Is quantum cryptography unbreakable?

Question

People always say that "there is no such thing as unbreakable crypto!"

In most cases they are right. AES, RC4, RSA, C25519, DH, .... are all cryptographic algorithms which are crackable (with extreme effort).

The asymmetric stuff, you can factorize; the ciphers you would have to brute force.

But from what I understood, symmetric quantum crypto is kind of uncrackable. It uses quantum mechanics (who would have thought?) to directly send the symmetric key to the other machine. But the sequence changes every read cycle, so if the attacker would sniff the traffic he would have a key other than that which the recipient received, and the recipient would know that the key was tampered with.

So, is quantum cryptography even breakable without physical access to the machine? And if yes, how?

Answer 1

You have to distinguish between "theoretically" and "practically" breakable. Pretty much any cryptosystem can be broken in practice by violating the assumptions that the theoretical security proof uses.

For example, with Quantum Key Distribution and a OTP, you might have theoretical perfect secrecy. However, the proof for such a scheme does not address the possibility of "Wait for them to receive the message and then threaten them to obtain it" - and there is nothing that QKD + OTP or any cryptography can do about to prevent this type of attack. This is because such an attack specifically targets what the security proof of the cryptography does not cover.

So in that sense, when an adversary has such options, achieving "unbreakable" security in practice is not a realistic prospect: In the best case scenario, with theoretically perfect crypto (i.e. QKD + OTP), there still exists a trivial solution to breaching the confidentiality of the information: Simply extract the information physically from the recipient, after they receive it. The implementation might be complex and expensive, but it is certainly possible in a practical sense.

Edit

This rather scathing blog.cr.yp.to post reiterates the the importance of the used assumptions and raises some technical points aside from the ever present threat of rubber hose cryptanalysis:

A company named ID Quantique has been selling quantum-cryptography hardware, specifically hardware for BB84-type protocols, since 2004. ID Quantique claims that quantum cryptography provides "absolute security, guaranteed by the fundamental laws of physics." However, Vadim Makarov and his collaborators have shown that the ID Quantique devices are vulnerable to control by attackers, that various subsequent countermeasures are still vulnerable, and that analogous vulnerabilities in another quantum-key-distribution system are completely exploitable at low cost. The most reasonable extrapolation from the literature is that all of ID Quantique's devices are exploitable...

...how can a product be broken if it provides "absolute security, guaranteed by the fundamental laws of physics"? The correct answer is that the hypotheses of the theorems, the assumptions made in the theorems, are not the laws of physics. The hypotheses include

• an embarrassingly oversimplified model of physics that can express some quantum concepts but that ignores critical long-distance interactions, notably electromagnetism; and
• an embarrassingly oversimplified model of the attacker that allows the attacker to inspect photons being sent between quantum-cryptography devices but that does not allow the attacker to interact with the devices in any other way.

Answer 2

The difference between cryptographic algorithms and quantum key distribution (QKD) is that the algorithms operate purely in the mathematical realm of information theory. QKD is a physical process. Thus, it can do things that algorithms cannot do.

Let's say Alice wants to send a message to Bob without Eve getting the information. If Alice uses a cryptographic algorithm to encrypt the message to Bob, and Eve intercepts the message, she may be able to undo the algorithm. However, if Alice has a way to send a message to Bob such that Eve cannot get ahold of the information that is transmitted, then Alice could be sent the message in plaintext and be perfectly comfortable that Eve can't get at the information.

QKD relies on the laws of quantum mechanics to create such a channel. In theory, it is perfect. So long as the laws of quantum mechanics hold true, QKD is safe. However, we have to remember that it is a physical protocol, not a mathematical one. The ability to implement it is completely dependent on the hardware available. I read a few years back that one of the QKD systems could be fooled by shining a flashlight down the fiber, which fooled the hardware implementation of the receiver into exposing the secret information in the next step. It relied on the physical limitations of the single-photon detectors used in the devices. ( L. Lydersen, C. Wiechers, C. Wittmann, D. Elser, J. Skaar, and V. Makarov, Nat. Photonics 4, 686)

These physical attacks should be thought of as akin to other physical attacks on algorithms. AES, for instance, is not considered broken. However, there are some very powerful side-channel attacks that can attack the hardware implementing the AES algorithm.