4 ms·

It was fascinating trying to get a letter to (I think it was) Phys Rev Letters published back in the 90's calling out the fundamental limitations of Quantum Cry

by yodon 5y ago

It was fascinating trying to get a letter to (I think it was) Phys Rev Letters published back in the 90's calling out the fundamental limitations of Quantum Crypto in response to the original Quantum Crypto paper. The Physicists who read the critique I wrote all said "well the Physics arguments you're making are obviously right, but I don't have the background to judge the Cryptography details" and the Cryptographers all said "well the Crypto arguments you're making are obviously right, but I don't have the background to judge the Physics details." Each side was in love with the idea of crossing over into each other's field, but neither side could see they'd built a house of cards in their joint ignorance of each other's fields. The amazing thing is from what I could tell it took more than a decade for any serious papers demonstrating its inherent limitations to be get properly published.

fsh 5y ago
The key fundamental weakness (the susceptibility to man-in-the-middle attacks) was addressed in the original BB84 publication [1]: The need for the public (non-quantum) channel in this scheme to be immune to active eavesdropping can be relaxed if the Alex and Bob have agreed beforehand on a small secret key, which they use to create Wegman-Carter multiple-message authentication tags for their messages over the public channel. Of course immediately raises the question why one should use QKD at all. If a shared secret is required anyway, why not simply use symmetric cryptography? In many modern articles, QKD is presented as a replacement for asymmetric cryptography. This I think is very misleading, since the reason for using asymmetric cryptography is that one does not need a shared secret. [1] http://researcher.watson.ibm.com/researcher/files/us-bennetc/BB84highest.pdf http://researcher.watson.ibm.com/researcher/files/us-bennetc...
- omegalulw 5y ago
  > Of course immediately raises the question why one should use QKD at all +1. Last I recall, AES is for the most part extremely resilient to attacks by quantum computers. It's RSA that drops dead.

by yodon 5y ago

fsh 5y ago

The key fundamental weakness (the susceptibility to man-in-the-middle attacks) was addressed in the original BB84 publication [1]: The need for the public (non-quantum) channel in this scheme to be immune to active eavesdropping can be relaxed if the Alex and Bob have agreed beforehand on a small secret key, which they use to create Wegman-Carter multiple-message authentication tags for their messages over the public channel. Of course immediately raises the question why one should use QKD at all. If a shared secret is required anyway, why not simply use symmetric cryptography? In many modern articles, QKD is presented as a replacement for asymmetric cryptography. This I think is very misleading, since the reason for using asymmetric cryptography is that one does not need a shared secret. [1] http://researcher.watson.ibm.com/researcher/files/us-bennetc/BB84highest.pdf http://researcher.watson.ibm.com/researcher/files/us-bennetc...

omegalulw 5y ago
> Of course immediately raises the question why one should use QKD at all +1. Last I recall, AES is for the most part extremely resilient to attacks by quantum computers. It's RSA that drops dead.