Re: Quantum Key Distribution: the bad idea that won't die...

2010-07-09 Thread Alexander Klimov
http://arxiv.org/abs/1005.2376

  Unconditional security proofs of various quantum key
  distribution (QKD) protocols are built on idealized
  assumptions. One key assumption is: the sender (Alice) can
  prepare the required quantum states without errors. However,
  such an assumption may be violated in a practical QKD system.
  In this paper, we experimentally demonstrate a technically
  feasible intercept-and-resend attack that exploits such
  a security loophole in a commercial plug  play QKD system.
  The resulting quantum bit error rate is 19.7%, which is below
  the proven secure bound of 20.0% for the BB84 protocol.

-- 
Regards,
ASK

-
The Cryptography Mailing List
Unsubscribe by sending unsubscribe cryptography to majord...@metzdowd.com


Re: Quantum Key Distribution: the bad idea that won't die...

2010-04-22 Thread Steven Bellovin
While I'm quite skeptical that QKD will prove of practical use, I do think it's 
worth investigating.  The physics are nice, and it provides an interesting and 
different way of thinking about cryptography.  I think that there's a 
non-trivial chance that it will some day give us some very different abilities, 
ones we haven't even thought of.  My analog is all of the strange and wondrous 
things our cryptographic protocols can do -- blind signatures, zero knowledge 
proofs, secure multiparty computation, and more -- things that weren't on the 
horizon just 35 years ago.  I'm reminded of a story about a comment Whit Diffie 
once heard from someone in the spook community about public key crypto.  We 
had it first -- but we never knew what we had.  You guys have done much more 
with it than we ever did.  All they knew to do with public key was key 
distribution or key exchange; they didn't even invent digital signatures.  They 
had non-secret encryption; we had public key cryptography.

Might the same be true for QKD?  I have no idea.  I do suggest that it's worth 
thinking in those terms, rather than how to use it to replace conventional key 
distribution.  Remember that RSA's essential property is not that you can use 
it to set up a session key; rather, it's that you can use it to send a session 
key to someone with whom you don't share a secret.  

Beyond Perry's other points -- and QKD is inherently point-to-point; you need 
n^2 connections, since you can't terminate the link-layer crypto at a router 
without losing your security guarantees -- it's worth reminding people that the 
security guarantees apply to ideal quantum systems.  If your emitter isn't 
ideal -- and of course it isn't -- it can (will?) emit more photons; I can play 
my interception games with the ones your detector doesn't need.
-
The Cryptography Mailing List
Unsubscribe by sending unsubscribe cryptography to majord...@metzdowd.com


Re: Quantum Key Distribution: the bad idea that won't die...

2010-04-22 Thread John Lowry

On Apr 20, 2010, at 11:31 AM, Perry E. Metzger wrote:

 
 Via /., I saw the following article on ever higher speed QKD:
 
 http://www.wired.co.uk/news/archive/2010-04/19/super-secure-data-encryption-gets-faster.aspx
 
 Very interesting physics, but quite useless in the real world.
 
 I wonder why it is that, in spite of almost universal disinterest in the
 security community, quantum key distribution continues to be a subject
 of active technological development.
 
 Perry
 -- 
 Perry E. Metzger  pe...@piermont.com
 
 -
 The Cryptography Mailing List
 Unsubscribe by sending unsubscribe cryptography to majord...@metzdowd.com


There have been many misattributions in the technological world
to include remarks supposedly made about 640K of memory, the number
of computers required for global processing needs, and the number of routers
that would eventually be required for internetworking.  

Perry's claim has the property of actually having been said, so I will archive 
it.

My own speculation is that the security community and its interests are
perhaps a bit broader than than some members wish it were.

If you want to see some interesting physics that represents unexpected
results relevant to communications (and comes from entangled QKD research) 
then take a look at: http://pra.aps.org/abstract/PRA/v81/i2/e023835

There is a human-readable summary at: http://focus.aps.org/story/v25/st7

John




-
The Cryptography Mailing List
Unsubscribe by sending unsubscribe cryptography to majord...@metzdowd.com


Re: Quantum Key Distribution: the bad idea that won't die...

2010-04-22 Thread Perry E. Metzger

Steven Bellovin s...@cs.columbia.edu writes:
 While I'm quite skeptical that QKD will prove of practical use, I do
 think it's worth investigating.

I agree. What I don't understand is why people are trying to
*commercialize* it, or claiming that it is of practical use as it
stands.

 The physics are nice, and it provides an interesting and different way
 of thinking about cryptography.  I think that there's a non-trivial
 chance that it will some day give us some very different abilities,
 ones we haven't even thought of.

I don't disagree, and I think that this, too, is a good reason to study
it in an academic setting. What I don't get, as I said, is people going
off and spending large amounts of effort on things like getting the
systems to do video rate communications or trying to sell them.

 My analog is all of the strange and wondrous things our cryptographic
 protocols can do -- blind signatures, zero knowledge proofs, secure
 multiparty computation, and more -- things that weren't on the horizon
 just 35 years ago.  I'm reminded of a story about a comment Whit
 Diffie once heard from someone in the spook community about public key
 crypto.  We had it first -- but we never knew what we had.  You guys
 have done much more with it than we ever did.  All they knew to do
 with public key was key distribution or key exchange; they didn't even
 invent digital signatures.  They had non-secret encryption; we had
 public key cryptography.

 Might the same be true for QKD?  I have no idea.  I do suggest that
 it's worth thinking in those terms, rather than how to use it to
 replace conventional key distribution.  Remember that RSA's essential
 property is not that you can use it to set up a session key; rather,
 it's that you can use it to send a session key to someone with whom
 you don't share a secret.

Fair point. There may be quite interesting tricks there, but I think it
would be better if people treated this as a very interesting research
space and not as an important security technology, which is how it gets
portrayed to the press.

As an academic research project, the intersection of quantum effects and
security remains a very interesting area to explore, and we may yet get
valuable security technologies out of it.

However, the current QKD concept is not of practical use, but it is
generally portrayed as being a really important breakthrough in the
press. (This also reflects a considerable popular misunderstanding of
where the problems in security are -- they're not in defending our
link layers against eavesdropping.)

 Beyond Perry's other points -- and QKD is inherently point-to-point;
 you need n^2 connections, since you can't terminate the link-layer
 crypto at a router without losing your security guarantees -- it's
 worth reminding people that the security guarantees apply to ideal
 quantum systems.  If your emitter isn't ideal -- and of course it
 isn't -- it can (will?) emit more photons; I can play my interception
 games with the ones your detector doesn't need.

Indeed, and from my readings of the literature there are other
attacks. I find it important, however, that even if the systems worked
perfectly and as advertised, there is little reason to want them.

Perry
-- 
Perry E. Metzgerpe...@piermont.com

-
The Cryptography Mailing List
Unsubscribe by sending unsubscribe cryptography to majord...@metzdowd.com


Re: Quantum Key Distribution: the bad idea that won't die...

2010-04-22 Thread Eugen Leitl
On Thu, Apr 22, 2010 at 09:46:18AM -0400, John Lowry wrote:

 My own speculation is that the security community and its interests are
 perhaps a bit broader than than some members wish it were.
 
 If you want to see some interesting physics that represents unexpected
 results relevant to communications (and comes from entangled QKD research) 
 then take a look at: http://pra.aps.org/abstract/PRA/v81/i2/e023835

This is interesting. However, even if you can use LoS up to LEO,
the question is of what the added value of a (supposedly, trend
in QC state cloning attacks is there) tamperproof exchange is over 
traditional cryptography.

I agree with Perry that it solves a non-problem. 
 
 There is a human-readable summary at: http://focus.aps.org/story/v25/st7

-- 
Eugen* Leitl a href=http://leitl.org;leitl/a http://leitl.org
__
ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org
8B29F6BE: 099D 78BA 2FD3 B014 B08A  7779 75B0 2443 8B29 F6BE

-
The Cryptography Mailing List
Unsubscribe by sending unsubscribe cryptography to majord...@metzdowd.com


RE: Quantum Key Distribution: the bad idea that won't die...

2010-04-21 Thread John Leiseboer
At 11:31 AM -0400 4/20/10, Perry E. Metzger wrote:
I wonder why it is that, in spite of almost universal disinterest in
the
security community, quantum key distribution continues to be a subject
of active technological development.

Paul Hoffman wrote:
You hit it: almost. As long as a few researchers are interested, and
there is money to be thrown down the drain^w^w^wat them, there will be
active development.

I too once worked exclusively in the world of classical cryptography and
was sceptical of QKD. I now work in both worlds - classical cryptography
and QKD. I now know that QKD can be a part of a high performance, cost
competitive, highly secure system. I found that having an open mind
about new technologies - and I don't mean just QKD - can and does
provide insights that are useful in not only developing those new
technologies, but also in improving existing ones.
 
Just because everyone who claims to be a crypto expert, or a few of
the more well-known popular experts (often the ones with big egos and
loud voices) say that crypto is not the weakest link, or that QKD is a
bad idea, doesn't mean it's true forever, even if you want to believe
that it's true now.

I don't know what the future holds, but when I think about what
technology might be like in 10, 20, 50 years from now, I think back to
what technology was like 10, 20, 50 years ago. Things change. And they
change a lot. I doubt that public key encryption as we know it will
survive the next 50 years. Maybe it won't survive the next 10 or 20
years. Maybe it will - I just don't know. I believe that it's important
to acknowledge what we don't know, and to do our best to mitigate risks
that may come from not knowing. We can of course identify and mitigate
certain risks, even if we don't know all the facts about the risk
itself.

I worry when I see critically secure systems being deployed that rely
exclusively on public key cryptography for key distribution. I'm
disappointed when I read and hear comments from people that reject
outright, even the possibility that QKD might be practical, and have a
place in securing our current and future systems.

To respond directly to Perry's comment quoted at the beginning of this
email, I can assure you that there is actually very strong interest in
QKD in the security community. The interest is not purely academic or
oriented towards research. It has a very sound practical, commercial,
and security basis.

-- John Leiseboer, CTO, QuintessenceLabs

Everything expressed by me in this email is my personal opinion. It is
not necessarily the opinion of my employer.

-
The Cryptography Mailing List
Unsubscribe by sending unsubscribe cryptography to majord...@metzdowd.com


Re: Quantum Key Distribution: the bad idea that won't die...

2010-04-21 Thread silky
On Wed, Apr 21, 2010 at 1:31 AM, Perry E. Metzger pe...@piermont.com wrote:

 Via /., I saw the following article on ever higher speed QKD:

 http://www.wired.co.uk/news/archive/2010-04/19/super-secure-data-encryption-gets-faster.aspx

 Very interesting physics, but quite useless in the real world.

Useless now maybe, but it's preparing for a world where RSA is broken
(i.e. quantum computers) and it doesn't require quantum computers; so
it's quite practical, in that sense.


 I wonder why it is that, in spite of almost universal disinterest in the
 security community, quantum key distribution continues to be a subject
 of active technological development.

 Perry

-- 
silky

  http://www.programmingbranch.com/

-
The Cryptography Mailing List
Unsubscribe by sending unsubscribe cryptography to majord...@metzdowd.com


Re: Quantum Key Distribution: the bad idea that won't die...

2010-04-21 Thread Perry E. Metzger

silky michaelsli...@gmail.com writes:
 On Wed, Apr 21, 2010 at 1:31 AM, Perry E. Metzger pe...@piermont.com wrote:

 Via /., I saw the following article on ever higher speed QKD:

 http://www.wired.co.uk/news/archive/2010-04/19/super-secure-data-encryption-gets-faster.aspx

 Very interesting physics, but quite useless in the real world.

 Useless now maybe, but it's preparing for a world where RSA is broken
 (i.e. quantum computers) and it doesn't require quantum computers; so
 it's quite practical, in that sense.

No, it isn't. QKD is useless three different ways.

First, AES and other such systems are fine, and the way people break
reasonably designed security systems (i.e. not WEP or what have you) is
not by attacking the crypto.

Second, you can't use QKD on a computer network. It is strictly point to
point. Want 200 nodes to talk to each other? Then you need 40,000
fibers, without repeaters, in between the nodes, each with a $10,000 or
more piece of equipment at each of the endpoints, for a total cost of
hundreds of millions of dollars to do a task ethernet would do for a
couple thousand dollars.

Third, QKD provides no real security because there is no actual
authentication. If someone wants to play man in the middle, nothing
stops them. If someone wants to cut the fiber and speak QKD to one
endpoint, telling it false information, nothing stops them. You can
speak the QKD protocol to both endpoints and no one will be the
wiser. So, you need some way of providing privacy and
authentication... perhaps a conventional cryptosystem. So, what did QKD
provide you with again?

There is no point to QKD at all.

Perry
-- 
Perry E. Metzgerpe...@piermont.com

-
The Cryptography Mailing List
Unsubscribe by sending unsubscribe cryptography to majord...@metzdowd.com


Re: Quantum Key Distribution: the bad idea that won't die...

2010-04-21 Thread Perry E. Metzger

silky michaelsli...@gmail.com writes:
 First of all, I'm sure you know more about this than me, but allow me
 to reply ...

 On Wed, Apr 21, 2010 at 11:19 PM, Perry E. Metzger pe...@piermont.com wrote:
  Useless now maybe, but it's preparing for a world where RSA is broken
  (i.e. quantum computers) and it doesn't require quantum computers; so
  it's quite practical, in that sense.

 No, it isn't. QKD is useless three different ways.

 First, AES and other such systems are fine, and the way people break
 reasonably designed security systems (i.e. not WEP or what have you) is
 not by attacking the crypto.

 I didn't say AES, I said RSA. Specifically I was referring to Shors
 factoring algorithm on quantum computers :
 http://citeseerx.ist.psu.edu/viewdoc/summary?doi=10.1.1.47.3862

I'm well aware, however, AES is not going to be broken by quantum
computers (see Scott Aaronson's excellent lay explanations of the fact
that quantum computers likely can't solve NP complete problems in
polynomial time), and no one uses RSA or any other asymmetric cipher for
link encryption. RSA+DH is typically used only for bootstrapping a
symmetric cipher. QKD only provides link encryption anyway.

 Second, you can't use QKD on a computer network. It is strictly point to
 point. Want 200 nodes to talk to each other? Then you need 40,000
 fibers, without repeaters, in between the nodes, each with a $10,000 or
 more piece of equipment at each of the endpoints, for a total cost of
 hundreds of millions of dollars to do a task ethernet would do for a
 couple thousand dollars.

 Sure, now. That's the point of research though; to find more efficient
 ways of doing things.

I'm afraid that QKD is literally incapable of being done more
efficiently than this. The whole point of the protocol is to get
guarantees of security from quantum mechanics, and as soon as you have
any intermediate nodes they're gone. I know of no one who claims to have
any idea about how to extend the protocol beyond that, and I suspect it
of being literally impossible (that is, I suspect that a mathematical
proof that it is impossible should be doable.)

 Third, QKD provides no real security because there is no actual
 authentication. If someone wants to play man in the middle, nothing
 stops them. If someone wants to cut the fiber and speak QKD to one
 endpoint, telling it false information, nothing stops them. You can
 speak the QKD protocol to both endpoints and no one will be the
 wiser. So, you need some way of providing privacy and
 authentication... perhaps a conventional cryptosystem.

 I agree this is an issue, and from my reading it doesn't seem
 completely resolved,

It isn't resolved at all.

 but again I think it's reasonable to continue researching into
 solutions.

No one is doing that, though. People are working on things like faster
bit rates, as though the basic reasons the whole thing is useless were
solved.

 Importantly, however, is that if a classical system is used to do
 authentication, then the resulting QKD stream is *stronger* than the
 classically-encrypted scheme.

Nope. It isn't. The system is only as strong as the classical system. If
the classical system is broken, you lose any assurance that you aren't
being man-in-the-middled.

 So, what did QKD provide you with again?

 There is no point to QKD at all.

 I disagree.

That is, of course, your privilege.

Perry
-- 
Perry E. Metzgerpe...@piermont.com

-
The Cryptography Mailing List
Unsubscribe by sending unsubscribe cryptography to majord...@metzdowd.com


Re: Quantum Key Distribution: the bad idea that won't die...

2010-04-21 Thread silky
On Thu, Apr 22, 2010 at 10:47 AM, Perry E. Metzger pe...@piermont.com wrote:

[...]

 Second, you can't use QKD on a computer network. It is strictly point to
 point. Want 200 nodes to talk to each other? Then you need 40,000
 fibers, without repeaters, in between the nodes, each with a $10,000 or
 more piece of equipment at each of the endpoints, for a total cost of
 hundreds of millions of dollars to do a task ethernet would do for a
 couple thousand dollars.

 Sure, now. That's the point of research though; to find more efficient
 ways of doing things.

 I'm afraid that QKD is literally incapable of being done more
 efficiently than this. The whole point of the protocol is to get
 guarantees of security from quantum mechanics, and as soon as you have
 any intermediate nodes they're gone. I know of no one who claims to have
 any idea about how to extend the protocol beyond that, and I suspect it
 of being literally impossible (that is, I suspect that a mathematical
 proof that it is impossible should be doable.)

What do you mean intermediate nodes? It's possible to extend the
length of QKD depending on the underlying QKD protocol used. I.e. in
the EPR-based QKD, extension is possible.


[...]

 No one is doing that, though. People are working on things like faster
 bit rates, as though the basic reasons the whole thing is useless were
 solved.

I don't think you can legitimately speak for the entire community as
to what or not they may be doing. It's interesting to me that some
arguably unrelated fields of research (i.e. quantum repeaters) may be
useful.


  Importantly, however, is that if a classical system is used to do
  authentication, then the resulting QKD stream is *stronger* than the
  classically-encrypted scheme.

 Nope. It isn't. The system is only as strong as the classical system. If
 the classical system is broken, you lose any assurance that you aren't
 being man-in-the-middled.

No, it's not only as strong as the classical; it gets stronger if the
classical component works. Quoting from:
http://arxiv.org/abs/0902.2839v2 - The Case for Quantum Key
Distribution

If authentication is unbroken during the first round of QKD, even if
it is only computationally
secure, then subsequent rounds of QKD will be information-theoretically secure.


 Perry
 --
 Perry E. Metzger                pe...@piermont.com

-- 
silky

  http://www.programmingbranch.com/

-
The Cryptography Mailing List
Unsubscribe by sending unsubscribe cryptography to majord...@metzdowd.com


Re: Quantum Key Distribution: the bad idea that won't die...

2010-04-21 Thread silky
On Thu, Apr 22, 2010 at 12:04 PM, Perry E. Metzger pe...@piermont.com wrote:
   No one is doing that, though. People are working on things like faster
   bit rates, as though the basic reasons the whole thing is useless were
   solved.
 
  I don't think you can legitimately speak for the entire community as
  to what or not they may be doing.

 I think I can, actually. I know of very few people in computer security
 who take QKD seriously. I feel pretty safe making these sorts of
 statements.

But QKD is more about Physics than computer security. Anyway, it seems
there is little purpose in continuing the discussion.


 Importantly, however, is that if a classical system is used to do
 authentication, then the resulting QKD stream is *stronger* than the
 classically-encrypted scheme.

 Nope. It isn't. The system is only as strong as the classical system. If
 the classical system is broken, you lose any assurance that you aren't
 being man-in-the-middled.

 No, it's not only as strong as the classical; it gets stronger if the
 classical component works. Quoting from:
 http://arxiv.org/abs/0902.2839v2 - The Case for Quantum Key
 Distribution

 If authentication is unbroken during the first round of QKD, even if
 it is only computationally secure, then subsequent rounds of QKD will
 be information-theoretically secure.

 Read what you just wrote.

 IF THE AUTHENTICATION IS UNBROKEN. That is, the system is only secure if
 the conventional cryptosystem is not broken -- that is, it is only as
 secure as the conventional system in use. Break the conventional system
 and you've broken the whole thing.

Yes, I never stated the opposite (quote tree left intact). You were
saying that it is only as strong as the classical system. It is
clearly shown that the security of a QKD system *after* authentication
is *stronger* than classical, due to the OTP.

If what you meant to say was it is broken if authentication is
broken then the answer is obviously yes. But the strength, in
cryptographic terms, is clearly better.


 Perry
 --
 Perry E. Metzger                pe...@piermont.com

-- 
silky

  http://www.programmingbranch.com/

-
The Cryptography Mailing List
Unsubscribe by sending unsubscribe cryptography to majord...@metzdowd.com


Re: Quantum Key Distribution: the bad idea that won't die...

2010-04-21 Thread Perry E. Metzger

Let me note that Mr. Leiseboer is the CTO of a company that makes QKD
equipment.

John Leiseboer jleiseb...@bigpond.com writes:
 I too once worked exclusively in the world of classical cryptography and
 was sceptical of QKD. I now work in both worlds - classical cryptography
 and QKD. I now know that QKD can be a part of a high performance, cost
 competitive, highly secure system.

On what basis do you know this?

Again, there are three insurmountable problems here:

QKD requires a conventional cryptosystem on top to provide
authentication and privacy in the face of man-in-the middle attacks (so
why do you want the QKD system?)

QKD is inherently incompatible with networks -- it is point to point
security only.

QKD provides no practical security over conventional cryptosystems. No
one attacks your security by breaking a modern system like AES -- people
look elsewhere to attack you. Not, of course, that it matters, because
if you can break AES, you can break a QKD system just by playing
man-in-the-middle, so again, why use QKD?

 Just because everyone who claims to be a crypto expert, or a few of
 the more well-known popular experts (often the ones with big egos and
 loud voices) say that crypto is not the weakest link, or that QKD is a
 bad idea, doesn't mean it's true forever, even if you want to believe
 that it's true now.

It is true forever. QKD doesn't even provide any security at all. As
I've said repeatedly:

As soon as you put a man in the middle with a pair of QKD boxes, each
endpoint will happily communicate with it as though it was the other
end. So, your security depends on having the data also authenticated and
encrypted with a conventional system. If the conventional system is
broken, the QKD added nothing. If the conventional system works, you
didn't need the QKD.  Game over.

If you can explain how to get around this, I'm all ears.

And please, no more comments about big egos. Technical arguments
only. This is not a marketing list, it is a technical list. I'm pretty
ruthless about cutting people off if they get insulting.

 I don't know what the future holds, but when I think about what
 technology might be like in 10, 20, 50 years from now, I think back to
 what technology was like 10, 20, 50 years ago. Things change. And they
 change a lot. I doubt that public key encryption as we know it will
 survive the next 50 years.

That's a very bold statement, and one that I doubt you can back up, but
it is irrelevant to the current discussion, since no one encrypts links
with public key anyway. They may use it for key exchange -- but again,
QKD only provides link security, and you need a conventional crypto
system running on top of it anyway because it can't defend against man
in the middle attacks anyway, so it doesn't matter. If RSA and DH can't
be trusted for key exchange, then both the conventional and the QKD
systems will need keys for conventional ciphers manually loaded at both
ends -- QKD isn't secure without the conventional cipher system
providing authentication and privacy in the face of man in the middle
attacks.

 I worry when I see critically secure systems being deployed that rely
 exclusively on public key cryptography for key distribution.

Well, since any secure QKD system needs a conventional cryptosystem on
top to provide the actual security anyway, this is not an advantage of
QKD. If it is a problem conventional systems can't surmount, QKD can't
surmount it. If conventional systems can get beyond it, then QKD isn't
needed.

 I'm disappointed when I read and hear comments from people that reject
 outright,

Well, you'll have to explain why I'm wrong, then.

In detail.

 even the possibility that QKD might be practical, and have a place in
 securing our current and future systems.

It is practical to build very expensive QKD boxes. It is totally
impractical to use them vs. just using a conventional cipher.

 To respond directly to Perry's comment quoted at the beginning of this
 email, I can assure you that there is actually very strong interest in
 QKD in the security community.

Not at the conferences I go to. I can't name anyone who has any interest
in it at all. Mostly we sit around at the bar and wonder why the hell
people keep spending money on it.

If you care to name people who have an interest here, please let me
know. I haven't found them.

 The interest is not purely academic or oriented towards research. It
 has a very sound practical, commercial, and security basis.

I again note that Mr. Leiseboer is the CTO of a company that makes QKD
equipment.

If you dispute my position here, I'm happy to discuss it, but you're
going to have to explain why I'm wrong -- a detailed technical
explanation, not a set of assertions.

Perry
-- 
Perry E. Metzgerpe...@piermont.com

-
The Cryptography Mailing List
Unsubscribe by sending unsubscribe cryptography to majord...@metzdowd.com


Re: Quantum Key Distribution: the bad idea that won't die...

2010-04-21 Thread Perry E. Metzger

silky michaelsli...@gmail.com writes:
 On Thu, Apr 22, 2010 at 12:04 PM, Perry E. Metzger pe...@piermont.com wrote:
   No one is doing that, though. People are working on things like faster
   bit rates, as though the basic reasons the whole thing is useless were
   solved.
 
  I don't think you can legitimately speak for the entire community as
  to what or not they may be doing.

 I think I can, actually. I know of very few people in computer security
 who take QKD seriously. I feel pretty safe making these sorts of
 statements.

 But QKD is more about Physics than computer security.

I agree it is an interesting physics trick -- considerable fun to read
about. I disagree that it is of use in making computer systems secure.

 Yes, I never stated the opposite (quote tree left intact). You were
 saying that it is only as strong as the classical system. It is
 clearly shown that the security of a QKD system *after* authentication
 is *stronger* than classical, due to the OTP.

 If what you meant to say was it is broken if authentication is
 broken then the answer is obviously yes. But the strength, in
 cryptographic terms, is clearly better.

Lets look at the two possible scenarios.

If the conventional crypto is secure, then the whole system is secure.
If the conventional crypto is insecure, then the whole system is
insecure.

Looks to me like the system is only as strong as the classical
system. If the classical system is unbroken, you don't need the QKD
box. If the classical system is broken, the QKD box adds no
security. Ergo, the system is only as strong as the classical system.


Perry
-- 
Perry E. Metzgerpe...@piermont.com

-
The Cryptography Mailing List
Unsubscribe by sending unsubscribe cryptography to majord...@metzdowd.com


Re: Quantum Key Distribution: the bad idea that won't die...

2010-04-20 Thread Paul Hoffman
At 11:31 AM -0400 4/20/10, Perry E. Metzger wrote:
I wonder why it is that, in spite of almost universal disinterest in the
security community, quantum key distribution continues to be a subject
of active technological development.

You hit it: almost. As long as a few researchers are interested, and there is 
money to be thrown down the drain^w^w^wat them, there will be active 
development.

--Paul Hoffman, Director
--VPN Consortium

-
The Cryptography Mailing List
Unsubscribe by sending unsubscribe cryptography to majord...@metzdowd.com