Quantum key distribution
Quantum key distribution (QKD) is a
An important and unique property of quantum key distribution is the ability of the two communicating users to detect the presence of any third party trying to gain knowledge of the key. This results from a fundamental aspect of quantum mechanics: the process of measuring a quantum system in general disturbs the system. A third party trying to eavesdrop on the key must in some way measure it, thus introducing detectable anomalies. By using quantum superpositions or quantum entanglement and transmitting information in quantum states, a communication system can be implemented that detects eavesdropping. If the level of eavesdropping is below a certain threshold, a key can be produced that is guaranteed to be secure (i.e., the eavesdropper has no information about it). Otherwise no secure key is possible, and communication is aborted.
The security of encryption that uses quantum key distribution relies on the foundations of quantum mechanics, in contrast to traditional
The main drawback of quantum-key distribution is that it usually relies on having an
Quantum key distribution is used to produce and distribute only a key, not to transmit any message data. This key can then be used with any chosen
Quantum key exchange
Quantum communication involves encoding information in quantum states, or
- Prepare and measure protocols
- In contrast to classical physics, the act of measurement is an integral part of quantum mechanics. In general, measuring an unknown quantum state changes that state in some way. This is a consequence of quantum indeterminacy and can be exploited in order to detect any eavesdropping on communication (which necessarily involves measurement) and, more importantly, to calculate the amount of information that has been intercepted.
- Entanglement based protocols
- The quantum states of two (or more) separate objects can become linked together in such a way that they must be described by a combined quantum state, not as individual objects. This is known as entanglement and means that, for example, performing a measurement on one object affects the other. If an entangled pair of objects is shared between two parties, anyone intercepting either object alters the overall system, revealing the presence of the third party (and the amount of information they have gained).
These two approaches can each be further divided into three families of protocols: discrete variable, continuous variable and distributed phase reference coding. Discrete variable protocols were the first to be invented, and they remain the most widely implemented. The other two families are mainly concerned with overcoming practical limitations of experiments. The two protocols described below both use discrete variable coding.
BB84 protocol: Charles H. Bennett and Gilles Brassard (1984)
This protocol, known as
The security of the protocol comes from encoding the information in non-orthogonal states. Quantum indeterminacy means that these states cannot in general be measured without disturbing the original state (see No-cloning theorem). BB84 uses two pairs of states, with each pair conjugate to the other pair, and the two states within a pair orthogonal to each other. Pairs of orthogonal states are referred to as a basis. The usual polarization state pairs used are either the rectilinear basis of vertical (0°) and horizontal (90°), the diagonal basis of 45° and 135° or the circular basis of left- and right-handedness. Any two of these bases are conjugate to each other, and so any two can be used in the protocol. Below the rectilinear and diagonal bases are used.
Basis | 0 | 1 |
---|---|---|
The first step in BB84 is quantum transmission. Alice creates a random bit (0 or 1) and then randomly selects one of her two bases (rectilinear or diagonal in this case) to transmit it in. She then prepares a photon polarization state depending both on the bit value and basis, as shown in the adjacent table. So for example a 0 is encoded in the rectilinear basis (+) as a vertical polarization state, and a 1 is encoded in the diagonal basis (x) as a 135° state. Alice then transmits a single photon in the state specified to Bob, using the quantum channel. This process is then repeated from the random bit stage, with Alice recording the state, basis and time of each photon sent.
According to quantum mechanics (particularly quantum indeterminacy), no possible measurement distinguishes between the 4 different polarization states, as they are not all orthogonal. The only possible measurement is between any two orthogonal states (an orthonormal basis). So, for example, measuring in the rectilinear basis gives a result of horizontal or vertical. If the photon was created as horizontal or vertical (as a rectilinear
As Bob does not know the basis the photons were encoded in, all he can do is to select a basis at random to measure in, either rectilinear or diagonal. He does this for each photon he receives, recording the time, measurement basis used and measurement result. After Bob has measured all the photons, he communicates with Alice over the public classical channel. Alice broadcasts the basis each photon was sent in, and Bob the basis each was measured in. They both discard photon measurements (bits) where Bob used a different basis, which is half on average, leaving half the bits as a shared key.
To check for the presence of an eavesdropper, Alice and Bob now compare a predetermined subset of their remaining bit strings. If a third party (usually referred to as Eve, for "eavesdropper") has gained any information about the photons' polarization, this introduces errors in Bob's measurements. Other environmental conditions can cause errors in a similar fashion. If more than bits differ they abort the key and try again, possibly with a different quantum channel, as the security of the key cannot be guaranteed. is chosen so that if the number of bits known to Eve is less than this,
E91 protocol: Artur Ekert (1991)
Artur Ekert's scheme[5] uses entangled pairs of photons. These can be created by Alice, by Bob, or by some source separate from both of them, including eavesdropper Eve. The photons are distributed so that Alice and Bob each end up with one photon from each pair.
The scheme relies on two properties of entanglement. First, the entangled states are perfectly correlated in the sense that if Alice and Bob both measure whether their particles have vertical or horizontal polarizations, they always get the same answer with 100% probability. The same is true if they both measure any other pair of complementary (orthogonal) polarizations. This necessitates that the two distant parties have exact directionality synchronization. However, the particular results are completely random; it is impossible for Alice to predict if she (and thus Bob) will get vertical polarization or horizontal polarization. Second, any attempt at eavesdropping by Eve destroys these correlations in a way that Alice and Bob can detect.
Similarly to BB84, the protocol involves a private measurement protocol before detecting the presence of Eve. The measurement stage involves Alice measuring each photon she receives using some basis from the set while Bob chooses from where is the basis rotated by . They keep their series of basis choices private until measurements are completed. Two groups of photons are made: the first consists of photons measured using the same basis by Alice and Bob while the second contains all other photons. To detect eavesdropping, they can compute the test statistic using the correlation coefficients between Alice's bases and Bob's similar to that shown in the
Device-independent quantum key distribution
In traditional QKD, the quantum devices used must be perfectly calibrated, trustworthy, and working exactly as they are expected to.[6] Deviations from expected measurements can be extremely hard to detect, which leaves the entire system vulnerable. A new protocol called device independent QKD (DIQKD) or measurement device independent QKD (MDIQKD) allows for the use of uncharacterized or untrusted devices, and for deviations from expected measurements to be included in the overall system.[6][7] These deviations will cause the protocol to abort when detected, rather than resulting in incorrect data.[6]
DIQKD was first proposed by Mayers and Yao,[8] building off of the BB84 protocol. They presented that in DIQKD, the quantum device, which they refer to as the photon source, be manufactured to come with tests that can be run by Alice and Bob to "self-check" if their device is working properly. Such a test would only need to consider the classical inputs and outputs in order to determine how much information is at risk of being intercepted by Eve. A self checking, or "ideal" source would not have to be characterized,[7][9] and would therefore not be susceptible to implementation flaws.[7]
Recent research has proposed using a Bell test to check that a device is working properly.[6] Bell's theorem ensures that a device can create two outcomes that are exclusively correlated, meaning that Eve could not intercept the results, without making any assumptions about said device. This requires highly entangled states, and a low quantum bit error rate.[7] DIQKD presents difficulties in creating qubits that are in such high quality entangled states, which makes it a challenge to realize experimentally.[6]
Twin fields quantum key distribution
Twin fields quantum key distribution (TFQKD) was introduced in 2018, and is a version of DIQKD designed to overcome the fundamental rate-distance limit of traditional quantum key distribution.[10] The rate-distance limit, also known as the rate-loss trade off, describes how as distance increases between Alice and Bob, the rate of key generation decreases exponentially.[11] In traditional QKD protocols, this decay has been eliminated via the addition of physically secured relay nodes, which can be placed along the quantum link with the intention of dividing it up into several low-loss sections. Researchers have also recommended the use of quantum repeaters, which when added to the relay nodes make it so that they no longer need to be physically secured.[11] Quantum repeaters, however, are difficult to create and have yet to be implemented on a useful scale.[10] TFQKD aims to bypass the rate-distance limit without the use of quantum repeaters or relay nodes, creating manageable levels of noise and a process that can be repeated much more easily with today's existing technology.[10]
The original protocol for TFQKD is as follows: Alice and Bob each have a light source and one arm on an interferometer in their laboratories. The light sources create two dim optical pulses with a randomly phase pa or pb in the interval [0, 2π) and an encoding phase γa or γb. The pulses are sent along a quantum to Charlie, a third party who can be malicious or not. Charlie uses a beam splitter to overlap the two pulses and perform a measurement. He has two detectors in his own lab, one of which will light up if the bits are equal (00) or (11), and the other when they are different (10, 01). Charlie will announce to Alice and Bob which of the detectors lit up, at which point they publicly reveal the phases p and γ.[10] This is different from traditional QKD, in which the phases used are never revealed.[12]
Information reconciliation and privacy amplification
The quantum key distribution protocols described above provide Alice and Bob with nearly identical shared keys, and also with an estimate of the discrepancy between the keys. These differences can be caused by eavesdropping, but also by imperfections in the transmission line and detectors. As it is impossible to distinguish between these two types of errors, guaranteed security requires the assumption that all errors are due to eavesdropping. Provided the error rate between the keys is lower than a certain threshold (27.6% as of 2002[13]), two steps can be performed to first remove the erroneous bits and then reduce Eve's knowledge of the key to an arbitrary small value. These two steps are known as information reconciliation and privacy amplification respectively, and were first described in 1992.[14]
Information reconciliation is a form of error correction carried out between Alice and Bob's keys, in order to ensure both keys are identical. It is conducted over the public channel and as such it is vital to minimise the information sent about each key, as this can be read by Eve. A common protocol used for information reconciliation is the cascade protocol, proposed in 1994.
Privacy amplification is a method for reducing (and effectively eliminating) Eve's partial information about Alice and Bob's key. This partial information could have been gained both by eavesdropping on the quantum channel during key transmission (thus introducing detectable errors), and on the public channel during information reconciliation (where it is assumed Eve gains all possible parity information). Privacy amplification uses Alice and Bob's key to produce a new, shorter key, in such a way that Eve has only negligible information about the new key. This is performed using a randomness extractor, for example, by applying a universal hash function, chosen at random from a publicly known set of such functions, which takes as its input a binary string of length equal to the key and outputs a binary string of a chosen shorter length. The amount by which this new key is shortened is calculated, based on how much information Eve could have gained about the old key (which is known due to the errors this would introduce), in order to reduce the probability of Eve having any knowledge of the new key to a very low value.
Implementations
Experimental
In 1991, John Rarity, Paul Tapster and Artur Ekert, researchers from the UK Defence Research Agency in Malvern and Oxford University, demonstrated quantum key distribution protected by the violation of the Bell inequalities.
In 2008, exchange of secure keys at 1 Mbit/s (over 20 km of optical fibre) and 10 kbit/s (over 100 km of fibre), was achieved by a collaboration between the University of Cambridge and Toshiba using the BB84 protocol with decoy state pulses.[19]
In 2007,
As of August 2015[update] the longest distance for optical fiber (307 km)[28] was achieved by University of Geneva and Corning Inc. In the same experiment, a secret key rate of 12.7 kbit/s was generated, making it the highest bit rate system over distances of 100 km. In 2016 a team from Corning and various institutions in China achieved a distance of 404 km, but at a bit rate too slow to be practical.[29]
In June 2017, physicists led by Thomas Jennewein at the Institute for Quantum Computing and the University of Waterloo in Waterloo, Canada achieved the first demonstration of quantum key distribution from a ground transmitter to a moving aircraft. They reported optical links with distances between 3–10 km and generated secure keys up to 868 kilobytes in length.[30]
Also in June 2017, as part of the
In August 2017, a group at Shanghai Jiaotong University experimentally demonstrate that polarization quantum states including general qubits of single photon and entangled states can survive well after travelling through seawater,[34] representing the first step towards underwater quantum communication.
In May 2019 a group led by Hong Guo at Peking University and Beijing University of Posts and Telecommunications reported field tests of a continuous-variable QKD system through commercial fiber networks in Xi'an and Guangzhou over distances of 30.02 km (12.48 dB) and 49.85 km (11.62 dB) respectively.[35]
In December 2020, Indian Defence Research and Development Organisation tested a QKD between two of its laboratories in Hyderabad facility. The setup also demonstrated the validation of detection of a third party trying to gain knowledge of the communication. Quantum based security against eavesdropping was validated for the deployed system at over 12 km (7.5 mi) range and 10 dB attenuation over fibre optic channel. A continuous wave laser source was used to generate photons without depolarization effect and timing accuracy employed in the setup was of the order of picoseconds. The Single photon avalanche detector (SPAD) recorded arrival of photons and key rate was achieved in the range of kbps with low Quantum bit error rate.[36]
In March 2021,
In July 2022, researchers published their work experimentally implementing a device-independent quantum key distribution (DIQKD) protocol that uses quantum entanglement (as suggested by Ekert)[5] to insure resistance to quantum hacking attacks.[6] They were able to create two ions, about two meters apart that were in a high quality entangled state using the following process: Alice and Bob each have ion trap nodes with an 88Sr+ qubit inside. Initially, they excite the ions to an electronic state, which creates an entangled state. This process also creates two photons, which are then captured and transported using an optical fiber, at which point a Bell-basis measurement is performed and the ions are projected to a highly entangled state. Finally the qubits are returned to new locations in the ion traps disconnected from the optical link so that no information can be leaked. This is repeated many times before the key distribution proceeds.[6]
A separate experiment published in July 2022 demonstrated implementation of DIQKD that also uses a Bell inequality test to ensure that the quantum device is functioning, this time at a much larger distance of about 400m, using an optical fiber 700m long.[7] The set up for the experiment was similar to the one in the paragraph above, with some key differences. Entanglement was generated in a quantum network link (QNL) between two 87Rb atoms in separate laboratories located 400m apart, connected by the 700m channel.The atoms are entangled by electronic excitation, at which point two photons are generated and collected, to be sent to the bell state measurement (BSM) setup. The photons are projected onto a |ψ+ state, indicating maximum entanglement. The rest of the key exchange protocol used is similar to the original QKD protocol, with the only difference being that keys are generated with two measurement settings instead of one.[7]
Since the proposal of Twin Field Quantum Key Distribution in 2018, a myriad of experiments have been performed with the goal of increasing the distance in a QKD system. The most successful of which was able to distribute key information across a distance of 833.8 km.[12]
In 2023, Scientists at Indian Institute of Technology (IIT) Delhi have achieved a trusted-node-free quantum key distribution (QKD) up to 380 km in standard telecom fiber with a very low quantum bit error rate (QBER).[39]
Commercial
Many companies around the world offer commercial quantum key distribution, for example:
In 2004, the world's first bank transfer using quantum key distribution was carried out in
Quantum key distribution networks
DARPA
The
SECOQC
The world's first
SwissQuantum
Id Quantique has successfully completed the longest running project for testing Quantum Key Distribution (QKD) in a field environment. The main goal of the SwissQuantum network project installed in the Geneva metropolitan area in March 2009, was to validate the reliability and robustness of QKD in continuous operation over a long time period in a field environment. The quantum layer operated for nearly 2 years until the project was shut down in January 2011 shortly after the initially planned duration of the test.
Chinese networks
In May 2009, a hierarchical quantum network was demonstrated in Wuhu, China. The hierarchical network consisted of a backbone network of four nodes connecting a number of subnets. The backbone nodes were connected through an optical switching quantum router. Nodes within each subnet were also connected through an optical switch, which were connected to the backbone network through a trusted relay.[46]
Launched in August 2016, the QUESS space mission created an international QKD channel between China and the Institute for Quantum Optics and Quantum Information in Vienna, Austria − a ground distance of 7,500 km (4,700 mi), enabling the first intercontinental secure quantum video call.[47][48][49] By October 2017, a 2,000-km fiber line was operational between Beijing, Jinan, Hefei and Shanghai.[50] Together they constitute the world's first space-ground quantum network.[51] Up to 10 Micius/QUESS satellites are expected,[52] allowing a European–Asian quantum-encrypted network by 2020, and a global network by 2030.[53][54]
Tokyo QKD Network
The Tokyo QKD Network[55] was inaugurated on the first day of the UQCC2010 conference. The network involves an international collaboration between 7 partners; NEC, Mitsubishi Electric, NTT and NICT from Japan, and participation from Europe by Toshiba Research Europe Ltd. (UK), Id Quantique (Switzerland) and All Vienna (Austria). "All Vienna" is represented by researchers from the Austrian Institute of Technology (AIT), the Institute for Quantum Optics and Quantum Information (IQOQI) and the University of Vienna.
Los Alamos National Laboratory
A hub-and-spoke network has been operated by Los Alamos National Laboratory since 2011. All messages are routed via the hub. The system equips each node in the network with quantum transmitters—i.e., lasers—but not with expensive and bulky photon detectors. Only the hub receives quantum messages. To communicate, each node sends a one-time pad to the hub, which it then uses to communicate securely over a classical link. The hub can route this message to another node using another one time pad from the second node. The entire network is secure only if the central hub is secure. Individual nodes require little more than a laser: Prototype nodes are around the size of a box of matches.[56]
Eagle-1
In 2024, the ESA plans to launch the satellite Eagle-1, an experimental space-based quantum key distribution system.[57]
Attacks and security proofs
Intercept and resend
The simplest type of possible attack is the intercept-resend attack, where Eve measures the quantum states (photons) sent by Alice and then sends replacement states to Bob, prepared in the state she measures. In the BB84 protocol, this produces errors in the key Alice and Bob share. As Eve has no knowledge of the basis a state sent by Alice is encoded in, she can only guess which basis to measure in, in the same way as Bob. If she chooses correctly, she measures the correct photon polarization state as sent by Alice, and resends the correct state to Bob. However, if she chooses incorrectly, the state she measures is random, and the state sent to Bob cannot be the same as the state sent by Alice. If Bob then measures this state in the same basis Alice sent, he too gets a random result—as Eve has sent him a state in the opposite basis—with a 50% chance of an erroneous result (instead of the correct result he would get without the presence of Eve). The table below shows an example of this type of attack.
The probability Eve chooses the incorrect basis is 50% (assuming Alice chooses randomly), and if Bob measures this intercepted photon in the basis Alice sent he gets a random result, i.e., an incorrect result with probability of 50%. The probability an intercepted photon generates an error in the key string is then 50% × 50% = 25%. If Alice and Bob publicly compare of their key bits (thus discarding them as key bits, as they are no longer secret) the probability they find disagreement and identify the presence of Eve is
So to detect an eavesdropper with probability Alice and Bob need to compare key bits.
Man-in-the-middle attack
Quantum key distribution is vulnerable to a man-in-the-middle attack when used without authentication to the same extent as any classical protocol, since no known principle of quantum mechanics can distinguish friend from foe. As in the classical case, Alice and Bob cannot authenticate each other and establish a secure connection without some means of verifying each other's identities (such as an initial shared secret). If Alice and Bob have an initial shared secret then they can use an unconditionally secure authentication scheme (such as Carter-Wegman,[58]) along with quantum key distribution to exponentially expand this key, using a small amount of the new key to authenticate the next session.[59] Several methods to create this initial shared secret have been proposed, for example using a 3rd party[60] or chaos theory.[61] Nevertheless, only "almost strongly universal" family of hash functions can be used for unconditionally secure authentication.[62]
Photon number splitting attack
In the BB84 protocol Alice sends quantum states to Bob using single photons. In practice many implementations use laser pulses attenuated to a very low level to send the quantum states. These laser pulses contain a very small number of photons, for example 0.2 photons per pulse, which are distributed according to a Poisson distribution. This means most pulses actually contain no photons (no pulse is sent), some pulses contain 1 photon (which is desired) and a few pulses contain 2 or more photons. If the pulse contains more than one photon, then Eve can split off the extra photons and transmit the remaining single photon to Bob. This is the basis of the photon number splitting attack,[63] where Eve stores these extra photons in a quantum memory until Bob detects the remaining single photon and Alice reveals the encoding basis. Eve can then measure her photons in the correct basis and obtain information on the key without introducing detectable errors.
Even with the possibility of a PNS attack a secure key can still be generated, as shown in the GLLP security proof;[64] however, a much higher amount of privacy amplification is needed reducing the secure key rate significantly (with PNS the rate scales as as compared to for a single photon sources, where is the transmittance of the quantum channel).
There are several solutions to this problem. The most obvious is to use a true single photon source instead of an attenuated laser. While such sources are still at a developmental stage QKD has been carried out successfully with them.[65] However, as current sources operate at a low efficiency and frequency key rates and transmission distances are limited. Another solution is to modify the BB84 protocol, as is done for example in the SARG04 protocol,[66] in which the secure key rate scales as . The most promising solution is the
in which Alice randomly sends some of her laser pulses with a lower average photon number. These decoy states can be used to detect a PNS attack, as Eve has no way to tell which pulses are signal and which decoy. Using this idea the secure key rate scales as , the same as for a single photon source. This idea has been implemented successfully first at the University of Toronto,[67][68] and in several follow-up QKD experiments,[69] allowing for high key rates secure against all known attacks.Denial of service
Because currently a dedicated fibre optic line (or line of sight in free space) is required between the two points linked by quantum key distribution, a
Trojan-horse attacks
A quantum key distribution system may be probed by Eve by sending bright light into the quantum channel and analyzing the back-reflections in a Trojan-horse attack. In a recent research study it has been shown that Eve discerns Bob's secret basis choice with higher than 90% probability, breaching the security of the system.[70]
Security proofs
If Eve is assumed to have unlimited resources, for example both classical and quantum computing power, there are many more attacks possible. BB84 has been proven secure against any attacks allowed by quantum mechanics, both for sending information using an ideal photon source which only ever emits a single photon at a time,[71] and also using practical photon sources which sometimes emit multiphoton pulses.[64] These proofs are unconditionally secure in the sense that no conditions are imposed on the resources available to the eavesdropper; however, there are other conditions required:
- Eve cannot physically access Alice and Bob's encoding and decoding devices.
- The random number generators used by Alice and Bob must be trusted and truly random (for example a Quantum random number generator).
- The classical communication channel must be authenticated using an unconditionally secure authentication scheme.
- The message must be encrypted using one-time pad like scheme
Quantum hacking
Hacking attacks target vulnerabilities in the operation of a QKD protocol or deficiencies in the components of the physical devices used in construction of the QKD system. If the equipment used in quantum key distribution can be tampered with, it could be made to generate keys that were not secure using a
Several other attacks including faked-state attacks,[73] phase remapping attacks,[74] and time-shift attacks[75] are now known. The time-shift attack has even been demonstrated on a commercial quantum cryptosystem.[76] This is the first demonstration of quantum hacking against a non-homemade quantum key distribution system. Later on, the phase-remapping attack was also demonstrated on a specially configured, research oriented open QKD system (made and provided by the Swiss company Id Quantique under their Quantum Hacking program).[77] It is one of the first 'intercept-and-resend' attacks on top of a widely used QKD implementation in commercial QKD systems. This work has been widely reported in media.[78][79][80][81]
The first attack that claimed to be able to eavesdrop the whole key
Counterfactual quantum key distribution
The task of distributing a secret key could be achieved even when the particle (on which the secret information, e.g. polarization, has been encoded) does not traverse through the quantum channel using a protocol developed by Tae-Gon Noh.
History
Quantum cryptography was proposed first by
Future
The current commercial systems are aimed mainly at governments and corporations with high security requirements. Key distribution by courier is typically used in such cases, where traditional key distribution schemes are not believed to offer enough guarantee. This has the advantage of not being intrinsically distance limited, and despite long travel times the transfer rate can be high due to the availability of large capacity portable storage devices. The major difference of quantum key distribution is the ability to detect any interception of the key, whereas with courier the key security cannot be proven or tested. QKD (quantum key distribution) systems also have the advantage of being automatic, with greater reliability and lower operating costs than a secure human courier network.
Kak's three-stage protocol has been proposed as a method for secure communication that is entirely quantum unlike quantum key distribution in which the cryptographic transformation uses classical algorithms.[88]
Factors preventing wide adoption of quantum key distribution outside high security areas include the cost of equipment, and the lack of a demonstrated threat to existing key exchange protocols. However, with optic fibre networks already present in many countries the infrastructure is in place for a more widespread use.
An Industry Specification Group (ISG) of the European Telecommunications Standards Institute (ETSI) has been set up to address standardisation issues in quantum cryptography.[89]
European Metrology Institutes, in the context of dedicated projects,[90][91] are developing measurements required to characterise components of QKD systems.
Toshiba Europe has been awarded a prestigious Institute of Physics Award for Business Innovation. This recognises Toshiba's pioneering QKD[92] technology developed over two decades of research, protecting communication infrastructure from present and future cyber-threats, and commercialising UK-manufactured products which pave the road to the quantum internet.
Toshiba also took the Semi Grand Prix award in the Solutions Category for the QKD has won the Minister of Economy, Trade and Industry Award in CEATEC AWARD 2021, the prestigious awards presented at CEATEC, Japan's premier electronics industry trade show.[93]
Deprecation from governmental institutions
Some organizations have recommended using "post-quantum cryptography (or quantum-resistant cryptography)" as an alternative because of the problems it raises in practical use. For example, the US National Security Agency, European Union Agency for Cybersecurity of EU (ENISA), National Cyber Security Centre (United Kingdom), and French Secretariat for Defense and Security (ANSSI) recommend it. (read through the bibliography for details).[94][95][96][97]
For example, the US National Security Agency addresses five issues:[94]
- Quantum key distribution is only a partial solution. QKD generates keying material for an encryption algorithm that provides confidentiality. Such keying material could also be used in symmetric key cryptographic algorithms to provide integrity and authentication if one has the cryptographic assurance that the original QKD transmission comes from the desired entity (i.e. entity source authentication). QKD does not provide a means to authenticate the QKD transmission source. Therefore, source authentication requires the use of asymmetric cryptography or preplaced keys to provide that authentication. Moreover, the confidentiality services QKD offers can be provided by quantum-resistant cryptography, which is typically less expensive with a better understood risk profile.
- Quantum key distribution requires special purpose equipment. QKD is based on physical properties, and its security derives from unique physical layer communications. This requires users to lease dedicated fiber connections or physically manage free-space transmitters. It cannot be implemented in software or as a service on a network, and cannot be easily integrated into existing network equipment. Since QKD is hardware-based it also lacks flexibility for upgrades or security patches.
- Quantum key distribution increases infrastructure costs and insider threat risks. QKD networks frequently necessitate the use of trusted relays, entailing additional cost for secure facilities and additional security risk from insider threats. This eliminates many use cases from consideration.
- Securing and validating quantum key distribution is a significant challenge. The actual security provided by a QKD system is not the theoretical unconditional security from the laws of physics (as modeled and often suggested), but rather the more limited security that can be achieved by hardware and engineering designs. The tolerance for error in cryptographic security, however, is many orders of magnitude smaller than in most physical engineering scenarios making it very difficult to validate. The specific hardware used to perform QKD can introduce vulnerabilities, resulting in several well-publicized attacks on commercial QKD systems.[98]
- Quantum key distribution increases the risk of denial of service. The sensitivity to an eavesdropper as the theoretical basis for QKD security claims also shows that denial of service is a significant risk for QKD.
In response to problem 1 above, attempts to deliver authentication keys using post-quantum cryptography (or quantum-resistant cryptography) have been proposed worldwide. On the other hand, quantum-resistant cryptography is cryptography belonging to the class of computational security. In 2015, a research result was already published that "sufficient care must be taken in implementation to achieve information-theoretic security for the system as a whole when authentication keys that are not information-theoretic secure are used" (when the authentication key is not information-theoretic secure (If the authentication key is not information-theoretically secure, an attacker can break it to bring all classical and quantum communications under control and relay them to launch a man-in-the-middle attack).[99] Ericsson, a private company, also cites and points out the above problems and then presents a report that it may not be able to support the zero trust security model, which is a recent trend in network security technology.[100]
See also
- List of quantum key distribution protocols
- Quantum computing
- Quantum cryptography
- Quantum information science
- Quantum network
References
- ISSN 0005-8580.
- ^ C. H. Bennett and G. Brassard. Quantum cryptography: Public key distribution and coin tossing. In Proceedings of IEEE International Conference on Computers, Systems and Signal Processing, volume 175, page 8. New York, 1984.
- S2CID 56465385.
- ].
- ^ S2CID 27683254.
- ^ S2CID 251131731.
- ^ PMID 35896650.
- arXiv:quant-ph/9809039.
- PMID 34001885.
- ^ S2CID 256768464.
- ^ PMID 25341406.
- ^ S2CID 117167883.
- hdl:10722/43370. Retrieved 4 September 2020.
- S2CID 206771454.
- ISBN 3-540-48285-7.
- arXiv:cs/0406001. Parma, Italy.
- doi:10.26421/QIC11.3-4-3. Archived from the original(PDF) on 15 December 2013. Retrieved 4 September 2020.
- arXiv:1204.5882v3 [quant-ph].
- S2CID 17141431.
- ISSN 1367-2630.
- S2CID 108284907.
- ^ S2CID 19225674.
- ^ a b H.-K. Lo, in Proceedings of 2004 IEEE ISIT (IEEE Press, New York, 2004), p. 137
- ^ S2CID 2651690.
- ^ a b H.-K. Lo, X. Ma, K. Chen, "Decoy State Quantum Key Distribution", Physical Review Letters, 94, 230504 (2005)
- ^ S2CID 836096.
- S2CID 15102161.
- ^
Korzh, Boris; Lim, Charles Ci Wen; Houlmann, Raphael; Gisin, Nicolas; Li, Ming Jun; Nolan, Daniel; Sanguinetti, Bruno; Thew, Rob; Zbinden, Hugo (2015). "Provably Secure and Practical Quantum Key Distribution over 307 km of Optical Fibre". Nature Photonics. 9 (3): 163–168. S2CID 59028718.
- S2CID 5206894.
- S2CID 21279135.
- ^ "China's quantum satellite achieves 'spooky action' at a record distance". 15 June 2017. Retrieved 15 June 2017.
- PMID 28619937.
- ^
Liao, Sheng-Kai; Cai, Wen-Qi; Handsteiner, Johannes; Liu, Bo; Yin, Juan; Zhang, Liang; Rauch, Dominik; Fink, Matthias; Ren, Ji-Gang; Liu, Wei-Yue; et al. (2018). "Satellite-Relayed Intercontinental Quantum Network". Physical Review Letters. 120 (3): 030501. S2CID 206306725.
- S2CID 46757097.
- S2CID 116403328.
- ^ Ministry of Defence (9 December 2020). "Quantum Communication between two DRDO Laboratories". Press Information Bureau. Retrieved 22 March 2021.
- ^ "ISRO makes breakthrough demonstration of free-space Quantum Key Distribution (QKD) over 300 m". Indian Space Research Organisation. 22 March 2021. Archived from the original on 22 March 2021. Retrieved 22 March 2021.
- ^ "Department of Space demonstrates entanglement based quantum communication over 300m free space along with real time cryptographic applications". Indian Space Research Organisation. 31 January 2022. Archived from the original on 1 February 2022. Retrieved 1 February 2022.
- ^ "EMERGING TECHNOLOGIES: IIT Delhi researchers achieve secure quantum communication for 380 km in standard telecom fiber - EducationTimes.com". www.educationtimes.com.
- ^ http://www.secoqc.net/downloads/pressrelease/Banktransfer_english.pdf Archived 9 March 2013 at the Wayback Machine secoqc.net
- ^ Jordans, Frank (12 October 2007). "Swiss Call New Vote Encryption System 'Unbreakable'". technewsworld.com. Archived from the original on 9 December 2007. Retrieved 8 March 2013.
- ^ Dillow, Clay (14 October 2013). "Unbreakable encryption comes to the U.S". fortune.cnn.com. Archived from the original on 14 October 2013.
- S2CID 593516.
- ^ Knight, Will. "Quantum cryptography network gets wireless link". Retrieved 18 August 2016.
- ^ "'Unbreakable' encryption unveiled". 9 October 2008. Retrieved 18 August 2016 – via bbc.co.uk.
- S2CID 118300112
- ^ Lin Xing (16 August 2016). "China launches world's first quantum science satellite". Physics World. Institute of Physics. Archived from the original on 1 December 2017. Retrieved 17 August 2016.
- ^ "First Quantum Satellite Successfully Launched". Austrian Academy of Sciences. 16 August 2016. Archived from the original on 18 March 2018. Retrieved 17 August 2016.
- ^ Wall, Mike (16 August 2016). "China Launches Pioneering 'Hack-Proof' Quantum-Communications Satellite". Space.com. Purch. Retrieved 17 August 2016.
- ^ Yuen Yiu (19 January 2018). "Is China the Leader in Quantum Communications?". IEEE. Retrieved 19 March 2018.
- ^ Amy Nordrum (3 October 2017). "China Demonstrates Quantum Encryption By Hosting a Video Call". IEEE. Retrieved 17 March 2018.
- ^ Jian-Wei Pan (3 October 2017). "A quantum communications satellite proved its potential in 2017". Science News. Retrieved 19 March 2018.
- ^ huaxia (16 August 2016). "China Focus: China's space satellites make quantum leap". Xinhua. Archived from the original on 17 August 2016. Retrieved 17 August 2016.
- ^ Jeffrey Lin; P.W. Singer; John Costello (3 March 2016). "China's Quantum Satellite Could Change Cryptography Forever". Popular Science. Retrieved 17 August 2016.
- ^ "UQCC2010 - Updating Quantum Cryptography and Communications 2010 | Tokyo QKD Network". www.uqcc2010.org.
- ].
- ^ Jones, Andrew (15 October 2022). "Europe plans to launch a quantum encryption satellite for ultrasecure communications in 2024". Space.com.
- ISSN 0022-0000.
- arXiv:quant-ph/0701168.
- S2CID 5529511.
- ^ D. Huang, Z. Chen, Y. Guo and M. Lee "Quantum Secure Direct Communication Based on Chaos with Authentication", Journal of the Physical Society of Japan Vol. 76 No. 12, 124001 (2007) ("124001". Archived from the original on 5 March 2012. Retrieved 6 February 2016.)
- ^ "5. Unconditionally secure authentication". Retrieved 18 August 2016.
- S2CID 18688722.
- ^ a b D. Gottesman, H.-K. Lo, N. L¨utkenhaus, and J. Preskill, Quant. Inf. Comp. 4, 325 (2004)
- S2CID 118994015.
- S2CID 4791560.
- S2CID 2564853.
- ^ Y.Zhao, B. Qi, X. Ma, H.-K. Lo, and L. Qian, in Proc. IEEE ISIT, pp. 2094–2098 (2006).
- S2CID 20424612.
- S2CID 15127809.
- S2CID 703220.
- S2CID 16173055.
- S2CID 17478135.
- S2CID 15024401.
- ^ B. Qi, C.-H. F. Fung, H.-K. Lo, and X. Ma, Quant. Info. Compu. 7, 43 (2007)
- S2CID 117595905.
- ^ F. Xu, B. Qi, and H.-K. Lo, New J. Phys. 12, 113026 (2010)
- ^ Quantum crypto boffins in successful backdoor sniff – Erroneous error-handling undermines bulletproofness retrieved 2010-05-26
- . Retrieved 18 August 2016 – via www.nature.com.
- ^ "Light fantastic". The Economist. 26 July 2010.
- ^ "Quantum cryptography system hacked - physicsworld.com". Archived from the original on 8 November 2011. Retrieved 26 July 2011.
- S2CID 58897515.
- S2CID 13395490.
- ISSN 1367-2630.
- S2CID 6778097.
- S2CID 206535295.
- S2CID 9804265.
- S2CID 52009384.
- ^ "ETSI – Quantum Key Distribution". etsi.org. 2014. Retrieved 28 July 2014.
- ^ "MIQC – European Metrology Research Programme (EMRP)". projects.npl.co.uk. 2014. Retrieved 28 July 2014.
- ^ "MIQC2 – European Metrology Research Programme (EMRP)". projects.npl.co.uk. 2019. Retrieved 18 September 2019.
- ^ "Quantum Key Distribution". Toshiba.
- ^ "CEATEC 2021 ONLINE". CEATEC. Archived from the original on 24 November 2021. Retrieved 24 November 2021.
- ^ a b "Quantum Key Distribution (QKD) and Quantum Cryptography (QC)". National Security Agency. Retrieved 16 July 2022. This article incorporates text from this source, which is in the public domain.
- ^ Post-Quantum Cryptography: Current state and quantum mitigation, Section 6 "Conclusion" [1]
- ^ "Quantum security technologies". www.ncsc.gov.uk.
- ^ "Should Quantum Key Distribution be Used for Secure Communications? | ANSSI". cyber.gouv.fr.
- S2CID 44504715.
- S2CID 7779977.
- arXiv:2112.00399 [cs.CR].
External links
- General and review
- Quantum Computing 101
- Scientific American Magazine (January 2005 Issue) Best-Kept Secrets Non-technical article on quantum cryptography
- Physics World Magazine (March 2007 Issue) Non-technical article on current state and future of quantum communication
- Scarani, Valerio; Bechmann-Pasquinucci, Helle; Cerf, Nicolas J.; Dušek, Miloslav; Lütkenhaus, Norbert; Peev, Momtchil (2009). "The Security of Practical Quantum Key Distribution". Rev. Mod. Phys. 81 (3): 1301–1350. S2CID 15873250.
- Nguyen, Kim-Chi; Gilles Van Assche; Cerf, Nicolas J. (2007). "Quantum Cryptography: From Theory to Practice". arXiv:quant-ph/0702202.
- SECOQC White Paper on Quantum Key Distribution and Cryptography European project to create a large scale quantum cryptography network, includes discussion of current QKD approaches and comparison with classical cryptography
- The future of cryptography May 2003 Tomasz Grabowski
- ARDA Quantum Cryptography Roadmap
- Lectures at the Institut Henri Poincaré (slides and videos)
- Interactive quantum cryptography demonstration experiment with single photons for education
- More specific information
- Ekert, Artur (30 April 2005). "Cracking codes, part II | plus.maths.org". Pass.maths.org.uk. Retrieved 28 December 2013. Description of entanglement based quantum cryptography from Artur Ekert.
- Xu, Qing (2009). Optical Homodyne Detections and Applications in Quantum Cryptography (PDF) (Thesis). Paris: Télécom ParisTech. Retrieved 14 February 2017.
- "Quantum Cryptography and Privacy Amplification". Ai.sri.com. Retrieved 28 December 2013. Description of BB84 protocol and privacy amplification by Sharon Goldwater.
- Bennett, Charles H.; Brassard, Gilles (2014). "Quantum cryptography: Public key distribution and coin tossing". Theoretical Computer Science. 560: 7–11. .
- Public debate on the Security of Quantum Key Distribution at the conference Hot Topics in Physical Informatics, 11 November 2013 Archived 4 March 2016 at the Wayback Machine
- Further information
- Quantum key distribution simulation
- Online Simulation and Analysis Toolkit for Quantum Key Distribution Archived 25 October 2016 at the Wayback Machine
- Quantum cryptography research groups
- Experimental Quantum Cryptography with Entangled Photons
- NIST Quantum Information Networks
- Free Space Quantum Cryptography
- Experimental Continuous Variable QKD, MPL Erlangen
- Experimental Quantum Hacking, MPL Erlangen
- Quantum cryptography lab. Pljonkin A.P.
- Companies selling quantum devices for cryptography
- AUREA Technology sells the optical building blocks for Quantum cryptography
- id Quantique sells Quantum Key Distribution products
- MagiQ Technologies sells quantum devices for cryptography
- QuintessenceLabs Solutions based on continuous wave lasers
- SeQureNet sells Quantum Key Distribution products using continuous-variables
- Companies with quantum cryptography research programmes