Bulletproof quantum crypto dinged by implementation weakness

Quantum crypto too easy

So they worked out a complex way of getting partial key, great. But this becomes a man in the middle attach and prone to the issue that as soon as you leave or make a single mistake, you are noticed.

You still have valuable data, but now they know and will be after you.

From the depths of history (say about 5 years ago) there was a much better attack.

Quantum key transport relies on groups or orthogonal detectors at each end of the link, such that as each entangled photon is received one measurement (e.g. polarization) is randomly made and the result stored. Later the other party, making random measures on the entangled pair of each photon you got passes their result table (in the clear) to you. (no risk here as the table is just random bits)

By Xor'ing the tables together you get the crypto key to be used on subsequent comms.

Here is the weakness: the random choice of measure is just that random, it is the comparison of the two tables that results in a key. If you could fix the random choice of one party to a known string then you can know what measure they will make and then be able to listen in, do what they would do and pass on the result.

The easiest way to do that is simple, just send a burst of polarized light bright enough to blind one sensor of one party, before they get to exchanging keys. Then you know that from then on whatever random measurement choice they make the crypto bits will always come from the other channel.

Hard to explain, but easy to do hence looking for my calculator.

@rich

"I met some Swedish people in Germany who went to Linköping Uni, and they reckoned it was a swinging place! So, what do I know? "

WIth only tufty grass and time on their hands - what do you think they did to pass the time?

Swinging....... Hmmmm..... I'll bet it did not involve a pendulum-like oscillating seat.

Should have seen it coming, actually...

" The underlying reason for this is that the authentication used, which is insensitive to such message changes when the key is unknown, becomes sensitive when used with a partially known key."

...so the message is in a box and is both alive and dead until someone uses the crypto-key to look into the box.

Dr Schrödinger would be so proud!

Superposing the themes here...

Erwin Schrödinger (above left) ties in very nicely with swinging, being something of a ladies' man. Proving that it is possible to be a Romeo and a geek simultaneously (how does this compare with a cat being both alive and dead?), he would delay his climax by solving complex equations in his head. His famous wave equation is supposed to have originated during a tryst in the Austrian Tirol.

DoS

So if any keys that get observed in transit are discarded, this would seem to expose a fairly simple DoS attack. If you have access to the physical cable, you would just need to put on a device that observed all of the traffic in flight, and it would discard every key it tried to send. It would be fairly obvious you had done this, but if your goal was just to disrupt comms rather than intercept them, that would work fine.

That would mean you'd need pretty good physical security on the fibre from source to destination, which would definitely bump the cost up a good deal.

@ brian

'Swinging....... Hmmmm..... I'll bet it did not involve a pendulum-like oscillating seat.'

Depends which catalogues you order from. Not that I have any experience of course.

Paris, well... Obvious really innit...

@Daniel B

Nearly right, in fact you send Keylength*3 (say) qbits. The first keylength qbits allow us to check if line is being tapped, we share publicly which filter we used and the result of using that filter with other party, if when using same filter we have different readings (more than can be accounted for by noise) we know comms are being intercepted. (This is due to quantum! ie observing the qbit affects it's state.

We can then use remaining Keylength*2 qbits to create the key, we form this by sharing with other party publicly the filters used for each qbit. Where we used the same filter we will both know what the polarisation of the qbit was and hence can use this info to create a key that can then be used for a more standard crypto system (ie a perfectly secure one time pad)

</geek mode>

@CTG

If you have physical access to the cable you can cut the fscking thing. That would be a pretty effective DoS attack too.

@CTG and AC

I like the JCB line of DoS tools myself, their fibre detecting units seem to be highly accurate....