[Qirg] Re: questions about QKD

[Rod Van Meter <[e-mail]>]

On 2024/06/04 15:47, John Mattsson wrote:
>
>
> I think this is a very good summary. I think wide-area, multipurpose, 
> generally entangled quantum networks will be useful to connect quantum 
> computers and quantum sensors.
>
We absolutely, unequivocally have to have networking at the data center 
level in order the scale quantum computers, so agreed.
>
> Except some very niche military use cases where QKD could serve as a 
> defense-in-depth for ML-KEM, Classic McEliece, or FrodoKEM, it is hard 
> to see practical use for QKD even if the problems you list are solved.
>
I'm old enough to have been wrong about potential uses for technologies, 
so I'm a little more cautious about it, but by and large I agree; use 
cases for QKD are likely pretty narrowly defined.

> As a person how studied physics and then switched to computer science, 
> I am very disappointed in a lot of quantum people making public 
> statements about QKD as practical security.
>
I think rather than deliberately disingenuous statements the problem is 
that the QKD community has too few serious security people (like you). I 
will say (just among us...er, well, this will go in the list archives 
for posterity, I suppose...) I have encountered quite a few physicists 
in the last twenty years who are, shall we say, not fully acquainted 
with the breadth and depth of computer science and computer engineering. 
They are EXTREMELY good at what they do, I just wish they paid a little 
more attention to what WE do!

The real forehead-slapper is when someone hacks a given QKD system and 
the response is, "Oh, well, that's just an implementation problem, it's 
still theoretically secure," as if "theoretically secure" or "it would 
have been secure if you had implemented it right" systems aren't one of 
our biggest source of headaches.

> Relying on current QKD systems would be very dangerous security wise.
>
Despite what I just said, I think the actual QKD startups that are 
serious *are* trying to work within the crypto/security communities, at 
least as best they can figure out; there is quite a bit over on the ITU 
side.
>
> One comment:
>
> "because the problem it solves -- generating shared random or 
> near-random bits secure enough to be used as encryption keys"
>
> While quantum researchers think QKD solves that problem, I don't think 
> this is correct. It is well-established security practice to never use 
> TRNG output directly and I don't think that will ever change. QKD is 
> providing unauthenticated key exchange. If QKD is ever practically 
> used, the output (secret entropy) of QKD would be input to a classical 
> KDF/CSPRNG. The output from the KDF/CSPRNG would be used in an AEAD 
> with information-theoretic or computational-theoretic security. See 
> e.g., BSI TR-02102-1 [1]:  "Irrespective of this, the BSI does not and 
> will not recommend the use of the one-time pad alone with keys 
> obtained via QKD or via other key agreement mechanisms in the future."
>
Thanks for all that! Noted and updated on the blog.
>
> https://www.bsi.bund.de/SharedDocs/Downloads/EN/BSI/Publications/TechGuidelines/TG02102/BSI-TR-02102-1.pdf?__blob=publicationFile&v=7
>