[Qirg] Re: questions about QKD

[John Mattsson <[e-mail]>]

Thanks Rod!

I think this is a very good summary. I think wide-area, multipurpose, generally entangled quantum networks will be useful to connect quantum computers and quantum sensors. Except some very niche military use cases where QKD could serve as a defense-in-depth for ML-KEM, Classic McEliece, or FrodoKEM, it is hard to see practical use for QKD even if the problems you list are solved. As a person how studied physics and then switched to computer science, I am very disappointed in a lot of quantum people making public statements about QKD as practical security. Relying on current QKD systems would be very dangerous security wise.

One comment:
"because the problem it solves -- generating shared random or near-random bits secure enough to be used as encryption keys"

While quantum researchers think QKD solves that problem, I don't think this is correct. It is well-established security practice to never use TRNG output directly and I don't think that will ever change. QKD is providing unauthenticated key exchange. If QKD is ever practically used, the output (secret entropy) of QKD would be input to a classical KDF/CSPRNG. The output from the KDF/CSPRNG would be used in an AEAD with information-theoretic or computational-theoretic security. See e.g., BSI TR-02102-1 [1]:  "Irrespective of this, the BSI does not and will not recommend the use of the one-time pad alone with keys obtained via QKD or via other key agreement mechanisms in the future."

https://www.bsi.bund.de/SharedDocs/Downloads/EN/BSI/Publications/TechGuidelines/TG02102/BSI-TR-02102-1.pdf?__blob=publicationFile&v=7

Cheers,
John Preuß Mattsson

From: Rod Van Meter <rdv=[e-mail]>
Date: Tuesday, 4 June 2024 at 07:41
To: [e-mail] <[e-mail]>
Subject: [Qirg] questions about QKD

After months of QIRG mostly being quiet, my apologies for several emails in a hour, but forgot to mention this one...

QIRG is *NOT* primarily about quantum key distribution (QKD), it is more about wide-area, multipurpose, generally entangled quantum networks, but QKD does of course come up. I recently had a good discussion with a visitor about what it means to work on QKD as a researcher these days, and we wound up writing on the whiteboard, coming up with a list of questions/research topics. This is on my blog at
https://rdvlivefromtokyo.blogspot.com/2024/05/questions-about-qkd.html
but I think it's short enough to be worth quoting here in full:

I think quantum key distribution is fascinating, but unlikely by itself to serve as reason enough to build a Quantum Internet. Keeping in mind that I am not directly a QKD researcher, in my opinion there are several major hurdles limiting adoption of QKD today:
·                     Range of QKD is limited (until we build a multihop, long-distance network).
·                     Boxes are expensive, not robust, and require a lot of operational expertise.
·                     Attacking QKD deployments is trivial; it's designed to detect eavesdroppers, so by its very nature acting as an eavesdropper is equivalent to launching a DDoS attack.
·                     Interoperability, standards and global operational confidence are still works in progress.
·                     Market pull is still limited, because the problem it solves -- generating shared random or near-random bits secure enough to be used as encryption keys -- still isn't tops on the list of pain points for Chief Security Officers, AND there is a classical solution in the offing (PQC) that requires "only" software and protocols, no new hardware.
·                     Latency to start up a connection is orders of magnitude too high to be useful at the e.g. HTTPS level, so it has at best a specific and limited role in systems, e.g. like network-to-network IPSec tunnels.
With that in mind, I recently had a discussion with a QKD researcher about how to evaluate new ideas in the area. We came up with about thirteen questions/concerns/metrics answering the question, "What do we want to improve?":
1.            Steady-state key generation rate
2.            Robustness against noise
3.            Fraction of raw resources dedicated to detecting an eavesdropper
4.            Robustness against some known attack (e.g., detector blinding or entangling with qubits)
5.            Required classical communication bandwidth/latency
6.            Simplicity of quantum hardware implementation
7.            Startup time
8.            Preconditions (e.g., pre-shared key for authentication)
9.            Classical resources required, esp. randomness
10.          Ease of integration into classical security systems
11.          Ability to use in a heterogeneous quantum network environment (e.g., full end nodes with memory v. measurement-only end nodes)
12.          Demands on or benefits to quantum network operations (e.g., link tomography or network routing)
13.          Extension to multi-party protocols
Simply playing with ideas, such as "I found this cool thing while looking at quantum graph states...", is great, and important, and that's where highly original stuff comes from. But if you bring me an idea, I'm pretty likely going to ask which of the above things it improves, or if you think it has value for some additional reason.

--Rod