3
$\begingroup$

I don't understand the popularity of the idea of QKD (often coupled with OTP). From what I can tell, a quantum-safe key exchange algorithm like McEliece has just as much security while operating over current networks, through repeaters, and not requiring single-photon emitters. Combining this with AES seems convenient and practical.

  1. Why would one ever choose QKD over McEliece?

The only reason I can discern is that there is some possibility that a yet-to-be-discovered algorithm may weaken McEliece or AES.

Improve this question
$\endgroup$
5
  • 1
    $\begingroup$ "often coupled with OTP"; actually, from my view of the QKD community, QKD is most often coupled with AES (so that you're not limited by the bandwidth limitations of QKD, which has been improving over time, but still has limits). Of course, if you do that, you lose the supposed "security guaranteed by Quantum Physics" claim QKD makes, but still, that's what it appears people do in practice... $\endgroup$
    – poncho
    Feb 21, 2020 at 19:41
  • $\begingroup$ It boils down to what you mean by "just as much security": practically? There's something to be said about "perfect" even if most people don't need perfect. Remember that most of the current work is research. Production scaling/efficiency is not a criterion for people working with QKD at this time. $\endgroup$
    – dandavis
    Feb 21, 2020 at 20:18
  • $\begingroup$ I oughtn't to have said "just as much security". That is not quite true. Even though most of the current work is research, though, there are commercially-available QKD systems (I think), but I can't figure out why there is even a market. $\endgroup$
    – Evariste
    Feb 21, 2020 at 20:33
  • $\begingroup$ There are most certainly QKD systems on the market (and have been for a number of years). $\endgroup$
    – poncho
    Feb 21, 2020 at 20:46
  • $\begingroup$ Quantum Key Distribution is rightly popular as an experimentation and research field for quantum physicists. It's a time-proven way to get the attention of the press and attract public money. But it's far from universally popular among cryptographers and security professionals. My perception is that most are close to my opinion: there's no need for QKD. Read the position of French security authorities, with links to their US and UK counterparts. $\endgroup$
    – fgrieu ♦
    Apr 19 at 14:55

1 Answer 1

Reset to default
0
$\begingroup$

Because it's the Holy Grail of cryptography.

To be specific, it's not unbreakable as the layman's literature suggests. It's that a quantum transmission of key material cannot be intercepted without the sending/receiving parties noticing. It is the Observer Effect in physics and a fundamental part of the Universes. Knowing that you're being spied upon in many ways gives you the advantage.

And if you can securely transmit a lot of key material, you can then use one time pad (OTP) techniques for the encryption. And OTPs are provably secure via information theory. McEliece/AES being limited key length based ciphers are not. Just because the academic community can't break McEliece or AES, doesn't mean that they haven't already been by state actors, or will be tomorrow by Alexander Verykleverkov in his university dorm room. Perhaps Shor's 3rd improved algorithm might work against McEliece. The point I'm labouring is that you can prove photon interception/OTP security now, but not McEliece/AES. All we have is an absence of evidence for them.

The only reason I can discern is that there is some possibility that a yet-to-be-discovered algorithm may weaken McEliece or AES.

You've answered your own question :-) Israel can keep defence-related documents sealed for 70 years. The UK had 50. Their transmission may have been intercepted or copied and stored. You cannot guarantee that they won't be teaching McEliece/AES breaking in high schools by 2091.

That's why there is a market for QKDNs. See all the interest in this older answer, and ponder the quotation at it's end. It's incredibly alluring, and if you want one, buy one of these:-

enter image description here

It's a node for commercial QKDNs. Cerberis from ID Quantique.

Improve this answer
$\endgroup$
12
  • 4
    $\begingroup$ Of course, Paul doesn't mention some issues with QKD systems; for one, they are prone to side channel attacks (which would leak the shared bits), for another, in practice they don't generate key bits fast enough for OTP, hence they often use the bits as AES key bits (and hence the entire system is no stronger than AES), for a third, there is a distance limitation (unless you use trusted repeaters, which is often not an option - they're working on untrusted repeaters, but that's years away...) $\endgroup$
    – poncho
    Feb 2, 2021 at 16:00
  • 1
    $\begingroup$ @poncho I would also suggest that side channel attacks are irrelevant within this context. AES leaks just as much when I have to write down my banking password on a post it note due to daft complexity requirements. This question concerns fundamental differences and what can be mathematically proven, not really the implementation irregularities which can undermine any and all crypto systems. $\endgroup$
    – Paul Uszak
    Feb 2, 2021 at 16:39
  • 1
    $\begingroup$ Perhaps Shor's 3rd improved algorithm might work against McEliece – Are you aware that McEliece is not in BQP? Furthermore, the reason AES et al aren't considered information theoretic secure is not because they have a finite key space. After all, Poly1305 is information theoretic secure but is not secure against a computationally-unbound adversary (it has a finite "key size"). $\endgroup$
    – forest ♦
    Feb 7, 2021 at 22:09
  • 1
    $\begingroup$ @JoãoBravo: well, the easiest way to have a 'QKD repeater' would be to have the repeater have two QKD endpoints; one connected to Alice and one connected to Bob. Alice and the repeater would establish a shared key, and Bob and the repeater would establish another shared key, and the repeater would (say) published the xor of the two keys (so Alice and Bob could derive the same key). This is a 'trusted repeater' (because the repeater is also privy to the computed key); there is also the possibility of an untrusted repeater, but that is considerably less trivial $\endgroup$
    – poncho
    Feb 18, 2021 at 16:17
  • 1
    $\begingroup$ @JoãoBravo: if you're asking about an untrusted repeater, well, one way to do this is to have a link between devices where the two endpoints would get mutually entangled qubits (which some QKD devices can do, but most can't). Alice and the repeater are endpoints of such a link, and share an entangled qubit, and Bob and the repeater share an entangled qubit. Then the repeater does 'entanglement swapping', where Alice and Bob's qubit becomes entangled (without the repeater learning anything about what that entangled qubit is); Alice and Bob can use their entangled qubit to communicate. $\endgroup$
    – poncho
    Feb 18, 2021 at 16:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.