Slashdot Mirror
Secure Video Conferencing via Quantum Cryptography
Roland Piquepaille writes "If you use a webcam to talk with your mom, this tool is not for you. But if you're working for a company and that you have to routinely discuss about sensitive future projects or the possible acquisition of another company, you need more security, and this new video conferencing system based on quantum cryptography is a tool you need. According to this article from Nature, researchers from Toshiba have developed a system which can generate 100 quantum 'keys' every second, fast enough to protect every frame in a video exchange. This technology, which today is working over a distance of about 120 kilometers, could become commercially available within two years at an initial cost of $20,000. This overview contains more details and references."
Maybe this "tool" isn't for having a chat with mom, but if you plan on making a Star Wars like lightsaber duel with a broom, make sure to use this.
Secure Video Conferencing via Quantum Cryptography
If you use a webcam to talk with your mom, this tool is not for you. But if you're working for a company and that you have to routinely discuss about sensitive future projects or the possible acquisition of another company, you need more security, and this new video conferencing system based on quantum cryptography is a tool you need. According to this article from Nature, researchers from Toshiba have developed a system which can generate 100 quantum 'keys' every second, fast enough to protect every frame in a video exchange. This technology, which today is working over a distance of about 120 kilometers, could become commercially available within two years at an initial cost of $20,000. Read more...
Here is the introduction from Nature.
Of course, today's videoconferencing tools using conventional encryption are already pretty secure. But if the NSA wants to check your conversation, I betit can. With quantum cryptography, this is a different story.
The Quantum Information Group at Toshiba gives more details on this subject on this page about Security from Eavesdropping . Below is a diagram illustrating the concept (Credit: Toshiba's Cambridge Research Laboratory).
The first commercial applications of quantum cryptography are now about one year old. However, this new system offers new levels of performances, according to Nature.
Toshiba has already built a Quantum Cryptography Prot
Does this guy have a day job? Sheesh.
The scientific arms race between rebels and agents continues!
"Old man yells at systemd"
But I guess you could get the best of both worlds, by storing your OTP on Quantum hard disks. Nyuk, nyuk.
I think most of you are aware of the controversy surrounding regular Slashdot article submitter Roland Piquepaille. For those of you who don't know, please allow me to bring forth all the facts. Roland Piquepaille has an online journal (I refuse to use the word "blog") located at http://www.primidi.com/. It is titled "Roland Piquepaille's Technology Trends". It consists almost entirely of content, both text and pictures, taken from reputable news websites and online technical journals. He does give credit to the other websites, but it wasn't always so. Only after many complaints were raised by the Slashdot readership did he start giving credit where credit was due. However, this is not what the controversy is about.
Roland Piquepaille's Technology Trends serves online advertisements through a service called Blogads, located at www.blogads.com. Blogads is not your traditional online advertiser; rather than base payments on click-throughs, Blogads pays a flat fee based on the level of traffic your online journal generates. This way Blogads can guarantee that an advertisement on a particular online journal will reach a particular number of users. So advertisements on high traffic online journals are appropriately more expensive to buy, but the advertisement is guaranteed to be seen by a large amount of people. This, in turn, encourages people like Roland Piquepaille to try their best to increase traffic to their journals in order to increase the going rates for advertisements on their web pages. But advertisers do have some flexibility. Blogads serves two classes of advertisements. The premium ad space that is seen at the top of the web page by all viewers is reserved for "Special Advertisers"; it holds only one advertisement. The secondary ad space is located near the bottom half of the page, so that the user must scroll down the window to see it. This space can contain up to four advertisements and is reserved for regular advertisers, or just "Advertisers".
Before we talk about money, let's talk about the service that Roland Piquepaille provides in his journal. He goes out and looks for interesting articles about new and emerging technologies. He provides a very brief overview of the articles, then copies a few choice paragraphs and the occasional picture from each article and puts them up on his web page. Finally, he adds a minimal amount of original content between the copied-and-pasted text in an effort to make the journal entry coherent and appear to add value to the original articles. Nothing more, nothing less.
Now let's talk about money. Visit BlogAds to check the following facts for yourself. As of today, December XX 2004, the going rate for the premium advertisement space on Roland Piquepaille's Technology Trends is $375 for one month. One of the four standard advertisements costs $150 for one month. So, the maximum advertising space brings in $375 x 1 + $150 x 4 = $975 for one month. Obviously not all $975 will go directly to Roland Piquepaille, as Blogads gets a portion of that as a service fee, but he will receive the majority of it. According to the FAQ, Blogads takes 20%. So Roland Piquepaille gets 80% of $975, a maximum of $780 each month. www.primidi.com is hosted by clara.net (look it up at Network Solutions ). Browsing clara.net's hosting solutions, the most expensive hosting service is their Clarahost Advanced ( link ) priced at £69.99 GBP. This is roughly, at the time of this writing, $130 USD. Assuming Roland Piquepaille pays for the Clarahost Advanced hosting service, he is out $130 leaving him with a maximum net profit of $650 each month. Keeping your website registered with Network Solutions cost $34.99 per year, or about $3 per month. This leaves Roland Piquepaille with $647 each month. He may pay for additional services related to his online journal, but I was unable to find any evidence of this.
All of the above are cold, hard, verifiable facts, except where stated otherwise. Now I will give you my personal opinion
Stop giving Roland free advertising revenue, read it in the parent post instead!
Unless you're Bill Gates.
How long before this in some ways is integrated with those digital projectors in the theaters?
ELOI, ELOI, LAMA SABACHTHANI!?
But you can cheat on your spouse as well!!
Not that the internet has such nefarious uses!
video conferencing.. the politically correct way to say, streaming porn
There are no atheists when recovering from tape backup.
Someone please sign up Paris Hilton for this...or not...nevermind...
New encryption tools are cool, but they only secure the network. The end-terminals (and end-users) are still insecure. Holes in the OS, clicking on the wrong email, etc. can compromise one of the machines. And if either party likes chocolate, then we know that we can get the keys to crypto just by offering a tasty morsel.
Security is only as strong as its weakest link. This invention ensures that the network is not the weakest link. Its a step in the right direction, but other components are still pretty vulnerable.
Two wrongs don't make a right, but three lefts do.
Interesting. Quantum cryptography is supposed to be 'hack proof'. So, why the need for 100 keys per second? One key at the start of the stream should be enough. If your video gets scrambled, it tells you that you have an infrastructure problem, or someone is actively trying to hack into your stream. Either way, continuing the conversation seems kinda moot.
:)
Perhaps this is a 'just because we can' technology which ignores the 'should we?' question. (or, I lack the vision to see how this is useful
eskwayrd = m^2c^4
Now we all get to suffer the bandwidth consequences of the paranoid's video conferencing. The packets screaming over UUNet's backbone will be prohibitive if only a handful (per capita) of streaming video apps used this technology. I guess it would push providers to put OC48's in our neighborhoods though.
For this to be really useful, you would need to be able to send the photons via satellite, something which is hard as the interaction with the environment along the way can destroy the entangled state. This would probably be interpreted the same as eavesdropping, further muddling the water. Physicists are indeed trying to get this to work, but it may take some time.
Physicist, consultant, science communicator
because his "articles" sure read like them, check out a google search on this phrase
This overview contains more details and references
perhaps Roland should spend his time and get a proper job (or perhaps nobody will employ him) and actually contribute something new to the internet instead of just leeching from others hard work.
Slashdot is exhibiting yet another example of hyprocracy, they'll whine about Microsoft "hiring" bloggers to promote products, yet ALL THE WHILE SLASHDOT DOES THE SAME!!! Roland's useless blog is full of plagarism and idiocy, yet since Roland pays off Slashdot to whore his links, SLASHDOT IS AS GUILTY AS MICROSOFT!!!
Yes, offtopic, I know. Moving on.
There are a lot of us here who object to Roland Piquepaille's well-documented practice of using Slashdot to direct readers to his site and thereby generate ad revenue for himself.
Roland Piquepaille contributes none of his own work (it's ALL derivative of others' efforts), and Slashdot is more than willing to sell their readers out to this character.
So the next time a Roland Piquepaille-submitted story comes up, don't read it. Don't post replies. Don't even acknowledge that the story is there.
It's time we send Slashdot the message that we don't like being taken advantage of in this manner.
"Ask not what your country can do for you." --John F. Kennedy
The technology is interesting and promising, but further development is necessary.
A price tag of $20000 is not justifiable over 120km. You can drive that distance in a couple of hours, and that is a) cheaper and b) enables face-to-face interaction.
I wonder whather they are really expecting anyone to buy such a system, or rather they just really want to stir interest on the technology instead.
And all the above is different from Slashdot how?
when are they going to be able to encrypt every packet i send out?
What they are doing here is encrypting each frame with a different key where the key is sent using quantum states so that any eaves dropping will be discovered. Their stated reason is that decrypting each frame is much more difficult than if the entire stream was encrypted with a single key.
Basically what they are saying is their system has several thousand keys instead of just one. But that does not make the underlying transmission any more secure. If it is possible to brute force one key, it is possible to brute force many keys.
All they are doing is making it less pratical to use a brute force attack. I'd classify this as being closer to a "security through obscurity" technique rather than a real advancement.
Now if they sent the entire data stream using quatum bits, that would be something different.
The site that I see showing up in /. over and over again that's just copies of press releases elsewhere on the net is PhysOrg. How much are they getting from /. eyeballs? How many slashleeches are there?
From the article:
Single photons do not split, so if the hacker (Eve) measures the photons on the fibre, they will not reach the intended recipient (Bob).
IIRC, "Oscar" was the traditional (wo)man-in-the-middle. If this new "Eve" is hot, she can have all the photons she wants.
This sig rocks the casbah.
So you are saying that if we don't want to support "Roland", then we must NOT F******* READ IT?
Egads, and does that mean that whoever posted Roland's article in this forum is...evil!
God help us all! First, the evil begins as a URL hyperlinked offsite to a Roland Piquepaille website, then it slowly migrates into the story with little reference offsite, then...
It spreads directly into the slashdot forum!
PARENT POST IS "Roland Piquepaille" concealing his story as a vigilante justice troll! Wait, uhm: worst. troll. ever. yeah, the worst. Who modded up this shit-blogger? Mod that fucker down. It's not Interesting and Insightful. Mod that troll down to the burning flames of Katz.
I don't see this as being really practical for security. So you've got all of this quantum-encrypted video which is infinitely better than an SSH-encrypted stream and you're feeling pretty smug about how unbreakable it is. Meanwhile, the janitor has planted a bug under your desk and is eavesdropping on everything you say. Or someone else hid a pinhole camera in a plant and is recording it all.
While I applaud the research and find the technology cool, I don't think a lack of decent encryption technology is the weakest link with regards to security.
Want to improve your Karma? Instead of "Post Anonymously", try the "Post Humously" option.
This is just spam. He has copied and pasted this form post. As is shown by today's date he used.
But you don't know what Mom and I do over the webcam. She's SO Hot in those fishnet stockings!
Just kidding. I have no mother.
Raise your children as if you were teaching them to raise your grandchildren, because you are.
How dare you IMPLY Longhorn is not secure?
There is nothing really exciting about this other than the overkill usage of quantum cryptography (also called quantum key exchange).
Basically, they are trying to generate enough keys so any succesful breaking of the cipher used gets only one frame of video. The only "exciting" part is they are using quantum cryptography to do this. However, this is like using a sledgehammer to push in a thumb tack - It uses a lot more hardware, and isn't the easiest or best method.
Another way to do this would be to conduct a large number of Diffie-Hellman key exchanges or STS exchanges, (one for each frame), and use the new key for each frame.
Or, even easier, both sides could use identical Linear Feedback Shift Registers to generate the same keys that they need. They cost way less than $20k and since a compromise of the system at either end would destroy the privacy afforded by the quantum encryption, just as secure.
Or, they could exchange one-time pads on a DVD and use the bits on there as the key. If my math is right, then a 4GB CD could hold enough keys for over 1100 hours of video, assuming a 256 bit key and 30 frames/sec. Exchanging 2 or 3 DVDs a year (if that) doesn't seem unreasonable.
None of these methods require a dedicated fiber line connecting the two groups. It can be performed over regular Ethernet if the groups want to. Translation: I can use it to talk to someone more than 120km away.
This isn't to say that some groups wouldn't want quantum security for something - if I was a Swiss bank that made daily transfers of a billion dollars to a German or Italian or French bank, then sure, I should spend the extra couple hundred k for an obscenely secure system.
This also begs the question of why encrypt each frame differently? Since it is VIDEO, then something in the picture is probably important - like a PowerPoint slide or graph or something. Since a presenter usually spends a minute or two on each slide, this means that an attacker would only need to decrypt one out of every 1800 slides (assuming 30 frames/second) to get the information they wanted. I think that it is a good idea to change keys as often as possible, but you have to ask what is the benefit for the added cost/overhead. In this case, I don't think it is very much.
So nice use of the "quantum cryptography" buzzword, but bad application of crypto technology in general.
Reading code is like reading the dictionary - you have to read half of it before you can go back and understand it.
look at the ratings on his comments.
Come on slashdot people -- its obvious that none of us like this parasitic-poster.
Mongrel News all the news that fits and froths
So, maybe I haven't been following the news, but have there been many instances of corporate video conferences being tapped/monitored/etc.?!
... maybe that's just me?
I understand the need to develop these technologies, but at least admit that there isn't any immediate demand besides possibly military applications. I much rather have someone working on securing ChoicePoint, Lexus Nexus, and a few other large data warehousing systems
But if you're working for a company and that you have to routinely discuss about sensitive future projects or the possible acquisition of another company, you need more security, and this new video conferencing system based on quantum cryptography is a tool you need.
Wow.
How can an educated person write garbage like that? I would expect something similar from a 5th grader.
What is secure? Nothing secure today will be secure tomorrow. Jeremy MCSE MCSA CCNA http://www.n2networksolutions.com/ Arizona computer consulting
If you use a webcam to talk with your mom, this tool is not for you.
But if you are the avergae geek, you'll use it anyways to talk to your mom.
Cheers,
RoadkillBunny
Seems the use of VTC with integrated quantum crypto is really very limited in usefulness, due to distance, cost, and required infrastructure. Where I would think it to be most effective, military installations that are in relative close proximity, yet separated by public land, isn't feasible because of lack of NSA approval on the devices (US military only of course).
It is however; very good to see that the industry is recognizing the need for commercially available devices with powerful embedded crypto systems. I can only hope that others follow this lead and begin to incorporate QC into other platforms.
Personally, I would like to see things like quantum crypto enabled network devices (routers & switches), secure network attached storage systems, and providers that sell these truly secure network services.
In addition, does anyone know if the currently available quantum crypto systems will operate over wave division multiplexed systems? If they did, or possible that they will in the future, the applications for QC enabled systems would be almost endless.
Thus generating ad revenue.
Methinks he must be sucking Timothy off...
Why not just use a VPN between to two sites. its a lot cheaper than 20000
Is it just me, or is using currently available teleconference protocols over a VPN just as secure?
That way you could use MSN, iChat, Jabber, whatever over PPTP, IPSec, or whatever floats your boat.
Let me know if I'm way off base here.
Thanks,
Aardwolf
Im dreaming ofa big bndwdth, That can resist the
All the hackers will have to do is make a quantum leap into the past to stop it from ever existing. That's a no brainer.
Quantum cryptography is neat, to be sure, but what happens if the cat dies?
I haven't lost my mind; it's backed up on a CD-R somewhere
I'd like to point out that quantum cryptography (depending on the protocol) does not protect against man in the middle. Unsurprisingly, some guy in Russia already has
a l-loopholes-erlangen-200409/present-attacks-via-op tical-loopholes-erlangen-200409.pdf
done research on this:
http://www.vad1.com/qcr/present-attacks-via-optic
There goes my confidence for quantum cryptography.
Then we know someone has been downloading porn.
I mod down pathetic posts.
While I agree with the thrust of your post, there's one bone I have to pick.
Diffie-Hellman and all other nominal one-way functions haven't been proven secure - it could well be possible that one-way functions don't exist, in which case all security based on them is worthless. Even if OWFs do exist and Diffie-Hellman is one it is still breakable in exponential time, which is vulnerable if quantum computers (or equivalent) are developed, and could potentially be vulnerable to a specially-designed supercomputer. OTOH a functional quantum link is completely eavesdrop-proof when proper protocols are used.
Sure, most people don't have to worry about a secret D-H/OWF inverting algorithm, but for the NSA and some of the other people this is targeted at even that tiny bit of extra security is incredibly valuable.
The amount of money pouring into quantum cryptography almost makes you wonder if the NSA might have found that OWFs do not exist...
With a dash of cronyism to boot. What else could be the reason/cause behind the info contained in the parent post?
Paul Graham describes in rather vivid detail what happens to the media when it is 'seduced' by PR firms. Imagine how threadbare Slashdot would be if you strip away all the PR-oriented news stories here....
This reporter's account proves that big business '0wns' the mass media at large. No wonder people are flocking to blogs for real news and commentary--not PR fodder....
To REALLY try to run away from the "bad guys" who would tremendously enjoy making a couple of extra holes in your head???
I'd guess it can cost much more to SECURELY deliver anything from point A to point B...
Paul B.
Easier. Greater boost to productivity.
And it rhymes.
Just what we need, now even wiretap attempts are going to make it look like the IT guys don't have a clue what they are doing with the network...
I can just see the look of astonishment, $20,000+ later, and Fred in IT still can't get the conference call thingy to work...
Looks like they will have some work on their hands... finding a use that justifies the cost, as well as finding customer's who think spending that kind of money for a phone call is justified. Look at all the companies that are losing customer data? Do you really think they will spend that much on a conference call? Not likely, so what is the real application of this technology? I mean, what application will this eventually end up in? DMCA aware HD broadcasts? Military communications? Its not going to end up in the home pc anytime soon, so what application will pay for the R&D?
Support NYCountryLawyer RIAA vs People
Everytime you want to do a submission to Slashdot, post an MLP story to Kuro5hin.org.
This way, you get your chance to "break" the story first, and there is no cabal of editors to shut you down. If you put in some effort and do full story, you can even be the article that Slashdot itself links to, like the ID story posted the other day.
Well, /. submission FAQ warns about such a thing and asks me not to get pissed but to blame my stars, so I was mentally prepared for this.. but this Ronald unmasking brought an interesting thing..
what if one constantly sees a site like freshnews, would it not increase the probability of a story getting posted.. I mean it has all sites from cnet to techdirt to porn-tech site like madville, you name it they have it..
and then there are tech mags like nature, newscientist and trnmag, which have good articles.. so how can such a situation be tackled? or how does accepting of articles get streamlined and give a fair chance to all? I agree that it also depends upon the way the article is submitted instead of just sending the link and a line..
The company http://www.idquantique.com/ sells the Vectis
I have been studying the literature on quantum computation, quantum teleportation, and quantum cryptography for several years now, and I find it all very fascinating, but I have a serious concern. So far, all tests I have read about have been performed with these two individuals named "Alice" and Bob". This brings up a number of serious problems:
It's certainly nice that quantum cryptography makes it impossible to eavesdrop on the communication. But what about man-in-the-middle attacks? If some attacker can 'cut the wire' and put a device in between the two open ends which forwards traffic between both sides (while copying the data somewhere presumably), this nicely hyped 'crypto' would immediately become useless. And this is of course a realistic scenario, why would you want to use encryption on a line if you're sure nobody can touch it? So, I would say that promoting this thing for 'encryption', and even more so for key exchange, is really foolish.
@_@
I had extended conversations (arguments) with the head of Telecommunications for one of the world's largest Intellectual Property-Holding companies about encrypting communications 12 years ago; they were building IP applications stretching their communications all over Europe as well as the US using a third-party provider.
Only in his Position could you have stated, on the record, that Security was not important and would not be addressed, even with the Terms of Service indicating there was no protection anywhere along the routes.
You know, if you "give away" enough IP, some of it will be found and used competitively against you. Duh.
The data on the disk becomes useless. All you need is a device that can tell you if the disk has been read while in route. Such things cost a lot less than $20k.
FRA: STFU GTFO
Has Jon Johansen broken their cryptography yet? No, give him a few more days then.
You would think this isn't cost effective, but VTC endpoints can easily cost between 2k to 30k per install. With a video bridge costing anywhere between 30k to 500k, a $20k security add-on is pennies in the VTC world.
:::: the insomniac's digest
The other components are not insecure as you suggest. Nearly all serious VTC endpoints run 128 bit AES as standard, they are hardware machines without user-serviceable software, and the code is proprietary to each vendor. Furthermore, you're talking about a field that has more security research and application then any other in the world. Outboard KG and KIV encryption are standard in the defense sector.
There are no worms, viruses or phishing techniques that apply to this discussion.
:::: the insomniac's digest
Idiots.
Who the hell pays these people? This isn't rocket science. The person in the middle just cuts in and runs two "optical ethernet" cards in their system, one in and one out.
What the hell is so hard about that?
I think these people spend too much time in the chemical lab.
Yeah, I can see that...but you're talking about a military application, not your common office campus. This is for DOD, NSA, DHS, CIA, law enforcement, etc...not for a medium-security facility where the janator can plant a bug under the conference table.
:::: the insomniac's digest
Mod parent up please. In contrast to the grandparent he knows what he's talking about (Probably that's why he's not a slashdot member or chose to stay anonymous :P)
can generate 100 quantum 'keys' every second, fast enough to protect every frame in a video exchange.
Hmmm...I was under the impression that I could encrypt however much data I wanted with a single key. There are even schemes which make this rather secure, like say the AES standard.
I'm guessing this is mainly marketed to the clueless that don't understand cryptology.
Quantum security devices are pretty cool though.
Tharkban (It is a signature after all)
If even one quantum key is "unbreakable" in its complete transmission, why not just use it to send a long symmetric password, and just encrypt with that?
--
make install -not war
don't see this as being really practical for security. So you've got all of this quantum-encrypted video which is infinitely better than an SSH-encrypted stream and you're feeling pretty smug about how unbreakable it is. Meanwhile, the janitor has planted a bug under your desk and is eavesdropping on everything you say. Or someone else hid a pinhole camera in a plant and is recording it all.
I disagree. I think it is eminently practical (assuming, of course, the actual hardware is practical). Issues with people and places needing to be secured are as old as the first secret kept between two people.
However, ever since the passenger pigeon or courier mail, the issue of "man in the middle" attacks has been a problem...one that wax seals can no longer prevent thanks to the telegraph, telephone, and modern digital communications. Now, IN ADDITION to endpoint security, we have routine, trivial cracking of en-route communications, something that in the excesses of 20th century law enforcement and other big brotherisms has become so routine as to be encoded into law (requiring telecoms to give George W. Jackboot trivial access to any private conversation on demand). Plugging this hole, making such interceptions of personal communications difficult or impossible, is IMHO a huge plus and a massive improvement over the status quo vis-a-vis personal privacy.
Now, will it ensure perfectly safe communications? No. But at least the police/feds/whoever will have to gain physical access to your property, rather than simply throwing a switch in the main office to listen to your private conversations. This is an improvement for everybody other than flatfoots to lazy to plant a bug while the suspects are out of town...and if it makes their investigations more difficult, well, that's a shame, but frankly, my privacy and freedom are vastly more important than their convinience.
The Future of Human Evolution: Autonomy
Toshiba has basically held up three fingers, and
told NSA/DoD/DHS to "read between the lines".
The USA's Dept. of Commerce is going to have a much
tougher time helping US-based companies to compete
in the world market if this techology becomes mainstream.