Slashdot Mirror
Commercial Quantum Cryptography System Hacked
KentuckyFC writes "Any proof that quantum cryptography is perfect relies on idealized assumptions that don't always hold true in the real world. One such assumption is related to the types of errors that creep into quantum messages. Alice and Bob always keep a careful eye on the level of errors in their messages because they know that Eve will introduce errors if she intercepts and reads any of the quantum bits in a message. So a high error rate is a sign that the message is being overheard. But it is impossible to get rid of errors entirely, so Alice and Bob have to tolerate a small level of error. This level is well known. Various proofs show that if the quantum bit error rate is less than 20 percent, then the message is secure. However, these proofs assume that the errors are the result of noise from the environment. Now, physicists have come up with an attack based on the realization that Alice also introduces errors when she prepares the required quantum states to send to Bob. This extra noise allows Eve to intercept some of the quantum bits, read them and then send them on, in a way that raises the error rate to only 19.7 percent. In this kind of 'intercept and resend attack,' the error rate stays below the 20 percent threshold and Alice and Bob are none the wiser, happily exchanging keys while Eve listens in unchallenged. The physicists say they have successfully used their hack on a commercial quantum cryptography system from the Geneva-based startup ID Quantique."
The primary application, which was preventing first posters, has been compromised.
...to e-mail Alice and Bob, rather than advertise that their love-letters are being snooped on?
It's a small world and it smells funny; I'd buy another if it wasn't for the money; Take back what I paid (SoM)
is probably that the cumulative error rate (channel + noise introduced by each party) is over the threshold. i imagine if they just lower the threshold for attacks they will catch the MITM. Of course it may necessitate using a less noisy channel (to keep the false-positive rate down)
...stopping reading the blurb on slashdot last week about the new position based system being secure because the people who previously said it wasn't secure changed their mind and said it was provably secure and then proceeded to use the words "cannot easily" to justify it being secure. Now, this week I see a commercial system that has been cracked because some how thresholds of likely hood were once again used. Anyone else see a trend?
If this article is correct, all an eavesdropper has to know is the proper error threshold to stay under to remain undetected.
Doesn't seem so secure to me.
The core idea of using quantum communication security (or, in general, quantum communication) is that you'll be able to tell when the message has been altered.
All a man in the middle attack has to do is read the message, recreate it, and send out a spoofed message instead of the original message.
Reading the message is trivial.
Recreating the message, while introducing tolerable levels of noise is trivial once you have the key. Alice does it all the time.
Blocking the original message is not trivial, but it is also not hard. It just requires physical access to the network. Be it jamming a wireless signal, splicing your attack node between two routers, whatever.
Sending out the spoofed message is trivial. The internet is slow and laggy. You can easily read, alter, and resend the message without the delay being noticed.
The only thing stopping a man in the middle attack is the need to have the key to resign an altered message as to make it appear that it came from Alice. This is a key-sharing problem. All digital security problems boil down to a key-sharing problem.
The only thing the quantum nature of communication adds is the ability to detect when people might be listening. This only gets around eavesdropping, not an actual MITM attack.
Indeed, the quantum nature of the "security", as this paper shows, actually opens the door to attacks, as the communication medium is not perfect and there is now a threshold for tolerable noise. Attacks can play around in that threshold all day long.
Really, is a little fidelity in this relationship too much to ask for? I've caught Bob kissing that skank Alice so many fucking times and he always says he's sorry and he'll stop seeing her, but still I can tell they're exchanging information through hidden channels.
But what I really hate is when people act like I'm so unreasonable by trying to find out what is going on and who my allegedly significant other is seeing behind my back. What the fuck.
-
Cryptographically Signed,
Eve.
(Inspired by xkcd, of course.)
Various proofs show that if the quantum bit error rate is less than 20 percent, then the message is secure. However, these proofs assume that the errors are the result of noise from the environment.
Then they do not "prove" anything.
When you start from a false premise, you produce "garbage", not "proofs" (Actually, you can produce some really useful counterfactuals that way, but you wouldn't present it in the context of a proof of the original concept). Particularly when talking about security, what moron would assume any sources of error come from the environment rather than the attacker???
Eve is a fucking spy, arrest her.
I'm not too sure about Alice and Bob either, seems they're always around when these things happen.
can be broken by a man
depending upon your current situation in life, this is either a wonderfully hopeful or horribly depressing realization
intellectual property law is philosophically incoherent. it is your moral duty to ignore it or sabotage it
The third paragraph from the end of TFA is the key. Alice/Bob will be in an arms race with Eve. Alice/Bob will need better single-photon detectors and generators to stay ahead of Eve. As Alice/Bob improve the quality of their hardware and increase the probability of being to emit and then detect a single photon increase, Eve has to keep pace with the quality of her hardware. Over time as Alice/Bob increase the quality of their hardware, the attack surface available to Eve shrinks, and it will take her longer to intercept without being discovered. Eve will also need an accurate assessment of Alice/Bob's hardware capability to mount a credible threat.
I don't get why anyone even bother with the so-called quantum encryption*, a simple pre shared key scheme is perfectly safe, a lot cheaper, well understood and well tested.
*The quantum part has nothing to do with encryption, it's just an over the top high tech attempt at preventing wire taps.
One the main contributors to the error rate is the photon detection efficiency, where 80% or better is considered "good". In a major breakthrough last month, NIST (yes, the National Institute of Standards and Technology, not some startup company's marketing hype) has achieved a record single-photon detection rates of 99% - and possibly better, since there currently exists no metrology to test that level of efficiency. So in terms of that source of error, things are looking up.
It's hardly fundamentally flawed. Even if the eavesdropper knows the error threshold and can intercept a few bits without detection thanks to errors in the system, the information gain is very minimal. You might be able to get a few percent of the transmitted bits in a key. Three out of every hundred bits in a one-time pad isn't going to break the encryption. The parties can always XOR some bits until the information that an eavesdropper could extract is negligible.
So if this is the future...where's my jet pack?
Moreover, in our attack, Eve only sends two states to Bob. Alice and Bob can detect this attack by estimating the statistics of the four BB84 states. Note that, once a security loophole has been found, it is often easy to develop countermeasures. However, the unanticipated attacks are the most fatal ones.
www.RacquetUp.org - Helping Detroit Youth
But at what dark-count rate? There are always trade-offs.
So if this is the future...where's my jet pack?
The dark count is essentially zero. That's what makes this breakthrough so impressive.
FTA I linked:
"When these detectors indicate they've spotted a photon, they're trustworthy. They don't give false positives," says Nam, a physicist with NIST's Optoelectronics division. "Other types of detectors have really high gain so they can measure a single photon, but their noise levels are such that occasionally a noise glitch is mistakenly identified as a photon. This causes an error in the measurement. Reducing these errors is really important for those who are doing calculations or communications."
Oh wow, I'll have to grab a hold of the publication. That is impressive.
So if this is the future...where's my jet pack?
Thing is nowadays TB drives are quite cheap. Generate a huge OTP, spread it over three drives at A, spread it over another three drives and send all three to B via three different couriers/paths. Add ECC if you want.
If they all made it safely without interception. You've got your secure channel. 1TB/128kbps = 2 years. 1TB/256kbps = 1 year.
You could send more than one set of drives. When they all arrive, you tell the "B" let's start with drive set #5.
Unfortunately this only detects if the photon hits. It does not measure anything like spin. So while useful, it does not seem directly transferable to a quantum cryptography application.
until he tells you what was in the message.
Of course you can't beat Alice because she's a girl. If Alice had sent the message to Eve then you'd be out of luck.
I say Bob should dump Alice and go with Eve. Bad girls are hot.
Though dumped good girls can be trouble as well, so the original problem remains.
Sadly, as long as Eve (or Alice) are sufficiently determined to intercept Bob's communications, he's got problems. The only answer may be to become a celibate monk in a monastery committedly observing a vow of silence.
Loose lips lose spit.
Does she live next door to Bob?
Had to be asked.. ;)
No photon detector "measures anything like spin". The polarization is determined by a filter prior to detection. Which direction the filter should be oriented is part of the quantum cryptography protocol, and the filter is followed by a detector that needs only to determine the presence or absence of a photon passing through the filter.
I should clarify that by "filter" I mean a birefringent filter such as calcite, where the photon decides on one of two paths based on its polarization. Two detectors, one in each path, determines which was taken by the photon. So the compound setup of filter + 2 detectors is in effect the "detector that measures spin" that you refer to.
Not really: this is why they only transmit the key across the quantum crypto link. Any bits that are intercepted are known and are simply not used. The actually interesting information is then transmitted across a classical link of any type and is encrypted using the quantum link-exchanged key. If you transmit a OTP-sized key across the quantum link and discard any bits that were intercepted, then there is no theoretical (or practical) way to decrypt the subsequent OTP-encrypted data exchange. That is to say, there is no way to intercept any of their juicy, juicy secrets.
PS. The commonly accepted mental image to associate with juicy secrets is a multi-colored wad of saliva-soaked chewing gum, approximately fifty pieces in mass, each piece from a different person. Now, imagine squeezing it in your hand and feeling the saliva running through your fingers and down your arm in a lukewarm manner somewhat evocative of mucus. Observe the rivulets of drool as they run together and eventually start to drip off your elbow in a slightly viscous manner. This is why people always have the urge to share juicy secrets!
Screw quantum, I'm sticking with ROT-13.
Mod Me Up. You'll make a grown man cry.
I guess I don't read crypto examples enough the first time I read this, I didn't get what the reference was.
I... I feel dumb now.
Quantum cryptography really isn't being proposed as a practical solution right now (hush, don't tell Id Quantique) but what's fun about it is that it's theoretically secure. If the person whose wrist your briefcase of disks is handcuffed to is bought out, you'd never know it and your enemies just gained access to all your secure communications. Two to four decades from now quantum cryptography might be practically competitive with carrying disks around, but for now, it's just for fun.
So if this is the future...where's my jet pack?
Problem is, the drives could be intercepted and copied without your knowledge. Roughly speaking, this is a problem quantum cryptography does not have, due to the no-cloning theorem.
> If the person whose wrist your briefcase of disks is handcuffed to is bought out,
1) You would need all three disks to reconstruct the original OTP that will be used.
2) If I send more sets of three and only use some sets, that makes it even harder.
3) I could even send 9 disks over time and over different couriers/channels and then randomly choose different combinations of them to construct the actual OTP.
Human ingenuity cannot concoct a cipher in which human ingenuity cannot break. --- Edgar Alan Poe
wait... what? arrogant researchers who proclaimed to find something that's the perfect, flawless, definite solution to a problem are wrong? holy geocentrism, batman! get the global warming phlogiston spontaneous generation out of here! AI singularity in 2008!