Quantum Cryptography Leaving the Lab

Theodore Logan writes "More than a year ago, MagiQ announced the world's first commercial quantum cryptography system (pdf), with ID Quantique following closely in their footsteps. Currently, the technology is limited to offering point-to-point connections up to a maximum distance of around 50 km, but this is likely to be greatly improved on in coming years. The systems available today are prohibitely expensive for the average Joe (MagiQ's are priced at more than $50,000 per unit), but one could envision a future in which they are built into the infrastructure by non-end user actors. Does this spell the end of the field of cryptography? Will systems like this ever become commonplace, or will they be reserved for sensitive financial transactions and military applications? What impact will quantum cryptography have on society? Good articles available from International Herald Tribune, EE Times and CNET."

It's worse than that, it's physics Jim

[Space cowboy]

Since they make a point that they "Rely on the laws of physics", they're bound by them too (maths is far more forgiving :-). Both systems rely on the quantum state of photons being undisturbed, so they can only be used between point-to-point optically-networked devices assuming the act of optically switching the packets has the same effect as reading them (the quantum state will be lost). If this is true, no secure networks could be mass-produced using this, unless you trust all the intervening nodes...

OTOH, it's the first generation of these devices, and perhaps IPv8 will somehow encode an encryption hierarchy (packets get encrypted sequentially in one direction, and decrypted on the way back, assuming the same route is taken, each node only needs to know the encryption to the next one worked ok to guarantee the encryption was ok. You'd still want to be in control of all the nodes along the way though...)

As for price - if they can solve the networking issue, that'll come down dramatically - it'll be onboard in the equivalent of the BIOS that we have in ten years time (when we all have fibre to the home. Possible optimistic :-)

Simon

Re:It's worse than that, it's physics Jim

[TedCheshireAcad]

It's nice for creating secure point-to-point links, but that's only roughly half of data security. Transmission security is great, but what happens when someone steals the hard drive out of the server?

With all due respect to the quantum guys, the traditional byte-crunching cryptography kind of has the market by the balls here.

Re:It's worse than that, it's physics Jim

[Rotting]

I was under the impression that quantum computing might bring the power needed (factoring) to give people the ability to brute force RSA, 3DES, etc...

So wouldn't that make the secure transfer of the keys somewhat pointless?

Re:It's worse than that, it's physics Jim

[T-Ranger]

Quantum computing and Quantum cryptography are NOT the same thing.

Realy Fast computers, including quantum computers, will brute force traditional (math based) crypto quicker then is possible now. Quantum cryptography is uncrackable unless you can figgure out a way to get around Heisenberg.

Re:It's worse than that, it's physics Jim

[Deadplant]

And we don't fully understand quantum physics, thus we can't be sure there isn't a way to generate something as funny sounding as an Anti-Heisenberg (insert star trek technical sounding blubbering) field. :)

FYI they're called Heisenberg compensators and they can be found in the transporter systems.

Re:depends on the potential payoffs

[T-Ranger]

Social engineering has always been an alternate to cracking. For some individules, social engineering has been easier then cracking. Very frequently physcial security is the weakest link in the chain.

Look at the FBI, NSA, CIA. (MI-5, GCHQ, MI-6) Just because the NSA can do all kinds of nasty computer based spying doesnt mean that the humans over at the CIA have nothing to do. And just because the NSA developes lots of nifty security things does not mean that the FBI no longer has to search for moles within

Re: Applications of quantum cryptography

[some guy I know]

Transmission security is great, but what happens when someone steals the hard drive out of the server?

Agreed.
To the question asked by the artcle submitter:

Does this spell the end of the field of cryptography?

the answer is no (at least, not yet), because quantum cryptography (in its present form) may be useful for encrypting communications, but it is ineffective for encrypting stored data.

Re:It's worse than that, it's physics Jim

[jbf]

Being a networking geek as well as a security geek, I'll point out that the way Internet routing currently works, based on the commercial nature of the Internet, means that almost no routes are symmetric. This is because policies like hot potato routing, where one provider tries to get rid of a packet as quickly as possible. For example, if Sprint and UUNET have exchanges in San Francisco and DC, and a packet goes from a Sprint customer in Sacramento to a UUNET customer in Baltimore, the packet from Sac to Baltimore will go Sprint to San Fran and UUNET the rest of the way, but the return packet will go UUNET to DC and Sprint the rest of the way.

Also, hop-by-hop security is not end-to-end security, so even if you do have all the routers in IPv8 using hop-by-hop encryption over petabit links, you'll still need end-to-end security.

So to answer the question in the post, unless you can afford a leased line with a single fiber, and that fiber is lossless enough to not need repeaters, this is only for things like financial institutions and spy networks.

Re:It's worse than that, it's physics Jim

[Anonymous Coward]

Remember its only secure in the sense that you can tell that someone is sniffing the wire (fibre) because a packet (quanta) is altered. It does not stop someone reading this data if they really want / dont care about being known.

You now need to build software on top that shuts down/reroutes the link if its not happy that the route is secure.

For point to point applications (aggregated backbones etc) its great. For general networking
(espicially multiplexed / contention based paradigms we have now) its not s

Re:It's worse than that, it's physics Jim

[Annoying]

You are missing the ideal application of this. Transmitting one time pads and ensuring they have not been compromised in transit. Properly generated one time pads are the only uncrackable cryptography but suffer from the problem of transmitting the key. So the data can't be accessed even if sent over a normal network so long as you know that the pad wasn't compromised. Quantum cryptography allows you to *know* that the pad wasn't compromised.

What application?

[Kjella]

One-time pads can only transfer as much data as the pad length, that is the nature of them. Rehashing them and whatever leave you open to attacks. So you need to transfer N bytes of pad to get N bytes of data securely. Well, if you already have a secure quantum line, why not send N bytes of data?

Now, if you could transfer a small symmetric key (well, at least on the order of bytes or kilobytes, not gigabytes), on the other hand...

Oh and one more thing - don't forget to have some kind of checksum on the OTP - if someone replaced the OTP with another OTP (standard man-in-the-middle attack) you wouldn't know... after all, it's only random data. The pads may no longer match, but who'd notice?

Kjella

Re:What application?

[Surt]

Transmitting a large one time pad to an agent in the field can allow them to use that one time pad _later_.

Re:It's worse than that, it's physics Jim

[Listen Up]

Wrong. Mathematics is both the language of the universe and the language of Physics (Mathematics and Physics are the only true understanding of our universe). Physics is unequivocally bound to Mathematics. Mathematics is not unequivocally bound to Physics. Mathematics itself is not bound to physical application, it is as perfect puzzle pieces to a grander system, its existence, laws and logical truths allows Physics to exist.

Pure Mathematics is absolutely unforgiving. Applied Mathematics, such as Phys

Re:It's worse than that, it's physics Jim

[Listen Up]

Wow, please do some research before posting. To truly understand the philosophy of Godel's theorem, you have to understand what he is talking about. Even in a 'perfect' system, you can create paradoxes out of the rules. This does not mean that the universe exists in any form of paradox or paradoxes within the universe exist naturally. It is correct to understand that Godel artificially created a system of paradox using mathematics, but he does not prove that mathematics can never be complete.

Godel, alt

How easy is it to implement ?

[SloWave]

I've seen that regular geeks can build things such as quantum force microscopes in their own homes, how hard would it be for someone to build a quantum crypto system?

point to point

[TedCheshireAcad]

Great, point to point security, but how do I encrypt all my pr0n with it?

Re:point to point

[Adriax]

Stick both ends onto your computer with a 49km loop of cable connecting the two. Then just compress your data, and send it through the loop constantly.
Kinda like putting your pr0nship on a holding pattern where no one else can touch it.

Re:point to point

[Rick.C]

how do I encrypt all my pr0n with it?

I've heard you can use steganography to hide your data in .JPGs ;)

MagiQ server at bargain based prices

[stecoop]

So we had a slashdot article [slashdot.org] today about CEOs should be held responsible for security at their organization. Then the law should be written to hold companies responsible for security should be fined 3 x $50,000 = +-$150,000. That would make MagiQ' server a bargain at only $50,000.

Quantum Cryptography

[Anonymous Coward]

I never understood how quantum cryptography is not vulnerable to normal man in the middle attacks. Anyone care to explain?

Re:Quantum Cryptography

[AndrewHowe]

The man in the middle can't reliably retransmit, so can always be detected. Unfortunately, as I see it, this means that he can DOS the connection.

Re:Quantum Cryptography

[Anonymous Coward]

Unfortunately, as I see it, this means that he can DOS the connection.

Er well to do anything at all with a quantum line you need access to the fiber, at which point Denial of Service is most easily performed with a large axe. :->

Re:Quantum Cryptography

[Elwood P Dowd]

Yeah, what your other respondent said.

The definition of a man in the middle is that he can DOS your connection. There's no communication method that isn't vulnerable to disconnection. Even telepathy, as evidenced by Magneto's anti-Xavier helmet.

Re:Quantum Cryptography

[Mateito]

> Unfortunately, as I see it, this means that he can DOS the connection.

As you saw it, you DOS'ed it. :)

(Quantum wave funcion collapse induced by observation. Play on words. Hey.. give me a break.. its Monday).

Re:Quantum Cryptography

[krumms]

Better he DOS the connection than decrypt it, yeah?

Re:Quantum Cryptography

[fullpunk]

Reading datas alter them. So the man in the middle will be detected. I'm not a professional, but I understood that you have to destroy the photon to read its information.

Wrong

[antientropic]

Reading datas alter them. So the man in the middle will be detected.

This is true for a passive attack, i.e., one were the attacker can only eavesdrop on a connection. However, in a man-in-the-middle attack, the attacker can also arbitrarily modify data. In particular you can have the following situation:

Alice <----> Eve <----> Bob

Here Alice thinks she is talking to Bob, but in fact she's talking to Eve, who decodes her packets, re-encodes them, and sends them to Bob. Unless Alice and Bob have some authentication mechanism (say, a shared secret key, or the other's public key), they have absolutely no way to tell that this is going on. The ability to detect eavesdropping on the quantum channel doesn't help at all, since Eve isn't eavesdropping - she's tunneling between two physically separate channels. Quantum cryptography does not differ in this respect from conventional cryptography: it's a basic fact of communication - how do you establish that the bits you are receiving come from the person/system from who you think they come?

Re:Wrong

[skifreak87]

Informally, it's impossible to observe say the spin of a photon without pretty much destroying it. So you'd have to reconstruct a photon w/ the same spin. However photons also have other properties which you cannot measure at the same time (Heisenberg's uncertainty principle), so basically the man-in-the-middle attack fails because the man in the middle cannot get all the information required to retransmit the photon exactly as is. There are ways using entanglement to test and make sure the photon is e

Re:Quantum Cryptography

[AndrewHowe]

The single photons are polarised, so to detect them you need the appropriately polarised detector. As there's only one photon, you can only have one detector, as the "wrong" detector will block the photon (and not detect it). You can only detect half of the photons, so you can only retransmit half.

Re:Quantum Cryptography

[AndrewHowe]

Sort of. It's part of a negotiation sequence. Read Xeo 024's qubit.org link, it explains it pretty well.

Re:Quantum Cryptography

[Anonymous Coward]

The key is sent with a single photon for a bit. A simple way of looking at it is that by measuring (spying) the photon, you unavoidably change it (randomly flip the bit), causing checksums in the protocol to fail and alarm bells to go off. Heisenberg's Uncertainty Principal or something.

Re:Quantum Cryptography

[Xeo 024]

Here is a nice article I found about it:

The purpose of cryptography is to transmit information in such a way that access to it is restricted entirely to the intended recipient. Originally the security of a cryptotext depended on the secrecy of the entire encrypting and decrypting procedures; however, today we use ciphers for which the algorithm for encrypting and decrypting could be revealed to anybody without compromising the security of a particular cryptogram. In such ciphers a set of specific parameters, called a key, is supplied together with the plaintext as an input to the encrypting algorithm, and together with the cryptogram as an input to the decrypting algorithm.The encrypting and decrypting algorithms are publicly announced; the security of the cryptogram depends entirely on the secrecy of the key, and this key must consist of any randomly chosen, sufficiently long string of bits.

Read more here [qubit.org]

Re:Quantum Cryptography

[VCAGuy]

Essentially, Quantum Cryptography works because of Heisenberg's Uncertainty Principle and a thought experiment known as Schrodinger's cat. Basically, when one of these devices transmits a bit, it does so as a single photon with a known "spin." By observing that photon, you modify the very physical properties of that photon and corrupt the data. The man in the middle has no way to reconstruct the data because he has no way of knowing the given properties of a photon in the seqence. Further, that serves to DOS the connection (becuase the man in the middle cannot retransmit the same quantum sequence), thus causing the units to switch off and declare an alarm.

It's similar to Schrodinger's cat: Schrodinger comprised a thought experiement where a cat was put into a sealed box with a poison and a radioactive atom. In the course of 1 hour, the atom has a 50/50 chance of decaying, thus killing the cat. At the end of the hour, the cat is neither dead or alive, but in a state of flux. It's not until you observe the system that you fix the state of the cat as being dead or alive.

magiq whitepaper

[dave_t_brown]

Here is a whitepaper [magiqtech.com] from MagiQ on their technology.

Forget Quantum - How can you beat Tempest

[stecoop]

As you can see from the replies above Quantum security if venerable to Man-In-the Middle attacks where you think your talking to one person but your actually not.

Now after you overcome the problem of Man in the Middle you must overcome Tempest Attacks [wikipedia.org] which captures the output radiation of electronic devices to gather sensitive data. I once saw a program that illustrated this that used two TV's side by side. One had a picture and the second one was very close and finely tuned to see the image on the fir

Solution looking for a problem

[heironymouscoward]

For a niche market, it may be useful. But the mass market is hardly suffering because of weak cryptography.

New technologies gives us a nice warm feeling, but the banal truth is that what most people need is better use of existing technology.

Still, I assume spooks and crooks will be investing heavily in quantum cryptography, and we'll see the first quantum walkie-talkies within 10-15 years.

Agreed

[Sanity]

This type of thing will become necessary once sufficiently powerful quantum computers become available, but until then - it is pretty hard to think of any applications for this that more conventional symmetric cryptography such as AES can't address.

Re:Agreed - But...

[mik]

it is pretty hard to think of any applications for this that more conventional symmetric cryptography such as AES can't address.

Here's one - it is easy to listen in on today's encrypted comms... It is easy to identify inderesting endpoints (US DOD, etc), it is cheap to write likely interesting messages to disk. A few years from now, you just set your Qomputer to decrypt all those stored comms. Just because it is in the past doesn't mean that it is stale (how old is your SSN/bank acount number/etc? How

Re:Solution looking for a problem

[gregfortune]

Unless we figure out how to punch a vacuum out through mid air... Or maybe cushion photons in really fast balls of air. 64K was enough RAM, right?

Re:Solution looking for a problem

[S3D]

The very nature of quantum cryptography prevents it from working without a wire, or fiber, as the case may be. It is doubtful that wireless quantum cryptography will ever exist.

Laser/maser beam should work though. So wireless probably theoretically possible in the direct line of sight.

Does this spell the end of the field...

[Anonymous Coward]

Does this spell the end of the field of cryptography?

Uh, no. Quantum key distribution is completely useless unless you have a cryptographic algorithm and protocol using that key for encryption. I suppose you could just send the message over quantum channels, but a quantum channel for key distribution is probably many orders of magnitude too slow for the acutal data.

Re:Does this spell the end of the field...

[gpinzone]

There's no guessing about the encryption method. It's a One Time Pad. Only the key is sent through the quantum link. After it's received, you can send the encrypted data any way you like. Send it over the Internet though the most insecure channels. It makes no difference as long as the key is secure and non-deterministic.

Re:Does this spell the end of the field...

[Anonymous Coward]

Er if the link is to slow for the data it is to slow for an OTP key... it has to be the same size as the data.

(Or do they mean that the quantum link will be transmitting OTP key continously..? How will the parties know which part of the key to use? Er ok they could transmit that on the quantum channel too... maybe it could work.)

Re:Does this spell the end of the field...

[Rich0]

Actually, they can specify what part of the OTP to use in the clear - as long as the OTP itself is secure you don't have to be secret about referring to it - as long as you don't re-use it.

Even if the link is slow it could have value in situations where burst bandwidth is greater than the QC link, but average bandwidth is not, as long as the OTP is cached. The message is sent conventionally, and as long as enough cached OTP is available it could be decrypted instantly.

QC can also be used to send symmetri

Re:Does this spell the end of the field...

[Theodore Logan]

Who the hell moderated this informative? QC uses one time pads, and since one time pads are provably secure, that's that. No need for fancy cryptographic algorithms. The "quantum" bit of it merely ascertains that the pad was not read by a man in the middle by making use of the EPR paradox [wikipedia.org], but other than that, this is the same algorithm as Gilbert Vernam developed more than 80 years ago (which is why one time pads are sometimes called Vernam ciphers).

Re:Does this spell the end of the field...

[Theodore Logan]

Uhm, I must be tired or something - the parent reply is completely irrelevant to your post. My apologies. The relevant reply is something like: yes, for some applications it will probably (at least initially, although I'm sure speeds will increase) be too slow, and in those cases you have a point. In others the speeds are just fine (if you can transmit a secure RSA key in reasonable time you can submit your password or bank account number or whatever directly as well).

In other words, in certain contexts it

Re:Does this spell the end of the field...

[Rich0]

I suppose you could just send the message over quantum channels, but a quantum channel for key distribution is probably many orders of magnitude too slow for the acutal data.

You can't just send the data over the quantum channel - it could be intercepted.

Quantum cryptography does not prevent interception of messages. It merely allows the sender and recipient to know that a message was intercepted.

So a practical QC scheme would be:

1. Send one-time-pad to recipient.
2. See if message was intercepted.

In the PDF

[Rosco P. Coltrane]

"No matter what advances occur in digital computing, quantum encryption can never be deciphered, read or copied"

Linux already has an interface that you can move your critical documents to and they'll never be deciphered, read or copied: /dev/null

Insensitive Applications

[handy_vandal]

Will systems like this ever become commonplace, or will they be reserved for sensitive financial transactions and military applications?

Quantum crypto will be very useful for insensitive financial/military applications. Example:

"All right, you worthless son-of-a-bitch -- pay your goddamned taxes, or we blow you away!"

-kgj

First thing that comes to mind...

[DarkHand]

Freenet: Quantum Encryption Edition

Link Security

[silas_moeckel]

All this is in link security it wills top people from tapping into fiber between endpoints (currently 50km not exactly usefull distance) this might be usefull for a paranoid campus setting or for military short distance communications. It would be nice for point to point open air laser links (I think it can be applied to that dont see any reason it cant but not 100% sure) But overall this dosent realy do much of anything usefull beyond that. I would hope they are working on longer distances though it would seem that since the quantum stuff is allways in sync and has little do to with speed of light while the laser light does have those issues so it would seem like a timing issue, again though in quantum physics I'm just an interested observer.

Re:Link Security

[silas_moeckel]

I would disagree with that. Pretty much it works as two matched black boxes. You can perform a man in the middle attack by intercepting a box or otherwise replacing a box. You then insert insert into the path one of the origional boxes and the pair for the replacement box and you end up with the "clear text" in the middle. It's just hard to perform a man in the middle attack. The nice thing that yes you can detect monitoring in the middle. You know it would be funny when these thigns go onto some of t

Uh Oh

[nate1138]

said Bob Gelfond, founder and CEO of MagiQ Technologies. "No
matter what advances occur in digital computing, quantum encryption can never
be deciphered, read or copied.

These kinds of statements always amuse me. It may be the toughest thing yet, but there's no saying that our understanding of some of the properties of quantum physics aren't flawed. Science may yet prove him wrong.

Re:Uh Oh

[jponster]

but what if you have a quantum computer? surely this would break all conventional encryuption, but can a quantum computer beat quantum encryption?

Anyone for a game of "Cryptographic Top Trumps"??

Re:Uh Oh

[Lord of Ironhand]

No it can't. Conventional encryption relies on the fact that it is very hard to factor large numbers; and a quantum computer can break that since it can quickly factor large numbers.

However, quantum cryptography does not rely on large numbers that are hard to factor, but on the fact that it is impossible (according to currently known physics, as correctly pointed out) for someone to eavesdrop without being detected.

www.qubit.org has this [qubit.org] explanation:

The basic idea of cryptosystems (B) is as follows. A sequ

The statement stands

[Chuck Chunder]

He said (my emphasis) "No matter what advances occur in digital computing, quantum encryption can never be deciphered, read or copied." and he's right. It would take advances in our knowledge of quantum physics to change that, not advances in digital computing.

Re:Uh Oh

[Beryllium Sphere(tm)]

Shamir has already described how to attack quantum key exchange. His attack, which I've talked about before here, is like Alexander the Great's attack on the Gordian Knot. You don't try to solve a problem designed to be unsolvable: instead you step back and figure out what the *real* problem is and solve that.

Besides the Shamir attack, there's always the wait-for-your-opponent-to-screw-up attack. One time pads are theoretically unbreakable, with mathematically provable security. This didn't stop the US from reading the Venona intercepts. The Soviets had used one time pads two times, and that mistake destroyed the security.

naive

[Rotting]

I will be the first to admit that I am somewhat ignorant in this matter. My understanding is that current crypto systems rely on the fact that keys take an extremely long time to be brute forced because currently computers are not efficient at all at factoring.

As I mentioned before I am ignorant when it comes to this but doesn't it seem a little naive to say that their technology is 100% secure? I read the pdf and it sounds impressive but I still don't know about anything really being 100% secure for all t

Re:naive

[Rick.C]

My understanding is that current crypto systems rely on the fact that keys take an extremely long time to be brute forced because currently computers are not efficient at all at factoring.

From the article:
"MagiQ Technologies, Inc., the quantum information processing (QIP) company, today announced the general availability of its Navajo Secure Gateway, the world's first commercially available quantum key distribution (QKD) system."

Note that this product makes no claim for more than secure key distribution

Re:naive

[Boglin]

As they said, you pick you own encryption algorithm. Frankly, if you want perfect security, you aren't going to be using public key encryption.

As an example of something that COULDN'T be broken, let's say you are trying to send a simply 1K text message. Now, all you need is a random 1K string that the text can be XOR'ed against. Now, this may seem pretty insecure; after all, they just have to cycle through all the possible 1K keys that you could have made to find the message. The problem is, though, t

Re:naive

[DR SoB]

Actually when they say 100% secure they are talking about the fact that as soon as someone tries to intercept the message, it changes the photon arangement of the atoms, and they can instantly detect it. Making it 100% secure in the fact that at least if they do intercept it and are able to decrypt it, you will know real-time. So in this aspect it is secure, until the average joe can do what they do that is, and start re-arranging photon's themselves, so they could read it, then just re-create it and se

Social Chaos and Anarchy

[bruthasj]

What impact will quantum cryptography have on society?

It will be the end of us all! I will *never* purchase GMO-computers They will spread into neighboring villages and corporate monopolies such as Consanto will patent with royalties accumulated on a per atom basis.

Oh, the humanity!

Theorys and more

[thogard]

Quantom theorys are already out of the lab and in the real world. Old computer hardware is based on NAND and XOR gates but Toffoli and Fredkin gates are useful in the modern world and because you can revser them, once you start building DES/AES/RSA engines out of them, you can start to short circut some of the brute force attaces in very interesting ways. Combined with the real world ability to pre-compute and store data sets in the order of 3e12 bytes at a time, there are many crypt attacks now open to anyone with a good collection of hard drives.

Bruce Schneier doesn't care for it

[Anonymous Coward]

See Bruce Schneier's comments about Magiq and quantum cryptography at Schneier.com [schneier.com]:

To quote:

This isn't new. The basic science was developed in the early 1980s, and there have been steady advances in engineering since then. I describe how it all works--basically--in Applied Cryptography, 2nd Edition (pages 554-557).

I don't have any hope for this sort of product. I don't have any hope for the commercialization of quantum cryptography in general; I don't believe it solves any security problem that needs solving. I don't believe that it's worth paying for, and I can't imagine anyone but a few technophiles buying and deploying it.

It's not that quantum cryptography might be insecure; it's that we don't need cryptography to be any more secure.

Not a question of if, but when

[dmccarty]

Every cipher scheme, from the Greeks' steganography [magic-city-news.com] to the Romans' alphabet substitution [thinkquest.org] to today's 3DES [wikipedia.org] and other schemes, has eventually been broken. It's unreasonable to believe that quantum cryptography will be invulnerable to attacks forever. It's not a question of if it can be broken, but rather when it will be broken.

Perhaps someone will discover a work-around to Heisenberg's uncertainty principle, or perhaps researchers will find flaws in the implementation of the algorithm. But if history is any indication of the future, quantum cryptography will eventually be cracked.

Re:Not a question of if, but when

[frankie]

Every cipher scheme, from the Greeks' steganography to the Romans' alphabet substitution to today's 3DES and other schemes, has eventually been broken

Except ... with the previous ciphers you mention, it was mathematically provable that the scheme could be broken. All you needed was sufficient computing power to sift for the key. For QC the situation is reversed -- it has been proven that QC cannot be broken (*) under the laws of physics as we know them. And I hope you'll agree that changing the laws of ph

Re:Not a question of if, but when

[frankie]

That said, I agree with others here that QC solves the wrong problem, especially since it's only used for key exchange in this case. We already have access to sufficiently-strong digital crypto keys, and a perfectly secure transmission is irrelevant if someone snags the message off your insecure desk after you decrypt it.

Re:Not a question of if, but when

[Cecil]

That's not at all true. First of all, the quantum part is seperate from the cryptography part. It's primary purpose is to provide you a conduit over which you can send data and be absolutely sure that if someone other than your recipient saw it, the recipient will know.

The one-time pad, which is only feasable by quantum cryptography, is impossible to decrypt without the key. Or rather, impossible to know which decryption is correct, as you can easily decrypt it into whatever you want.

You have no idea whet

Solving the wrong problem

[Paul Johnson]

Quantum crypto is only useful over point to point for short distances because it relies on properties of photons that cannot be amplified (if they could be amplified then you could clone the signal and the security would be lost). Its also very very slow (kilobits per second at best). The way it is used is as a key distribution system. The heavy lifting of actually transmitting the data is done by ordinary crypto. So its no stronger than the ordinary crypto. The only thing in favour of quantum key distribution is that you can change the key very frequently.

But these days if you want to intercept data then cracking the crypto is one of the last avenues you would try anyway. Far easier to crack the end points, suborn a trusted employee or any of the other common attacks. Security is only as strong as the weakest link. Quantum crypto merely reinforces one of the strongest links.

Re:Solving the wrong problem

[dmccarty]

So its no stronger than the ordinary crypto.

I think that's a little too simple. The quantim crypto part is used to transmit a one-time pad, which is probably unbreakable. However, one-time pads suffer from key-distributions problems, which is where the quantum bit--no pun intended*--comes in. So it makes for a nice marriage between the two.

* A desparate punster submitted ten puns to a local newspaper to try to win the grand punster prize. His hopes were dashed, however, to find out that not only did

won't the Government just make this illegal?

[RiotXIX]

I wouldn't be surprised if the Government prevented this from becoming common place: I remember them doing something like this before, where they wouldn't allow 40-bit encryption system for the public (or something like that), because it meant the NSA couldn't crack it in a reasonable time. Privacy is illegal. If the government can't tap your phone calls and read your e-mails, then they won't allow the public to use that technology. Or at least until the war on terrorism ends (should be sometime around the extinction of human nature and mankind).

What the hell?..

[Chitlenz]

Is a non-end user actor?

For some reason I have this vision of Gary Bussey making a drug deal...

heh - chitlenz

How quantum crypto works

[ColonelPanic]

(Based on memory of Bruce Schneier's description in Applied Cryptography)

Alice sends Bob a series of polarized photons.
There are four possibilities: -, |, /, and \.

Bob sets up his polarization detector randomly so that each "qbit" is measured either for horizontal/vertical polarization or diagonal polarization. If a - or | photon hits the detector and it was set up for horizontal/vertical, he gets a good bit, otherwise a bad bit. And if a / or \ photon hits the detector and it was set up for diagonal polarization, same story. The key point is this: if the detector was set one way and the photon is polarized the other, it is in principle impossible to know its true polarization.

So Bob has a sequence of photons, some of which he knows, and some he doesn't, and he knows which are which. He sends Alice a clear-text message saying which ones he knows. Alice then encrypts the true plaintext by XOR'ing it with the values of the photons that Bob knows, using some convention like "- and / are 0, | and \ are 1".

Example:
Alice sends...: - \ - | / - | (random)
Bob's detector: + + X + X X + (random)
Bob's result..: - ? ? | / ? |
Bob's response: 1 0 0 1 1 0 1
Key...........: 0 1 1 1

If Eve tries to listen in on the photons Alice sends to Bob, she perturbs them irrevocably.

A bad description -- go buy Bruce's book for a better one.

Quantum crypto is no better than regular crypto

[SiliconEntity]

Your description is almost right, but after receiving the photons, Bob can't tell which ones were "good" or "bad". Instead, the two parties have to exchange cleartext information about which bases they used. Then the ones where they matched are the good photons which can encrypt the message.

The problem is with this cleartext message about the bases. How do you stop an intermediary from altering this message, which could hide her attempts to snoop on the photons? This is the problem of sending an authenticated message, and quantum crypto won't help you with this.

To send the authenticated cleartext message, you either need a tamper-proof channel between the parties, which is usually physically impossible, or you have to fall back on regular crypto, either public key or pre-shared key. So ultimately the supposedly unbreakable security of quantum crypto is in fact dependent on conventional cryptography. And if you're relying on conventional crypto anyway, why go to the expense of using quantum crypto?

In short, there is a great deal of hype here. When closely examined, the physical and computational requirements of quantum crypto don't make sense for the real world. You either need an unrealistic tamper-proof channel, or you rely on regular crypto and get no more security than conventional crypto gives you.

Re:Quantum crypto is no better than regular crypto

[Anonymous Coward]

A pretty good analysis, but you're missing two points.

1. Yes, quantum cryptography, by itself, can't authenticate the message. It can't change your motor oil or serve you breakfast in bed either, but so what? What it can do is something classical crypto can never do: it reveals passive eavesdropping on your communications.
2. It might be necessary to rely on classical crypto to do the authentication. There also might be good quantum methods for doing that, but even if there aren't, it doesn't matter. Peopl

A way to break it?

[Enigma_Man]

I was looking at this, and reading about it, and read how you cannot determine the state of the photons without changing their state, so someone cannot "watch" the photons fly past without affecting them. I'm assuming the black box on the other end is somehow able to read the original photons correctly?

However... What if someone were to have their own "black box", break the fiberoptic line, put one end into the receiver of their black box, and the other end out. That way you wouldn't be watching the photons go by, and affecting them. You could read them with your own black box, then re-transmit the correct photon.

Admittedly, this would be expensive, but if you are in dire need of reading something that had to be secured with quantum encryption, then money probably isn't of much concern.

Is this an incorrect assumption, or analysis on my part? I'm not a quantum physicist by any means, but I couldn't glean enough info from the articles to tell otherwise.

-Jesse

Re:A way to break it?

[Molecular Mechanic]

You are thinking in terms of classical physics. On the quatum level, the properties that are to be measured do not actually exist until an attempt is made to measure them. All that exists is a wave function representing the combined probablities of the various properties momentum, spin, location, etc.

Furthermore, in accord with the Heisenberg uncertainty principle, you cannot determine all of the properties, of, for example, an electron. Knowing (measuring) one property makes the others unknowable (NOT un

Re:A way to break it?

[Enigma_Man]

Well... What I'm thinking of is this: You originally have two "black boxes" one sending photons, and the other receiving. I'm assuming that the receiving black box can actually read the info it's supposed to be getting, right?

Now... Assume you wanted to transmit that data further than the 100 km. the spec lays out. You would need three black boxes, one in the middle to receive from the first, and re-transmit the data as photons to the next black box.

Can that be done? Or am I just lacking in knowledge

Re:A way to break it?

[menscher]

It's been a few years since I've thought about QCrypto, but what you're proposing is an extension to the intended use.

The "standard" use of these devices is for point-to-point communication. Put one end in the White House and the other in the Pentagon (about 40km away) and you have a communications channel that can not be sniffed without detection. So far, so good.

But this doesn't scale well. Talking from DC to Moscow would probably require some sort of relay system, just as a relay system would be r

What is the use of this QC key exchange?

[gay358]

As far as I know, this quantum "cryptography" prevents just passive evesdropping (where the parties are able to notice evesdropping because of this quantum "cryptography"), but as it doesn't include any kind of authentication, active attact (where all the messages are captured and the attacker is able to send his own messages) should be successfull. It is possible for Eve to just hijack all the messages and pretend to be Bob when communicating with Alice and to pretend to be Alice when communicating with Bob. It is of course possible to make this "cryptography" more secure by using some classical cryptographical methods, like authentication. But if we have rely to public key algorithms (which might become obsolete by advances in quantum computing), then it is not clear to me what is the advantage of using quantum cryptography in the first place. If somebody has answer to this question, I would be glad to hear it.

Re:

[account_deleted]

Comment removed based on user account deletion

A Useful but Long Quote.

[fermion]

I quote from the preface of Bruce Schneier Secrets and Lies, without permission

I have written this book partly to correct a mistake.

Seven years ago I wrote another book: Applied Cryptography. In it I described a mathematical utopia: algorithms that would keep your deepest secrets safe for millennia, protocols that could perform the most fantastical electronic interactions-unregulated gambling, undetectable authentication, anonymous cash-safely and securely. In my vision cryptography was the great technological equalizer; anyone with a cheap (and getting cheaper every year) computer could have the same security as the largest government. ...I went so far as to write: "It is insufficient to protect ourselves with laws; we need to protect ourselves with mathematics."

It's just not true. Cryptography can't do any of that.

It's not that cryptography has gotten weaker since 1994, or that the things I described in that book are no longer true; it's that cryptography doesn't exist in a vacuum.

Cryptography is a branch of mathematics. And like all mathematics, it involves numbers, equations, and logic. Security, palpable security that you or I might find useful in our lives, involves people: things people know, relationships between people, people and how they relate to machines. Digital security involves computers: complex, unstable, buggy computers.

Mathematics is perfect; reality is subjective. Mathematics is defined; computers are ornery. Mathematics is logical; people are erratic, capricious, and barely comprehensible.

The error of Applied Cryptography is that I didn't talk at all about the context. I talked about cryptography as if it were The Answer(TM). I was pretty naïve.

The result wasn't pretty. Readers believed that cryptography was a kind of magic security dust that they could sprinkle over their software and make it secure. ... A colleague once told me that the world was full of bad security systems designed by people who read Applied Cryptography.

Since writing the book, I have made a living as a cryptography consultant: designing and analyzing security systems. To my initial surprise, I found that the weak points had nothing to do with the mathematics. They were in the hardware, the software, the networks, and the people. Beautiful pieces of mathematics were made irrelevant through bad programming, a lousy operating system, or someone's bad password choice. ...

Any real-world system is a complicated series of interconnections. ... No system is perfect; no technology is The Answer(TM).

This is obvious to anyone involved in real-world security. In the real world, security involves processes. It involves preventative technologies, but also detection and reaction processes, and an entire forensics system to hunt down and prosecute the guilty. Security is not a product; it itself is a process. And if we're ever going to make our digital systems secure, we're going to have to start building processes.

A few years ago I heard a quotation, and I am going to modify it here: If you think technology can solve your security problems, then you don't understand the problems and you don't understand the technology.

This book is about those security problems, the limitations of technology, and the solutions.

Anecdote

[mark-t]

In the CS department at my school last year, all the students were encouraged to attend a particular lecture on quantum computing that was being given one day, and after the lecture one of my classmates was rather disturbed about some of the possibilities that quantum computing would enable, specifically quantum cryptography.

What I found rather peculiar about his view was that the reason he didn't like quantum cryptography was because it enabled organizations, such as a corrupt government perhaps, to be able to use this effectively unbreakable communication technique in order to avoid accountability to anyone else, while as long as encryption technologies remain crackable, there would always be some risk of being accountable to others for what they are communicating about.

It didn't even seem to matter to him that his own communications would be secure with this technology... he just didn't like the idea of technology introducing a break in a chain of accountability.

Re:Anecdote

[SB9876]

While quantum cryptography is something we should be concerned about, it won't allow governments and organizations to operate without accountability. From what I understand about state of the art quantum 'cryptography', it's purely a means to ensure that no one is listening in on your communication line. The actual cryptography on both ends is no more unbeatable than what already exists.

Also, you've still got other lines of evidence - bodies, eye witnesses, etc.

Wireless?

[wodelltech]

It seems that this technology is limitted to photonic transmission. Is that the case or can this technology be applied to wireless transmission media as well?

Frank Frink says...

[fxer]

"Will systems like this ever become commonplace?"

I predict that quantium crypto computers will be so large as to fill an entire building, and only the 5 richest people in the world will be able to afford them

Quantum Crypto Provably Flawed?

[theLOUDroom]

Is quantum crypto provably flawed?

I see tons of posts stating the the link is "absolutely" secure, but it seems that isn't really the case. [dhushara.com] (see the bottom of the page.)

What strikes me about all this is the following section:
"each pulse should be attenuated to an average of about .1 photon to reduce the probability of generating a two-photon pulse that could be split and eavesdropped undetectably."


What that says to me is that there is not way to 100% know you're transmitting just one photon.

It sounds like there's no device that is capable of transmitting one and only one photon with 100% reliability. If this is the case, a lot of the arguments about how secure this is are vastly overstated.

In the end QC would be vulnerable to a man-in-the-middle attack by watching for multi-photon emissions.

If this is the case, a lot of the noise surrounding QC could turn out to be hype. Is there a quantum physicist in the house?

Re:Of course..

[Anonymous Coward]

Dude, "quantum stuff" != "other quantum stuff".

Nice attempt to score an easy +5 insightful...

Re:Of course..

[brokenin2]

OK.. sorry for summarising.. but quantum computers can crack conventional encryption in a single cycle. They make it trivial to factor things down to prime numbers, no matter how large. And since this is the basis of most current cryptography, they will obsolete our current cryptography.

Quantum cryptography (at least in under current theory) cannot be cracked, or intercepted, or decoded twice by two different entities. It is the king of the mountain as far as secure goes.

There are huge problems in tryin

Re:Of course..

[tomstdenis]

"OK.. sorry for summarising.. but quantum computers can crack conventional encryption in a single cycle. They make it trivial to factor things down to prime numbers, no matter how large. And since this is the basis of most current cryptography, they will obsolete our current cryptography."

This is bullshit. First off, you have to assume that

a) non-trivial Quantum computers can be constructed at all [who says there are not limits?]

b) The time per solution is not greater than a brute force attack.

I mean sure a single cycle AES cracker would be cool. But if the machine took 2^100 years to build who gives a shit?

This type of hype always pisses me off.

To boot as I understand it, QC only "attacks" in sqrt time by meet-in-the-middle approaches. So AES-256 would provide all the security ya need.

Tom

Re:Of course..

[Prof.Phreak]

Why don't you read some literature the explains quantum computing...

Last I heard, there is still a ton of comp-sci problems that are hard, even in the quantum world. NP problems will still be NP problems---quantum computers don't help with those.

Also, unless some really major innovations come up, we won't see quantum computers anytime soon (and I mean in centuries, not years).

Re:Of course..

[Amiga Lover]

I fear the Quantum DRM that'll follow.

Quantum Crypto != Quantum Computing

[ponds]

Too bad quantum crypto and quantum computing have absolutely nothing in common.

Quantum crypto is a misnomer, it isnt even crypto at all. It's an intrusion detection system. Quantum crypto works by sending sensitive photons through a tight channel as bits which will get disturbed by an eavesdropper. Where as electrical signal on a wire expects static, and a wiretap isnt noticed.

Quantum computing however, works on electron entanglement, and is pretty far off.

Re:I was watching some TV the other day

[Rosco P. Coltrane]

Crypto is one of those feel-good technologies that costs people a lot of money but doesn't really do much for anyone in the end.

Okay then, why don't you send me your credit card number in plain text then? no need to encrypt it, it's just feel-good technology, and I'm really an honest guy...

You, sir, are grossly misinformed

[sczimme]

and I can't believe anyone actually modded you up. So crypto is just a "feel-good technolog[y]" and "doesn't really do much for anyone in the end"? Have you ever used a VPN? Or SSL? Or anything in the PGP/GPG genre? Why?

Crypto is not perfect but it is extremely useful in certain situations. You apparently believe that since crypto doesn't solve all of our problems that we shouldn't use it at all.

PS If you think that "a very determined person" stealing the machine will render all crypto ineffective, you need some remedial reading on the topic. (Not a flame - just an observation.) Here is a hint: multi-level security.

Re:I was watching some TV the other day

[geoffspear]

Yeah, if the US military decides that they want to blow the crap out of you and seize your home and all of your computers, encryption won't do you much good.

For the vast majority of us who aren't doing anything that would make the military want to invade and take over the networks we're using, it's fairly effective. But thanks for the reminder that if all the technology I use gets destroyed, I should switch to a courier who's willing to die to keep my Quicken data secure.

Re:I was watching some TV the other day

[Theodore Logan]

If your data is so important that you need this level of crypto, try to remember that all it takes is a very determined person to come in and steal the machine.

Unless the hard drive is encrypted, that is. Which, I suppose, is one out of many answers to my question in the write up regarding the potential future obsoleteness of traditional cryptography. QC is good for quickly passing secure messages from A to B. But sometimes, B=A, i.e. the intended recipient of the message is yourself. Then you'd probably

Re:I was watching some TV the other day

[Comatose51]

Obviously everything we use involves trade-offs. The more secure it is, the more difficult it is to use. Having a human courier might be very secure but I doubt Internet commerce would be where it is today if that's all we used. You have to weight the benefits and the costs. A blanket statement like that is silly. At some point, we have to decide that even if a technology is not absolutely secured, it is good enough. Whatever lost we might experience is offset by the gains. This is why we continue to

Hey, a solution to the outsourcing woes

[xant]

Hire one of our displaced IT Workers as a courier. If anyone tries to steal the message, he'll destroy himself. Either way the unemployment rate goes down.

Because linear key improvement isn't an advantage.

[expro]

The reason most encryption works is because when you linearly increase key size, you exponentially increase the amount of time required to crack the key if you have no special knowledge, meaning it is much more difficult (impossible for practical purposes) to decrypt without a key than encrypt or decrypt with the necessary keys.

Doubling the key size may only double the work of the one encrypting and decrypting using a key but exponentially increases the work of the one trying to break it without a key. Almost no matter how easy it is to crack a short key, you can increase key size until the advantage of linear versus exponential is overwhelming.

But quantum computing -- encoding the problem into the quantum matrix, not to be confused with the quantum encryption described in this article -- threatens to be able to solve such problems in linear time instead of exponential time.

This means that when the user doubles the size of his key instead of exponentially (enormously) increasing the amount of work to solve the problem, it only doubles the amount of work required to crack it, which would make decryption a simple footrace even if you do not have the key, if the amount of work required to crack the key is proportional to the amount of work required to encrypt / decrypt instead of an exponential relationship.

Primes would not seem to be adequate at all, if quantum computing allows them to be solved linearly. At best, if you could find something that had the difficulty of non-quantum primes under quantum computing, then perhaps you could use that.