Re: [saag] [Qirg] Security considerations in draft-irtf-qirg-quantum-internet-use-cases-08

[Joseph D Touch <[e-mail]>]

Hi, all,

Besides the quantum issues, it might be important to include all of the classical channel issues with QKD too.

Joe

--
Dr. Joseph Touch
Principal Scientist
Information Systems and Cyber Division
The Aerospace Corporation
424-254-4357 cell


From: Qirg <[e-mail]> on behalf of John Mattsson <john.mattsson=[e-mail]>
Date: Saturday, February 12, 2022 at 4:37 AM
To: "[e-mail]" <[e-mail]>
Cc: "[e-mail]" <[e-mail]>, saag <[e-mail]>
Subject: [Qirg] Security considerations in draft-irtf-qirg-quantum-internet-use-cases-08

Hi,

I think this document is progressing nicely, but the security considerations are severely lacking. I don't think the document can be published without additions to the security considerations. The document mostly focuses on that fact that QKD is information-theoretically secure but misses a lot of practical security weaknesses. Only relying on QKD would catastrophically decrease the security of modern networks and augmenting modern networks with QKD does not make a significant difference.

I think the security consideration has to mention zero-trust as well as referring to the very good overviews given in [3][4][5].

Suggested text:

"
Modern networks are implemented with zero trust principles where classical cryptography is used for confidentiality, integrity protection, and authentication on many of the logical layers of the network stack, often all the way from device to software in the cloud [1]. The cryptographic solutions in use today are based on well-understood primitives, provably secure protocols and state-of-the-art implementations that are secure against a variety of side-channel attacks.

In contrast to conventional cryptography and PQC, the security of QKD is inherently tied to the physical layer, which makes the threat surfaces of QKD and conventional cryptography quite different. QKD implementations have already been subjected to publicized attacks [2] and the NSA notes that the risk profile of conventional cryptography is better understood [3]. The fact that conventional cryptography and PQC are implemented at a higher layer than the physical one means PQC can be used to securely send protected information through untrusted relays. This is in stark contrast with QKD, which relies on hop-by-hop security between intermediate trusted nodes. The PQC approach is better aligned with the modern technology environment, in which more applications are moving toward end-to-end security and zero-trust principles. It is also important to note that while PQC can be deployed as a software update, QKD requires new hardware.

Regarding QKD implementation details, the NSA states that communication needs and security requirements physically conflict in QKD and that the engineering required to balance them has extremely low tolerance for error. While conventional cryptography can be implemented in hardware in some cases for performance or other reasons, QKD is inherently tied to hardware. The NSA points out that this makes QKD less flexible with regard to upgrades or security patches. As QKD is fundamentally a point-to-point protocol, the NSA also notes that QKD networks often require the use of trusted relays, which increases the security risk from insider threats.

The UK’s National Cyber Security Centre cautions against reliance on QKD, especially in critical national infrastructure sectors, and suggests that PQC as standardized by the NIST is a better solution [4]. Meanwhile, the National Cybersecurity Agency of France has decided that QKD could be considered as a defense-in-depth measure complementing conventional cryptography, as long as the cost incurred does not adversely affect the mitigation of current threats to IT systems [5].
"

[1]  NIST, Zero Trust Architecture, August 2020
[2] Physical Review A 78, Experimental demonstration of time-shift attack against practical quantum key distribution systems, October 28, 2008, Zhao, Y.; Fung, C.; Qi, B.; Chen, C.; Lo, H.
[3] NSA, Post-Quantum Cybersecurity Resources
[4] National Cyber Security Centre, Quantum security technologies, March, 2020
[5] ANNSI, Should quantum key distribution be used for secure communications?, May 2020