7 ms·

Serious Flaw Emerges In Quantum Cryptography

34 points by llambda 15y ago

srl 15y ago
If I'm understanding this correctly, the "serious flaw" recently uncovered is that if the manufacturer of the crypto devices is malicious, the crypto devices can be made to be insecure. Despite the fact that this same "serious flaw" exists with classical cryptography devices, only worse (since the quantum attack doesn't reveal plaintext A until B is sent). (Disclosure: haven't bothered to read the arXicle.)
- bcl 15y ago
  I read it and you're right. I'm puzzled as to why they would think this 'scuppers' all of quantum cryptography. They also mention imperfect hardware, but hardware always improves.
  - beloch 15y ago
    This obviously doesn't have any impact on those who own and trust the sender and receiver and only need to be cautious about what happens in between them. However, part of the desire for device independent security is that you can use public infrastructure without trusting it and still be certain that your communication is secure. i.e. If quantum networks replace/augment classical networks, can you trust them without controlling them? This work suggests that dream may be more difficult to achieve that previously thought, although the jury is most assuredly still out.
    - Groxx 15y ago
      Isn't that everyone? Quantum crypto does nothing for authentication as far as I'm aware, so you still need to identify your recipient by some method. It requires hardware as far as I'm aware, so you still need to trust the sending and receiving hardware. Which leaves you with just the medium of transmission; if it's crypto you're trusting, the medium doesn't matter. If it's quantum effects for communicating, the only trick I'm aware of lets quantum-crypto-communication detect observers, which this 'scuppering' has no effect on.
- tjoff 15y ago
  Despite the fact that this same "serious flaw" exists with classical cryptography devices, only worse (since the quantum attack doesn't reveal plaintext A until B is sent). How would you do this with classical cryptography? Isn't the point about this particular flaw that it is pretty much undetectable (other than inspecting the hardware itself (which is outside the scope of the article that treats it as a black box)). If the same were to be implemented on classical cryptography it would be comparatively trivial to detect if someone tried to sneak in an old message interleaved with a new message (you know the plaintext + key and thus you know exactly what that will generate). The compelling argument for quantum cryptography is that it is provably secure (well, that's the theory) and it is quite difficult to prove that the hardware has not been tampered with. The thing you could do with classical cryptography is to in some way "leak" the key (such as what debian inadvertently did with openssl) but the whole point of quantum cryptography is to have a perfect key distribution to combat any known or unknown attacks. I found the abstract, http://arxiv.org/abs/1201.4407 http://arxiv.org/abs/1201.4407 , shorter and more informative than the article.
  - aidenn0 15y ago
    "How would you do this with classical cryptography?" Nearly every classical cryptography device uses a source of entropy; if you break that intentionally then you have a side-channel.
- greeneggs 15y ago
  The Technology Review article is confusing, but I can try to summarize. Quantum key distribution (QKD) promises security based on the laws of quantum physics, and not on computational assumptions. However, in practice, QKD experiments have been attacked through side channels. One possible side channel comes from a malicious manufacturer. Side-channel attacks also affect classical cryptography, of course, but might be more important for QKD because: 1. Quantum devices are harder to build and test, and less understood, than classical devices, so side-channel attacks might be easier, at least for now. 2. The goal of QKD has always been to reach higher security than is possible classically. "Device-independent" (DI) QKD solves this problem. DIQKD allows for extracting a secure key even if the crypto devices are manufactured by your enemy. This should be hard to believe; it is completely impossible classically. It is very cool that it is (probably) possible quantumly. I say "probably" because full DIQKD security proofs do not yet exist; giving a full proof is a major open problem in the field. From the perspective of people in the field, the next step in the DIQKD roadmap would be to deploy a DIQKD experiment. Although standard QKD schemes are even commercially available these days, deploying a DIQKD scheme is another major open problem because the schemes proposed currently are far too inefficient to be practical and require noise rates below current photon detector technology. The new paper says that we should reconsider this roadmap. Even if we are able to give a DIQKD security proof, there is still a problem, because when you reuse untrusted devices they can leak previously generated keys. I don't have a lot of time to explain this and don't know that it is an especially novel observation. It can probably be worked around with more sophisticated key-generation methods. But that's essentially the current status.
VikingCoder 15y ago
Okay, here I go on a tangent: If I buy two 5-bay DROBOs, 10 2 TB HDs, and a hardware random number generator, I could make a multi-TB One Time Pad, and copy it onto the second DROBO. I keep DROBO one, and physically carry DROBO two to my intended recipient. What are the problems with this? It's cheap. It's as secure as any communication could possibly be. It provides for a whole lot of communication, with relatively little physical effort.
- tjoff 15y ago
  You can't prove that you can trust the carrier. And with trust I not only mean that the carrier has good intentions but also that the carrier is physically unable to do any mistakes. Also you can't prove that someone doesn't sniff the traffic when you copy it to your second DROBO and you can't prove that none of the drives have been copied afterwards. Not saying that your approach isn't "secure enough" (I'd guess that's what they do on submarines?), but compared to (the theory of) quantum cryptography it has many flaws.
  - VikingCoder 15y ago
    Thanks for the reply! > You can't prove that you can trust the carrier. I said that I physically carry DROBO two to my intended recipient. I can trust myself. > Also you can't prove that someone doesn't sniff the traffic when you copy it to your second DROBO and you can't prove that none of the drives have been copied afterwards. There is no such thing as secure communication. Copying data from one DROBO to another DROBO is about as secure as I could possibly imagine. Physical security is a failure point in any system. As much as I can trust my sending location, and my receiving location, I can trust this system. > compared to (the theory of) quantum cryptography it has many flaws. Compared to quantum cryptography: I can't prove that I trust the person who set up the quantum cryptography system. I can't prove that someone doesn't sniff my connection to my quantum key system. I can't prove that someone doesn't sniff the data coming out on the receiving end. I think this all boils down to physical security - which is a problem in any secure communication system. And I think my two DROBO, ten HD, one hardware random number generator, one round-trip plane ticket, system is about - mmm - 4 to 6 orders of magnitude cheaper.
benmmurphy 15y ago
i don't understand how it is not susceptible to MITM attacks. how do you know you know the thing at the other end is really who you want to talk to without using some kind of preshared key? maybe an eavesdropper can't view the conversation between you and the other end but that doesn't matter if someone can easily pretend to be the other end.
- cgray4 15y ago
  As far as I understand it (which isn't too far), quantum bits are physical things. So only the person who has the qubits can see the key exchange. As long as the qubits are physically safe in the hands of the person you want to talk to (admittedly a big if), there can't be a MITM attack.
- greeneggs 15y ago
  Both standard quantum key distribution (QKD) and device-independent quantum key distribution schemes assume that the two parties share an authenticated classical channel. Without authentication, of course you cannot prevent man-in-the-middle attacks. Authentication can be established using a shared secret (which is why purists sometimes refer to QKD as a key expansion protocol). Or, it can be established using signatures and certificate authorities. It is worth pointing out that man-in-the-middle (MITM) attacks must be made online; if you break a signature scheme a year after the QKD protocol finishes, it does not compromise the key.
- ArbitraryLimits 15y ago
  It's possible to structure "quantum communication" (meaning passing qubits back and forth, basically) so that if someone in the middle reads them at all, the recipient is aware of it. It's not really possible to prevent the interception but it is possible always to detect it, at least in theory.
Groxx 15y ago
>"In short, the problem is that an adversary can program devices to store data in one protocol and leak it in subsequent protocols, in ways that are hard or impossible to counter if the devices are reused," say Barrett and co. You mean, if you store the encryption key and later reveal it to outside sources, your secure communication is no longer secure? SHOCK AND AWE. It's complete fluff that has nothing to do with quantum cryptography, just the intrinsic chain-of-trust of whatever hardware you're using. If something you're using is untrustworthy, the whole chain is - this is not a new discovery.

34 points by llambda 15y ago

srl 15y ago

If I'm understanding this correctly, the "serious flaw" recently uncovered is that if the manufacturer of the crypto devices is malicious, the crypto devices can be made to be insecure. Despite the fact that this same "serious flaw" exists with classical cryptography devices, only worse (since the quantum attack doesn't reveal plaintext A until B is sent). (Disclosure: haven't bothered to read the arXicle.)

bcl 15y ago
I read it and you're right. I'm puzzled as to why they would think this 'scuppers' all of quantum cryptography. They also mention imperfect hardware, but hardware always improves.
- beloch 15y ago
  This obviously doesn't have any impact on those who own and trust the sender and receiver and only need to be cautious about what happens in between them. However, part of the desire for device independent security is that you can use public infrastructure without trusting it and still be certain that your communication is secure. i.e. If quantum networks replace/augment classical networks, can you trust them without controlling them? This work suggests that dream may be more difficult to achieve that previously thought, although the jury is most assuredly still out.
  - Groxx 15y ago
    Isn't that everyone? Quantum crypto does nothing for authentication as far as I'm aware, so you still need to identify your recipient by some method. It requires hardware as far as I'm aware, so you still need to trust the sending and receiving hardware. Which leaves you with just the medium of transmission; if it's crypto you're trusting, the medium doesn't matter. If it's quantum effects for communicating, the only trick I'm aware of lets quantum-crypto-communication detect observers, which this 'scuppering' has no effect on.
tjoff 15y ago
Despite the fact that this same "serious flaw" exists with classical cryptography devices, only worse (since the quantum attack doesn't reveal plaintext A until B is sent). How would you do this with classical cryptography? Isn't the point about this particular flaw that it is pretty much undetectable (other than inspecting the hardware itself (which is outside the scope of the article that treats it as a black box)). If the same were to be implemented on classical cryptography it would be comparatively trivial to detect if someone tried to sneak in an old message interleaved with a new message (you know the plaintext + key and thus you know exactly what that will generate). The compelling argument for quantum cryptography is that it is provably secure (well, that's the theory) and it is quite difficult to prove that the hardware has not been tampered with. The thing you could do with classical cryptography is to in some way "leak" the key (such as what debian inadvertently did with openssl) but the whole point of quantum cryptography is to have a perfect key distribution to combat any known or unknown attacks. I found the abstract, http://arxiv.org/abs/1201.4407 http://arxiv.org/abs/1201.4407 , shorter and more informative than the article.
- aidenn0 15y ago
  "How would you do this with classical cryptography?" Nearly every classical cryptography device uses a source of entropy; if you break that intentionally then you have a side-channel.
greeneggs 15y ago
The Technology Review article is confusing, but I can try to summarize. Quantum key distribution (QKD) promises security based on the laws of quantum physics, and not on computational assumptions. However, in practice, QKD experiments have been attacked through side channels. One possible side channel comes from a malicious manufacturer. Side-channel attacks also affect classical cryptography, of course, but might be more important for QKD because: 1. Quantum devices are harder to build and test, and less understood, than classical devices, so side-channel attacks might be easier, at least for now. 2. The goal of QKD has always been to reach higher security than is possible classically. "Device-independent" (DI) QKD solves this problem. DIQKD allows for extracting a secure key even if the crypto devices are manufactured by your enemy. This should be hard to believe; it is completely impossible classically. It is very cool that it is (probably) possible quantumly. I say "probably" because full DIQKD security proofs do not yet exist; giving a full proof is a major open problem in the field. From the perspective of people in the field, the next step in the DIQKD roadmap would be to deploy a DIQKD experiment. Although standard QKD schemes are even commercially available these days, deploying a DIQKD scheme is another major open problem because the schemes proposed currently are far too inefficient to be practical and require noise rates below current photon detector technology. The new paper says that we should reconsider this roadmap. Even if we are able to give a DIQKD security proof, there is still a problem, because when you reuse untrusted devices they can leak previously generated keys. I don't have a lot of time to explain this and don't know that it is an especially novel observation. It can probably be worked around with more sophisticated key-generation methods. But that's essentially the current status.

VikingCoder 15y ago

Okay, here I go on a tangent: If I buy two 5-bay DROBOs, 10 2 TB HDs, and a hardware random number generator, I could make a multi-TB One Time Pad, and copy it onto the second DROBO. I keep DROBO one, and physically carry DROBO two to my intended recipient. What are the problems with this? It's cheap. It's as secure as any communication could possibly be. It provides for a whole lot of communication, with relatively little physical effort.

tjoff 15y ago
You can't prove that you can trust the carrier. And with trust I not only mean that the carrier has good intentions but also that the carrier is physically unable to do any mistakes. Also you can't prove that someone doesn't sniff the traffic when you copy it to your second DROBO and you can't prove that none of the drives have been copied afterwards. Not saying that your approach isn't "secure enough" (I'd guess that's what they do on submarines?), but compared to (the theory of) quantum cryptography it has many flaws.
- VikingCoder 15y ago
  Thanks for the reply! > You can't prove that you can trust the carrier. I said that I physically carry DROBO two to my intended recipient. I can trust myself. > Also you can't prove that someone doesn't sniff the traffic when you copy it to your second DROBO and you can't prove that none of the drives have been copied afterwards. There is no such thing as secure communication. Copying data from one DROBO to another DROBO is about as secure as I could possibly imagine. Physical security is a failure point in any system. As much as I can trust my sending location, and my receiving location, I can trust this system. > compared to (the theory of) quantum cryptography it has many flaws. Compared to quantum cryptography: I can't prove that I trust the person who set up the quantum cryptography system. I can't prove that someone doesn't sniff my connection to my quantum key system. I can't prove that someone doesn't sniff the data coming out on the receiving end. I think this all boils down to physical security - which is a problem in any secure communication system. And I think my two DROBO, ten HD, one hardware random number generator, one round-trip plane ticket, system is about - mmm - 4 to 6 orders of magnitude cheaper.

benmmurphy 15y ago

i don't understand how it is not susceptible to MITM attacks. how do you know you know the thing at the other end is really who you want to talk to without using some kind of preshared key? maybe an eavesdropper can't view the conversation between you and the other end but that doesn't matter if someone can easily pretend to be the other end.

cgray4 15y ago
As far as I understand it (which isn't too far), quantum bits are physical things. So only the person who has the qubits can see the key exchange. As long as the qubits are physically safe in the hands of the person you want to talk to (admittedly a big if), there can't be a MITM attack.
greeneggs 15y ago
Both standard quantum key distribution (QKD) and device-independent quantum key distribution schemes assume that the two parties share an authenticated classical channel. Without authentication, of course you cannot prevent man-in-the-middle attacks. Authentication can be established using a shared secret (which is why purists sometimes refer to QKD as a key expansion protocol). Or, it can be established using signatures and certificate authorities. It is worth pointing out that man-in-the-middle (MITM) attacks must be made online; if you break a signature scheme a year after the QKD protocol finishes, it does not compromise the key.
ArbitraryLimits 15y ago
It's possible to structure "quantum communication" (meaning passing qubits back and forth, basically) so that if someone in the middle reads them at all, the recipient is aware of it. It's not really possible to prevent the interception but it is possible always to detect it, at least in theory.

Groxx 15y ago

>"In short, the problem is that an adversary can program devices to store data in one protocol and leak it in subsequent protocols, in ways that are hard or impossible to counter if the devices are reused," say Barrett and co. You mean, if you store the encryption key and later reveal it to outside sources, your secure communication is no longer secure? SHOCK AND AWE. It's complete fluff that has nothing to do with quantum cryptography, just the intrinsic chain-of-trust of whatever hardware you're using. If something you're using is untrustworthy, the whole chain is - this is not a new discovery.