[Qirg] Re: questions about QKD

["Chung, Joaquin" <[e-mail]>]

I have a very naive question. Can QKD tell me with certainty that the channel is being eavedropped? Can it differentiate between a squirrel eating a fiber vs. a spy cutting it?

Regards,

Joaquin
________________________________
From: Rod Van Meter <rdv=[e-mail]>
Sent: Tuesday, June 4, 2024 2:59 AM
To: John Mattsson <john.mattsson=[e-mail]>; [e-mail] <[e-mail]>
Subject: [Qirg] Re: questions about QKD

On 2024/06/04 15: 47, John Mattsson wrote:   I think this is a very good summary. I think wide-area, multipurpose, generally entangled quantum networks will be useful to connect quantum computers and quantum sensors. We absolutely, unequivocally
ZjQcmQRYFpfptBannerStart
This Message Is From an External Sender
This message came from outside your organization.

ZjQcmQRYFpfptBannerEnd


On 2024/06/04 15:47, John Mattsson wrote:




I think this is a very good summary. I think wide-area, multipurpose, generally entangled quantum networks will be useful to connect quantum computers and quantum sensors.

We absolutely, unequivocally have to have networking at the data center level in order the scale quantum computers, so agreed.

Except some very niche military use cases where QKD could serve as a defense-in-depth for ML-KEM, Classic McEliece, or FrodoKEM, it is hard to see practical use for QKD even if the problems you list are solved.

I'm old enough to have been wrong about potential uses for technologies, so I'm a little more cautious about it, but by and large I agree; use cases for QKD are likely pretty narrowly defined.

As a person how studied physics and then switched to computer science, I am very disappointed in a lot of quantum people making public statements about QKD as practical security.

I think rather than deliberately disingenuous statements the problem is that the QKD community has too few serious security people (like you). I will say (just among us...er, well, this will go in the list archives for posterity, I suppose...) I have encountered quite a few physicists in the last twenty years who are, shall we say, not fully acquainted with the breadth and depth of computer science and computer engineering. They are EXTREMELY good at what they do, I just wish they paid a little more attention to what WE do!

The real forehead-slapper is when someone hacks a given QKD system and the response is, "Oh, well, that's just an implementation problem, it's still theoretically secure," as if "theoretically secure" or "it would have been secure if you had implemented it right" systems aren't one of our biggest source of headaches.

Relying on current QKD systems would be very dangerous security wise.

Despite what I just said, I think the actual QKD startups that are serious *are* trying to work within the crypto/security communities, at least as best they can figure out; there is quite a bit over on the ITU side.



One comment:

"because the problem it solves -- generating shared random or near-random bits secure enough to be used as encryption keys"



While quantum researchers think QKD solves that problem, I don't think this is correct. It is well-established security practice to never use TRNG output directly and I don't think that will ever change. QKD is providing unauthenticated key exchange. If QKD is ever practically used, the output (secret entropy) of QKD would be input to a classical KDF/CSPRNG. The output from the KDF/CSPRNG would be used in an AEAD with information-theoretic or computational-theoretic security. See e.g., BSI TR-02102-1 [1]:  "Irrespective of this, the BSI does not and will not recommend the use of the one-time pad alone with keys obtained via QKD or via other key agreement mechanisms in the future."

Thanks for all that! Noted and updated on the blog.



https://www.bsi.bund.de/SharedDocs/Downloads/EN/BSI/Publications/TechGuidelines/TG02102/BSI-TR-02102-1.pdf?__blob=publicationFile&v=7<https://urldefense.us/v3/__https://www.bsi.bund.de/SharedDocs/Downloads/EN/BSI/Publications/TechGuidelines/TG02102/BSI-TR-02102-1.pdf?__blob=publicationFile&v=7__;!!G_uCfscf7eWS!YDYr93hxH-ZH4PxNdGMvbvujzcderWBfNEDYLRHPDyMQJNFE2Qb7cPKzcqhF4zizBciL3u-cm1gP1aFXoOeaeAIhEMMuCRFWjw$>