2
$\begingroup$

RFC 8784 introduces a staightforward mechanism to use a pre-shared key to make modified IKEv2 key agreement resistant to a quantum computer Shor algorithm attack- thus providing a "quantum-safe" infomation channel. One use of this information channel could be to share keys.

QKD authentication requires a PSK in order to be quantum safe. And then can provide a quantum safe channel to share keys.

Both RFC 8784 and a QKD solution depend on a pre-shared key that has not been compromised. What tangible benefits of using QKD solution versus using RFC 8784 if the objective is key sharing over the channel?

Improve this question
$\endgroup$
6
  • 1
    $\begingroup$ This was asked as a canonical question Why Quantum Key Distribution (QKD) is impractical that answer many of the distinction. $\endgroup$
    – kelalaka
    Oct 20, 2022 at 18:26
  • 1
    $\begingroup$ The discussion in the canonical question does not address the question asked: Even if all the issues with QKD practically were addressed, what advantage or attack vectors could QKD protect against as compared to just using PSK with RFC8784? Potentially, a stolen PSK would allow an adversary to use man in the middle attacks against either QKD or RFC8784. Both need a PSK, and both promise quantum safe transfer. Is RFC8784 susceptible to more attack vectors that a proponent of QKD could use to indicate the QKD is solving something better than RFC8784? I could not think of any. $\endgroup$
    – Crypto-Student
    Oct 20, 2022 at 22:56
  • $\begingroup$ A hypothetical secure QKD system would be secure regardless of future developments, including leaking key material. That is, it would provide information-theoretical security. Unlike a cryptographic key exchange scheme. This is typically considered insufficiently important to bother with QKD. $\endgroup$
    – K.G.
    Oct 22, 2022 at 15:14
  • $\begingroup$ A hypothetical secure QKD system would still need to rely on a PSK or seed for authentication at start-up to protect against masquerade attacks. Once one concedes at least one PSK is needed for QKD authentication, and the scheme must rely on a set of protections to keep a single PSK safe, then QKD fails to demonstate serious advantage over RFC8784: Both solutions rely on a PSK; Both solutions must protect from both masquerade and eavesdrop attacks. Cost of masquerade is much higher for QKD which could be deterrent to attack, but only because QKD is so expensive compared to simpler solutions. $\endgroup$
    – Crypto-Student
    Oct 25, 2022 at 11:22
  • $\begingroup$ @Crypto-Student Please note the words «future developments». A hypothetical secure QKD only needs computational security at the time of communication. A non-QKD scheme needs computational security also in the future. I am not a fan of QKD, but you still need to properly understand its properties. $\endgroup$
    – K.G.
    Oct 26, 2022 at 16:13

1 Answer 1

Reset to default
0
$\begingroup$

The French cybersecurity organization, ANSSI, has seemed to address this comparison of purely symmetric-cryptography-based solution compared to QKD solutions.

https://www.ssi.gouv.fr/en/publication/should-quantum-key-distribution-be-used-for-secure-communications/

A second, less-known fact is that a purely symmetric-cryptography-based solution compares favorably with practical QKD, that is, QKD paired with symmetric cryptography: it is much easier to deploy than QKD because it only requires standard network infrastructure; and offers comparable security, because it uses the same computational cryptography primitives.

Secure communications based only on symmetric cryptography may by appealing when users sets are fixed or can be managed centrally, and when one sees a value in avoiding the use of asymmetric cryptography altogether, for instance as an extra measure of caution against unknown cryptanalysis algorithms, quantum or otherwise. Publication [4] provides an example of a protocol that could be used in such a case.

Improve this answer
$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.