Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Cryptographers achieve perfect secrecy with imperfect devices

quantamagazine.org

Post reply on HN
Print view View original

11–20 of 34 posts

Re: Cryptographers achieve perfect secrecy with imperfect devices

#11

Post by lanstin »

klickverbot wrote: post #9

First author of one of the preprints mentioned in the article here (theory in Paris/Geneva/Zürich/Lausanne, experiment in Oxford) – happy to answer any questions! I obviously speak only for myself, not for any of my colleagues, and as a matter of course, I should also mention that publication in a peer-reviewed journal is still pending for these results. One point to mention — which I feel quite strongly about, and I…

I always read perfect secrecy as a term of art with some technical meaning.

This protocol seems to solve the communication at a distance problem for which asymmetric encryption was developed but since then a lot of other uses for public key, e.g. signing and multi-party decryption and so on have come out of public key. Do you think there will be entanglement based replacements for these?

Re: Cryptographers achieve perfect secrecy with imperfect devices

#12

Post by fsh »

klickverbot wrote: post #9

First author of one of the preprints mentioned in the article here (theory in Paris/Geneva/Zürich/Lausanne, experiment in Oxford) – happy to answer any questions! I obviously speak only for myself, not for any of my colleagues, and as a matter of course, I should also mention that publication in a peer-reviewed journal is still pending for these results. One point to mention — which I feel quite strongly about, and I…

The first sentence of your paper abstract is:

Cryptographic key exchange protocols traditionally rely on computational conjectures such as the hardness of prime factorisation to provide security against eavesdropping attacks. Remarkably, quantum key distribution protocols like the one proposed by Bennett and Brassard provide information-theoretic security against such attacks, a much stronger form of security unreachable by classical means.

This is not wrong, but in my opinion quite misleading. QKD is no replacement for asymmetric cryptography since it requires exchanging a secret key before the communication can take place. This makes it functionally equivalent to a symmetric stream cipher. So why do you mention prime factorization and cite RSA? The security of QKD should be compared to that of the best symmetric algorithms, not that of asymmetric ones.

I have seen this pattern in many talks and papers from the field. Maybe the issue is that the QKD community seems to have almost no overlap with the IT security community. In my experience, QKD people almost never talk about how you would actually use and/or attack a system in practice.

Re: Cryptographers achieve perfect secrecy with imperfect devices

#13

Post by NoKnowledge »

klickverbot wrote: post #9

First author of one of the preprints mentioned in the article here (theory in Paris/Geneva/Zürich/Lausanne, experiment in Oxford) – happy to answer any questions! I obviously speak only for myself, not for any of my colleagues, and as a matter of course, I should also mention that publication in a peer-reviewed journal is still pending for these results. One point to mention — which I feel quite strongly about, and I…

> Rather, device-independent quantum key distribution allows you to scale back the assumptions on your implementation to a well-motivated, minimal set. To me, this is already intriguing enough without the need for hyperbole!

Would it be accurate to say it is scaled back to the level achieved by classical (non-quantum) cryptography?

Re: Cryptographers achieve perfect secrecy with imperfect devices

#14

Post by klickverbot »

lanstin wrote: post #11
klickverbot wrote: post #9

First author of one of the preprints mentioned in the article here (theory in Paris/Geneva/Zürich/Lausanne, experiment in Oxford) – happy to answer any questions! I obviously speak only for myself, not for any of my colleagues, and as a matter of course, I should also mention that publication in a peer-reviewed journal is still pending for these results. One point to mention — which I feel quite strongly about, and I…

I always read perfect secrecy as a term of art with some technical meaning. This protocol seems to solve the communication at a distance problem for which asymmetric encryption was developed but since then a lot of other uses for public key, e.g. signing and multi-party decryption and so on have come out of public key. Do you think there will be entanglement based replacements for these?

> I always read perfect secrecy as a term of art with some technical meaning.

That's indeed the case, but I fear the subtle technical definition here is usually one of the first things to go in the cycle of press releases and news articles, entirely too quickly giving rise to headlines that speak of “unhackable cryptography" or things like that. I've slightly edited my above post to clarify this, thanks.

> Do you think there will be entanglement based replacements for these [other protocols]?

One thing to note is that QKD is fundamentally a primitive to create shared, private randomness, not a communication channel – of course, the output can be used as the key for one-time pad encryption, but you might as well use it some different way.

For applications beyond that, I am really not an expert, but from what I know, people are looking into a variety of protocols, such as for leader election. There was a review article a few years back by Wehner et al., "Quantum internet: A vision for the road ahead" (https://www.science.org/doi/10.1126/science.aam9288), which highlights some proposals.

As for applications like signing, one aspect to consider is that quantum entanglement will, at least for another decade or two, always be much shorter-lived than classical data at rest. Thus, most practical quantum protocols will boil down to creating and making use of entanglement in a short amount of time, e.g. to initially establish some sort of shared secret, make a coordinated decision, etc.

Re: Cryptographers achieve perfect secrecy with imperfect devices

#15

Post by NoKnowledge »

mikeiz404 wrote: post #8
NoKnowledge wrote: post #4

The article suggests that quantum key distribution (QKD) is a replacement for a courier, but that is not true. Distributing an initial small secret key (which allows authenticity of the post-processing of the quantum measurements) is still required. Also I think the added value of device-independence is overstated. While it does indeed prevent loss of security by faulty quantum hardware (even if constructed malicious…

> The article suggests that quantum key distribution (QKD) is a replacement for a courier, but that is not true. Distributing an initial small secret key (which allows authenticity of the post-processing of the quantum measurements) is still required. Is checking authenticity needed if you’re communicating with just one party? From what I understood from the article the data received can be assumed to be random and p…

Yes, otherwise how would you know you are indeed communicating with that party?

Otherwise the standard Person-in-the-Middle attack would apply: Eve (claiming to be Bob) first runs a full protocol session (quantum + classical communication) with Alice, resulting in a shared key X. Then she does the same to Bob, resulting in a key Y. When Alice wants to encrypt a message to Bob, she encrypts with X. Eve can decrypt (and optionally re-encrypt with Y and forward the message to Bob).

Re: Cryptographers achieve perfect secrecy with imperfect devices

#16

Post by hannob »

fsh wrote: post #12
klickverbot wrote: post #9

First author of one of the preprints mentioned in the article here (theory in Paris/Geneva/Zürich/Lausanne, experiment in Oxford) – happy to answer any questions! I obviously speak only for myself, not for any of my colleagues, and as a matter of course, I should also mention that publication in a peer-reviewed journal is still pending for these results. One point to mention — which I feel quite strongly about, and I…

The first sentence of your paper abstract is: Cryptographic key exchange protocols traditionally rely on computational conjectures such as the hardness of prime factorisation to provide security against eavesdropping attacks. Remarkably, quantum key distribution protocols like the one proposed by Bennett and Brassard provide information-theoretic security against such attacks, a much stronger form of security unreach…

QKD advocates have been doing this for ages, it's been pointed out repeatedly that they make dishonest claims and they continue to do so. Here's a paper from 2004(!) pointing this out: https://eprint.iacr.org/2004/156

It's not an accident, it's deliberate deception.

Re: Cryptographers achieve perfect secrecy with imperfect devices

#17

Post by cryptonector »

klickverbot wrote: post #9

First author of one of the preprints mentioned in the article here (theory in Paris/Geneva/Zürich/Lausanne, experiment in Oxford) – happy to answer any questions! I obviously speak only for myself, not for any of my colleagues, and as a matter of course, I should also mention that publication in a peer-reviewed journal is still pending for these results. One point to mention — which I feel quite strongly about, and I…

QKD continues to be cryptography snake oil. Interesting for research, useless for actual real-life use.

Re: Cryptographers achieve perfect secrecy with imperfect devices

#19

Post by NateLawson »

QKD relies on many underlying assumptions, which researchers conveniently sweep under the rug while continuing to build castles ever higher on the theoretically "perfect" but insecure foundation. It is unclear how the underlying implementation for QKD can be made as secure as modern silicon countermeasures are against attacks like fault injection.

A while back, I summarized all the ways I could think of where the layer under QKD fall apart. I think the list is still valid:

https://rdist.root.org/2008/10/24/quantum-cryptography-is-us...

Re: Cryptographers achieve perfect secrecy with imperfect devices

#20

Post by CodesInChaos »

fsh wrote: post #12
klickverbot wrote: post #9

First author of one of the preprints mentioned in the article here (theory in Paris/Geneva/Zürich/Lausanne, experiment in Oxford) – happy to answer any questions! I obviously speak only for myself, not for any of my colleagues, and as a matter of course, I should also mention that publication in a peer-reviewed journal is still pending for these results. One point to mention — which I feel quite strongly about, and I…

The first sentence of your paper abstract is: Cryptographic key exchange protocols traditionally rely on computational conjectures such as the hardness of prime factorisation to provide security against eavesdropping attacks. Remarkably, quantum key distribution protocols like the one proposed by Bennett and Brassard provide information-theoretic security against such attacks, a much stronger form of security unreach…

I believe you can achieve secure communication by combining QKD with an asymmetric signature algorithm (hash signatures being a particularly interesting choice), while that's not possible by combining a stream cipher with a signature algorithm.
Post reply on HN