Re: [Qirg] QKD in OpenSSL

Yes, this is something that has always bothered me about QKD.

In classical key exchange (e.g. Diffie-Hellman), if an eavesdropper Eve passively observes a key exchange (e.g. by passively tapping a fiber), then Alice and Bob neither need to know nor care that Eve is doing that. Alice and Bob can just use the key “knowing” that Eve (if she is present) cannot determine the shared key by just observing the key exchange (assuming Eve doesn’t have a quantum computer).

But in QKD, if Eve passively observes the key exchange, then Alice and Bob will detect that Eve has “observed" the key exchange and by doing so Eve has invalidated the key exchange. Hence, Alice and Bob cannot use the shared key and must start over or fall back to classical key exchange, just because Eve was there “observing" the key exchange.

Just as you say, just “passively observing” a fiber constitutes a Denial-of-Service attack.

Of course, the terminology “passively observing” is kind of meaningless in quantum mechanics, because observing = interfering. 

But still, this bothered me a lot, and made me feel that QKD is more “vulnerable” than classical key exchange to DoS attacks.

The standard defense that I always read in the QKD literature is that if Eve is in a position to passively monitor a link, then she is also in a position to initiate a DoS attack by simply cutting the fiber. So, the argument goes, QKD is no more vulnerable to a DoS attack than classical key exchange.  I am not sure if I agree with that — it does not feel quite right to me.

— Bruno

> On Nov 18, 2019, at 7:00 AM, Rodney Van Meter <rdv@sfc.wide.ad.jp> wrote:
> 
> Very cool.
> 
> You might check out some of the work we did five years ago that never made it to RFC.
> https://tools.ietf.org/html/draft-nagayama-ipsecme-ipsec-with-qkd-01 <https://tools.ietf.org/html/draft-nagayama-ipsecme-ipsec-with-qkd-01>
> 
> One interesting, and controversial, topic is what to do when an eavesdropper *does* interfere with a QKD connection.  It’s a great, and easy, DOS attack.  So, should the rekeying stop, and the connection depending on the rekeying be killed when the key lifetime expires?  Or should there be a fallback mechanism of potentially lower security?
> 
> This is more of an issue for IPsec, which has rekeying and explicit lifetimes, than for SSL.
> 
> Rodney Van Meter
> Professor, Faculty of Environment and Information Studies
> Keio University, Japan
> rdv@sfc.wide.ad.jp <mailto:rdv@sfc.wide.ad.jp>
> 
> 
> 
>> On Nov 13, 2019, at 21:47, Bruno Rijsman <brunorijsman@gmail.com <mailto:brunorijsman@gmail.com>> wrote:
>> 
>> For those interested, I just posted a report on how we added support for Quantum Key Distribution (QKD) to OpenSSL during the RIPE Pan-European Hackathon at QuTech last week. 
>> 
>> http://bit.ly/openssl-qkd <http://bit.ly/openssl-qkd>
>> 
>> — Bruno
>> _______________________________________________
>> Qirg mailing list
>> Qirg@irtf.org <mailto:Qirg@irtf.org>
>> https://www.irtf.org/mailman/listinfo/qirg
> 