Re: [Qirg] QKD in OpenSSL

[Bruno Rijsman <[e-mail]>]

Hi Diego,

Having heard your comments at the mike at the QIRG session in Singapore, I think I have a better appreciation of the point you are making.

Yes, we need to be very careful that we don't assume that the experiences and instincts (gut feelings) that we have as classical network engineers necessarily translate well to quantum networks.

In this specific case, we as classical network engineers have gotten used to the fact of life that we must assume that all traffic is being monitored, copied, and possibly even stored as the traffic transits the network.

Service and content providers are analyzing traffic for advertising purposes. And governments are analyzing traffic for law enforcement purposes.

Thus, we build our protocols (e.g. Diffie-Hellman) in such a manner that it is okay if the traffic is being monitored. The party that does the monitoring will not be able to learn anything from the monitoring (unless they have access to a quantum computer).

Furthermore, we (correctly) assume that it is *physically possible* to tap and monitor a classical link without the communicating parties being aware or affected.

Because of this "baggage of classical intuition" we classical network engineers feel very nervous about the fact that merely tapping and monitoring a quantum link in itself and by itself is already a DOS attack because it causes the tapped communication to be invalidated (e.g. the key exchange to be aborted).

Rather than thinking of this as a defect of quantum networks, it may be an example of our classical intuition not serving us well.

In fact, we should think of it as a benefit of quantum networks. The point is that tapping and monitoring a quantum link is physically impossible, due to the very fundamental laws of quantum physics. So, with quantum networks we will never end up in the situation that service providers and governments will be pervasively observing all traffic on the network. Our "classical paranoia" for this situation will no longer be needed.

And, yes, it is still true the very fact of attempting to monitor a quantum link is in itself any by itself already a DOS attack. But you are very correct to point out that this requires physical access to the link, in which case cutting the link is a much cheaper attack.

In classical networks, the eavesdropper chooses to monitor rather than to cut the link because (a) monitoring is physically possible and relatively inexpensive and (b) the eavesdropper is more interesting in learning some information rather than initiating a DOS attack. In quantum networks neither (a) nor (b) are possible.

-- Bruno


> On Nov 18, 2019, at 10:34 AM, Diego R. Lopez <[e-mail]> wrote:
> 
> Hi Bruno,
>  
> It looks I’m becoming the “physical argument” guy in the group, but the fact is that QKD (and I guess quantum communication at large) has to do with physical effects, and we have not achieved (not sure if we eve would) the levels of abstraction and virtualization we see in classical digital environments. So observation in QKD implies physical access, and therefore the capacity of direct physical interference. And, FWIW,  cutting a fiber is always cheaper than any quantum-level observations…
>  
> Be goode,
>  
> --
> "Esta vez no fallaremos, Doctor Infierno"
>  
> Dr Diego R. Lopez
> Telefonica I+D
> https://www.linkedin.com/in/dr2lopez/ <https://www.linkedin.com/in/dr2lopez/> 
>  
> e-mail: [e-mail] <mailto:[e-mail]>
> Tel:         [phone]
> Mobile:  [phone]
> ----------------------------------
>  
> On 18/11/2019, 15:08, "Qirg on behalf of Bruno Rijsman" <[e-mail] <mailto:[e-mail]> on behalf of [e-mail] <mailto:[e-mail]>> wrote:
>  
> Yes, this is something that has always bothered me about QKD.
>  
> In classical key exchange (e.g. Diffie-Hellman), if an eavesdropper Eve passively observes a key exchange (e.g. by passively tapping a fiber), then Alice and Bob neither need to know nor care that Eve is doing that. Alice and Bob can just use the key “knowing” that Eve (if she is present) cannot determine the shared key by just observing the key exchange (assuming Eve doesn’t have a quantum computer).
>  
> But in QKD, if Eve passively observes the key exchange, then Alice and Bob will detect that Eve has “observed" the key exchange and by doing so Eve has invalidated the key exchange. Hence, Alice and Bob cannot use the shared key and must start over or fall back to classical key exchange, just because Eve was there “observing" the key exchange.
>  
> Just as you say, just “passively observing” a fiber constitutes a Denial-of-Service attack.
>  
> Of course, the terminology “passively observing” is kind of meaningless in quantum mechanics, because observing = interfering. 
>  
> But still, this bothered me a lot, and made me feel that QKD is more “vulnerable” than classical key exchange to DoS attacks.
>  
> The standard defense that I always read in the QKD literature is that if Eve is in a position to passively monitor a link, then she is also in a position to initiate a DoS attack by simply cutting the fiber. So, the argument goes, QKD is no more vulnerable to a DoS attack than classical key exchange.  I am not sure if I agree with that — it does not feel quite right to me.
>  
> — Bruno
> 
> 
>> On Nov 18, 2019, at 7:00 AM, Rodney Van Meter <[e-mail] <mailto:[e-mail]>> wrote:
>>  
>> Very cool. 
>>  
>> You might check out some of the work we did five years ago that never made it to RFC.
>> https://tools.ietf.org/html/draft-nagayama-ipsecme-ipsec-with-qkd-01 <https://tools.ietf.org/html/draft-nagayama-ipsecme-ipsec-with-qkd-01>
>>  
>> One interesting, and controversial, topic is what to do when an eavesdropper *does* interfere with a QKD connection.  It’s a great, and easy, DOS attack.  So, should the rekeying stop, and the connection depending on the rekeying be killed when the key lifetime expires?  Or should there be a fallback mechanism of potentially lower security?
>>  
>> This is more of an issue for IPsec, which has rekeying and explicit lifetimes, than for SSL.
>>  
>> Rodney Van Meter
>> Professor, Faculty of Environment and Information Studies
>> Keio University, Japan
>> [e-mail] <mailto:[e-mail]>
>>  
>>  
>> 
>> 
>>> On Nov 13, 2019, at 21:47, Bruno Rijsman <[e-mail] <mailto:[e-mail]>> wrote:
>>>  
>>> For those interested, I just posted a report on how we added support for Quantum Key Distribution (QKD) to OpenSSL during the RIPE Pan-European Hackathon at QuTech last week. 
>>>  
>>> http://bit.ly/openssl-qkd <http://bit.ly/openssl-qkd>
>>>  
>>> — Bruno
>>> _______________________________________________
>>> Qirg mailing list
>>> [e-mail] <mailto:[e-mail]>
>>> https://www.irtf.org/mailman/listinfo/qirg <https://www.irtf.org/mailman/listinfo/qirg>
>>  
> 
>  
> 
> 
> Este mensaje y sus adjuntos se dirigen exclusivamente a su destinatario, puede contener información privilegiada o confidencial y es para uso exclusivo de la persona o entidad de destino. Si no es usted. el destinatario indicado, queda notificado de que la lectura, utilización, divulgación y/o copia sin autorización puede estar prohibida en virtud de la legislación vigente. Si ha recibido este mensaje por error, le rogamos que nos lo comunique inmediatamente por esta misma vía y proceda a su destrucción.
> 
> The information contained in this transmission is privileged and confidential information intended only for the use of the individual or entity named above. If the reader of this message is not the intended recipient, you are hereby notified that any dissemination, distribution or copying of this communication is strictly prohibited. If you have received this transmission in error, do not read it. Please immediately reply to the sender that you have received this communication in error and then delete it.
> 
> Esta mensagem e seus anexos se dirigem exclusivamente ao seu destinatário, pode conter informação privilegiada ou confidencial e é para uso exclusivo da pessoa ou entidade de destino. Se não é vossa senhoria o destinatário indicado, fica notificado de que a leitura, utilização, divulgação e/ou cópia sem autorização pode estar proibida em virtude da legislação vigente. Se recebeu esta mensagem por erro, rogamos-lhe que nos o comunique imediatamente por esta mesma via e proceda a sua destruição