Quantum Cryptography Broken, and Fixed

schliz writes in with research out of Sweden in which researchers showed that, looking at a quantum cryptographic system as a whole, it was possible for an eavesdropper to extract some information about the QC key, thus reducing the security of the overall system. The team then proposed a cheap and simple fix for the problem. "The advanced technology was thought to be unbreakable due to laws of quantum mechanics that state that quantum mechanical objects cannot be observed or manipulated without being disturbed. But a research team at Linköping University in Sweden claim that it is possible for an eavesdropper to [get around the limitations] without being discovered. In a research paper, published in the international engineering journal IEEE Transactions on Information Theory (abstract), the researchers propose a change in the quantum cryptography process that they expect will restore the security of the technology."

Comments

So is the cat dead?

[EmbeddedJanitor]

Quantum stuff is so illogical to us mortals that you'd expect attempting to break it would just make it stronger.

Re:So is the cat dead?

[Tackhead]

> Quantum stuff is so illogical to us mortals that you'd expect attempting to break it would just make it stronger.

Which is precisely what happened.

In a research paper, published in the international engineering journal IEEE Transactions on Information Theory (abstract), the researchers propose a change in the quantum cryptography process that they expect will restore the security of the technology.

By being sufficiently precise about the nature of the insecurity, they changed the probability of its being insecure!

Furthermore, now that we know it's secure again (that is, we've proven it to be secure, effectively computing the probability of insecurity to be precisely zero), we no longer know anything about the nature of the system's security holes again!

That was all supposed to be a lead-up to a Heisenberg Uncertainty Principle joke, but it's actually a pretty good description of how computer security works in even the non-quantum world. The more secure you think your system is, the more likely it is you'll get 0wn3d in some completely unexpected way. The known unknowns aren't the ones you've gotta worry about, and nailing them down doesn't do anything about the unknown unknowns, other than to collapse the joke's waveform into something resembling a Don Rumsfeld speech.

In anything other than a Slashdot quantum crypto discussion, that sort of whiplash-inducing change of joke subjects would be highly improbable. As it stands, I'm going to shift gears a third time and hand it off to Douglas Adams.

Zaphod: Tackhead, is this sort of thing going to happen every time you post using the Infinite Improbability joke drive?
Tackhead: Very probably, I'm afraid.

Re:So is the cat dead?

[NotQuiteReal]

You can increase the complexity by using a tri-state cat.

It can be either alive or dead or both alive and dead.

We call these three states alive, dead and zombie.

There, I hope that sheds some photons on the matter.

Re:So is the cat dead?

[tzanger]

I thought a tri-state cat would be alive, dead and high-impedance.

Re:So is the cat dead?

[Anonymous Coward]

I thought a tri-state cat would be alive, dead and high-impedance.

In lieu of mod points, let the record show that after going through a bunch of Schrodinger or Quantum jokes, the closest I got was this one, because I always thought of "high-impedance" as the TTL way of saying "you don't know, so don't ask, just remember that it's something that is neither 0 nor 1", and the HTML gag was as close as I could get.

Re:So is the cat dead?

[bh_doc]

*sigh* Dude, the whole point of the bi-state cat is that both alive and dead is exactly the state the cat ends up in. It's a superposition until you measure it. That's why it's so bizarre. Schrodinger's cat is a zombie.

Re:So is the cat dead?

[Anonymous Coward]

[get around the limitations]

Why isn't there a HeisenbergCompensator tag?

Re:So is the cat dead?

[Reasonable Radical]

Work it harder make it better do it faster makes us stronger more than ever... Wait sorry, you probably weren't TRYING to make Daft Punk run through my head...

Re:So is the cat dead?

[fahrbot-bot]

I thought a tri-state cat would be alive, dead and high-impedance.

Actually, "high-impedance" is how'd I'd describe the alive state for most cats - yikes!

Re:So is the cat dead?

[Thanshin]

The tri-state cat should be alive, dead or dog.

Re:So is the cat dead?

[Anonymous Coward]

They only become high-impedence when you try to put them in a box that they can brace themselves on the sides of.

Re:So is the cat dead?

[evanbd]

To quote one of my favorite games:

The cat looks up at you and, noticing a certain hungry gleam in your eye that it doesn't like one bit, jumps from the divan and hides in a box under the coffee-table. Just before the lid clicks shut, you see a tiny pendulum inside, and wonder if the cat's going to be alive for much longer. You reason that, since the cat could be either alive or dead, and you can't know which without opening the box, then therefore the cat must be both alive and dead -- or in other words, undead. That must be what funerals are for -- so that everyone knows for certain that the person going into the coffin is definitely dead, and you don't have to worry about quantum uncertainty causing zombies to burst out of the ground.

Re:So is the cat dead?

[Anonymous Coward]

$ cat /dev/voodoo ... [Alt-F2]
$ ps xa|grep cat
  3984 tty1 Z 0:00 cat

Opps. My cat is in quantum state

Re:So is the cat dead?

[Daimanta]

More like alive and terrified, alive and not terrified or dead. And do NOT combine dead and terrified, or you'd have a scared zombie cat.

Re:So is the cat dead?

[SEWilco]

Did someone actually see quantum cryptography while it was broken? If it was not observed, was it ever broken?

Re:So is the cat dead?

[Linker3000]

I'd ROT13 the cat too, just to be sure

Re:So is the cat dead?

[caveman]

There is yet another state that the cat can be in, as alluded to in 'Lords and Ladies' by Terry Pratchett..

From Wikipedia:

Greebo had spent an irritating two minutes in that box. Technically, a cat locked in a box may be alive or it may be dead. You never know until you look. In fact, the mere act of opening the box will determine the state of the cat, although in this case there were three determinate states the cat could be in: these being Alive, Dead, and Bloody Furious.

Shawn dived sideways as Greebo went off like a Claymore mine.

"Don't worry about him," said Magrat dreamily, as the elf flailed at the maddened cat. "He's just a big softy."

Re:So is the cat dead?

[Viperpete]

Referring to your signature: But how many cubits per epoch can you go?

Wah?

[Anonymous Coward]

Again in English please?

Re:Wah?

[mrbluze]

The advanced technology was thought to be unbreakable due to laws of quantum mechanics that state that quantum mechanical objects cannot be observed or manipulated without being disturbed.

Well the worst thing about an encrypted stream is that you trust it, not really knowing if someone is listening half way down the line. If you get a hint that it's being listened to, you can start sending garbage (or misinformation) down the line so as to confuse the hell out of the eavesdropper, whilst taking up alternative methods of communication or something.

This makes me wonder if cryptography needs to become cleverer. I mean, depending on the type of data you're sending, might there be a role in padding encrypted streams with 'honeypot' data, like random bits of vaguely interesting crap that the expected listener might want to be interested in. Sort of a live equivalent of Truecrypt's plausible deniability.

What do people think about that?

Re:Wah?

[Darkness404]

However what happens if that "randomness" doesn't become all that random? First there is a possibility of an attacker using the same algorithm and managing to have a list of "garbage data" to ignore. Second there is a possibility of using a similar method to determine info about the system (for example, MS's version of it would probably be totally different then the Linux/*NIX version) and then move on to another attack.

Now, I admit I don't know that much about cryptography and this probably couldn't happen with more advanced methods but for simple ones this could make it be useless.

Re:Wah?

[dotancohen]

Again in English please? It just means that they were using Debian.

Re:Wah?

[Anonymous Coward]

If you put big stickers over the components saying 'Top Secret' it'll be secure again.

Re:Wah?

[MadnessASAP]

It doesn't matter. The moment he tries to read the stream to see whether the data is garbage or not he has changed the quantum properties and the receiver will know someone is listening. It is theoretically impossible to discern anything about the stream without being detected.

Re:Wah?

[Brian Gordon]

I don't really get it.. why can't eve read the stream (altering it or destroying it or whatever) and send out the exact same stream- at least one that collapses to the same message (I don't know much about quantum waveforms but that at least seems possible).. a classic man in the middle

Re:Wah?

[MadnessASAP]

Errrr.... Well you see that... Well Uhmmmm... *runs away*

But seriously, there is a good reason unfortunately I haven't yet taken enough physics to adequately understand it much less explain it.

Re:Wah?

[cnettel]

Eve can read the stream if she already has the key and state of the transaction. She cannot read the stream in a hope to apply brute-force cracking, or similar, to it later. Naturally, if she has the key(s), and access to the medium, she can fake the identity of the sender more or less perfectly.

Re:Wah?

[Anonymous Coward]

All quantum crypto provides is a good source of OTP (One-Time-Pad) material for standard encryption algorithms heck even XOR would work if your stupid enough to trust the OTP data from your "infallable" quantum channel that much.

Since all entanglement can do is provide the same jyberish to two listeners setup to see it -- its *impossible* to bind trust/identity to the quantum channel in any way that can be verified. Whatever trust is avaliable in the system comes entirely from "classic" sources such as pre-arranged shared secret keys.

Therefore it will only be as hard to crack as it is to obtain knowledge of the shared secret key. People who claim otherwise don't understand that encryption is meaningless without trust.

So then what is the benefit of going quantum? The OTP source of course. Its the best way to thwart cryptoanalysis. Also provides perfect protection for data recorded prior to key compromise. However after a key compromise it only helps while an active MITM attack is not in progress.

I must say the chances of that happening after going through all the trouble to obtain the secret key in the first place are practically zero so yes ah you can still be screwed even if this stuff worked perfectly as advertised which it clearly doesn't :)

Re:Wah?

[something_wicked_thi]

1. Alice sends the key to Bob, in the open, unencrypted, but using a random base-4 encoding. There are two states for a 1 bit and two states for a 0 bit.

2. Bob reads the key, but, due to the random encoding, he can read only half of it (you can read only if the receiver is in the same state as the sender), so Bob sees some random subset of the bits. This random subset is the key. Alice does not know which subset this is.

3. Bob transmits the configuration he used to read the stream back to Alice. Alice compares the configuration to her own configuration for sending data and derives which bits Bob saw. They now both know the key.

It is impossible to read the bits without changing them, in which case Bob will see something different from what was sent, so the keys won't match.

It is also impossible to derive the key from the configuration that is sent back by Bob because it only specifies how the bits were read, not what the bits were.

This is, of course, vulnerable to a man-in-the-middle attack, however.

Re:Wah?

[catprog]

The thing is you can only accurately read about 50% of the photons.

When Eve reads the message changes to 50% correct, 50% incorrect.

When Bob gets the photons his 50% will consist of 25% correct and 25% incorrect ones. (assuming true randomness)

When Alice and Bob compare there keys they will see the discrepancy.

Then the 1 and 0 are XORs with the message and then the result is sent.

http://en.wikipedia.org/wiki/Quantum_cryptography#Polarized_photons_-_Charles_H._Bennett_and_Gilles_Brassard_.281984.29

Re:Wah?

[temcat]

Eve cannot read the stream because 0s and 1s are sent, shall we say, in two coordinate systems (bases) randomly chosen by Alice. The receiver, be it Bob or Eve, cannot in principle measure these basis, only guess them (randomly). If you guess right, you correctly receive 0 or 1. If you guess wrong, you receive garbage. After the transmission Alice and Bob tell each other (over a classical channel) the bases they chose for each bit, and they discard the bits for which they chose different bases. Then they check (and discard) some subset of bits for discrepancies. If Eve was measuring the stream during the transmission, she would inevitably introduce errors by wrongly guessing some bases. Therefore, if error rate is higher than a certain threshold, Alice and Bob conclude that their communication was eavesdropped and discard the transmission altogether.

Then there's the separate question of Eve messing with the classical communication between Alice and Bob, but AFAIK it has also been successfully dealt with.

Re:Wah?

[catprog]

The stream they are talking about is the key.

Re:Wah?

[Anonymous Coward]

Then there's the separate question of Eve messing with the classical communication between Alice and Bob, but AFAIK it has also been successfully dealt with.

For some value of "successfully", considering you're commenting on a news item about a flaw in that very mechanism.

I know the solution

[jollyreaper]

They were connecting the computers via cat-5 cable. Everyone knows you're supposed to use Schrödinger's cat-5 cable in that sort of application.

Re:I know the solution

[dotancohen]

They were connecting the computers via cat-5 cable. Everyone knows you're supposed to use Schrödinger's cat-5 cable in that sort of application. No, the solution was already posted here:
http://article.gmane.org/gmane.linux.debian.security.announce/1614

Re:I know the solution

[Metasquares]

Warning: Windows may or may not be connected to any networks. Please look at your router.

Re:I know the solution

[mrmeval]

"When using quantum communications I always use Schrödinger's cat-5 cable. A quality product of the Jollyreaper company."

I lol'd really.

There is no such thing as absolute security

[Anonymous Coward]

If data is stored, with the intent and purpose of actually being retrievable at some time in the future, and a mechanism exists to access said data, then it is not absolutely secure because it has been designed to be retrieved.
As long as there is even one access method there exists the opportunity to expoloit it somehow.

Re:There is no such thing as absolute security

[Slashdot Suxxors]

So how do you retrieve something that's not retrievable?

Re:There is no such thing as absolute security

[Anonymous Coward]

Knock Knock...
This is the point of the joke. Hello, you seem to have missed me earlier.

Re:There is no such thing as absolute security

[lakeland]

As long as there is even one access method there exists the opportunity to expoloit it somehow. No. In Mathematics, 1 + 1 = 2. It doesn't just usually equal 2, except in cases that you can't think of right now. Similarly, the computer program:

x = 0
x = x + 1

We know with absolute certainty that x = 1.

Returning to access methods, you need to parse the requested object and retrieve it from storage. For both of those operations it is possible to break them down into simple, irrefutable steps much like x = x + 1 amd prove conclusivly that the program has no security flaws.

Re:There is no such thing as absolute security

[Anonymous Coward]

x = 0
x = x + 1

We know with absolute certainty that x = 1. Sure you do, you and the machine elves.

Now, here's a nice jacket, better put it on, it's cold outside, and we're going on a trip with these nice men...

Re:There is no such thing as absolute security

[Anonymous Coward]

If the data CAN be retrieved then SOMEONE knows how to retrieve it, therefore the data is not 100% secure. There is a POINT OF POSSIBLE FAILURE. His kid could get kidnapped and held to ransom for the password, his unsecured laptop could be stolen.
All I am sayiing is that, as long as the data is retrievable, it will never be 100% secure. Now it may seems that I was referring only to technical aspects earlier but I wasn't, I am referring to social engineering as well as hacking and so forth.

Re:There is no such thing as absolute security

[Metasquares]

In theory, yes, x will always be 1. However, there are a number of practical cases which can screw this up, since the computer is a mechanical device. For example, cosmic radiation can flip one of the bits in the memory location x was being stored in after it's assigned 0 but before the addition takes place, which can cause a dramatically different result. More realistically, you could have multiple threads running at once and you could be preempted anywhere (including in the middle of that addition) between the two assignments to x. If the other thread changes x, it's anyone's guess what you're getting back.

Because these sorts of events are unlikely and/or preventable, we tend to assume that mechanical calculations are infallible. Strictly speaking, that isn't true. Highly reliable, yes, especially with modern error correcting codes. Infallible, no.

Re:There is no such thing as absolute security

[Anne_Nonymous]

If you love your data, let it go. If it returns to you, it's yours.

Re:There is no such thing as absolute security

[lakeland]

Perhaps.

I'll ignore threads - it's hard enough to prove a simple deterministic program is correct so I'll assume that this is running without an OS.

As for bit flips due to cosmic radiation, there are plenty of algorithms that ensure a bit hasn't been flipped in a transmission and I would suspect they could be applied to a situation like this. Google pops up helpful hints too, e.g. http://csdl2.computer.org/persagen/DLAbsToc.jsp?resourcePath=/dl/mags/co/&toc=comp/mags/co/2002/01/r1toc.xml&DOI=10.1109/2.976922

Re:There is no such thing as absolute security

[Anonymous Coward]

Detecting sarcasm isn't your strong point, I see.

Re:There is no such thing as absolute security

[Anonymous Coward]

If data is stored, with the intent and purpose of actually being retrievable at some time in the future, and a mechanism exists to access said data, then it is not absolutely secure because it has been designed to be retrieved.
As long as there is even one access method there exists the opportunity to expoloit it somehow. Information that can not be retrieved is not information. By definition, information must be received and understood. What is the purpose of encrypting the data you send to someone if it can not be retrieved?

Re:There is no such thing as absolute security

[marcosdumay]

That is why i save all my documents into /dev/null, and read them from /dev/urandom.

By the way, my documents don't seem to like me very much... Am I feeding them wrongly?

Re:There is no such thing as absolute security

[ultranova]

If data is stored, with the intent and purpose of actually being retrievable at some time in the future, and a mechanism exists to access said data, then it is not absolutely secure because it has been designed to be retrieved.

Yes, but AFAIK quantum cryptography is not about storing and later retrieving data, it is about communicating data between two parties. AFAIK it simply lets the sender and recipient to know if anyone else besides them got the data. From there it is a simple matter of using an insecure channel to transfer random data to act as one-time pad and then, if and only if the pad was not listened to, XOR the actual data with it and send it over.

Re:There is no such thing as absolute security

[Anonymous Coward]

Clearly it can be retrieved, the issue is whether you can detect that it was retrieved.

That wacky quantum cryptography

[Anonymous Coward]

It was actually broken AND fixed at the SAME TIME!

Re:That wacky quantum cryptography

[mrbluze]

It was actually broken AND fixed at the SAME TIME! Kind of like a Windows Update.

Re:That wacky quantum cryptography

[Anonymous Coward]

Well, not quite. With Windows Update, we have a few possibilities:

1. The Fix IS Broken
2. The Fix Breaks Something Else
3. ? (the fix actually works?)
4. Profit!

I don't think those happen concurrently

Re:That wacky quantum cryptography

[MadnessASAP]

Well 1,2 and 4 happen at the same time all the time but 3 only happens in advanced university physics labs under very carefully controlled conditions.

Re:That wacky quantum cryptography

[Anonymous Coward]

Don't give them marketing ideas!

Now with aspartame

[ezwip]

50% more secure then then Titanic and Space Shuttle combined!

the fix?

[Anonymous Coward]

Change Bob's name to Robert?

Fundamental Flaw in Quantum[Anything]

[thinktech]

The whole thing strikes me as a theory in a vacuum, I don't believe that ANY quantum object is invulnerable to observation. At it's core, this is a theory on paper that has no real-world solution. It's like the perfect gas. It simply doesn't exist. And any "fix" will invariably need fixing again. When did common-sense stop making sense in science?

Re:Fundamental Flaw in Quantum[Anything]

[maxume]

Lasing is a quantum effect. If they weren't positively blase, we would probably call them quantum lasers, and then you would be in trouble.

Re:Fundamental Flaw in Quantum[Anything]

[geekoid]

Except for the stuff that actually works and they have proven.

"I don't believe.."
How about some thinking, eh?

Re:Fundamental Flaw in Quantum[Anything]

[Anonymous Coward]

Quantum mechanics is very real I am afraid.
From superconductors to Aspect experiments

BTW a Superconductor doesn't lose energy because QM makes it impossible for the electrons to scatter of the nuclei. Again something entirely impossible according to our common intuitions, which, alas, the world does not care about all that much.

See also:
http://en.wikipedia.org/wiki/No_cloning_theorem

Re:Fundamental Flaw in Quantum[Anything]

[fred fleenblat]

>> When did common-sense stop making sense in science?

If something already makes sense then there is less of a need to study it scientifically. So science will gravitate towards non-intuitive things like neutrinos, recessive genes, bose-einstein condensates, etc.

Re:Fundamental Flaw in Quantum[Anything]

[kestasjk]

The whole thing strikes me as a theory in a vacuum, I don't believe that ANY quantum object is invulnerable to observation. Someone's beliefs are at odds with well founded, empirically established physical laws?!

I just hope this doesn't catch on..

Re:Fundamental Flaw in Quantum[Anything]

[nerdacus]

Someone's beliefs are at odds with well founded, empirically established physical laws?! I just hope this doesn't catch on..

Too late, it caught on long ago. It's called religion.

Re:Fundamental Flaw in Quantum[Anything]

[Anonymous Coward]

Well, if the analogy your using is true, then we have perfect gases!!

Unfortunately, it's not!

Quantum effects have been measured in far less than perfect conditions,
first by Einstein, Poldolsky, and Rosen I believe.

Re:Fundamental Flaw in Quantum[Anything]

[Dekker3D]

they've proven that at least some things aren't immune to observation. who says the rest are? it's harder to prove that something can't be observed or altered or whatever, than it is to prove that it can be.

there's no empirical evidence that proves that he's wrong. and as long as there isn't, he's free to believe what he wants.

Re:Fundamental Flaw in Quantum[Anything]

[Anonymous Coward]

Modded troll for telling the truth? Yeah, dipshits, I'm sure something that you can't observe is really science. By that logic, creationist and "intelligent design" morons are scientific thinkers.

Re:One time pad

[dotancohen]

Just use a one time pad. That way she won't know where to find you when he wants his daddy?

Spooky Decryption

[bevoblake]

It's quantum right? So there's really just a probability of it being broken or fixed at any given point in time...

Schroedinger's Key

[Speare]

Wait, so it was both broken AND not broken? Don't open the box! Just leave it as it is and we can have a half-cryptographic solution forever.

Re:Schroedinger's Key

[skiddy]

I've just introduced a new form of cryptography at work which I belive is very similar to what you're discussing. Basically, I write something (that I don't want people to see) on a piece of paper. I put it in a box. I close the box. People can no longer read it. Where do I get a job with this Quantum company?

hype alert

[BReflection]

The title of their paper is "Security Aspects of the Authentication Used in Quantum Cryptography." That would make an awesome title for a book that aimed to cover every single security aspect of the authentication used in QC, but not a paper that simply points out that (duh!) you shouldn't allow the eavesdropper to see the key.

Re:hype alert

[bh_doc]

While I agree it seems to be surrounded in hype, and while I'm unfortunately unable to access the paper itself (my university doesn't subscribe to IEEE Transactions on Information Theory, apparently), your comment about evesdroppers seeing the key is without merit. The whole point of quantum cryptography is that by employing superposition and state collapse, a key can be negotiated between two parties with an exponentially high probability that any evesdropper listening in will be detected, due to their back-effect of measuring the communication channel. (I might have muddled the terminology a little, but the concepts are true.) So you shouldn't have to worry about an evesdropper because they will make themselves known just by listening in.

Re:hype alert

[fatphil]

Of course, one thing that's often forgotten is that an evesdropper is indistinguishable from noise, so as long as the evesdropper is prepared to snoop on a proportion of the signal that's less than the noise floor, he'll not get detected. Of course, he won't get much information either.

Re:hype alert

[Anonymous Coward]

So you shouldn't have to worry about an evesdropper because they will make themselves known just by listening in. So that means, as far as I understand:

I can safely exchange a key, because I can detect eavesdroppers and replace the sniffed parts of the key with new ones?

But if someone is continuosly does that, doesn't he effectively prevent me from communicating at all??

Re:hype alert

[Anonymous Coward]

The article is also available on arXiv, where you don't need a subscription.

Re:hype alert

[Anonymous Coward]

The paper is also available on on arXiv, where you don't need a subscription.

Re:hype alert

[jalar]

It points out that even if you use the full QC machinery to prevent the eavesdropper from seeing the key, that is not enough when using the key for authentication within QC.

It's what my parents taught me

[Anonymous Coward]

"If you break it, fix it."

Article is a dupe...

[The Master Control P]

Just like the last time, the laws of quantum physics still work and it is still impossible to observe a quantum system without altering it. The researchers found that the classical authentication protocols that prevent man-in-the-middle attacks were insufficient.

Re:Article is a dupe...

[Anonymous Coward]

Quantum cryptography is a misnomer. Really it should be called quantum key exchange. Classical encryption technology must still be used for authentication, and (in practical terms) to encrypt the actual message once a key exchange has occurred. Neither of the classical components is invulnerable. Only the key exchange itself is protected by quantum physics. The article simply describes an error in the implementation of the authentication, and a fix for that error. The issue really has nothing to do with the quantum key exchange.

Initialization vector

[andrewsb]

This bit from the article sounds like they just added an initialization vector (see wikipedia for definition):

"The researchers propose an additional, non-quantum exchange of a small amount of random bits that are separate from the quantum key."

Re:One time pad

[Anonymous Coward]

That way she won't know where to find you when he wants his daddy? That's what throwaway cellphones are for.

Re:That wacky quantum cryptography one in a

[davidsyes]

... So, this quantum break-fix happening in this way, is what, a one-in-a-gwee-zillion event? Does that make it statistically a ... Quantum Singularity?

The End of The Science of Cryptography

[Whiteox]

There was an interesting book on cryptography which I loaned to a friend, that surmised that the law of cryptography which state that every code can be broken is now defunct due to quantum cryptography.
This in effect means that the science of cryptography has met its end in terms of development.
Like the game of checkers, there are no more moves to make.
At the time of publication (2002?), the longest distance an encrypted quantum message sent and received was approximately 50kms and considered to be impossible to break.

Re:The End of The Science of Cryptography

[Anonymous Coward]

That book was full of shit. Cryptography is no where near finished. I wish people would stop making such a big God damned fuss about quantum cryptography. All it does is make eavesdropping detectable. In any secure application you still don't want the eavesdropper to be able to understand what they overhear, even if you can immediately detect them overhearing it, so you still need to scramble your message somehow, i.e. using actual cryptography. Furthermore, quantum cryptography works exclusively over fibre optic connections. It will never be applied to cat 5 LANs or to wi-fi connections because it fundamentally can't be.

Re:The End of The Science of Cryptography

[Tmack]

...It will never be applied to cat 5 LANs....

Unless of course (as was pointed out above), that lan is using Shrödinger's cat-5...

tm

Re:The End of The Science of Cryptography

[SeekerDarksteel]

Quantum cryptography is quantum cryptography only in the sense that it is quantum and is used in cryptographic protocols. It is literally no different than having a guaranteed secure line over which to transmit a private key. The protection quantum cryptography lends to you is the guarantee of that line security. Nothing else.

Re:The End of The Science of Cryptography

[evanbd]

As long as people have a need to exchange messages with people they can't actually send photons to directly, there will be a need for cryptography.

Re:The End of The Science of Cryptography

[catprog]

Quantum cryptography gives you a secure way to pass the key to the person your communicating with.

Wireless communications are not fundamentally incompatible with Quantum cryptography

Oh,

[oliverk]

What's really going to bake your noodle later on is, would you still have broken it if I hadn't said anything?

Alice and Bob are sick today. We need some answers

[failedlogic]

As I don't know what I'm supposed to know about quantum cryptography, where can I find Alice and Bob to explain it to me? I feel sorry for them though. I'm always bugging them for an explanation and they always oblige. I'm really pissed off though. Every time, I want a different opinion, there they are in every book - Alice .... and .... Bob. Why must *they* always explain to me the most difficult concept in computing. If they aren't doing their jobs, as is obvious with QC, we need some new instructors. If I were either of them, I'd quit my day job. Since nobody understands QC, and anyone that does can't simplify it for the rest of us, they're setting themselves up for massive overtime or heart attack.

Re:One time pad

[bh_doc]

But how do you transmit that pad between parties?

That is exactly the point of quantum cryptography. The cryptographic key is the one time pad, negotiated between two parties, using superposition (and in some cases entanglement) in order to come to agreement on the pad and at the same time detect evesdroppers.

Re:Alice and Bob are sick today. We need some answ

[bh_doc]

[N]obody understands QC, and anyone that does can't simplify it for the rest of us

You've just summed up the entirety of quantum physics. Really, it's impossible to simplify it enough for the general public to both know what it means (as in, the behaviours it predicts) and "understand" it in any intuitive way. Hell, most physicists don't understand it in that sense. It just isn't intuitive (for common definitions of the word). So some of the time (probably more than we'd like to admit) we just plug in the math. And it works.

No, not really

[Moraelin]

No, not really. QC only works over dedicated, point-to-point fibre optic lines.

Do you understand that one crucial aspect? If I want to talk to you completely securely, with quantum handshake, and able to detect eavesdroppers, I would need one uninterrupted strand of fibre from Germany to wherever you are. Screw 50kms, we're talking potentially tens of thousands of kilometres.

Or a chain of routers along the way that we both trust blindly to not be compromised, because each breaks that quantum handshake, and each is a point where someone could eavesdrop. You can't tunnel QC over such a hop, so it's a bit like having SSL only from your computer to your ISP, then have it decrypted there and re-encrypted to the next hop, and so on.

It's also pretty much against the whole idea of a network like the Internet. Since again, it needs dedicated uninterrupted point-to-point connections, not a loose mesh of routing machines. (You _could_ transmit the rest over the internet once you negotiated a key over QC, but: 1. you still need a dedicated connection for that handshake, and 2. you still need normal cryptography for the actual transmission then.)

For two John Does like us it's already pretty infeasible to go QC all the way.

Even for someone like the US Army:

1. Good luck having an all-QC connection from Washington to Baghdad. Even in 50 km segments, you need a lot of basically routers every 50 km on the ocean floor, each of them being a potential eavesdropping point. So if you ditch normal cryptography, you'd need to do... what? Park a couple of submarines near each of them to make damn sure the Russkies and Chinese don't tamper with them? Have permanent manned bases on the ocean floor every 50 km, with a company of soldiers watching each router, and watching each other so none of them can be a double agent and tamper with it?

2. And what do you do if someone drops a depth charge on one of those? You sure you don't want some regular crypto as backup?

3. That still doesn't help your communication to your airplanes, tanks, cruise missiles, etc, there. You can't tie a cable from each of them to Washington.

Etc.

So basically... well, let me put it mildly: I don't know what book you've read, or by what author, but I'd bet it wasn't written by someone who knows much about cryptography. It sounds more like the kind of predictions made by self-styled "pundits" like Cringely or Dvorak. Or, of course, any other of the many like them.

Re:No, not really

[Anonymous Coward]

No, not really. QC only works over dedicated, point-to-point fibre optic lines.

Do you understand that one crucial aspect? If this is true, someone should tell the ESA. It would be bad news for their plans for QM communication with satellites :

http://www.vnunet.com/vnunet/news/2191998/researchers-plan-quantum-link

This isn't just theoretical. It's already been demonstrated

http://arxivblog.com/?p=317

The first line of the article is particularly relevant : "Quantum physicists have been sending qubits through the atmosphere encoded in individual photons for years now."

(Have a look at http://arxiv.org/abs/0803.1871 for the details).

Parent's post is also suspicious - whether or not -all- classical crypto schemes can be broken by a QM computer is not known (except perhaps by the NSA, but they're not letting on).

There's plenty of people working on this, including me. o.t.o.h. maybe I (and the ESA) are just self-styled pundits, as well ?

Re:No, not really

[Anonymous Coward]

Great book on the topic:

The Code Book: The Science of Secrecy from Ancient Egypt to Quantum Cryptography by Simon Singh

http://www.amazon.com/Code-Book-Science-Secrecy-Cryptography/dp/0385495323/ref=pd_bbs_sr_1?ie=UTF8&s=books&qid=1210772146&sr=8-1

Re:No, not really

[taylor]

Actually, quantum cryptography can work with non-secured intermediate repeater stations. In essence, rather than attempting to send the random bits directly, one attempts to build an entangled pair of quantum bits, one at each end of the repeater chain. This is trying to build a specific state, which can be verified before use. The random key is generated using the non-classical correlations of the entangled pair (for more info, one can google "Ekert quantum repeater").

As you might expect, the protocol for this case is very different from that used in classical repeaters: one cannot measure the signal and amplify it, because doing so would negate the security you are attempting to establish. Instead, a quantum repeater focuses on the specific task of creating an entangled state at the either end, which can then be used to generate cryptographically secure random bits. Because one can verify the final state at the ends of the system before it is used, and independently of malicious users in the middle, a quantum repeater is no more susceptible to an intercept attack than a short-distance single fiber approach. Again, both are susceptible to a complete man-in-the-middle replacement / redirect.

Re:No, not really

[Anonymous Coward]

> QC only works over dedicated, point-to-point fibre optic lines.

I know nothing about quantum cryptography, but this summary confuses me. If you have a dedicated line to the person with whom you are communicating, why would you need quantum cryptography, or even SSL, or data security at all? If the line is dedicated, isn't eavesdropping physically prevented?
I suppose if the line were copper, someone could splice in a connection and eavesdrop that way, which is probably also be possible for fibre-optic cable - but then you no longer have a dedicated line, if I understand your post correctly.
If I had a dedicated line, I wouldn't bother with security at all.

I suspect the purpose of QC is for communicating over insecure networks, as is the purpose of SSL. Otherwise, what's the point?

I just Googled up quantum cryptography, and discovered that it's been tested successfully wirelessly, through the air, at distances of 20-25 km. Further, the whole point of QC is that it supposedly guarantees that nobody has intercepted the photons used in the transmission (of the initial handshake, I guess?), or that an interception is readily detectable. Thus, your whole post seems to be way, way off.

Re:No, not really

[IdeaMan]

Laser bounce from a satellite in orbit?

Only way I could see to MITM attack it would be to put a blimp drone or maneuver a satellite between the two.

Re:No, not really

[Vadim Makarov]

Distance improves steadily. The current record for a point-to-point link is over 200 km in fiber (albeit not installed but spools in a lab) and 144 km of free space (between two mountains on islands in the Pacific). Never mind that the 144 km experiment uses passively-quenched single-photon detectors which I think I have successfully broken. Also, I think at least one group is seriously working on a link with some sort of quantum repeaters in middle nodes.

Re:No, not really

[wodon]

Remember that the quantum Cryptography bit is only there to generate the one time pad which will then be used with an algorythin to encrypt the message.

There is the potential to have secured pad generation links which you could take your keys away from and then encrypt over the recular internet.

Re:One time pad

[Anonymous Coward]

But how do you know who your negotiating with for your snazzy new encryption key is really someone you want to be talking to? The answer is standard (non quantum) algorithms to verify trust which are still succeptable to standard attacks. The one-time-pad properties of the magical quantum channel mearly make it harder to carry out such attacks.

I've made one other comment on Slashdot, but...

[skiddy]

Again, I think I have a quantum girlfriend.

Re:Alice and Bob are sick today. We need some answ

[catprog]

In a sense.

A number of Polarised photons are sent.

The person receiving uses one of 2 filters/readers .

Use the right filter and you get the correct bit.

Use the wrong filter and half of the time you get the correct bit and the other time you get the wrong one. This means if you incept the key you can not send the same set of photons on.

Discard the ones that you used the wrong filter on and then compare your key with the other person. (over an un-encrypted line). If there are too many errors then it has been incepted and the key is discarded.

Then using the key you can XOR binary data in a un-decodable stream which can be sent over an un-encrypted line

Comments by Schneier

[Anonymous Coward]

This article in IEEE Spectrum contains more details and comments from Bruce Schneier and others.

Re:Alice and Bob are sick today. We need some answ

[catprog]

Simple answer.

a one-time-pad is unbreakable but needs keys to be distrubted.

QC is used to send the keys and if it is incepted it can be detected and the key discarded.

Re:Alice and Bob are sick today. We need some answ

[Anonymous Coward]

Yes, but I get the feeling QC will always be easy to disrupt. Yeah, the end users are gonna know about it, but if they're relying on it, then it could be a problem.

I gues I'm saying there may be future non-crack based (D)DOS attacks on this!

Broken QC FAQ

[jalar]

See http://www.mai.liu.se/~jalar/qkg/faq.html?lang=en

Future history

[Anonymous Coward]

Here's the future in a nutshell. 1- Quantum cryptography becomes the norm. 2- Someone figures out a clever way to eavesdrop on it. 3- Since that person has also effectively violated the laws of physics, they go on to invent the transporter or starship or some other far-cooler thing, even though their original intention was to be a jerk or thief. 4- History only remembers them as the inventor of the cool thing. Universities are named after the person.

Re:Alice and Bob are sick today. We need some answ

[Anonymous Coward]

Really, it's impossible to simplify it enough for the general public to both know what it means (as in, the behaviours it predicts) and "understand" it in any intuitive way.

I disagree. Best example is an atom from a radioactive isotope. Say, one atom of radioiodine. Radioiodine decays by beta emission with a halflife of 8 days, so if you have a single atom then there is a 50% chance it will have decayed after 8 days.

Now the crucial point is that to the best of our knowledge, this is a truly random event, meaning there is no measurement calculation or theory you could use to predict if it will decay within 8 days or not, not even in principle.

It's unlike a pair of dice where the outcome is in principle predictable by analyzing the forces momentum and impacts the dice undergo. If quantum mechanics is a good theory ( and to date it has not disagreed with a single empirical experiment ) then the decay of radioactive atoms is absolutely random, and it is not merely technologically difficult to predict when a given atom will decay, it is physically impossible.

Some people don't believe this. Some people like to cling to the idea that we just don't know enough about sub-atomic physics and that some day quantum mechanics will be proven inaccurate in this respect. While it is technically impossible for a physical theory to give an absolute proof, every single empirical experiment today agrees with the assumption that radioactive decay is truly random.

There are even experiment's whose results and outcomes are expected to differ depending on if the randomness is truly random or pseudo-random in nature. The exact design of such an experiment is rather complicated, but such experiments exist, and these experiments appear to confirm that certain physical phenomena are indeed truly random.

Now, I don't think what I just wrote is hard to understand. Depending on your personality it may be hard to believe or accept, but understanding what I just said is not tricky. There is no infallible proof to determine that what I just said is correct, but every physical experiment performed to date agrees quite well with it, and perhaps more crucially: Some physical experiments would be very difficult to explain if this was NOT correct. Now the reasons for that last claim are a little* hard to understand, but what the claim actually says is not something which can't be explained with relative ease

*here "a little" is the underestimate of the month.

Re:Alice and Bob are sick today. We need some answ

[bh_doc]

You are (mostly) correct. However, your example is of one relatively simple aspect of quantum mechanics. You haven't even touched on the real meat of quantum mechanics: Superposition, entanglement, action at a distance, wave-particle duality, many worlds interpretation... all that "spooky" junk. I'd like to see an intuitive, understandable explanation of that. Honestly, I would.