4 ms·

If I'm understanding this correctly, the "serious flaw" recently uncovered is that if the manufacturer of the crypto devices is malicious, the crypto devices ca

by srl 15y ago

If I'm understanding this correctly, the "serious flaw" recently uncovered is that if the manufacturer of the crypto devices is malicious, the crypto devices can be made to be insecure. Despite the fact that this same "serious flaw" exists with classical cryptography devices, only worse (since the quantum attack doesn't reveal plaintext A until B is sent). (Disclosure: haven't bothered to read the arXicle.)

bcl 15y ago
I read it and you're right. I'm puzzled as to why they would think this 'scuppers' all of quantum cryptography. They also mention imperfect hardware, but hardware always improves.
- beloch 15y ago
  This obviously doesn't have any impact on those who own and trust the sender and receiver and only need to be cautious about what happens in between them. However, part of the desire for device independent security is that you can use public infrastructure without trusting it and still be certain that your communication is secure. i.e. If quantum networks replace/augment classical networks, can you trust them without controlling them? This work suggests that dream may be more difficult to achieve that previously thought, although the jury is most assuredly still out.
  - Groxx 15y ago
    Isn't that everyone? Quantum crypto does nothing for authentication as far as I'm aware, so you still need to identify your recipient by some method. It requires hardware as far as I'm aware, so you still need to trust the sending and receiving hardware. Which leaves you with just the medium of transmission; if it's crypto you're trusting, the medium doesn't matter. If it's quantum effects for communicating, the only trick I'm aware of lets quantum-crypto-communication detect observers, which this 'scuppering' has no effect on.
tjoff 15y ago
Despite the fact that this same "serious flaw" exists with classical cryptography devices, only worse (since the quantum attack doesn't reveal plaintext A until B is sent). How would you do this with classical cryptography? Isn't the point about this particular flaw that it is pretty much undetectable (other than inspecting the hardware itself (which is outside the scope of the article that treats it as a black box)). If the same were to be implemented on classical cryptography it would be comparatively trivial to detect if someone tried to sneak in an old message interleaved with a new message (you know the plaintext + key and thus you know exactly what that will generate). The compelling argument for quantum cryptography is that it is provably secure (well, that's the theory) and it is quite difficult to prove that the hardware has not been tampered with. The thing you could do with classical cryptography is to in some way "leak" the key (such as what debian inadvertently did with openssl) but the whole point of quantum cryptography is to have a perfect key distribution to combat any known or unknown attacks. I found the abstract, http://arxiv.org/abs/1201.4407 http://arxiv.org/abs/1201.4407 , shorter and more informative than the article.
- aidenn0 15y ago
  "How would you do this with classical cryptography?" Nearly every classical cryptography device uses a source of entropy; if you break that intentionally then you have a side-channel.
greeneggs 15y ago
The Technology Review article is confusing, but I can try to summarize. Quantum key distribution (QKD) promises security based on the laws of quantum physics, and not on computational assumptions. However, in practice, QKD experiments have been attacked through side channels. One possible side channel comes from a malicious manufacturer. Side-channel attacks also affect classical cryptography, of course, but might be more important for QKD because: 1. Quantum devices are harder to build and test, and less understood, than classical devices, so side-channel attacks might be easier, at least for now. 2. The goal of QKD has always been to reach higher security than is possible classically. "Device-independent" (DI) QKD solves this problem. DIQKD allows for extracting a secure key even if the crypto devices are manufactured by your enemy. This should be hard to believe; it is completely impossible classically. It is very cool that it is (probably) possible quantumly. I say "probably" because full DIQKD security proofs do not yet exist; giving a full proof is a major open problem in the field. From the perspective of people in the field, the next step in the DIQKD roadmap would be to deploy a DIQKD experiment. Although standard QKD schemes are even commercially available these days, deploying a DIQKD scheme is another major open problem because the schemes proposed currently are far too inefficient to be practical and require noise rates below current photon detector technology. The new paper says that we should reconsider this roadmap. Even if we are able to give a DIQKD security proof, there is still a problem, because when you reuse untrusted devices they can leak previously generated keys. I don't have a lot of time to explain this and don't know that it is an especially novel observation. It can probably be worked around with more sophisticated key-generation methods. But that's essentially the current status.

by srl 15y ago

bcl 15y ago

I read it and you're right. I'm puzzled as to why they would think this 'scuppers' all of quantum cryptography. They also mention imperfect hardware, but hardware always improves.

beloch 15y ago
This obviously doesn't have any impact on those who own and trust the sender and receiver and only need to be cautious about what happens in between them. However, part of the desire for device independent security is that you can use public infrastructure without trusting it and still be certain that your communication is secure. i.e. If quantum networks replace/augment classical networks, can you trust them without controlling them? This work suggests that dream may be more difficult to achieve that previously thought, although the jury is most assuredly still out.
- Groxx 15y ago
  Isn't that everyone? Quantum crypto does nothing for authentication as far as I'm aware, so you still need to identify your recipient by some method. It requires hardware as far as I'm aware, so you still need to trust the sending and receiving hardware. Which leaves you with just the medium of transmission; if it's crypto you're trusting, the medium doesn't matter. If it's quantum effects for communicating, the only trick I'm aware of lets quantum-crypto-communication detect observers, which this 'scuppering' has no effect on.

tjoff 15y ago

Despite the fact that this same "serious flaw" exists with classical cryptography devices, only worse (since the quantum attack doesn't reveal plaintext A until B is sent). How would you do this with classical cryptography? Isn't the point about this particular flaw that it is pretty much undetectable (other than inspecting the hardware itself (which is outside the scope of the article that treats it as a black box)). If the same were to be implemented on classical cryptography it would be comparatively trivial to detect if someone tried to sneak in an old message interleaved with a new message (you know the plaintext + key and thus you know exactly what that will generate). The compelling argument for quantum cryptography is that it is provably secure (well, that's the theory) and it is quite difficult to prove that the hardware has not been tampered with. The thing you could do with classical cryptography is to in some way "leak" the key (such as what debian inadvertently did with openssl) but the whole point of quantum cryptography is to have a perfect key distribution to combat any known or unknown attacks. I found the abstract, http://arxiv.org/abs/1201.4407 http://arxiv.org/abs/1201.4407 , shorter and more informative than the article.

aidenn0 15y ago
"How would you do this with classical cryptography?" Nearly every classical cryptography device uses a source of entropy; if you break that intentionally then you have a side-channel.

greeneggs 15y ago

The Technology Review article is confusing, but I can try to summarize. Quantum key distribution (QKD) promises security based on the laws of quantum physics, and not on computational assumptions. However, in practice, QKD experiments have been attacked through side channels. One possible side channel comes from a malicious manufacturer. Side-channel attacks also affect classical cryptography, of course, but might be more important for QKD because: 1. Quantum devices are harder to build and test, and less understood, than classical devices, so side-channel attacks might be easier, at least for now. 2. The goal of QKD has always been to reach higher security than is possible classically. "Device-independent" (DI) QKD solves this problem. DIQKD allows for extracting a secure key even if the crypto devices are manufactured by your enemy. This should be hard to believe; it is completely impossible classically. It is very cool that it is (probably) possible quantumly. I say "probably" because full DIQKD security proofs do not yet exist; giving a full proof is a major open problem in the field. From the perspective of people in the field, the next step in the DIQKD roadmap would be to deploy a DIQKD experiment. Although standard QKD schemes are even commercially available these days, deploying a DIQKD scheme is another major open problem because the schemes proposed currently are far too inefficient to be practical and require noise rates below current photon detector technology. The new paper says that we should reconsider this roadmap. Even if we are able to give a DIQKD security proof, there is still a problem, because when you reuse untrusted devices they can leak previously generated keys. I don't have a lot of time to explain this and don't know that it is an especially novel observation. It can probably be worked around with more sophisticated key-generation methods. But that's essentially the current status.