I see there's a project to combine Quantum Key Distribution, Physical Unclonable Functions, and classical crypto, in order to secure a high speed (100Gb/s) optical link.

While there does not seem to be a direct combination of QKD and PUF in that particular project, I wonder if that combination could be used to solve one of the problems of QKD: it is by itself not secure against a Man-in-the-Middle attack. Perhaps a PUF could solve that by some synergy with QKD (the issue seem to be: make it impossible for a MitM to appear holding the legitimate PUF, when he really is using the legitimate one remotely).

Are the QKD and PUF combined for that purpose? It yes, how, and how is it superior to the combination of classical crypto (which can solve MitM) and PUF (which should prevent cloning of the credentials), without QKD?

Reformulation: One problem with proof of ownership of a PUF (especially of the silicon memory kind envisioned in my first reference) is that they can be relayed, so that the verifier may believe he is interacting directly with the PUF, when in reality he is interacting with the PUF through some hostile proxy/MitM. My question is about using a quantum protocol to solve that, which hypothetically could make sense with some PUFs, e.g. optical. Perhaps this should be migrated to the physics site (but I have not the foggiest idea how).

  • 1
    $\begingroup$ I don't get how PUF solve MitM. $\endgroup$ Jul 9 '12 at 12:53
  • $\begingroup$ Neither do I; that's why I ask! I wonder if it combines with QKD in some way making it impossible for the MitM to use the legitimate PUF remotely. $\endgroup$
    – fgrieu
    Jul 9 '12 at 13:39
  • $\begingroup$ Uhm, reading my own source, it does not look like the PUF is planning to be combined directly with QKD in this project at least. $\endgroup$
    – fgrieu
    Jul 9 '12 at 14:01
  • $\begingroup$ It seems "boxes pairing" is the only hint on PUF is the slides, without any explanation. There's a chance to fight relaying with classical timing verification. Quantum wiretap channel might be a suitable well-known model for relaying. $\endgroup$ Oct 26 '16 at 10:50

It seems difficult to combine the two. PUFs can provide authentication but they are based on the sender having first built up a small number of challenge/response pairs before handing the PUF over. So if Alice gives the PUF to Bob, Alice can authenticate Bob with the response. However if the protocol is two-phased, where Alice authenticates Bob and then they do QKD, the MITM will just jump in at the second phase. So the idea is that PUF-based authentication needs to be binded to the key generated during QKD.

For example, Alice and Bob could perform QKD but treat the output as a challenge, and the response from the PUF is their shared secret key. Unfortunately, the number of possible outputs is too large for building up a set of challenge/response pairs. Without jumping into using classical cryptography, I don't see a way that the addition of a PUF could be useful.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.