0
$\begingroup$

This Wikipedia article discusses one drawback of quantum key-distribution:

The main drawback of Quantum Key Distribution is that it usually relies on having an authenticated classical channel of communications. In modern cryptography, having an authenticated classical channel means that one has either already exchanged a symmetric key of sufficient length or public keys of sufficient security level. With such information already available, one can achieve authenticated and secure communications without using QKD, such as by using the Galois/Counter Mode of the Advanced Encryption Standard. Thus QKD does the work of a Stream Cipher at many times the cost. Noted security expert Bruce Schneier remarked that quantum key distribution is "as useless as it is expensive".

My question is, how universal is this drawback? Wikipedia says “usually”, so are there some quantum key distribution schemes which do not rely on an authenticated classical channel of communication?

And if so has any such scheme been practically implemented?

$\endgroup$
1
  • $\begingroup$ "The main drawback of Quantum Key Distribution is that it usually relies on having an authenticated classical channel of communications." - I disagree - there are more significant drawbacks; the authenticated channel is more of a minor nuisance rather than a practical difficulty. $\endgroup$ – poncho Dec 15 '20 at 17:41
2
$\begingroup$

Which QKD schemes don’t utilize an authenticated classical channel?

None that can be trusted. All secure Key Distribution systems, quantum or not, require an authenticated channel at setup, before the distributed key can be trusted. This is typically a classical channel, like a person carrying (before the Key Distribution occurs) a paper with some secret scribbled on it in an opaque envelope, or (after the fact) a telephone line to compare a public value, with the tone of the voice expected to provide proof of origin.

A Key Distribution system not using an authenticated channel would allow Alice and Bob, who never met, to agree on a secret key. Alice would be using a gismoA, Bob a gismoB, both of public design. And when gizmoA and gizmoB are connected in some way (perhaps an optical fiber) not under scrutiny by Alice, Bob, or their delegates, the gismos would do their thing and output a secret key identical on both sides.
That can't be: the "public design" requirement allows an adversary to build gismoA2 and gismoB2 functionally identical¹ to the originals. The "connected in some way not under scrutiny" requirement allows the adversary to connect gismoB2 to gismoA and gismoA2 to gismoB. From the standpoint of Alice and Bob, nothing has changed: their gismoA and gismoB output a key. However gismoB2 outputs the same as gismoA, and gismoA2 outputs the same as gismoB, and the adversary knows these outputs. Thus the "secret" requirement is not met.

As Charles H. Bennett and Gilles Brassard put it in their "BB84" paper Quantum cryptography: Public key distribution and coin tossing generally regarded as foundational to KQD:

(QKD) achieves one of the main advantages of public key cryptography by permitting secure distribution of random key information between parties who share no secret information initially, provided the parties have access, besides the quantum channel, to an ordinary channel susceptible to passive but not active eavesdropping.

Accordingly, all serious articles on QKD, and companies selling QKD gismos, acknowledge they rely on an authenticated classical channel of communication. Many additionally require that channel to provide secrecy (that's a security requirement if that channel is used before QKD takes place). However, that channel needs only be used once at setup, or perhaps when the gismos get out of sync due to errors or attacks. For example, ID Quantique's 2020 whitepaper states that it is made

use of a pre-established secret key in the emitter and the receiver, which is used to authenticate the communications on the classical channel. This initial secret key serves only to authenticate the first quantum cryptography session. After each session, part of the key produced is used to replace the previous authentication key.

This is universal. All serious attempts replace the authenticated classical channel by another authenticated channel of some sort. One line of research DHL a Physicaly Unclonable Function, Fedex entangled photons, or UPS trapped smurfs. Another literally aims a single-photon/laser source towards a satellite, reasons that no other satellite can realistically get in there and play satellite-in-the-middle (per laws of physics unchanged since Kepler), discount the possibility of drone-in-the-middle² as too far-fetched, and hopes there's no fog.


¹ "Functionally identical" is not the same as indiscernible. There may be (e.g. quantum) PUFs that insure gizmos are discernible, but "public design" implies that how to make discernible gizmos functional and interroperable is public.

² That reportedly works against printers, but admittedly few use QKD.

$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.