Tell me more ×
Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It's 100% free, no registration required.
up vote 3 down vote favorite
1

i read this recently: http://www.newscientist.com/article/dn12786-quantum-cryptography-to-protect-swiss-election.html

and some parts of this: http://en.wikipedia.org/wiki/Quantum_key_distribution

they talk about direct fibre optic cable and evesdropping that seems passive.

i want to know whether quantum key distribution provides any security against active attacks too?

i mean, for example isn't it possible that fibre optic cable is cut at some point in its path by an attacker and then he places a repeater there and before repeating the signal he can read the secret information in the channel?

share|improve this question
See also this article and the accompany comments section for extensive discussion about the strengths and weaknesses of quantum key distribution, from many experts. – D.W. Nov 24 '12 at 0:55

1 Answer

up vote 4 down vote

No, Quantum Key Distribution is not any safer than conventional crypto is against an active Eve impersonating as Bob to Alice using the same equipment and knowledge as the rightful Bob (or/and impersonating as Alice to Bob using the same equipment and knowledge as the rightful Alice). Otherwise stated, QKD can resist Man Eve In The Middle only inasmuch as Eve lacks some initial shared secret known only to legitimate parties Alice and Bob.

The best QKD claims to achieve is turn an authenticated channel (or a short shared secret) into a channel safe from any eavesdropping (or an arbitrarily longer shared secret), against any attack active or passive (including by MITM). E.g. Alice and Bob start from a shared secret of say 512 bits (that could be the conventional hash of a pass phrase), assumed unknown to Eve. Alice and Bob apply some protocol with photons and mirrors, plus some elementary conventional operations on bits for post-processing; and end up with some kilo bits (per second of experiment) of random secret material unknown to Eve. Alice and Bob can use that secret material to encipher data using a One Time Pad (perhaps while they are generating that secret material, so they need not store it).

Non-quantum cryptography routinely does the same (or better: the initial trusted data needs not be secret, e.g. Alice and Bob can exchange their public key; this makes it easier to safely use asymmetric non-quantum cryptography than it is to use QKD). However non-quantum cryptography relies on assumptions on the hardness of some problem, such as the discrete logarithm problem, or/and finding more plaintext/ciphertext pairs given examples for a blockcipher; whereas QKD, and more generally Quantum Cryptography, attempts to rely only on the laws of physics.

The security track record of QKD systems is poor: one security problem has been that imperfections of single-photon sources could be exploited; another rather spectacular one was active blinding; now I'm hearing of double blinding. QKD is not practicable with the current fiber infrastructure (quantum repeaters, if any, exist in labs only). Combine with the fact that QKD solves a problem that is already solved in practice, more conveniently, by classical cryptography, and many reach the conclusion that QKD is a marvelous accomplishment but pointless in practice, except perhaps as a justification for funneling out money.

share|improve this answer
can u clarify your meaning of 'short shared secret' and 'longer shared secret' please? – H M May 27 '12 at 9:53
1  
A short shared secret is similar to a symmetric key in conventional crypto: a couple of hundred bits. The long shared secret is similar to the keystream a stream cipher produces. It's as long as the message you want to send. Essentially quantum crypto acts like an online-only stream cipher. – CodesInChaos May 27 '12 at 10:08
can we possibly combine (use concurrently) classic methods/algorithms like symmetric and asymmetric encryption algorithms with QKD to make it more complete/strong? i mean for example we can defend against MITM attacks using standard public key cryptography methods. that is to say encrypt the key using classic methods before sending it over the quantum channel. – H M May 27 '12 at 16:16
2  
You can use certain provably secure MACs with quantum crypto, but they're still symmetric crypto. Using normal public key crypto defeats most of the point of quantum crypto, it's provable security. Symmetric encryption is one of the strongest building blocks we currently have, so quantum crypto is pretty useless, since we need to use weaker primitives to do anything interesting. – CodesInChaos May 27 '12 at 17:12
3  
Another argument that I've come across is that OTP is more implementable than Quantum Cryptography. That is, if the goal is to rely on a security assumption other than computational complexity, it's easier to pregenerate billions of truly random keypairs and preload them onto the endpoints at installation time, than to implement a secure QKD system. This is not an argument that we should use OTP, this is an argument that suggests that QKD doesn't solve any problems that aren't solved better using other means. – poncho May 29 '12 at 16:26

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.