# Why is it difficult to encrypt large amounts of information using quantum key distribution?

An article last month claimed that Toshiba Corp. and Tohoku University recently broke the record for the amount of data encrypted using quantum key distribution by transmitting "a few hundred gigabytes".

But QKD is merely a protocol for transmitting symmetric keys - the actual encrypted data is later sent over an insecure channel where presumably bandwidth is not a limitation (or at least any limitations are completely separate from the encryption protocol). Moreover, my understanding is that once you've transmitted a single symmetric key, the amount of data that you can encrypt with it is effectively unlimited:

The answer at https://crypto.stackexchange.com/a/2473/76433 claims that for AES-128 the risk of compromise is "very likely" after $$2^{64}$$ blocks of encrypted data are transmitted, but the answer at https://crypto.stackexchange.com/a/5101/76433 says that for AES-256, after $$2^{50}$$ blocks of data transmission the probability of data leakage is still only $$2^{-29}$$. The answer at https://crypto.stackexchange.com/a/66261/76433 is more conservative and recommends only encrypting 64 GiB of data per symmetric key in order to keep the collision risk down to $$2^{-64}$$.

So it seems that after you've transmitted a mere 256 bits of symmetric key data via QKD, the amount of data you can encrypt is effectively unlimited. (If you want to be extremely conservative and you want the risk all the way down to $$2^{-64}$$, then maybe you'd need to transmit a few keys in order to transmit "a few hundred gigabytes" of data.) And modern QKD technology can easily transmit millions of bits per second (although whether or not they are actually secure is a separate question). So why is it impressive that large amounts of data were transmitted?

More broadly, is there any real advantage to having a QKD system that can transmit more than ~256 bits? (Again, I'm putting aside any practical security risks of QKD and assuming for the sake of argument that it is indeed secure.)

• Did you find the original article? I think they used a new key for each block encryption orsimilar so that they can test the reliability of the system? Feb 11 '20 at 16:28
• @kelalaka I didn't find the original article, no. Isn't using a new key for each block a huge overkill? At that point, you might as well just use a one-time pad, which would be faster, more secure, and require less symmetric key transmission. Feb 11 '20 at 16:32

I believe the end goal is to use the QKD data as a one-time pad, so the QKD rate would need to be the same as the plaintext data rate. That is the only guaranteed-secure method. (Although I think QKD might be a bit of a scam.)

Also, you can't use a key forever. I recently made a 400Gbps AES-GCM encryptor. You're not supposed to send more than 2^32 blocks with the same key, because it starts to get easy to forge tags after that. This corresponds to ~8 hours' worth of data.

• QKD is a marvelous achievement: it does the same as traditional symmetric crypto, replacing an unproven mathematical hypothesis (impossibility to find a polynomial time algorithm to solve some combinatorial problem) by unproven physical hypothesis. Suggesting that QKD solves the problem of initial key distribution is an often practiced scam. Truth is, we still need to secure by traditional means (a trusted courier) the transfer of an initial information authenticating the parties. Even using key distribution in the name is a bit of a scam.
– fgrieu
Feb 12 '20 at 7:18
• What are you reffering to when you say unproven physical hypothesis? The theory of quantum mechanics is understood and proven well enough, especially the observation of quantum states, to just call it "unproven". In theory (emphasis) it's absolutely secure. Feb 12 '20 at 10:12
• (1) Doesn't $(2^{32} \text{ blocks}) \times (128 \text{ bits/block}) / (400 \times 10^9 \text{ bits }/s)$ work out to 1.4 seconds, not 8 hours? (2) I don't think it gets "easy" to forge tags after $2^{32}$ blocks. As described in the second link above, after that much data transmission the probability of a partial data leak reaches $2^{-65}$, which is still effectively zero. Feb 12 '20 at 14:27
• Sorry: I meant 2^32 GCM frames, each frame having a tag, and each frame having a duration of ~6us in my case. Feb 12 '20 at 18:06
• The main reason I think QKD is a scam is because there are quantum-resistant key exchange algorithms that seem as safe as QKD without all the hassle. But QKD is sexier. (There are also the authentication problems you mention.) Feb 12 '20 at 18:18

The breakthrough in the article is a little misleading. As you correctly stated it's possible to send an (almost) unlimited amount of encrypted data using a symmetric encryption algorithm like AES. They did send this AES key using QKD.

As far as I can tell from this article from 2017, the actual breakthrough is that they managed to perform a QKD at a very high speed:

"The device has achieved a key data distribution speed of 13.7 megabits per second. The speed is about seven times the previous fastest quantum key distribution speed: the 1.9Mbps that Toshiba achieved in 2016."

• I suppose that's kind of impressive, but it seems to me to be pretty silly to bother with high-bandwidth QKD if every bit after the 256th one delivers zero marginal utility. Of the 13.7 million bits delivered in that second, all but the first 1000 at the most weren't used. I could imagine a few edge situations were low latency could be important, but not high bandwidth. Feb 11 '20 at 20:20