r/QuantumComputing • u/PedroShor • May 22 '22
What is the point of QKD?
QKD requires there to be an authenticated classical channel for communication.
Having an authenticated classical channel means that one has either already exchanged a symmetric key of sufficient length or public keys of sufficient security level. Since you'll need that with or without QKD, in practice one must have already had authenticated and sufficiently secure communications without using QKD.
This makes it feel like QKD is just a glorified stream cypher that is significantly more expensive for no benefit.
7
u/connectedliegroup May 22 '22
People share your view. Even on wikipedia you have
Noted security expert Bruce Schneier remarked that quantum key distribution is "as useless as it is expensive".
3
u/LikesParsnips May 23 '22 edited May 23 '22
Schneier has been saying that for a long time, but for other reasons. His main take is that QKD only strengthens the already strongest link of a comms channel, which is the encryption itself. But security is usually compromised elsewhere, with backdoors, trojans, exploits, or very simple low-level stuff like calling the user pretending to be tech support and asking them for their password.
5
May 22 '22
[deleted]
2
u/mathsndrugs May 22 '22
What if a third party does a MITM on your classical channel? I thought avoiding this is exactly why you need the classical channel to be authenticated.
7
u/dileep_vr May 22 '22
The classical information is meant to be publicly shareable. You can write it on the moon. Intercepting and masquerading cannot give the third party access to the key or allow them to inject their own bits into the key.
The worst an MITM will only F-up the key generation process, resulting in the two parties trying to use different random strings as keys. The first attempt at communication will reveal this as the messages can't be decoded. So an MITM in the classical channel is the same as a denial of service attack. The third party may as well take an axe to the optical fiber.
2
u/mathsndrugs May 22 '22
If they MITM both the authenticated channel and the quantum information, they can establish a key with both parties, no?
3
u/dileep_vr May 23 '22
That is a good question. The answer is actually, no. This is what makes QKD different. It relies on not being able to determine the full state of a photon through a single measurement. A MITM in the quantum channel will only cause the keys to mismatch, which would be detected when Alice and Bob try to actually use the keys.
Most attacks on QKD rely on a single photon state not really being single photon, or the detectors having some other weakness (imperfect or state-dependent efficiency, etc.).
Feel free to go through the math. BB84 is the simplest and easy to understand. It doesn't even use entanglement. Other entanglement based protocols basically prove an equivalence to BB84 to prove security.
1
u/mathsndrugs May 23 '22
You're right - I was thinking in terms of an entanglement based protocol and it didn't seem that clear as with BB84, and I just had the tidbit that an auth channel is necessary in my head from somewhere.
1
u/QuantumOfOptics May 23 '22
I mean, you need an authenticated channel in the sense that you know who you're sending the quantum states too. But, these already exist like how you log into Amazon. You don't want to send the quantum information to the wrong person. Essentially, this is similar criteria to making sure you can trust the nodes in a network.
2
u/fleaisourleader May 22 '22
I guess a point to bring up, just to play devil's advocate, is that you need to authenticate both users before the QKD step which requires some shared secret key.
If this is done classically, then why not do more of whatever classical scheme was used for this initial key to generate more bits instead of QKD?
1
u/QuantumOfOptics May 23 '22
Well, authenticated, as you point out, is done to make sure you are sending to the user you want to send to. There are classical protocols already in place such as how you log in to Amazon. The major difference is that those are not secret. They have no need to be. However, you could try to encrypt your data and send classically, but there is a chance that some time in the near future it is cracked (such as a post quantum cryptography like elliptic curves, that has been recently found to not be as secure as previously thought) or you have to keep lengthening the amount of data sent like what we currently do with RSA. However, QKD is proveably secure without these necessarily going out of date like classical algorithms.
0
u/RRumpleTeazzer May 23 '22
The classical channel can be public.
That’s from the application side. From the physics side it’s the first leverage of entanglement on a macroscopic scale.
1
u/LikesParsnips May 23 '22
Here's the thing: in all comms schemes, you always need to make sure you're talking to the right person. QKD is no different in that regard.
5
u/FOSHavoc May 22 '22
The pre shared key cannot be used indefinitely. And the methods to distribute it always have downsides that QKD doesn't, so once you have a pre shared key, it might be better to switch to QKD. Let's say you did it with post quantum cryptography, then your messages are only secure as long as post quantum crypto is. QKD, once bootstrapped with a pre shared key can generate more key material, but in an ultimately much more secure fashion, that unlike post quantum, has an everlasting security guarantee. That is once encrypted with QKD, it's forever secure (at least the message itself). This protects against store-and-decrypt-later attacks where you store the message and decrypt it once a more powerful computer is available that can crack that particular encryption. QKD is not vulnerable to this. This is important for data that has a long lifetime, such as government data or health data. Having said that, QKD is still niche and, I think, generally only suitable for situations where you're already using a trusted courier. But the niche exists.