Re: [saag] Security considerations in draft-irtf-qirg-quantum-internet-use-cases-08

["Hemmert, Tobias" <[e-mail]>]

Dear all,

for your information, adding to the references that have already been provided, I would like to point out two more quite recent publications on QKD security.

The German BSI has recently published an extensive document on the migration to quantum-safe cryptography [1] (unfortunately only available in German at the moment, an English version is in preparation). This also includes a chapter on QKD that points out some of the limitations and discusses security properties of QKD. Sections 4.5 and 4.6 on page 54 contain a concise summary of some of the main points and some recommendations.

Furthermore, the NLNCSA has also recently published recommendations on the quantum threat that also contain a short section on QKD [2].

Maybe these are of interest to you as well.

All best
Tobias

[1] BSI, Kryptografie quantensicher gestalten, December 2021. www.bsi.bund.de/PQ-Migration<http://www.bsi.bund.de/PQ-Migration>
[2] NLNCSA, Prepare for the threat of quantum computers, January 2022. https://english.aivd.nl/publications/publications/2022/01/18/prepare-for-the-threat-of-quantumcomputers


Von: Qirg <[e-mail]> Im Auftrag von Chonggang Wang
Gesendet: Samstag, 12. Februar 2022 13:50
An: John Mattsson <john.mattsson=[e-mail]>rg>; [e-mail]
Cc: [e-mail]; saag <[e-mail]>
Betreff: Re: [Qirg] Security considerations in draft-irtf-qirg-quantum-internet-use-cases-08

Hi John,

Thanks for your feedback. We will incorporate your suggested texts to the next version of this document.

Best regards,
Chonggang

From: Qirg <[e-mail]> On Behalf Of John Mattsson
Sent: Saturday, February 12, 2022 7:36 AM
To: [e-mail]
Cc: [e-mail]; saag <[e-mail]>
Subject: [Qirg] Security considerations in draft-irtf-qirg-quantum-internet-use-cases-08


Hi,

I think this document is progressing nicely, but the security considerations are severely lacking. I don't think the document can be published without additions to the security considerations. The document mostly focuses on that fact that QKD is information-theoretically secure but misses a lot of practical security weaknesses. Only relying on QKD would catastrophically decrease the security of modern networks and augmenting modern networks with QKD does not make a significant difference.

I think the security consideration has to mention zero-trust as well as referring to the very good overviews given in [3][4][5].

Suggested text:

"
Modern networks are implemented with zero trust principles where classical cryptography is used for confidentiality, integrity protection, and authentication on many of the logical layers of the network stack, often all the way from device to software in the cloud [1]. The cryptographic solutions in use today are based on well-understood primitives, provably secure protocols and state-of-the-art implementations that are secure against a variety of side-channel attacks.

In contrast to conventional cryptography and PQC, the security of QKD is inherently tied to the physical layer, which makes the threat surfaces of QKD and conventional cryptography quite different. QKD implementations have already been subjected to publicized attacks [2] and the NSA notes that the risk profile of conventional cryptography is better understood [3]. The fact that conventional cryptography and PQC are implemented at a higher layer than the physical one means PQC can be used to securely send protected information through untrusted relays. This is in stark contrast with QKD, which relies on hop-by-hop security between intermediate trusted nodes. The PQC approach is better aligned with the modern technology environment, in which more applications are moving toward end-to-end security and zero-trust principles. It is also important to note that while PQC can be deployed as a software update, QKD requires new hardware.

Regarding QKD implementation details, the NSA states that communication needs and security requirements physically conflict in QKD and that the engineering required to balance them has extremely low tolerance for error. While conventional cryptography can be implemented in hardware in some cases for performance or other reasons, QKD is inherently tied to hardware. The NSA points out that this makes QKD less flexible with regard to upgrades or security patches. As QKD is fundamentally a point-to-point protocol, the NSA also notes that QKD networks often require the use of trusted relays, which increases the security risk from insider threats.

The UK's National Cyber Security Centre cautions against reliance on QKD, especially in critical national infrastructure sectors, and suggests that PQC as standardized by the NIST is a better solution [4]. Meanwhile, the National Cybersecurity Agency of France has decided that QKD could be considered as a defense-in-depth measure complementing conventional cryptography, as long as the cost incurred does not adversely affect the mitigation of current threats to IT systems [5].
"

[1]  NIST, Zero Trust Architecture, August 2020
[2] Physical Review A 78, Experimental demonstration of time-shift attack against practical quantum key distribution systems, October 28, 2008, Zhao, Y.; Fung, C.; Qi, B.; Chen, C.; Lo, H.
[3] NSA, Post-Quantum Cybersecurity Resources
[4] National Cyber Security Centre, Quantum security technologies, March, 2020
[5] ANNSI, Should quantum key distribution be used for secure communications?, May 2020

[Das Bild wurde vom Absender entfernt. Banner]

[Das Bild wurde vom Absender entfernt. Banner]<https://www.interdigital.com/features/sustainability-in-a-wireless-world>

Sustainability in a Wireless World: Research dedicated to understanding the impact of our technologies on the planet.<https://www.interdigital.com/features/sustainability-in-a-wireless-world>

This e-mail is intended only for the use of the individual or entity to which it is addressed, and may contain information that is privileged, confidential and/or otherwise protected from disclosure to anyone other than its intended recipient. Unintended transmission shall not constitute waiver of any privilege or confidentiality obligation. If you received this communication in error, please do not review, copy or distribute it, notify me immediately by email, and delete the original message and any attachments. Unless expressly stated in this e-mail, nothing in this message or any attachment should be construed as a digital or electronic signature.

Java, JavaScript sowie aktive Inhalte wurden aus dieser E-Mail herausgefiltert.