Comment by comex | Hacker News Reader

Comment by comex | Hacker News Reader

Parent Full thread

I still don’t understand the point of quantum key distribution. It protects against passive snooping but not against an active man-in-the-middle attack: thus it gives you no more protection than, say, the Diffie-Hellman exchange performed at the start of every TLS connection. The main counterargument is that quantum computers can break Diffie-Hellman, and can do so retroactively if someone is tapping your communications today and saving them for the future. But post-quantum public key cryptography exists; admittedly it’s not as vetted yet as the traditional kind. but it will be soon enough, so even if there’s some rationale for using QKD today, it’s not the “future-looking” technology it’s sold as.

And in the meantime, if you really want to guarantee the confidentiality of your shared secret that badly, you can just physically drive over to the other organization carrying a copy of it. Inconvenient, but surely less so than running long fiber-optic cables through tunnels solely for that purpose.

QKD does defend against active man-in-the-middle. Working from the premise that qubits in general cannot be cloned (the no-cloning theorem), a protocol can be devised that can detect tempering by an adversary with unlimited computational power and technological abilities. BB84[1] is such a protocol, which is also used in commercial QKD products.

Of course it doesn’t defend against attacks on the devices, buildings or people; these are likely higher ranked risks than crypto attacks for many organisations.

[1]: https://en.wikipedia.org/wiki/BB84

I think OP's point is that no key establishment protocol - quantum or otherwise - protects against a true "man-in-the-middle" who can simply negotiate different keys with both parties and transparently decrypt-encrypt in the middle.

Of course, this isn't what QKD is supposed to solve, anyway. QKD does not address authentication, only key distribution.

The basic idea is that the communication channel key changes very frequently (EDIT: see praseodym's response below). The QKD network itself is basically just a stream of keys. An active attack would require compromise of many keys. If your error rate goes above some threshold (even for re-transmissions of a single message), you know the QKD channel is being tampered with.

Take the whisper protocol for example... instead of having a synchronized state machine that determines shared message keys between both parties, those keys may instead come from an external QKD stream.

To add to that: a QKD with one-time pad[1] is proven secure. However, because many QKD implementations have low secret key rates (the highest in research is 10Mbps[2]; most commercial implementations do only a few Kbps) you won’t be doing high-bandwidth communication using that method.

[1] https://en.m.wikipedia.org/wiki/One-time_pad [2] https://www.toshiba.co.jp/about/press/2017_09/pr1501.htm

The author of OP article really needs to read that Toshiba press release. Good layman explanation.

Also, I figured that the bottleneck came from the amount of entangled photons that could be generated. Interesting to know that it's a hardware/software issue on the detector and post-processing side.

> I still don’t understand the point of quantum key distribution.

The point is to make wild claims about a future Quantum Internet, which then leads to large amounts of research funding. It's very successful in achieving that.

Reply on news.ycombinator.com