31–34 of 34 posts
The challenge (which the authors don't actually name, and which they take a long time to even describe) is key distribution. Apparently their solution is for Alice and Bob to each have a quantum object that is entangled with the other.
But now they have the same problem, but harder: how to distribute entangled quantum objects.
What have I missed?
> The universe hadn’t decided what the value would be before it was measured,” said Colbeck. “That’s the origin of the security.” My naive security architect view is, I get the impression the people doing quantum engineering and those working as cryptographers have a very narrow overlap. Reading about quantum key agreement/distribution (QKD), it's different from cryptographic functions where you have things like conv…
> My naive security architect view is, I get the impression the people doing quantum engineering and those working as cryptographers have a very narrow overlap. You probably aren't wrong, but also note that popular science articles are probably not the best basis for judging this. :) A number of people working on QKD have done serious work on classical cryptosystems as well, although the overlap of that set with peop…
Popular science articles aren't sufficient to reason about the science - but they are at least as rigorous as the product spec sheets people will make their security decisions on, so I'd propose pop articles are admissable in discussing the security of the scheme. It's not on the consumer to understand, but on the producer to demonstrate.
The issue with QKD right now is that the risk/benefit isn't there from a security product perspective. If I have something that needs quantum security, I necessarily don't trust a bunch of people who say, "trust me, it's science," as I am looking at where the risk goes. If I'm using crypto on classical computers, most of my risk gets diffused through standards bodies (NIST, essentially), and then my vendors, banks, insurers, etc. QKD and PUFs have the same problem, which is snakeoil risk.
The information theoretic security (as a function of entropy) of an algorithm is scientifically interesting, but when it comes to applying it to risk management (e.g. distributing accountability), there is a ceiling on that. Measuring security based on work or operations over a classical compute cost / complexity class, I agree, is an orthogonal concern with QKD, but security as defined by where the risk goes needs a definition it can reason about.
I agree it (the analysis) will look different, and if I were to equip my fellow security analysts with a tool, it would be to not be persuaded that their lack of a quantum physics background disqualifies them from interrogating the real security benefits of QKD proposals.
Earlier quoted context omitted.
> The article suggests that quantum key distribution (QKD) is a replacement for a courier, but that is not true. Distributing an initial small secret key (which allows authenticity of the post-processing of the quantum measurements) is still required. Is checking authenticity needed if you’re communicating with just one party? From what I understood from the article the data received can be assumed to be random and p…
Yes, otherwise how would you know you are indeed communicating with that party? Otherwise the standard Person-in-the-Middle attack would apply: Eve (claiming to be Bob) first runs a full protocol session (quantum + classical communication) with Alice, resulting in a shared key X. Then she does the same to Bob, resulting in a key Y. When Alice wants to encrypt a message to Bob, she encrypts with X. Eve can decrypt (an…
Earlier quoted context omitted.
> The article suggests that quantum key distribution (QKD) is a replacement for a courier, but that is not true. Distributing an initial small secret key (which allows authenticity of the post-processing of the quantum measurements) is still required. Is checking authenticity needed if you’re communicating with just one party? From what I understood from the article the data received can be assumed to be random and p…
Without authentication, any form of communication is susceptible to a man-in-the-middle attack. You simply don't know who you are communicating with. This makes using QKD very hard to justify in practice. If you have exchanged a pre-shared key (which is required for authentication anyway), you can just use a symmetric stream cipher like AES for encrypting the communication. This is many orders of magnitude cheaper an…