A Working, Quantum-Encrypted Intranet

192939495969798999 writes "This article points out how BBN, developers of ARPANET, have actually created a quantum-encrypted intranet that serves pages to a small group of research scientists. I firmly believe this is as significant as the very first internet transmission some years back. If the technology is working and 100% secure, how long until it makes its way at least into government websites? This might be the end of the hacked by Chinese index pages!" Reader Kent adds "A New York based company, MagiQ Technologies, has begun selling units for commercial use while a group in Europe recently made the first quantum encrypted bank transaction in Vienna, Austria - April 2004. But the Boston network - though limited to three locations - is believed to be the first Internet-integrated system that runs continuously between multiple distant locations."

Comments

common logical fallacy

[Anonymous Coward]

If the technology is working and 100% secure, how long until it makes its way at least into government websites? This might be the end of the hacked by Chinese index pages!

Just because a computer uses encryption, doesn't mean that it is unhackable.

Re:common logical fallacy

[ThomaMelas]

Not really. But it will show if it's been viewed or tampered with, so you can declare the transmission null and void.

Re:common logical fallacy

[evslin]

"Make something idiot-proof and they'll build a better idiot."

Beam me to my computer

[Anonymous Coward]

BAH! , Until they have me beaming back and forth from my bed to my computer I'm not giving quantum computing a dime.

FP?

[hackronym0]

I just wanted to pose the question, how can you prove that it has not been tampered with? You can't measure anything without changing the state, right? So you shouldn't really be able to prove that its secure either. Anyone else think that this is BS?

Re:FP?

[i_should_be_working]

it's the key to the encryption that they have to make sure isn't tampered with or eavesdropped on. say the key is 100 bits long. after the transmission of the key, the sender and reciever compare, say, 50 of these bits publicly. if the receiver's bits are different than the sender's they know someone has tampered with it (since any measurement by an outsider will alter the state) and they throw that key away. if they are exactly the same, they know no one listened in and they can use the other 50 bits as the actual key.
they send the encrypted data only after they are sure no one else has the key.

Re:FP?

[Silverlancer]

Its because of how quantum encryption works. Basically, I'll make an explanation here for everyone. We'll have two computers, Alice and Bob. Alice sends a bunch of *RANDOMLY* polarized photons, each polarized RANDOMLY with one of two polarizers--up-down, or diagonal. So you could have one of the following four photons: / \ | --

Bob at the other end RANDOMLY switches between filters, and thus gets only about 3/4 of the photons right (this is a little long and thus I won't do the math here). So he reads off, over an insecure line, which filters he used when. Alice tells him when he was right and when he was wrong. The series of bits that he got right will be used for a one time pad cipher. However, Eve, the evesdropper, can't get the one-time pad! Why? Because she and Bob will have used a different sequence of polarizers, and thus she would have gotten some of the one-time pad wrong. Plus, when Eve measured any photon along the line, it would change its polarization, so therefore before doing the encrypted transmission, Alice could send a portion of the one-time pad to Bob. If any of it changed, then obviously Eve was on the line.

Re:FP?

[radamson]

You can measure _some_ in quantum mechanics things without changing them, and that's the way these systems work. If I send you a horizontally polarized photon then if you measure it along the horizontal direction you won't change its state, but if you measure along any other direction you will. These systems work by the receiver measuring in one of two possible directions selected at random. The receiver and the sender then tell each other what direction the measurements were done so that they can decide what information is valid and what isn't.

An eavesdropper will inevitably destroy some of the valid information which will introduce noise into the sent signal. The sender and receiver can detect this noise and deduce that they are being eavesdropped on.

Incidentally, the security of the most common scheme has been proven mathematically by Shor and Preskill.

Re:FP?

[BondHeadGuy]

Well, yes, but it's like exception handling vs. error codes: using exceptions doesn't get rid of the error handling problem, but at least they ensure that things can't fail silently. Presumably the two parties do not want to use the line at all if it has been tapped. Better a DOS than a leak of confidential information.

Re:FP?

[eegad]

Bob was sent to the store by Alice for polarized one-time pads but as usual he came back with the wrong filter. She should have just sent Eve to begin with.

Re:FP?

[NoData]

I have a question regarding this. It sounds like quantum encryption requires a direct optical connection between the sender and receiver. Is it theoretically possible make it "routable?" That is to say, would it be usable in the post office type model the internet uses, where packets have to be inspected (and, thus presumably destroying the message in a quantum transmission) to determine where they're going, or would a completely new model need to be developed?

Encryption != Security

[leerpm]

If the technology is working and 100% secure, how long until it makes its way at least into government websites? This might be the end of the hacked by Chinese index pages!"

Just because the network and all of the transmissions are encrypted, doesn't mean the server is secure. Having IIS running HTTPS exclusively doesn't mean you don't have to patch it.

What?!

[Manip]

How will this stop worms or web-sites getting 'hacked'? It isn't even designed to! It is designed to stop sniffing or the modification of data while it is on the pipe. I think the poster needs get a clue.

Re:What?!

[xyzzy]

That would require the slashdot editorial staff to actually a) read the article they're posting about, and b) understand said article.

Makes quantum networking look easy, no?

Re:Impressive...

[watanabe]

hopefully the 'human' factor is addressed. You know, passwords like 'password' or the person's initials. The weakest link in the chain has always been the humans...well, save for that time in the 2001 movie, but I digress.

Actually, you have literally no idea of how a quantum encrypted network works. What's interesting about the quantum encrypted network is not whether it keeps password cracking from L33T hackers, but how it makes sniffing along the connection either impossible, or impossible without being noticeable, depending on the implementation.

Excellent ..

[ReidMaynard]

Tonight I'm adding "Quantum Network Engineer" to my resume...

Re:Excellent ..

[nkh]

I prefer: Engineer with 20 years of experience in quantum encryption (I'm sorry if you don't get this rather cryptic joke...)

The EU too!

[tcd004]

Don't miss this bit on how the EU is planning to use Quantum Crypto to subert and avoid the U.S.'s rampant digital espionage.

tcd004

Does this mean Google will need to switch...

[scotay]

...from pigeon-based indexing to using cats?

QC is not an encryption tech

[po8]

This might be the end of the hacked by Chinese index pages!

Uh, no. Quantum communication is not magic. (OK, maybe, but not that kind of magic.) What it is, is perfectly secure against physical eavesdropping. An attacker can't "tap the wire", as it were. The name "quantum encryption" is something of a misnomer, though: this technology is just a communication channel, albeit an uber-cool one.

100% secure - but the transport medium only

[Anonymous Coward]

this doestn mean that a buggy iis connected to the quantum network will be any more secure if it would be connected by rj45 or fibre ethernet.

this means only, that man-in-the-middle attack cant be done, or data during the flow cant be altered without recognization.

this is just a new transport media but not making the services and clients at both ends any more secure.

think of this as an ssl/ssh/vpn replacement.

if you have bugs in the rest of your software/hardware ssl/ssh/vpn/quantum cant help either.

nuff said

It's gotta be said:

[El_Smack]

So that's what Al Gore has been up to!

Re:100% secure?

[maxwell demon]

nothing is 100% secure.

Where do I get this nothing stuff?

Re:Yess!

[idontgno]

Quantum Encrypted Pr0n Surfing!

Hmm...Beyond the index page, Natalie Portman exists in a superposition of having and not having hot grits in her pants...until you click "ENTER"...

quantum: viewing changes Data..

[rockclimber]

Now I understand! when word was randomly messing up my settings and files, it was because I was viewing them.

so it WAS a feature, not a bug.

who d'have thunk that MS had such advanced SECURITY tech... :-)

A Good Thread About Quantum Crypto

[bahamutirc]

There was a good discussion about quantum crypto on The Cryptography Mailing List last month.

Perhaps a more accurate characterization...

[rpdillon]

While quantum cryptography is, depending on implementation, not hackable, that doesn't account for all the other parts of the system. Bascially, quantum cryptography protects the data in transit, but does nothing to protect the machines its being sent to/from, and certainly doesn't address issues like storage of the data.

Further, what it secure? Not being altered by unauthorized parties (webpages need this), or not being read by unauthorzied parties (goverments need this) or somewhere in between (can't be read without the sender/receiver being notified)?

Security may well be one of the most misunderstood topics, with quantum physics just above it... =)

Re:No such thing...

[lukewarmfusion]

They know that. Of course, you're going to have to explain it to a client one day and realize that when the client hears "it's not 100% secure," they will start looking for something that is. When some PR guy comes along and claims it's 100% secure, we snicker and the PR guy wins the project and gets a Porsche.

I've spent a lot of time educating clients regarding the "nature of things" as you described. However, when the client isn't at that level of interest/ability to understand/etc., I simply say "SSL is the same level of encryption that banks and credit card companies rely on . Your data will be safe." Sometimes I also use the "it would take sixty million years or so to brute force the encryption. I doubt you'll be worried about your 2004 data in sixty million years."

How will MS use this technology?

[Trolling4Dollars]

Considering that a secure OS is the purported "holy grail" for MS, how do you suppose they will utilize this technology? Let's think about how they integrated the TCP/IP and the Internet. Initially, they "had a better idea" in the forms of NetBEUI and the MSN service (pre-Internet proprietary service). Eventually they "got religion" and started using TCP/IP (albeit a little funky) and real Internet service instead of prepackaged proprietary content. So... with that history, can we expect MS to say, "pah! Quantum Encryption? We have something better". They roll out their "anti-matter encryption with 1 gigqbit strength" and then they start having problems with crackers starting DoE (denial of existence) attacks on remote computers by causing anti-matter overloads. Several hundred thousand deaths later, they "innovate" their own approach to quantum encryption and "save the day". Of course after that all of reality melts away in a wash of windows logos when a quantum worm gets released and all those entangled quanta fizzle apart the space time continuum. So... did MS create the big bang meta-retroactively? ;P

Re:Live/Dead Cat Powered Router...

[maxwell demon]

Recall: The routers of type l/d cat XY have a defect which causes an uncertainty relation between destination IP and destination port. That is, if you know exactly to which IP the packet should be routed, the port is completely unknown and vice versa.

Infrastructure for this?

[gravityZ]

Does anyone know what changes are needed to the current fibre infrastructure to support quantum encryption? can you hook two boxes up at either end of a random cable? what about repeaters, etc, interfering with the signal?

Illegal in US?

[raisedbyrobots]

Would the US government really allow a technology that it couldn't eavesdrop?

Re:100% secure?

[Jerf]

Breaking quantum encryption would most likely net you a Nobel Prize in Physics, since it implies breaking QM.

This is indeed a truly new level of encryption. We probably can't say 100%, but breaking quantum encryption is definately a different order of difficulty than breaking conventional encryption.

not a big deal

[eddeye]

Quantum "encryption" is for the most part useless. It's just another way to exchange symmetric keys. The advantages are purely information-theoretic; in the real world, classical methods are just as good and a whole lot cheaper.

It's like replacing a steel deadbolt with titanium, meanwhile the door is still wooden, the hinges are brass, and there's a large window right next to it.

The only uses are extremely high-value applications like banking and the military. Even then I'd spend my money elsewhere.

An impossible claim!

[GMFTatsujin]

I'd say "I'll believe it when I see it," but by seeing the quantum crytography in action, I'd be observing it, and, well...