# Tag Info

## Hot answers tagged quantum-cryptography

14

There is, in principle, no limit to the dimension of the state space of a quantum system. This includes infinite dimension (usually countable, i.e. a separable Hilbert space) and any large but finite dimension. In the context of quantum information, systems with a state space of dimension $d\geq 2$ are usually called qudits. It's also important to mention ...

9

Well, since I'm one of the authors on the paper, let me try to answer your question. First I should explain that the paper you link to is not the original paper proposing that approach, but rather the first implementation of it (in this case using quantum optics). The original paper which introduced the Universal Blind Quantum Computing (UBQC) protocol ...

9

The question to answer is "Is N the product of P*Q?" I believe that the easiest way to understand Shor is to imagine two sine waves, one length P and one length Q. Assuming that P and Q are co-prime, then the question above can also be answered "At what point does the harmony of P overlapped with Q repeat itself?" And the answer can be determined quickly, ...

8

With Grover's algorithm, quantum computers can brute-force a block cipher with $n$-bit keys using $2^{n/2}$ steps, which is much smaller than the regular effort ($2^n$). This means, for example, that AES-128 could be broken with $2^{64}$ steps, and that AES-256 would offer the same security that AES-128 offers currently. In short, key sizes would need to be ...

7

No, Quantum Key Distribution is not any safer than conventional crypto is against an active Eve impersonating as Bob to Alice using the same equipment and knowledge as the rightful Bob (or/and impersonating as Alice to Bob using the same equipment and knowledge as the rightful Alice). Otherwise stated, QKD can resist Man Eve In The Middle only inasmuch as ...

7

The statement a 15360-bit RSA key is the equivalent to a 256-bit symmetric key does not take into account quantum algorithms. In fact, it is based on a specific computation model. It is just based on the fact that there exist sub-exponential algorithms for factoring and therefore you need longer keys than when using symmetric-key crypto where it is ...

7

Actually, if RSA is being used in a deterministic way (and the public exponent $e$ is relatively small), someone could recover the value $N$. We know that $P^e = C \bmod N$; that's equivalent to $P^e - C = kN$ for some integer $k$; if $e$ is small, then Shor's algorithm might be able to factor $P^e - C$; allowing you to recover $N$. Alternatively, if you ...

7

I see two problems with this idea. The first problem is Shor's algorithm; that's a quantum algorithm that is able to find the cycle length of a group (and if you can solve that problem, it is easy to factor and compute discrete logs). In this case, if we define the group of elements defined by the initial start state in the signature, where $H^n$ is the ...

6

Actually, most of the primitives that are currently believed to be secure FHE methods would appear to be quantum resistant; a partial list would include Craig Gentry's original scheme based on ideal lattices, BGV (based on ring-LWE), and this NTRU-based approach. All three are based on hard problems that are not susceptible to Shor's algorithm.

5

What's to guarantee authentication or message integrity (particularly when Alice and Bob are exchanging which filters were correct and so on)? A pre-authenticated classical channel is an essential requirement in addition to the quantum channel on which the quantum key exchange (QKE) is performed. This implies that Alice and Bob must share an initial secret ...

5

Let’s take your questions in order. Note that I’m a physicist working in quantum cryptography, so my opinion on this might be biased 1. What about authentication ? The classical channel between Alice and Bob has to be authenticated in order for the protocol to work. Formally, this is a pre-requisite for quantum key distribution (QKD), and is not part of ...

5

QKD aims at exchanging key material to be used with encryption based on OTPs between two parties and thus to achieve perfect secrecy for transmitted messages. There are, however, several drawbacks for practical use in a wired setting of QKD (required hardware and their vulnerability to hacks, limited distance) which does not support their use for end-to-...

5

The standard answer in the research literature is to use information-theoretically secure message authentication codes, typically universal hashing (aka Carter-Wegman authenticators). Of course, you could use computationally-secure message authentication codes, like CMAC or HMAC, if you wanted, though that would partly defeat one of the reasons for using ...

4

Well, to understand why QKD is often associated with OTP, we need to review what Quantum crypto is, and why it claims to be secure. Overall, we know of three implementable paradigms for cryptographical security: Informational: the attacker does not have enough information to determine the plaintext from the ciphertext Computational complexity: the process ...

3

ECC is not resistant against quantum computers. Quantum complexity for breaking RSA and ECC are $O(\frac{s^9}{{(\log (s))}^5})$ and $O(s^3)$ respectively. Which $s$ is security level $(80-96)$. So as SEJPM mentioned in comments, "ECC is less resistant against quantum computers than RSA". One of newest post quantum cryptographic schemes is isogeny ...

3

There are several kind of quantum key distribution (QKD) protocols as of today. Are you looking for a particular one? The best known QKD protocol goes by the name BB84 after its inventors Bennett and Brassard and the year in which they presented their work. Searching on the Internet, I found this link http://fredhenle.net/bb84/demo.php with a simulation ...

3

The main problem with the OTP is key distribution. You must share a random (not pseudo-random) key of the length of the message to make the OTP possible. QKD is one way (and possibly the most promising) to solve the problem of sharing a large enough, random key to use with the OTP. That said, QKD can be used with any cipher. My personal opinion is that most ...

3

No. The Yale result describes a method of partial measurement that is not completely destructive to the quantum system's coherence, which is tied to its physical representation. It is not a refutation of quantum indeterminacy, which is the basis for (provably secure) quantum key exchange. In other words, the Yale team measured a qubit in such a way that ...

3

In fact, the basic idea of Shor's algorithm for the discrete logarithm problem is reasonably simple. Assume (as in Section 4 Discrete Log: the easy case of Shor's paper) that you have an efficient quantum algorithm for the Fourier transform. Then, applying this Fourier transform twice (once for $a$ and once for $b$) on a quantum superposition of values $g^a\... 3 If the school has graduate courses that interest you and you think you can do well in (i.e. for comprehensive exams), and there is a strong crypto research group there, I would recommend any school that satisfied these criteria. As you move through academics, it becomes more and more clear that the quality of your research is the most important, and it is ... 2 Actually recently I found out about a complete QKD simulation toolkit that has become available, accessible online via this link, QKD simulator. It is a parameter-based simulator, so different scenarios (qubit numbers, Eve's influence, etc.) can be set up and simulated. 2 All mathematical groups can be used to perform an ElGamal encryption, so that is a first kind of math. That's where elliptic curves are useful: they have a group structure. If you find a group, you can build a cryptosystem out of it. However, as @poncho pointed out, different groups have different properties with regards to security. For instance, elliptic ... 2 It seems difficult to combine the two. PUFs can provide authentication but they are based on the sender having first built up a small number of challenge/response pairs before handing the PUF over. So if Alice gives the PUF to Bob, Alice can authenticate Bob with the response. However if the protocol is two-phased, where Alice authenticates Bob and then they ... 2 What you are describing is known as the Photon Number Splitting Attack (PNS), described for the first time (I think) by Brassard, Lütkenhaus, Mor ans Sanders in this 1999 paper. Several countermeasures have been invented since (single photon sources, robust protocols, decoy states), but detailing them would stray away from of your question. If one sends 2 ... 2 If we assume that Alice is the one sending the photons, and Bob is the one receiving them, then Bob selects random bases to take the measurements, and then announces them (both to Alice and any potential attacker) after he has taken those measurements. An attacker cannot use that announcement to decide how to take measurements himself, as he doesn't hear it ... 1 I'ld say the answer is “no”. Usually you need to factor the modulus$N$to break RSA. Now$N$is not available to the attacker. So with a single plain text and cipher text I'm pretty sure the attacker has too little information to retrieve N or any other key component. Your pre-condition of not having the public key and therefore the modulus$N$available ... 1 While Poncho's answer already handles some issues with periodicity, there might be some other, functional issues: You have to make sure that the PRNG can be publicly evaluated on an intermediate value of the chain (to allow verification). If you consider PRNG's like block ciphers in counter mode (or similar constructions) you have the fast accessibility ... 1 Bob and Alice then take the correct configurations, and they convert those to a prearranged code, which could be, as an example, that a correctly guessed diagonal detector is 0, and a correctly guessed rectilinear detector is 1. This way an encryption key will be composed. I believe that's where you got it a bit off. A correctly guessed rectilinear ... 1 The obvious approach is to help Bob learn$s_0 \oplus (s_0 \oplus s_1) \times c$, presumably using$F$to help him learn this information. So, here is the natural protocol: Alice and Bob invoke$F$. Alice provides the input$s_0 \oplus s_1$, Bob provides the input$c$. Alice learns$p$and Bob learns$q$, where we are guaranteed that$p \oplus q = (s_0 \...

Only top voted, non community-wiki answers of a minimum length are eligible