1
$\begingroup$

For a practical QKD implementation where OTP has been chosen for encrypting, how are key sizes determined?

Say, for example, Alice wishes to exchange xGB to Bob, then a key management system should already have xGB worth of OTP key material ready to use from a larger pool of shared key material. If so, then how is this key material built up using QKD? Is it (a) built in a monolithic style, where post processing is conducted on keys of arbitrary length, or is it (b) build up from smaller keys individually post processed? (Error correction method is arbitrary).

If (b) is the correct answer, then what is a typical/optimal individual key size?

Improve this question
$\endgroup$
4
  • $\begingroup$ QKD is not mainstream, especially combined with OTP (I think it's less uncommon to use KQD to establish/renew symmetric keys, e.g. for AES). Thus I don't believe there are well-established practices beyond sending an initial trusted key (e.g. by trusted courier) to counter MitM attack (which contrary to common belief applies to QKD absent that precaution). All the rest I guess depends on the supplier of the particular QKD gizmo. Although that's old and not recently updated, it might still be useful. $\endgroup$
    – fgrieu ♦
    Commented Jul 17 at 11:00
  • $\begingroup$ What do you mean with "post processing on key material"? That sounds too much like applying cryptographic primitives to create the required key stream. If that's the case then we're talking stream cipher, not OTP. Either you establish enough key material (there is research into fast QKD that could be used) or (base) keys are established, in which case it's not an OTP any longer. $\endgroup$
    – Maarten Bodewes ♦
    Commented Jul 17 at 11:57
  • $\begingroup$ @fgrieu 1) Do we believe in Buzek & Hillery's imperfect cloning machine, or is it not proven? Their conclusion still suggests that the original states will be perturbed. 2) If true, would error accumulation due to improper cloning still not lead to discovery of Eve? 3) If errors go unnoticed, would any message not get increasingly garbled through the error accumulation, again indicating the presence of Eve? $\endgroup$
    – Paul Uszak
    Commented Jul 17 at 12:54
  • $\begingroup$ @PaulUszak: 1) I'm incompetent on the physics. I trust that works based on academic consensus. 2&3) I understand and trust the principle of classical IT techniques that allow to safely correct errors. They can achieve, on top of QKD with error, a privacy amplification starting from initially trusted key material. I have reservations about: unaccounted-for physical phenomena (e.g. unwanted emissions of a transmitter); deliberate remote tampering with the physical apparatus (e.g. photoreceptor blinding as in some earlier attacks); possible software weaknesses accidental or not; business case. $\endgroup$
    – fgrieu ♦
    Commented Jul 17 at 14:13

1 Answer 1

Reset to default
2
$\begingroup$

Welcome Niall :-)

It's worthwhile visiting https://crypto.stackexchange.com/a/67525/23115 first as there is some confusion on how QKD works. Look specifically at the single quantum channel between Alice and Bob.

There is no extant store/reserve of key material. Generating such a pool is the whole purpose of QKD. It is initiated by Alice's RNG, transferred over the optical channel and accumulated at Bob's digs after sifting and verification.

This can occur logical bit by logical bit at any arbitrary rate (currently up to some Mbps). Thus there is no "key size" as such. That notion may have come to you from the fact that commercial QKD systems like this one use slower quantum transmission to generate/exchange keys for much faster traditional cryptography such as AES. That then operates over conventional network infrastructure.

Improve this answer
$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.