TL;DR The answer is classical cryptography.
Besides a quantum link, secure data communication with Quantum Cryptography (more precisely, Quantum Key Distribution) uses classical links, a lot of mathematically provable classical cryptography, and a setup procedure using initially trusted material just as in classical cryptography.
To perform the same, classical cryptography uses the One Time Pad; or assumes a bound of the adversary's computing power and some unproven mathematical hypothesis. But assumptions may turn out wrong, and risk exists that future progress allows decryption of archived intercepts. Pure Quantum Key Distribution avoids that particular risk by instead relying only on physics when it comes to unproven assumptions.
Quantum Key Distribution (QKD) is now a subfield of Quantum Cryptography (QC), which also includes:
- Post-Quantum Cryptography, exploring cryptographic methods usable on classical computers that will resist attack by Quantum Computers, should they become applicable to attack today's cryptography.
- Quantum Random Number Generation, which aims at producing a demonstrably secure source of near-perfect random secret non-shared bits demonstrably rooted in some identified quantum physics phenomena; these are often used as RNGs in Quantum Key Distribution, and that's consistent.
- Quantum Cryptanalysis, studying attack of any kind of cryptography with a Quantum Computer, and attacks with any kind of device against Quantum Key Distribution or Quantum Random Number Generation.
The thought experiment in the seminal BB84 article quoted in the question can lead to practical QKD. I explain how and give links, but no math. That's out of ignorance on the quantum side, laziness on the information-theoretic side, and 30000 characters limit as an excuse.
A. Issues prevent direct use of sifted bits
The question summarized only a subset of the article, and stops at obtaining sifted bits. These are squarely unsuitable for direct use, and do not achieve Quantum Key Distribution (QKD), for three main reasons:
- Errors creep in the sifted bits
The many imperfections of the model (heavily simplified compared to the actual hardware and the known laws of quantum physics, even at the time the article was written) are such that, without Eve messing, sizably many sifted bits differ at Alice's and Bob's end. Sifted bits are thus unusable as key to a cipher, for decryption would likely fail.
- The sifted bits are not nearly secret enough
An eavesdropper can gain sizable knowledge about the sifted bits. That makes them unacceptable for direct use as a keystream, for Eve's partial knowledge puts confidentiality in jeopardy. Quoting the article, the best insurance given by the quantum model of the adversary is only:
it can be shown that no measurement on a photon in transit, by an eavesdropper who is informed of the photon's original basis only after he has performed his measurement, can yield more than 1/2 expected bits of information about the key bit encoded by that photon
- Who are these sifted bits shared with?
The first part of the article, and the question, assume the classical channels are
susceptible to eavesdropping but not to the injection or alteration of messages
Without such insurance, Alice and Bob would be unsure about who their sifted bits are really shared with! It could be that Eve rather than Bob is who receives Alice's photons and "communicates over the public channel to Alice", thus that Alice shares sifted bits with Eve. Bob faces a similar issues if Eve really is who sent him photons and "tells him which filters are correct". This allows a Man-in-the-Middle attack when data transmission time comes.
B. Classical cryptography rooted in information theory fixes them all
- Secret-Key Reconciliation protocol remove errors, and more
Coding theory and error detection and correction are used to build a secure Secret-Key Reconciliation protocol additional to sifting, also running over the classical channels. Its objectives are to
- remove or fix errors in the sifted bits, with bounded low odds of the contrary;
- obtain an upper bound on the actual error rate, which is attributed to Eve spying the quantum channel;
- obtain and minimize an upper bound on the information leaked by running the protocol over the classical channels, that Eve is assumed to scrutinize;
- deduce a lower bound of what entropy (if any) remains in the rest; if there is less than some headroom, QKD failed.
Such reconciliation protocol can loose little-enough entropy as to be usable in practice, and be information-theoretically provable; but no simple such one is known. A most scrutinized milestone is the cascade protocol in: Gilles Brassard and Louis Salvail's Secret-Key Reconciliation by Public Discussion, in proceedings of Eurocrypt 1993.
- Privacy Amplification distillates a shared key
The entropy demonstrably remaining after reconciliation (if any) is distilled into bits with close to perfect entropy. A classical cryptographer would use a hash, but provable information theory has nothing to offer in that category. ID Quantique's 2020 whitepaper gives a rudimentary Privacy Amplification Protocol, but that's only for illustration.
Further, for use as an ever-flowing source of near-perfect random secret shared bits, it must be removed from the outcome enough bits to renew the setup key (see 3 below). Articles scrutinizing this circularity go under variations of the name Universally Composable Quantum Privacy Amplification.
- Classical setup key and cryptography make the classical channels secure
The method proposed by the article is the most common:
Alice and Bob have agreed beforehand on a small secret key, which they use to create Wegman–Carter authentication tags
That's similar to the low-tech key ceremony of classical cryptography: Bob physically meets Alice, each throws an hex dice 20 times, and writes the outcomes as 20 characters, forming two lines on paper. Chemical carbon copy insures Alice and Bob keep identical notes. Their are sealed in two opaque tamper-evident envelopes to insure secrecy until use. Bob protects his envelope while he gets back. Alternatively, Alice does the whole job and a trusted courier hands Bob the envelope against signature.
For each of the two classic communication channels, the half of the setup key generated by the sender on that channel is used as key to an information-theoretic Message Authentication Code (like Universal hashing of Mark N. Wegman, J. Lawrence Carter; New hash functions and their use in authentication and set equality, in Journal of Computer and System Sciences, 1981), computed over all the data sent on the channel for sieving and reconciliation. That MAC (one of the two "tags" in the article) is sent on the conventional channel it protects. The receiver can recompute and check it, and this gives demonstrably bounded odds of forgery. Our example's 80-bit half key demonstrably gives 40-bit security: better than one in a million millions odds of undetected forgery, which satisfies any rational person.
Setup key transfer must insure integrity, but can be differed to a moment when secrecy is no longer required, like in classical asymmetric cryptography. However setup key halves must then be conveyed separately in each direction, after reconciliation, but before the key established by QKD can be trusted. That's inconvenient, and common practice is to keep the setup key secret: ID Quantique's 2020 whitepaper states that it is made
use of a pre-established secret key in the emitter and the receiver, which is used to authenticate the communications on the classical channel. This initial secret key serves only to authenticate the first quantum cryptography session. After each session, part of the key produced is used to replace the previous authentication key.
Note: This did not cover a number of things needed for a working QKD, and possible pitfalls:
- How does Bob conclude that a photon did not pass thru a polarizing beam splitter, which is an absence of event? If that's by timing, how do Alice and Bob get a common timing reference precise enough? At a coarser level, how do Bob and Alice agree on a common indexing of expected photon events?
- How much exploitable information leaks thru classical side-channels not accounted for in the reconciliation's estimate of remaining entropy, e.g. due to timing variations in the sifting or reconciliation protocol, varying light intensity, electromagnetic leakage..
- How much other headroom is necessary in the test at end of reconciliation to robustly cover the imperfections of the quantum model, including those sneakily introduced by a creative adversary? How can it be safely arranged a retry should that test fail?
- How is the setup key stored secretly in the QKD devices? How is it kept in synchronization under down-to-earth constraints like power failure?
- Uncaught design errors or runtime faults (accidental or deliberate) in the implementation, which relies on conventional electronics, processors, and software.
C. Quantum Cryptography from Quantum Key Distribution
Just like conventional cryptography, Quantum Cryptography aims at transmission of arbitrary data with confidentiality and integrity (understood to include assurance of origin and destination). Each of these two goals can be reached in two ways, both using classical cryptography over classical channels, using the outcome of Quantum Key Distribution as key:
- Provably secure conventional cryptography rooted in information theory
- The One Time Pad (or an essentially equivalent variant) for confidentiality, using the random bits of QKD as keystream.
Security relies heavily on the quality of the Privacy Amplification of B.2, and on the soundness of the insurance given by the Secret-Key Reconciliation protocol of B.1. Throughput is bounded by the sift rate diminished by what's eaten by the tasks in B.
- An information-theoretic Message Authentication Code for integrity and origin, keyed from the QKD flow, as in B.3 above. That tolerates small imperfections in Privacy Amplification.
- Conventional symmetric cryptography without mathematical proof
Some symmetric cipher for confidentiality, regularly re-keyed using the key stream of QKD. That's the only method to boost an otherwise insufficient rate of QKD. Also, it adequately mitigates small imperfections after Privacy Amplification.
A typical choice is the block cipher AES-256, perhaps with an operating mode like CTR. That's pragmatic and makes a lot of sense: AES-256 is rubber-stamped by civilians and miliary, is largely conjectured adequately secure from brute force attack for decades including using Quantum Computers, and against side channel attack assuming regular key change with classical key derivation, which QKD can supplement or replace.
Some standard Message Authentication Code for integrity, e.g. HMAC-SHA-512, probably regularly keyed from the QKD; giving up on using an information-theoretic MAC could make sense when reusing a commercial classical cryptography device without modification.
Authenticated encryption (perhaps AES-GCM), which is a modern way to integrate a symmetric cipher and a standard MAC.
The above techniques are believed secure, or even mathematically provable for those of C.1. The technically difficult points are the prior QKD, and correct implementation as for conventional applied cryptography: Random Number Generator, side channels and fault attacks, integration in a protocol..
D. Operational constraints of Quantum Cryptography
There are severe limitations to QKD, at least as widely available:
- Incompatibility with network gear along the fiber (standard optical amplifiers or other standard repeaters as used in long fiber cables, switches and routers directing data to the right user). Solutions exist only at the laboratory level. Commercial offers are restricted to point-to-point communication, or/and use conventional cryptography beyond that.
- Small range, and (when not assisted by conventional cryptography not mathematically proven) low bandwidth, with a compromise between the two. For example, the Cerberis3 QKD System is specified for 1.4 kbit/s over 50 km, and less at the maximum range of 75 km. For direct line-of-sight ground-satellite by night, a 2017 paper reports ~12 kbit/s at 645 km to ~1 kbit/s at 1200 km. In lab conditions with supercooled photon detector it is reported
- If we want pure QKD, it is lost the convenience of Public-Key Infrastructure based on digital certificates issued by certification authoritie(s).
- No interoperability between vendors (closest I could find is Toshiba's call for arms towards that, in a Feb. 2017 newsletter).
- No extensive data on operational availability of QKD links is available, especially under varying temperature; it is reasonable to fear low Mean Time Between Failure for some parts, e.g. photon detectors after temperature cycling.
- To my knowledge, no device employing QKD has obtained so far (Aug 2017) a public security certification covering QKD. Fact-checking this datasheet for a "Certified Common Criteria & FIPS 140-2 Level 3" product with "Support for QKD" available as an upgrade, I conclude the only quantum-related feature covered by certificates is a RNG, and the FIPS 140-2 security policy's only mention of QKD is:
The Quantum Key Channel serial port connects to a separately available ID Quantiqe (sic) Cerberus quantum key distribution server (not a supported FIPS140-2 Level 3 mode of operation under this certification).
E. Security of Quantum and conventional cryptography
- How Quantum Key Distribution implementations fail
The security of QKD is rooted into parts of cryptography that are mathematically proven secure; and a physical model of how photons (possibly other quantum physics objects) behave per modern physical theory, which exquisitely matches experimental results, and allows theoretical proofs.
However, a large fraction of particles physics and electromagnetism, and all of gravity/relativity, is typically brushed aside from the analysis; and the hypothesis of proofs do not fully model the equipment used, which has allowed some credible attacks, like phase-remapping.
Worst, adversaries think outside of the box and actively modify the quantum experiment so that the model is no longer a close fit. Like Eve blinds the photon detector! Quoting Lars Lydersen, Carlos Wiechers, Christoffer Wittmann, Dominique Elser, Johannes Skaar and Vadim Makarov: Hacking commercial quantum cryptography systems by tailored bright illumination, in Nature Photonics Letter 2010:
we demonstrate how two commercial QKD systems id3110 Clavis2 and QPN 5505, from the commercial vendors ID Quantique and MagiQ Technologies, can be fully
cracked. We show experimentally that Eve can blind the gated detectors in the QKD systems using bright illumination, thereby converting them into classical, linear detectors. The detectors are then fully controlled by classical laser pulses superimposed over the bright continuous-wave (c.w.) illumination. Remarkably, the detectors exactly measure what is dictated by Eve.
A joint 2010 press release with the company which QKD device was hacked mentions that it was
developed and tested a countermeasure. [..] “Testing is a necessary step to validate a new security technology and the fact that this process is applied today to quantum cryptography is a sign of maturity for this technology,” explains [..] CEO of [..company..]
That's an arms race, similar to what has been ongoing for 40 years in Smart Cards, often used nowadays for convenient cryptographic key distribution. Eve has blueprints for other attacks:
- inducing Alice to make errors by blinding her side rather than Bob's;
- probe the (assumed random and secret) orientation of Alice and/or Bob polarizers by remotely sending photons (perhaps entangled, and with whatever characteristic best fits the job) in-between the individual photons sent (typically regularly) by Alice;
- predicting Alice's or Bob's RNG from earlier output (to reach the record rates reported in D.2, several gigabit/second of assumed perfect randomness are consumed by Alice; that's hundreds times more than common quantum sources);
- classical TEMPEST information leaks or induced-faults targeting the state of the quantum gear, the current setup key, or the QKD outcome.
- Quantum and Classical assumptions compared
Conventional cryptography achieves the equivalent of QDK only by relying on some mathematically unproven hypothesis. For symmetric (secret-key) cryptography, that can be broadly described as hardness of solving some combinatorial problem. Further, asymmetric (public-key) cryptography is required for turning a channel with integrity into one with confidentiality (something QKD can do), and that relies on the hardness of solving some other problem; examples include integer factorization, discrete logarithm, or RLWE.
There is wide consensus, but no mathematical proof, that (ignoring implementation issues) current conventional cryptography is currently secure; and that symmetric cryptography needs at most a doubling of the key size to become secure against future quantum computers hypothetically usable for problems of cryptographic interest. Which key size is required for which of the various problems used in asymmetric cryptography is an active research topic.
The security of QKD relies on physical hypothesis, where the security of conventional cryptography relies on mathematical hypothesis. Both kinds of hypothesis are not mathematically proven. But both are firmly established (at least when we restrict conventional cryptography to its symmetric branch). Any insecurity (beyond, inevitably, the humans involved) is likely to lie elsewhere: oversimplified theoretical model, undetected mistakes or backdoors in the implementation. The complexity of QKD makes these mishaps more likely.
- Quantum Key Distribution's strongest point
QKD gives an insurance that classical cryptography does not. Arguably, if a data transfer protected by QKD is secure when it takes place, and uses only mathematically proven cryptography, then no future progress will decipher that data. The argument is that even if the photons sent on the quantum channel could be stored (a trick that has been pulled) at time of the communication in hope of decryption in the future, the photons would not reach the quantum receptor, QKD would fail (with high insurance), actual data encryption would not occur, and the data would be safe.
By contrast, the channels of classical cryptography can be passively eavesdropped and stored for hypothetical future decryption using superior technology. That's reasonable: even perfect forward secrecy won't resit a break of the symmetric cipher. Intercepts kept from the past that used a well-documented cipher with less than about 100-bit key are decipherable today with enough resources, 3DES (64-bit block, 111-bit key) will likely succumb, AES-128 can assuming mere stability of technical progress, AES-192 too if further assuming quantum computers usable for cryptanalysis, AES-256 also if we stop wondering about how and when.
F. Use cases for commercial Quantum Cryptography
The justified scientific recognition and the press coverage of QKD/QC helps sales, and is enough for targeting some markets:
- Experimental study of QKD/QC, which is of high scientific and educational value from both experimental quantum physics and applied cryptography/cryptanalysis/auditing/hacking perspectives.
- A segment of the computer security market: purchase-decision-makers in quest of prestige, reassurance, or theatrical effect. Quantum can be to crypto what gold is to audio, and silver to bullet.
- The funneling out of money for plausible cause. Expensive security equipment is good at that, usefulness is secondary, unconventionality no obstacle: see ADE 651.
- Cover for backdoor. QKD equipment is sold to supply keys for encryption of sensitive data. Knowing an easily exploitable vulnerability in the QKD implementation (e.g. leak of shared key on classical channels, perhaps subtly by timing variation in sifting or reconciliation, accidentally or deliberately) can break an otherwise secure encrypted link.
- Cover for trojan. QKD equipment has reasons to be in secure perimeter. It's cabinet is thus ideal to physically sneak-in a microphone, camera, spy gadget, or side-channel attack device (being physically connected to the targeted security equipment helps immensely).
It is harder to find a security problem that today's QKD can solve (and penetrate the bulk of the market); many conditions must be met:
- The confidentiality of some data to be transferred from point to point is of vital importance (at time of transfer, or later).
- And the One Time Pad (which has successfully been used in that situation) is not an option; perhaps the means that must transport the shared key of QKD with at least integrity won't transfer a 1TB memory stick full of randomness with integrity and confidentiality, or the data of vital importance is larger than 1TB; see Johny Mnemonic.
- And QKD is left usable despite D.1, D.2 (excluding the bandwidth issue which is adequately taken care by C.2), D.4, D.5 and D.6.
Assuming the above, then it is rational to think about using commercial QKD as a supplement to classical cryptography; fortunately, we are not bound to choose between the two, and can get the best of both worlds on security, when it is acceptable to get the worst on availability.
Classical cryptography featuring perfect forward secrecy and robust cipher with large block and key is widely available. On the communication link it uses, it can be inserted an independently sourced commercial QKD equipment, of course with independently managed setup keys for each of the two encryption means as in any sound use of multiple encryption. An auditor can ensure confidentiality is at least as good as without QKD by merely ruling out trojan (see F.5), for a fee. Perhaps the reduction in simplicity and assurance of working on D-day is worth the price and added confidence in long term confidentiality, however tarnished it is by the use of classical cryptography without mathematical proof to reach acceptable throughput.
But it would be entirely irrational to rely solely on QKD, given its immaturity, unconvincing security argument against adversaries not bound by the narrow physical hypothesis made, deep complexity when we account for the arsenal of classical cryptography necessary to make it work at all, tainted security track record for these reasons, poor auditability and recognition by practitioners, and requirement for the same inconvenient setup key management as classical cryptography.
Quantum Key Distribution (a subfield of Quantum Cryptography) in principle performs the same tasks, and uses the same operational procedures as conventional cryptography, with no operational simplification whatsoever. In particular, the need for initially trusted material established by inconvenient human means remains.
QKD relies on physics rather than mathematics when it comes to unproven hypothesis. That's a remarkable achievement and paradigm shift. But if that's a benefit, it is intangible, and did not help QKD get a clean security track record, much less be widely recognized as useful by practitioners.
Integration of QKD in current networks is utterly impractical: QKD currently requires a dedicated fiber with practical range limit ≪500 km, or direct line of sight with no sunlight, rain, or fog. That can only be extended with trusted facilities at each intermediary endpoint. Practical throughput is low, except when supplemented by conventional cryptography (then loosing some of the aforementioned intangible benefit).
Commercial QKD equipment is complex, in part because it relies heavily on many classical mathematically provable cryptographic techniques. It is expensive, big, power-hungry, in low demand and stock, of unproven field reliability, seldom used in practice, and not recognized by security certification authorities.
QKD removes the risk that future technological progress allows compromise of intercepts made earlier. It is worth consideration in complement (not replacement) of carefully vetted classical cryptography with independent secure setup procedure, for data which confidentiality is of utmost importance (especially if that's for decades), if we trust couriers for setup keys but not for the One Time Pads traditionally used for perfect secrecy in that situation.