3
$\begingroup$

I don't understand the popularity of the idea of QKD (often coupled with OTP). From what I can tell, a quantum-safe key exchange algorithm like McEliece has just as much security while operating over current networks, through repeaters, and not requiring single-photon emitters. Combining this with AES seems convenient and practical.

  1. Why would one ever choose QKD over McEliece?

The only reason I can discern is that there is some possibility that a yet-to-be-discovered algorithm may weaken McEliece or AES.

$\endgroup$
4
  • 1
    $\begingroup$ "often coupled with OTP"; actually, from my view of the QKD community, QKD is most often coupled with AES (so that you're not limited by the bandwidth limitations of QKD, which has been improving over time, but still has limits). Of course, if you do that, you lose the supposed "security guaranteed by Quantum Physics" claim QKD makes, but still, that's what it appears people do in practice... $\endgroup$
    – poncho
    Feb 21 '20 at 19:41
  • $\begingroup$ It boils down to what you mean by "just as much security": practically? There's something to be said about "perfect" even if most people don't need perfect. Remember that most of the current work is research. Production scaling/efficiency is not a criterion for people working with QKD at this time. $\endgroup$
    – dandavis
    Feb 21 '20 at 20:18
  • $\begingroup$ I oughtn't to have said "just as much security". That is not quite true. Even though most of the current work is research, though, there are commercially-available QKD systems (I think), but I can't figure out why there is even a market. $\endgroup$
    – Evariste
    Feb 21 '20 at 20:33
  • $\begingroup$ There are most certainly QKD systems on the market (and have been for a number of years). $\endgroup$
    – poncho
    Feb 21 '20 at 20:46
-1
$\begingroup$

Because it's the Holy Grail of cryptography.

To be specific, it's not unbreakable as the layman's literature suggests. It's that a quantum transmission of key material cannot be intercepted without the sending/receiving parties noticing. It is the Observer Effect in physics and a fundamental part of the Universes. Knowing that you're being spied upon in many ways gives you the advantage.

And if you can securely transmit a lot of key material, you can then use one time pad (OTP) techniques for the encryption. And OTPs are provably secure via information theory. McEliece/AES being limited key length based ciphers are not. Just because the academic community can't break McEliece or AES, doesn't mean that they haven't already been by state actors, or will be tomorrow by Alexander Verykleverkov in his university dorm room. Perhaps Shor's 3rd improved algorithm might work against McEliece. The point I'm labouring is that you can prove photon interception/OTP security now, but not McEliece/AES. All we have is an absence of evidence for them.

The only reason I can discern is that there is some possibility that a yet-to-be-discovered algorithm may weaken McEliece or AES.

You've answered your own question :-) Israel can keep defence-related documents sealed for 70 years. The UK had 50. Their transmission may have been intercepted or copied and stored. You cannot guarantee that they won't be teaching McEliece/AES breaking in high schools by 2091.

That's why there is a market for QKDNs. See all the interest in this older answer, and ponder the quotation at it's end. It's incredibly alluring, and if you want one, buy one of these:-

enter image description here

It's a node for commercial QKDNs. Cerberis from ID Quantique.

$\endgroup$
9
  • 3
    $\begingroup$ Of course, Paul doesn't mention some issues with QKD systems; for one, they are prone to side channel attacks (which would leak the shared bits), for another, in practice they don't generate key bits fast enough for OTP, hence they often use the bits as AES key bits (and hence the entire system is no stronger than AES), for a third, there is a distance limitation (unless you use trusted repeaters, which is often not an option - they're working on untrusted repeaters, but that's years away...) $\endgroup$
    – poncho
    Feb 2 at 16:00
  • $\begingroup$ @poncho You raise an important point. What is the necessary bit rate to use a one time pad? This question always arises on this site, and is always immediately dismissed. Even though my linked answer features the Tokyo and NIST video systems, and the smart phone phone that all run as pure OTPs. And that was based on years old literature. Thus is was fast enough for pure OTP video years ago. $\endgroup$
    – Paul Uszak
    Feb 2 at 16:37
  • $\begingroup$ @poncho I would also suggest that side channel attacks are irrelevant within this context. AES leaks just as much when I have to write down my banking password on a post it note due to daft complexity requirements. This question concerns fundamental differences and what can be mathematically proven, not really the implementation irregularities which can undermine any and all crypto systems. $\endgroup$
    – Paul Uszak
    Feb 2 at 16:39
  • $\begingroup$ I do not believe that side channel attacks are irrelevant; we can perform our AES implementation in (say) a Faraday cage; in contrast, the current QKD designs need a sensor that interacts directly with the quantum events (which are tiny) from the other side (or an attacker), and hence side channel attacks on this sensor are far more difficult to shield. Now, there is work on "device independent QKD" which might be inherently stronger, however most (if not all) current QKD devices don't attempt to implement this. $\endgroup$
    – poncho
    Feb 2 at 19:07
  • 1
    $\begingroup$ Perhaps Shor's 3rd improved algorithm might work against McEliece – Are you aware that McEliece is not in BQP? Furthermore, the reason AES et al aren't considered information theoretic secure is not because they have a finite key space. After all, Poly1305 is information theoretic secure but is not secure against a computationally-unbound adversary (it has a finite "key size"). $\endgroup$
    – forest
    Feb 7 at 22:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.