Quantum Encryption Implementation Broken
I Don't Believe in Imaginary Property writes "Professor Johannes Skaar's Quantum Hacking group at NTNU have found a new way to break quantum encryption. Even though quantum encryption is theoretically perfect, real hardware isn't, and they exploit these flaws. Their technique relies on a particular way of blinding the single photon detectors so that they're able to perform an intercept-resend attack and get a copy of the secret key without giving away the fact that someone is listening. This attack is not merely theoretical, either. They have built an eavesdropping device and successfully attacked their own quantum encryption hardware. More details can be found in their conference presentation."
Now that's efficiency for you, folks!
The World Wide Web is dying. Soon, we shall have only the Internet.
Can we please get to play with some of these emerging technologies before someone goes breaking them? This is why we can't have nice things! You intellectuals and your tinkering....
Schrödinger's Hack!
There's only one way to look at this story, the quantum encryption may or may not be broken, or maybe partially so, so both cases could be true at the same time.
Take Nobody's Word For It.
broken even easier by capturing the data prior to encryption. HEH.
Hehe, that master student you will see at the second linked page is me ten years ago :-)
How is it news that a flawed implementation of a perfectly secure algorithm can be taken advantage of? Cryptographers have been doing side channel attacks for a long time.
Want to improve your Karma? Instead of "Post Anonymously", try the "Post Humously" option.
Exactly. More proof that Firewalls and Antiviruses can never keep up with hackers.
Truly nothing to see here.
"Be prepared, son. That's my motto. Be prepared." --Joe Hallenbeck
"Even though quantum encryption is theoretically perfect"
And Communism works, IN THEORY.
...is the first group of hackers composed entirely of cats.
We all know that theory can be notoriously variable when put into practice. In theory, quantum in particular, your wave function places your probability of spontaneously appearing in a parallel universe as magnificantly insignificant, yet its a "theorhetically possible". Knowing such, it should not be a surprise when such a powerful and not fully-understood "proof-of-concept" implementation is shown to be flawed, there are things we cannot master, and possibilities that cannot be ruled out. No security measure will ever be truly "perfect".
The best password encryption can be broken with a hard-hack, Louisville Sluggers provide a great brute-force technique.
'We are trying to prove ourselves wrong as quickly as possible, because only in that way can we find progress.' RPF
I TOLD YOU NOT TO LOOK AT IT!
It's ok, the message hasn't actually been decoded by a third party as long as you don't read it.
HA! I just wasted some of your bandwidth with a frivolous sig!
You said what now?
I got norton.
[in before people who don't get the reference]
I'm not sure I have heard this term before. How does an "intercept-resend attack" differ from a man-in-the-middle attack?
We don't have a quantum computer to provide the quantum encryption yet, but the encryption is already broken.
I think it's time for my beauty rest.
...oh, wait a second...nevermind.
To paraphrase E. E. (Doc) Smith.
What man can create man can circumvent.
I guess we need a lens...
I'm sure there is a joke in there somewhere.
"linux is just DOS with a UNIX like syntax" -- Galactic Dominator (944134)
Even though quantum encryption is theoretically perfect...
Most things that are perfect *are* theoretical.
...real hardware isn't, and they exploit these flaws.
Most modern encryption isn't cracked by breaking the technology used to encrypt it. Security is only as secure as the pain tolerance of the person who knows the PIN, or the size of the visor that is suppose to hide the numbers you press from the person in line behind you.
Saying that this exploit "defeated" quantum encryption is like saying that a bank is not secure because someone got stuck up walking home after making a withdrawal.
The summary admits as much by saying "Even though quantum encryption is theoretically perfect, real hardware isn't".
Does anyone think that a laboratory quantum encryption setup is exactly the hardware that quantum encryption implementations are going to have when they are commercially available?
I've seen this before, where someone claims that product X or Y is "not secure" because they were able to obtain a passphrase via social engineering.
You are welcome on my lawn.
> How is it news that a flawed implementation of a perfectly secure algorithm can be taken advantage of?
Because it's a very technically impressive hack that breaks the guarantees we love quantum encryption for (the idea that we can detect eavesdropping) and it does it in a fairly general way, using a weakness in an important piece of hardware (the single photon detectors) that's used in many quantum cryptography setups.
It may not be surprising to you, but the technology used isn't so trivial as you make it sound. Read their conference presentation if you want to see. The only reason I didn't write more of it into the summary is because I didn't want to butcher all the explanations when I could let you read the original.
- IDBIIP
It uses bright light to blind the single-photon detectors. Determining that your detectors are saturated isn't that hard; if they get saturated, someone's probably performing this attack and you might not want to use the key. In fact, any reasonable QKD scheme should really try to ensure that the detectors are operating properly throughout the key distribution otherwise it's a giant security hole.
So if this is the future...where's my jet pack?
Quantum encryption needs a second channel that isn't vulnerable to man in the middle attack. It doesn't say how to make it, it only says that it's needed. This channel is used to transmit the polarization used, and although it doesn't transmit information related to the unencrypted data, the entire algorithm depends on the integrity of this channel not being attacked (sniffed it's OK) .
In my opinion saying that quantum encryption is theoretically perfect is misleading, as there is no probe that this secure channel can be made.
Could someone please slowly explain to me why I cannot intercept and regenerate as part of a man in the middle attack.
In other words, how is it that Alice knows what she is sending, without either setting it in advance or detecting it?
If the third party reads it before you do, they are really the second party. Then you read it as the third party. Or wait long enough and be the fourth party.
Infuriate left and right
1. Build quantum encryption system with a security flaw in the implementation.
2. Publish!
3. Exploit the flaw.
4. Publish!
5. Fix the flaw.
6. Publish!
Wasn't Switzerland using this form of quantum crypto for some election or something?
http://it.slashdot.org/article.pl?sid=07/10/11/2211205
No, this is a way to get another revenue stream. Sell the two 'secure' endpoints to person's A and B, sell third interception endpoint to NSA... Increase revenue by 50%!
Sleep your way to a whiter smile...date a dentist!
Too bad this has nothing to do with antivirus software or firewalls..
I raise you a Vigenere - used by the Confederates after it was successfully broken by Babbage.
(Also, apparently they changed the password twice during the course of the war.)
Heh. There's an article about cryptography, and suddenly everyone on Slashdot is an expert.
I must be new here.
Could we stop it calling him quantum encryption and call it by what it is : Secure quantum transmission ? Encryption / decryption involve changing a message with a key as to make it non-decipherable. Quantum "encryption" do no such a things, it only allow sending a emssage from point A to point B , while warning you if somebody eavesdrop (at least in theory...). You could push a message in plain text through such a channel, or a KEY, both can be perfectly read by the eavesdropped, but the sender/receiver pair will know it has been caught. There is nothing encrypted whatsoever here.
C. Sagan : A demon haunted world:
http://www.amazon.com/gp/product/0345409469/
visit randi.org
This was done a while ago. My understanding of Quantum Physics/Cryptography is admittedly under par, but from what I understand they're able to send fake data (via photons) that confuse the person that's doing the wiretapping.
I'm sure there is a joke in there somewhere.
Hey at least 1 person got it! :D
"Be prepared, son. That's my motto. Be prepared." --Joe Hallenbeck
See subject line