3 ms·

Large companies and governments go to some lengths to protect their internal communications between their sites. Cloud providers also have some dedicated fiber

Large companies and governments go to some lengths to protect their internal communications between their sites. Cloud providers also have some dedicated fiber between their data centers.

xyzzy123 2y ago
Right but what are they going to do with the keys being exchanged? Load them into networked traditional computers? If the computers are secure they can presumably do authenticated key agreement perfectly well and if they are not then I don't see how the QKD helps. Security is nuanced and thinking in binaries is often a mistake - but I don't see how QKD meaningfully changes anyone's threat model in any plausible deployment scenario.
- amluto 2y ago
  QKD will generate a session key, just like Diffie-Hellman or some of the post-quantum DH alternatives. If your threat model includes the risk that someone captures and stores ciphertext and subsequently gets access to a quantum computer and the ability to break whatever post-quantum scheme you’ve augmented with, then maybe QKD is useful. I agree that this is a bit of a stretch. (Of course, one can also augment DH with symmetric crypto for the datacenter use case, with someone trustworthy literally carrying the key to the other end of the link, and I see no realistic usage of QKD that will outperform that unless one is worried about post-compromise recovery of a symmetric key stored in a piece of hardware. Plus, QKD has its own issues: security of QKD is subject to catastrophic failures if the single-photon source isn’t actually a single-photon source and possibly also if a malicious light source injected into the fiber causes the transmitter to stop being a single-photon source or the receiver to behave in a manner inconsistent with any possible single received photon. Think of these as side channel and fault attacks that are rather difficult to manage.)

Large companies and governments go to some lengths to protect their internal communications between their sites. Cloud providers also have some dedicated fiber between their data centers.

xyzzy123 2y ago

Right but what are they going to do with the keys being exchanged? Load them into networked traditional computers? If the computers are secure they can presumably do authenticated key agreement perfectly well and if they are not then I don't see how the QKD helps. Security is nuanced and thinking in binaries is often a mistake - but I don't see how QKD meaningfully changes anyone's threat model in any plausible deployment scenario.

amluto 2y ago
QKD will generate a session key, just like Diffie-Hellman or some of the post-quantum DH alternatives. If your threat model includes the risk that someone captures and stores ciphertext and subsequently gets access to a quantum computer and the ability to break whatever post-quantum scheme you’ve augmented with, then maybe QKD is useful. I agree that this is a bit of a stretch. (Of course, one can also augment DH with symmetric crypto for the datacenter use case, with someone trustworthy literally carrying the key to the other end of the link, and I see no realistic usage of QKD that will outperform that unless one is worried about post-compromise recovery of a symmetric key stored in a piece of hardware. Plus, QKD has its own issues: security of QKD is subject to catastrophic failures if the single-photon source isn’t actually a single-photon source and possibly also if a malicious light source injected into the fiber causes the transmitter to stop being a single-photon source or the receiver to behave in a manner inconsistent with any possible single received photon. Think of these as side channel and fault attacks that are rather difficult to manage.)