3
$\begingroup$

I don't understand the popularity of the idea of QKD (often coupled with OTP). From what I can tell, a quantum-safe key exchange algorithm like McEliece has just as much security while operating over current networks, through repeaters, and not requiring single-photon emitters. Combining this with AES seems convenient and practical.

  1. Why would one ever choose QKD over McEliece?

The only reason I can discern is that there is some possibility that a yet-to-be-discovered algorithm may weaken McEliece or AES.

Improve this question
$\endgroup$
5
  • 1
    $\begingroup$ "often coupled with OTP"; actually, from my view of the QKD community, QKD is most often coupled with AES (so that you're not limited by the bandwidth limitations of QKD, which has been improving over time, but still has limits). Of course, if you do that, you lose the supposed "security guaranteed by Quantum Physics" claim QKD makes, but still, that's what it appears people do in practice... $\endgroup$
    – poncho
    Commented Feb 21, 2020 at 19:41
  • $\begingroup$ It boils down to what you mean by "just as much security": practically? There's something to be said about "perfect" even if most people don't need perfect. Remember that most of the current work is research. Production scaling/efficiency is not a criterion for people working with QKD at this time. $\endgroup$
    – dandavis
    Commented Feb 21, 2020 at 20:18
  • $\begingroup$ I oughtn't to have said "just as much security". That is not quite true. Even though most of the current work is research, though, there are commercially-available QKD systems (I think), but I can't figure out why there is even a market. $\endgroup$
    – Evariste
    Commented Feb 21, 2020 at 20:33
  • $\begingroup$ There are most certainly QKD systems on the market (and have been for a number of years). $\endgroup$
    – poncho
    Commented Feb 21, 2020 at 20:46
  • $\begingroup$ Quantum Key Distribution is rightly popular as an experimentation and research field for quantum physicists. It's a time-proven way to get the attention of the press and attract public money. But it's far from universally popular among cryptographers and security professionals. My perception is that most are close to my opinion: there's no need for QKD. Read the position of French security authorities, with links to their US and UK counterparts. $\endgroup$
    – fgrieu ♦
    Commented Apr 19, 2023 at 14:55

2 Answers 2

Reset to default
1
$\begingroup$

QKD is "popular" as it doesn't rely on an algorithm that can possibly be broken. McEliece doesn't have a security proof. So although it is thought to be secure after many years of analysis, it may be broken.

McEliece may even be practically broken now without the cryptographic community knowing about it. This is not very likely and it goes for any cryptographic algorithm that is not theoretically secure, but it is not impossible and cannot be disproven.

Of course, using QKD does have very real drawbacks, which are indicated in the this Q/A on our site. This is why it is not that popular in the cryptographic community despite it being theoretically secure.

Improve this answer
$\endgroup$
2
  • $\begingroup$ You just know that I can’t let this go 😃 Uncharacteristically, you’ve acknowledged that McEliece may have been clandestinely broken (see NOBUS). Might you then accept the same for AES? And are you not then driven by Hobson’s Choice towards QKDNs & OTPs? $\endgroup$
    – Paul Uszak
    Commented Dec 16, 2023 at 0:18
  • $\begingroup$ These are not schemes that have been invented by the NSA. Afaik neither scheme has been significantly altered by NIST either. This is something different from e.g. Dual-DRBG. From AES I know that few cryptographers doubt the construction. So no, I don't think it's the same thing. And please remind yourself that for QKD's you're still dependent on suppliers. I think you've pointed out a Swiss company not too long ago. It's not like crypto boxes from Swiss have always been secure, right? $\endgroup$
    – Maarten Bodewes ♦
    Commented Dec 17, 2023 at 3:50
0
$\begingroup$

Because it's the Holy Grail of cryptography.

To be specific, it's not unbreakable as the layman's literature suggests. It's that a quantum transmission of key material cannot be intercepted without the sending/receiving parties noticing. It is the Observer Effect in physics and a fundamental part of the Universes. Knowing that you're being spied upon in many ways gives you the advantage.

And if you can securely transmit a lot of key material, you can then use one time pad (OTP) techniques for the encryption. And OTPs are provably secure via information theory. McEliece/AES being limited key length based ciphers are not. Just because the academic community can't break McEliece or AES, doesn't mean that they haven't already been by state actors, or will be tomorrow by Alexander Verykleverkov in his university dorm room. Perhaps Shor's 3rd improved algorithm might work against McEliece. The point I'm labouring is that you can prove photon interception/OTP security now, but not McEliece/AES. All we have is an absence of evidence for them.

The only reason I can discern is that there is some possibility that a yet-to-be-discovered algorithm may weaken McEliece or AES.

You've answered your own question :-) Israel can keep defence-related documents sealed for 70 years. The UK had 50. Their transmission may have been intercepted or copied and stored. You cannot guarantee that they won't be teaching McEliece/AES breaking in high schools by 2091.

That's why there is a market for QKDNs. See all the interest in this older answer, and ponder the quotation at it's end. It's incredibly alluring, and if you want one, buy one of these:-

enter image description here

It's a node for commercial QKDNs. Cerberis from ID Quantique.

Improve this answer
$\endgroup$
14
  • 4
    $\begingroup$ Of course, Paul doesn't mention some issues with QKD systems; for one, they are prone to side channel attacks (which would leak the shared bits), for another, in practice they don't generate key bits fast enough for OTP, hence they often use the bits as AES key bits (and hence the entire system is no stronger than AES), for a third, there is a distance limitation (unless you use trusted repeaters, which is often not an option - they're working on untrusted repeaters, but that's years away...) $\endgroup$
    – poncho
    Commented Feb 2, 2021 at 16:00
  • 1
    $\begingroup$ @poncho I would also suggest that side channel attacks are irrelevant within this context. AES leaks just as much when I have to write down my banking password on a post it note due to daft complexity requirements. This question concerns fundamental differences and what can be mathematically proven, not really the implementation irregularities which can undermine any and all crypto systems. $\endgroup$
    – Paul Uszak
    Commented Feb 2, 2021 at 16:39
  • 2
    $\begingroup$ Perhaps Shor's 3rd improved algorithm might work against McEliece – Are you aware that McEliece is not in BQP? Furthermore, the reason AES et al aren't considered information theoretic secure is not because they have a finite key space. After all, Poly1305 is information theoretic secure but is not secure against a computationally-unbound adversary (it has a finite "key size"). $\endgroup$
    – forest
    Commented Feb 7, 2021 at 22:09
  • 2
    $\begingroup$ @JoãoBravo: well, the easiest way to have a 'QKD repeater' would be to have the repeater have two QKD endpoints; one connected to Alice and one connected to Bob. Alice and the repeater would establish a shared key, and Bob and the repeater would establish another shared key, and the repeater would (say) published the xor of the two keys (so Alice and Bob could derive the same key). This is a 'trusted repeater' (because the repeater is also privy to the computed key); there is also the possibility of an untrusted repeater, but that is considerably less trivial $\endgroup$
    – poncho
    Commented Feb 18, 2021 at 16:17
  • 1
    $\begingroup$ @JoãoBravo: if you're asking about an untrusted repeater, well, one way to do this is to have a link between devices where the two endpoints would get mutually entangled qubits (which some QKD devices can do, but most can't). Alice and the repeater are endpoints of such a link, and share an entangled qubit, and Bob and the repeater share an entangled qubit. Then the repeater does 'entanglement swapping', where Alice and Bob's qubit becomes entangled (without the repeater learning anything about what that entangled qubit is); Alice and Bob can use their entangled qubit to communicate. $\endgroup$
    – poncho
    Commented Feb 18, 2021 at 16:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.