Toshiba reports milestone in quantum cryptography
www3.nhk.or.jp
www3.nhk.or.jp
https://www.toshiba.eu/pages/eu/Cambridge-Research-Laborator...
Basically their achievement is that they have done quantum key distribution over a distance of 600km, which is apparently a world first. And I suppose it demonstrates commercial viability.
For people not familiar with the idea: They didn't send a genome over the quantum channel, they sent a private key over the quantum channel, and then encrypted the genome with that key using conventional encryption, and then sent that encrypted genome over a conventional network.
Without QKD this process would have been done using public key encryption, which means the sender would have to have received the public key from a trusted source, usually you trust that source because a third source trusts it, etc, this is called the chain of trust. You can see how if a malicious party injects itself into the chain of trust the confidentiality is broken. With QKD you only have to trust that the person you want to talk to is on the other side of the quantum link you've established, i.e. the security is put firmly in the physical realm. Because of the quantum entangling properties of this link, a malicious party can't inject itself physically in the middle of this link, and can not eaves drop or manipulate it.
More precisely, it is possible to know if someone is eavesdropping and halt the key sharing.
QKD does not prevent it, but has a provable method to know that someone is listening (statistics of the measurements change).
Unless some breakthrough in physics of particles, where all is not fully understood yet. A bit like standard cryptographic protocol are safe unless some breakthrough in mathematics or computer science.
If you think about it, this is fundamentally not possible. There is no way of authenticating who sits on the other end of your fiber connection without having previously exchanged a key. This could either be a shared secret key, or standard public key cryptography.
From an it-security perspective, QKD is simply a very expensive and impractical stream cipher that (slowly) grows a short shared secret key into an arbitrarily long one. The only fundamental advantage over a symmetric encryption algorithm like AES is that an attack would have to happen during the QKD process when the (signed) basis settings are exchanged. It is not possible to simply record all the communication with the hope to maybe being able to break the algorithm in the far future.
QE doesn’t stop anyone from creating a new node in the middle of a single edge and then re-establishing the QE channel in between.
- They have a 50% chance of measuring in the correct basis and re-sending the proper qubit - They have a 50% change of measuring in the incorrect basis, in which case their measurement means nothing and the qubit they send is in a superposition in the correct basis, leading to a chance Bob measures the wrong value
Over a very long string, it becomes exponentially unlikely that the MITM could guess the proper basis and then re-send the proper qubit to Bob. As that binary string grows in length, it's essentially impossible to MITM with any meaningful likelihood.
From the essay
> Now, no one has actually observed UEFI being compromised, nor has anyone captured any UEFI-compromising Trickbot code. The thinking goes that Trickbot only downloads the UEFI code when it finds a vulnerable system.
> Running in UEFI would make Trickbot largely undetectable and undeletable. Even wiping and restoring the OS wouldn't do it. Remember, TPMs are designed to be unpatchable and tamper-resistant. The physical hardware is designed to break forever if you try to swap it out.
[1] https://pluralistic.net/2020/12/05/trusting-trust/#thompsons...
I can see how that would be an easy thing to trust if the only people capable of building such a link are your fellow scientists, but in a scenario where this technology becomes common, is it reasonable that users would ever be able to verify who is listening at the other end?
If not, what’s the use case?
To trust that (without PKI), you have to meet your peer in person, don't you? If so, at that point you can just hand an HSM to them with your symmetric key on it. No need to use a quantum device.
> With QKD you only have to trust that the person you want to talk to is on the other side of the quantum link you've established, ...
Re-read that please. How is that different?
How do you know that there isn't a QKD MITM in your wire? It would be trivial to set one up. QKD is trivially vulnerable to MITM attacks because there's no quantum authentication system. All it costs is a pair of QKD devices, and physical access -- anywhere in the 600km will do.
But with classical crypto we get to arrange authentication that works. You don't have to trust a third party, just the employees doing the set up.
Anyone who tells you QKD is better than classical crypto is straight up lying to you.
But then I thought about it for a while longer, and I came up with this: Maybe the advantage is that the private key never actually can be read by anyone, not even the two communicating parties, thus basically eradicating the possibility of spies or betrayal within your engineering ranks.
If you can guarantee the physical integrity of the line for the entire 600km, you're also basically set. The only actual attack on QKD is setting up those MITM's, maybe even only during the initial set up? I don't know how often the entanglement has to be reset, are they permanently entangled or is there a reestablishing every so often?
You're going to be using classical crypto for bulk no matter what, so, no, you don't get that advantage, and anyways, what does anyone care what a session key is when they can get the session plaintext? Worried about decryption of ciphertext the attacker did not earlier get the plaintext to? Just re-key often.
> If you can guarantee the physical integrity of the line for the entire 600km, you're also basically set.
You must be joking.
With classical crypto I just don't have to care if the physical link is secure (except for DoS concerns -- please don't backhoe-cut my links!). For bulk symmetric crypto PQ is not even that much of a concern. And if we ever get to a PQ world, the lack of quantum authentication technology means that QKD will not be a solution to our PQ problems.
No matter how hard anyone tries to find QKD to be better than classical crypto, it just isn't.
You're right, there's no fundamental advantage there it seems. It could still just be a convenient way of rekeying very often (assuming it can "conveniently" be verified to be free of mitm)
> You must be joking.
Only half, for my day job I work with UAV operations, and inspecting 600km of lines daily would be peanuts for something with military scale funding.
> No matter how hard anyone tries to find QKD to be better than classical crypto
Well I hope you don't think I was doing that, I'm just trying to figure out a use for it.
No. ECDH is just fine. PQ crypto is also just fine.
And no, QKD cannot be "conveniently" verified to be free of MITMs -- this is more important than whether QKD can be a "convenient way of rekeying very often" (which it isn't anyways).
> Only half, for my day job I work with UAV operations, and inspecting 600km of lines daily would be peanuts for something with military scale funding.
A UAV cannot police 600km of fiber optics 24/7. 10 UAVs cannot either. The cost of this is nuts compared to the cost of using classical crypto -- and for what benefit?! There is no benefit to QKD, not any benefit at all.
> Well I hope you don't think I was doing that, I'm just trying to figure out a use for it.
It may be useful to train quantum physicists. Hmm, that may be its only use -- I can't think of any others.
Of course, this depends on your equipment not leaking extra photons or having other sidechannels... which seems harder than ordinary asymmetric crypto.
But you would combine QKD with asymmetric crypto so that both would have to be broken to lose your link security.
I don't think it's that generally interesting, but if you already have dedicated private fiber between your super secret secure facilities, -- why not?
QKD only works for point-to-point links.
If PQ happens and we have no PQ classical asymmetric algorithms, QKD cannot save us. We do not have time to rebuild the Internet around hop-by-hop security in a world of QKD, and anyways, QKD can be trivially MITMed, so this just doesn't work.
Fortunately we do have some PQ classical algs. Fortunately we're not in a PQ world yet. If we end up being unfortunate (PQ happens before we deploy PQ classical algs) then QKD cannot help us.
> I don't think it's that generally interesting, but if you already have dedicated private fiber between your super secret secure facilities, -- why not?
Because I might as well use classical symmetric keying and not worry about PQ.
In that case the attacker could potentially compromise your security with an analysis breakthrough on the symmetric cipher, and a passive (e.g. bend the fiber a bit and see the light that comes out the side) attack.
The QCD requires an active attack, you have to actually insert active equipment into the line, not just peel off some stray photons.
So assume you're already using multiple layers of independently keyed state of the art cryptography, and still have money left over in your link security budget...
How much is it worth to you to make it so that attackers have to insert equipment vs just siphon off a bit of extra light with a tiny bend in the fiber (assuming they have space alien grade mathematical breakthroughs)?
It's probably worth more than nothing.
Now, I would agree that any who is promoting this stuff with claims greater than "probably worth slightly more than nothing" is misleading people.
And as an area of pure research it gives us a lot of room to learn about practical realizations of quantum-sensitive systems, optics, photonics, electronics, etc. There is plenty of research with no known practical application at all. Having a really minor application isn't a great sin.
QKD does roughly what Diffie-Hellman does. One way to look at Diffie-Hellman is that two parties have a public but tamper-proof communication channel: Alice and Bob can talk to each other, everyone can hear them, but no one can impersonate them. (This could be literal shouting in a crowded room, cryptography could be used to authenticate messages, etc.) Using Diffie-Hellman, Alice and Bob exchange secret shares over the public channel, derive a secret key, and, assuming no one has a mathematical breakthrough or a quantum computer, no one else knows the key.
With QKD, Alice and Bob have the same public channel, but they also have a quantum communication channel, e.g. a fiber. This quantum channel is assumed to be completely insecure. Using both channels together and some math, Alice and Bob derive a secret key. For their trouble, they have a stronger sort of security compared to Diffie-Hellman — they don’t need to trust that their attacker doesn’t have some kind of breakthrough. There is an information theoretic proof that the scheme is secure as long as everyone plays by the rules. (Playing by the rules means no side channel or glitch attacks. A classical glitch might involve putting a very high voltage onto someone’s network cable to cause their NIC to malfunction. A quantum glitch attack might involve shining an extremely bright light into the fiber to cause someone’s hardware to misbehave.)
This is all that QKD does. It’s not magic, and the tamper-proof classical channel is required.
https://scitechdaily.com/china-builds-the-worlds-first-integ...
I'm probably completely wrong too.
Entanglement is what you get when you have a state in the tensor product of two systems which is not a tensor product of a single state from each system, but is instead a linear combination of such products.
There are, in fact, experiments that can be (and have been) done which distinguish between “these two particles are entangled” and “we don’t know which of two combinations of states these two particles are in”.
However, if you only have one particle of the entangled pair, and don’t have any other way of getting information from the other particle, you can’t distinguish it from just, a probability mixture of (superpositions of) states of the one particle. I say “(superpositions of) states of the one particle” to emphasize that the states don’t have to be in one of the standard basis states with a nice name like “up” or “down”, (though you could use a different basis in which it is a basis state).
Unless I'm wrong, it appears to be a "milestone" in that they sent human genome data rather some other kind of data (I'm not sure how that is significant) and no new quantum cryptography breakthrough has been achieved?
-New dual band stabilisation technique cancels the problem of temperature and strain fluctuations to allow long distance quantum communication
-Quantum key distribution demonstrated on fibres of record 600km length
-Significant advance towards building a global quantum internet
But also we don't need to. Cryptography without quantum is just fine.