1
$\begingroup$

An article last month claimed that Toshiba Corp. and Tohoku University recently broke the record for the amount of data encrypted using quantum key distribution by transmitting "a few hundred gigabytes".

But QKD is merely a protocol for transmitting symmetric keys - the actual encrypted data is later sent over an insecure channel where presumably bandwidth is not a limitation (or at least any limitations are completely separate from the encryption protocol). Moreover, my understanding is that once you've transmitted a single symmetric key, the amount of data that you can encrypt with it is effectively unlimited:

The answer at https://crypto.stackexchange.com/a/2473/76433 claims that for AES-128 the risk of compromise is "very likely" after $2^{64}$ blocks of encrypted data are transmitted, but the answer at https://crypto.stackexchange.com/a/5101/76433 says that for AES-256, after $2^{50}$ blocks of data transmission the probability of data leakage is still only $2^{-29}$. The answer at https://crypto.stackexchange.com/a/66261/76433 is more conservative and recommends only encrypting 64 GiB of data per symmetric key in order to keep the collision risk down to $2^{-64}$.

So it seems that after you've transmitted a mere 256 bits of symmetric key data via QKD, the amount of data you can encrypt is effectively unlimited. (If you want to be extremely conservative and you want the risk all the way down to $2^{-64}$, then maybe you'd need to transmit a few keys in order to transmit "a few hundred gigabytes" of data.) And modern QKD technology can easily transmit millions of bits per second (although whether or not they are actually secure is a separate question). So why is it impressive that large amounts of data were transmitted?

More broadly, is there any real advantage to having a QKD system that can transmit more than ~256 bits? (Again, I'm putting aside any practical security risks of QKD and assuming for the sake of argument that it is indeed secure.)

$\endgroup$
  • $\begingroup$ Did you find the original article? I think they used a new key for each block encryption orsimilar so that they can test the reliability of the system? $\endgroup$ – kelalaka Feb 11 at 16:28
  • 1
    $\begingroup$ @kelalaka I didn't find the original article, no. Isn't using a new key for each block a huge overkill? At that point, you might as well just use a one-time pad, which would be faster, more secure, and require less symmetric key transmission. $\endgroup$ – tparker Feb 11 at 16:32
2
$\begingroup$

I believe the end goal is to use the QKD data as a one-time pad, so the QKD rate would need to be the same as the plaintext data rate. That is the only guaranteed-secure method. (Although I think QKD might be a bit of a scam.)

Also, you can't use a key forever. I recently made a 400Gbps AES-GCM encryptor. You're not supposed to send more than 2^32 blocks with the same key, because it starts to get easy to forge tags after that. This corresponds to ~8 hours' worth of data.

$\endgroup$
  • $\begingroup$ QKD is a marvelous achievement: it does the same as traditional symmetric crypto, replacing an unproven mathematical hypothesis (impossibility to find a polynomial time algorithm to solve some combinatorial problem) by unproven physical hypothesis. Suggesting that QKD solves the problem of initial key distribution is an often practiced scam. Truth is, we still need to secure by traditional means (a trusted courier) the transfer of an initial information authenticating the parties. Even using key distribution in the name is a bit of a scam. $\endgroup$ – fgrieu Feb 12 at 7:18
  • $\begingroup$ What are you reffering to when you say unproven physical hypothesis? The theory of quantum mechanics is understood and proven well enough, especially the observation of quantum states, to just call it "unproven". In theory (emphasis) it's absolutely secure. $\endgroup$ – AleksanderRas Feb 12 at 10:12
  • $\begingroup$ (1) Doesn't $(2^{32} \text{ blocks}) \times (128 \text{ bits/block}) / (400 \times 10^9 \text{ bits }/s)$ work out to 1.4 seconds, not 8 hours? (2) I don't think it gets "easy" to forge tags after $2^{32}$ blocks. As described in the second link above, after that much data transmission the probability of a partial data leak reaches $2^{-65}$, which is still effectively zero. $\endgroup$ – tparker Feb 12 at 14:27
  • $\begingroup$ Sorry: I meant 2^32 GCM frames, each frame having a tag, and each frame having a duration of ~6us in my case. $\endgroup$ – Evariste Feb 12 at 18:06
  • $\begingroup$ The main reason I think QKD is a scam is because there are quantum-resistant key exchange algorithms that seem as safe as QKD without all the hassle. But QKD is sexier. (There are also the authentication problems you mention.) $\endgroup$ – Evariste Feb 12 at 18:18
1
$\begingroup$

The breakthrough in the article is a little misleading. As you correctly stated it's possible to send an (almost) unlimited amount of encrypted data using a symmetric encryption algorithm like AES. They did send this AES key using QKD.

As far as I can tell from this article from 2017, the actual breakthrough is that they managed to perform a QKD at a very high speed:

"The device has achieved a key data distribution speed of 13.7 megabits per second. The speed is about seven times the previous fastest quantum key distribution speed: the 1.9Mbps that Toshiba achieved in 2016."

$\endgroup$
  • $\begingroup$ I suppose that's kind of impressive, but it seems to me to be pretty silly to bother with high-bandwidth QKD if every bit after the 256th one delivers zero marginal utility. Of the 13.7 million bits delivered in that second, all but the first 1000 at the most weren't used. I could imagine a few edge situations were low latency could be important, but not high bandwidth. $\endgroup$ – tparker Feb 11 at 20:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.