Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Serious Flaw Emerges In Quantum Cryptography

technologyreview.com

Post reply on HN
Print view View original

21–30 of 47 posts

Re: Serious Flaw Emerges In Quantum Cryptography

#21

Post by tjoff »

VikingCoder wrote: post #9
tjoff wrote: post #7

Earlier quoted context omitted.

You can't prove that you can trust the carrier. And with trust I not only mean that the carrier has good intentions but also that the carrier is physically unable to do any mistakes. Also you can't prove that someone doesn't sniff the traffic when you copy it to your second DROBO and you can't prove that none of the drives have been copied afterwards. Not saying that your approach isn't "secure enough" (I'd guess tha…

Thanks for the reply! > You can't prove that you can trust the carrier. I said that I physically carry DROBO two to my intended recipient. I can trust myself. > Also you can't prove that someone doesn't sniff the traffic when you copy it to your second DROBO and you can't prove that none of the drives have been copied afterwards. There is no such thing as secure communication. Copying data from one DROBO to another D…

True, if I'm allowed to treat the quantum crypto system as a black box mirroring the DROBOs should be considered a black box as well.

But can you trust yourself to not take a large enough bribe? What if someone hold someone special in hostage?

If you only have to convince yourself (quite limiting scenario) I see no, major, problem with your setup. This of course assuming you have eye-contact with the DROBO at all times etc. etc.

Most scenarios however you can't have as much trust in the carrier as you have in yourself.

But I agree. When reading quantum cryptography and its issues I often get the feeling that its all a bit silly. But I totally get the motivation about it, it's extremely enticing. However, I see why some likes to claim that quantum cryptography is just a way for physicists to get paid :P

But there seems to be a market for it and I have no idea how far it can go.

Re: Serious Flaw Emerges In Quantum Cryptography

#22

Post by VikingCoder »

junkbit wrote: post #10
VikingCoder wrote: post #6

Okay, here I go on a tangent: If I buy two 5-bay DROBOs, 10 2 TB HDs, and a hardware random number generator, I could make a multi-TB One Time Pad, and copy it onto the second DROBO. I keep DROBO one, and physically carry DROBO two to my intended recipient. What are the problems with this? It's cheap. It's as secure as any communication could possibly be. It provides for a whole lot of communication, with relatively…

If either side is compromised it is difficult to reissue (e.g. if they are undercover in another country). The beauty of public keys is that they can be revoked and the other side can use your new key without you having to transport/transmit a private key in peril.

This is a good point.

A problem with public keys is that they rely on math that we presume is hard.

One Time Pads do not depend on that.

Re: Serious Flaw Emerges In Quantum Cryptography

#23

Post by ArbitraryLimits »

benmmurphy wrote: post #8

i don't understand how it is not susceptible to MITM attacks. how do you know you know the thing at the other end is really who you want to talk to without using some kind of preshared key? maybe an eavesdropper can't view the conversation between you and the other end but that doesn't matter if someone can easily pretend to be the other end.

It's possible to structure "quantum communication" (meaning passing qubits back and forth, basically) so that if someone in the middle reads them at all, the recipient is aware of it. It's not really possible to prevent the interception but it is possible always to detect it, at least in theory.

Re: Serious Flaw Emerges In Quantum Cryptography

#24

Post by VikingCoder »

tptacek wrote: post #17
VikingCoder wrote: post #6

Okay, here I go on a tangent: If I buy two 5-bay DROBOs, 10 2 TB HDs, and a hardware random number generator, I could make a multi-TB One Time Pad, and copy it onto the second DROBO. I keep DROBO one, and physically carry DROBO two to my intended recipient. What are the problems with this? It's cheap. It's as secure as any communication could possibly be. It provides for a whole lot of communication, with relatively…

The problem with this is that it is unlikely to be in practical terms better than using two slips of paper to write down a 256 bit random number and using that to establish a long-lived AES-256-CTR session. (This is without getting into the fact that a single keystream is not a secure message exchange protocol, and that conventional cryptography has well-tested ways of linking confidentiality secrets to integrity sec…

> a single keystream is not a secure message exchange protocol

I have to build protocols around making sure to not re-use parts of my One Time Pad. Around making sure that I validate messages. Asking for a re-send of a message. Destroy the One Time Pad because it's been compromised, etc.

But at it's core, using a One Time Pad is a secure message exchange protocol. I'm surprised to see you contradict that.

> and that conventional cryptography has well-tested ways of linking confidentiality secrets to integrity secrets and of marshalling and canonicalizing messages

I'm sorry - I don't know what you mean. Can you explain it to me more simply?

Cryptotext = Plaintext XOR OneTimePad.

Plaintext = Cryptotext XOR OneTimePad.

As I said, I have a lot of work to do to handle my One Time Pad... But the fundamental mathematics are secure. And you seem to be saying they are not. What do you mean?

> None of this has much to do with QC,

Agreed - that's why I called it a tangent.

Re: Serious Flaw Emerges In Quantum Cryptography

#25

Post by tptacek »

VikingCoder wrote: post #24
tptacek wrote: post #17

Earlier quoted context omitted.

The problem with this is that it is unlikely to be in practical terms better than using two slips of paper to write down a 256 bit random number and using that to establish a long-lived AES-256-CTR session. (This is without getting into the fact that a single keystream is not a secure message exchange protocol, and that conventional cryptography has well-tested ways of linking confidentiality secrets to integrity sec…

> a single keystream is not a secure message exchange protocol I have to build protocols around making sure to not re-use parts of my One Time Pad. Around making sure that I validate messages. Asking for a re-send of a message. Destroy the One Time Pad because it's been compromised, etc. But at it's core, using a One Time Pad is a secure message exchange protocol. I'm surprised to see you contradict that. > and that…

The difference between a stream of bytes and a "message" is crucial, and if you don't understand it, the best reason you shouldn't do your Drobo OTP scheme is that you don't understand crypto well enough to implement any cryptosystem. Just use TLS.

(I don't mean to be offensive. I don't understand bioinformatics, for instance, and probably shouldn't build mission critical things that rely on it.)

Re: Serious Flaw Emerges In Quantum Cryptography

#26

Post by tptacek »

VikingCoder wrote: post #20
aidenn0 wrote: post #15

Earlier quoted context omitted.

1) Your random number generator could be broken 2) I can flip bits in your message without you detecting it. 3) I can send random messages and get your receiver out of sync with you.

1) True. Buy a few of them, and XOR them all together. 2) I can always have a Message Digest of my message included. 3) If the Message Digest doesn't match, the message will not be accepted as valid. The receiver will not be out of sync.

An encrypted SHA1 hash isn't a MAC. The protocol you outlined would be trivially breakable. You seem pretty smart; give it a few minutes thought and see if you can grok why.

Re: Serious Flaw Emerges In Quantum Cryptography

#27

Post by VikingCoder »

tptacek wrote: post #25
VikingCoder wrote: post #24

Earlier quoted context omitted.

> a single keystream is not a secure message exchange protocol I have to build protocols around making sure to not re-use parts of my One Time Pad. Around making sure that I validate messages. Asking for a re-send of a message. Destroy the One Time Pad because it's been compromised, etc. But at it's core, using a One Time Pad is a secure message exchange protocol. I'm surprised to see you contradict that. > and that…

The difference between a stream of bytes and a "message" is crucial, and if you don't understand it, the best reason you shouldn't do your Drobo OTP scheme is that you don't understand crypto well enough to implement any cryptosystem. Just use TLS. (I don't mean to be offensive. I don't understand bioinformatics, for instance, and probably shouldn't build mission critical things that rely on it.)

I'm not proposing that you buy my system - I'm asking what's wrong with my design for the core mechanic.

And you've genuinely offered no substantive critiques. Sounds like the core mechanic is gold, then.

If there's nothing wrong with the core mechanic, I should be able to buy a commercial system built on it, and know that it has all of the inherent strengths and weaknesses of my core mechanic. And possibly more weaknesses, inherent in the implementation of any security system.

Re: Serious Flaw Emerges In Quantum Cryptography

#28

Post by tptacek »

VikingCoder wrote: post #27
tptacek wrote: post #25

Earlier quoted context omitted.

The difference between a stream of bytes and a "message" is crucial, and if you don't understand it, the best reason you shouldn't do your Drobo OTP scheme is that you don't understand crypto well enough to implement any cryptosystem. Just use TLS. (I don't mean to be offensive. I don't understand bioinformatics, for instance, and probably shouldn't build mission critical things that rely on it.)

I'm not proposing that you buy my system - I'm asking what's wrong with my design for the core mechanic. And you've genuinely offered no substantive critiques. Sounds like the core mechanic is gold, then. If there's nothing wrong with the core mechanic, I should be able to buy a commercial system built on it, and know that it has all of the inherent strengths and weaknesses of my core mechanic. And possibly more weak…

Thank you. It's people like you who are steadily paying for my kids' college education. :)

I don't blame you for being frustrated with my responses, but it's my experience that detailed critiques of random crypto schemes on message boards are counterproductive; the designer just "yes, but"'s the critique until all the low-hanging fruit is picked (each of which was a devastating flaw in their original scheme), and the conversation ends with a no- less- fatally- flawed system and a designer who is perversely more confident.

Re: Serious Flaw Emerges In Quantum Cryptography

#29

Post by mindslight »

VikingCoder wrote: post #27
tptacek wrote: post #25

Earlier quoted context omitted.

The difference between a stream of bytes and a "message" is crucial, and if you don't understand it, the best reason you shouldn't do your Drobo OTP scheme is that you don't understand crypto well enough to implement any cryptosystem. Just use TLS. (I don't mean to be offensive. I don't understand bioinformatics, for instance, and probably shouldn't build mission critical things that rely on it.)

I'm not proposing that you buy my system - I'm asking what's wrong with my design for the core mechanic. And you've genuinely offered no substantive critiques. Sounds like the core mechanic is gold, then. If there's nothing wrong with the core mechanic, I should be able to buy a commercial system built on it, and know that it has all of the inherent strengths and weaknesses of my core mechanic. And possibly more weak…

For one, you don't have a MAC. This means an attacker can flip arbitrary bits in your message. There's a huge difference between crypto primitives and a crypto system.

(It seems like it should be possible to devise a non-algorithmic MAC using a second pad. But now we're back in theory-land.)

Re: Serious Flaw Emerges In Quantum Cryptography

#30

Post by tptacek »

mindslight wrote: post #29
VikingCoder wrote: post #27

Earlier quoted context omitted.

I'm not proposing that you buy my system - I'm asking what's wrong with my design for the core mechanic. And you've genuinely offered no substantive critiques. Sounds like the core mechanic is gold, then. If there's nothing wrong with the core mechanic, I should be able to buy a commercial system built on it, and know that it has all of the inherent strengths and weaknesses of my core mechanic. And possibly more weak…

For one, you don't have a MAC. This means an attacker can flip arbitrary bits in your message. There's a huge difference between crypto primitives and a crypto system. (It seems like it should be possible to devise a non-algorithmic MAC using a second pad. But now we're back in theory-land.)

(It might be possible to devise a non-algorithmic MAC using a second pad, hmm.)

AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA!

Post reply on HN