyped about this, but I don't understand why it's necessary. QKDS requires classical symmetric key crypto still, so this is only for key exchange. There are a number of quantum-resistant public key algos on the horizon (e.g. lattice-based.) Even if public key were completely broken, you could ship hard drives full of one-time pads and cycle through keys every 15 minutes. Not to mention, a sophisticated adversary could still take advantage of a fiber cut to MitM the traffic (splice into the cable on both sides, negotiate keys separately between each side and yourself and then decrypt/re-encrypt/relay data.)

accurrent 5y ago
Im not an expert in this field but a colleague of mine did mention the mitm can be remedied using newer device independent qkd techniques. The main issue as I understand is QKD systems have very poor key rates, hence they arent very efficient.
- yodon 5y ago
  Apologies in advance as it's been a very long time since I was focused on Quantum Cryptography, so please be kind if I'm garbling things or stating things poorly. I haven't thought about this stuff in 20+ years so the mental paths are a bit rusty. The ultimate purpose of quantum crypto is to prevent eavesdropping on your channel. With quantum crypto, mitm attacks will almost always be the easiest form of attack so you can't trust quantum crypto if you can't prevent mitm attacks. If you share enough information to detect and prevent an mitm attack, you share enough info to form a classical crypto system with equivalent protection (as in, if you don't know who you are talking to, there's fundamentally no way to know if you've been mitm'ed, quantum crypto or not, so you have to share some kind of info with the other party in order to prove the end of the system is your intended recipient, and you can't bootstrap that sharing with your quantum crypto system so you must have found some secure key distribution mechanism to do so prior to using the quantum system - this is fundamentally the key distribution problem, and quantum doesn't actually help with this part it just obfuscates that it's happening because people get distracted by the shiny uncertainty principle math). That required shared info is what the security of your quantum crypto "protected" system is actually built on. You can do just as well at protecting your transmissions against eavesdropping using classical methods far more cheaply and far more easily. Someone, (possibly Bernstein?, it's been a long time since I was thinking about this stuff), wrote a paper in the late 90's on communicating over noisy channels (or using noisy channels to a public random number source? as I said, it's been 20 years) and showed as long as you could estimate/demonstrate that your channel had lower noise than your opponents you could use the knowledge of that noise difference to deliver any desired level of security through the channel. That paper didn't make an explicit connection to quantum crypto because quantum crypto was so new and so niche at the time, but all Quantum Crypto is really doing is providing a way to get a good estimate of the noise ratios between your channel and your attacker's channel. That's handy, but mostly theater. The rest works just as well classically.
cryptica 5y ago
Key exchange would be great though as the ability to securely share secret keys could then allow switching to a symmetric key encryption algorithm (these are usually simpler and more efficient). I believe RSA is mostly only used for key exchange anyway (due to bad performance) in popular protocols such as TLS. I'm not sure about the second part regarding the MitM attack; doesn't BB84's requirement of "the existence of an authenticated public classical channel." mitigate this? What kind of authentication is required there? Would signing a message using a secret key (e.g. Lamport OTS or some other quantum-resistant/hash-based signature algorithm) suffice to establish an 'authenticated channel'? The main problem I can see based on my limited understanding is that if an MitM attacker managed to intercept every key exchange attempt over a channel, they might not be able to intercept private messages, but they could prevent the encrypted channel from being formed.

accurrent 5y ago

Im not an expert in this field but a colleague of mine did mention the mitm can be remedied using newer device independent qkd techniques. The main issue as I understand is QKD systems have very poor key rates, hence they arent very efficient.

yodon 5y ago
Apologies in advance as it's been a very long time since I was focused on Quantum Cryptography, so please be kind if I'm garbling things or stating things poorly. I haven't thought about this stuff in 20+ years so the mental paths are a bit rusty. The ultimate purpose of quantum crypto is to prevent eavesdropping on your channel. With quantum crypto, mitm attacks will almost always be the easiest form of attack so you can't trust quantum crypto if you can't prevent mitm attacks. If you share enough information to detect and prevent an mitm attack, you share enough info to form a classical crypto system with equivalent protection (as in, if you don't know who you are talking to, there's fundamentally no way to know if you've been mitm'ed, quantum crypto or not, so you have to share some kind of info with the other party in order to prove the end of the system is your intended recipient, and you can't bootstrap that sharing with your quantum crypto system so you must have found some secure key distribution mechanism to do so prior to using the quantum system - this is fundamentally the key distribution problem, and quantum doesn't actually help with this part it just obfuscates that it's happening because people get distracted by the shiny uncertainty principle math). That required shared info is what the security of your quantum crypto "protected" system is actually built on. You can do just as well at protecting your transmissions against eavesdropping using classical methods far more cheaply and far more easily. Someone, (possibly Bernstein?, it's been a long time since I was thinking about this stuff), wrote a paper in the late 90's on communicating over noisy channels (or using noisy channels to a public random number source? as I said, it's been 20 years) and showed as long as you could estimate/demonstrate that your channel had lower noise than your opponents you could use the knowledge of that noise difference to deliver any desired level of security through the channel. That paper didn't make an explicit connection to quantum crypto because quantum crypto was so new and so niche at the time, but all Quantum Crypto is really doing is providing a way to get a good estimate of the noise ratios between your channel and your attacker's channel. That's handy, but mostly theater. The rest works just as well classically.

cryptica 5y ago

Key exchange would be great though as the ability to securely share secret keys could then allow switching to a symmetric key encryption algorithm (these are usually simpler and more efficient). I believe RSA is mostly only used for key exchange anyway (due to bad performance) in popular protocols such as TLS. I'm not sure about the second part regarding the MitM attack; doesn't BB84's requirement of "the existence of an authenticated public classical channel." mitigate this? What kind of authentication is required there? Would signing a message using a secret key (e.g. Lamport OTS or some other quantum-resistant/hash-based signature algorithm) suffice to establish an 'authenticated channel'? The main problem I can see based on my limited understanding is that if an MitM attacker managed to intercept every key exchange attempt over a channel, they might not be able to intercept private messages, but they could prevent the encrypted channel from being formed.