Jump to content

Quantum key distribution

From Wikipedia, the free encyclopedia
This is an old revision of this page, as edited by Lawrencec (talk | contribs) at 19:07, 13 October 2006. The present address (URL) is a permanent link to this revision, which may differ significantly from the current revision.

Quantum cryptography uses quantum mechanics for secure communications. Unlike traditional cryptography, which employs various mathematical techniques to restrict eavesdroppers from learning the contents of encrypted messages, quantum cryptography is based on the physics of information. Eavesdropping can be viewed as measurements on a physical object — in this case the carrier of the information. Using quantum phenomena such as quantum superpositions or quantum entanglement one can design and implement a communication system which can always detect eavesdropping. This is because measurements on the quantum carrier of information disturbs it and therefore leaves traces.

Quantum key exchange

Whereas classical public-key cryptography relies on the computational difficulty of certain hard mathematical problems (such as integer factorization) for key distribution, quantum cryptography relies on the laws of quantum mechanics. Quantum cryptographic devices typically employ individual photons of light and take advantage of either the Heisenberg uncertainty principle or quantum entanglement.

Uncertainty: The act of measurement is an integral part of quantum mechanics, not just a passive, external process as in classical physics. So it is possible to encode information into some quantum properties of a photon in such a way that any effort to monitor them necessarily disturbs them in some detectable way. The effect arises because in quantum theory, certain pairs of physical properties are complementary in the sense that measuring one property necessarily disturbs the other. This statement is known as the Heisenberg uncertainty principle. The two complementary properties that are often used in quantum cryptography, are two types of photon’s polarization, e.g. rectilinear (vertical and horizontal) and diagonal (at 45° and 135°).

Entanglement: It is a state of two or more quantum particles, e.g. photons, in which many of their physical properties are strongly correlated. The entangled particles cannot be described by specifying the states of individual particles and they may together share information in a form which cannot be accessed in any experiment performed on either of the particles alone. This happens no matter how far apart the particles may be at the time.

Two different approaches

Based on these two counter-intuitive features of quantum mechanics (uncertainty and entanglement), two different types of quantum cryptographic protocols were invented. The first type uses the polarization of photons to encode the bits of information and relies on quantum randomness to keep Eve from learning the secret key. The second type uses entangled photon states to encode the bits and relies on the fact that the information defining the key only "comes into being" after measurements performed by Alice and Bob.

Polarized photons - Charles H. Bennett and Gilles Brassard (1984)

This cryptographic scheme, known as BB84, uses pulses of polarized light, with one photon per pulse. Consider two types of polarization, linear and circular. Linear polarization can be vertical or horizontal and circular polarization can be left-handed or right-handed. Any type of polarization of a single photon can encode one bit of information, for example, vertical polarization for "0" and horizontal polarization for "1" or left-handed polarization for "0" and right-handed polarization for "1". In order to generate a random key, Alice must send either horizontal or vertical polarization with equal probability. To keep Eve from successfully eavesdropping, Alice also uses randomly the alternative circular polarizations randomly choosing between left-handed and right-handed photons.

Entangled photons - Artur Ekert (1991)

The Ekert scheme uses entangled pairs of photons. These can be made by Alice, by Bob, or by some source separate from both of them, including eavesdropper Eve, although the problem of certifying them will arise. In any case, the photons are distributed so that Alice and Bob each end up with one photon from each pair.

The scheme relies on three properties of entanglement. First, we can make entangled states which are perfectly correlated in the sense that if Alice and Bob both test whether their particles have vertical or horizontal polarizations, they will always get opposite answers. The same is true if they both measure any other pair of complementary (orthogonal) polarizations. However, their individual results are completely random: it is impossible for Alice to predict if she will get vertical polarization or horizontal polarization.

Second, these states have a property often called quantum non-locality, which has no analogue in classical physics. If Alice and Bob carry out polarization measurements, their answers will not be perfectly correlated, but they will be somewhat correlated. That is, there is an above-50% probability that Alice can, from her measurement, correctly deduce Bob's measurement, and vice versa. And these correlations are stronger - Alice's guesses will on average be better - than any model based on classical physics or ordinary intuition would predict.

Third, any attempt at eavesdropping by Eve will weaken these correlations, in a way that Alice and Bob can detect.

Privacy amplification

Quantum cryptography protocols achieve something that ordinary classical cryptography cannot. They allow Alice and Bob to generate and share random keys which are very similar - in perfect conditions they would be identical, but actually there will be some error rate. They also allow Alice and Bob to estimate the level of eavesdropping and so work out the maximum amount of information Eve can have about their shared random keys. These are interesting results, but on their own they are not enough to solve the key distribution problem. It could be disastrous if Eve learns even a small part of the cryptographic key: she could then read part - perhaps a critical part - of the secret message Alice wants to send. Because errors and background noise can never completely be avoided, Alice and Bob can never guarantee that Eve has no information at all about their keys - communication errors and eavesdropping cannot be distinguished, and so to be on the safe side Alice and Bob have to assume that all discrepancies are due to Eve.

Privacy amplification is a sort of cryptographic version of error correction, which allows Alice and Bob to start with similar shared random keys about which Eve has some information and make shorter shared random keys which are identical and about which Eve has (essentially) no information.

Though classical privacy amplification can be used for either the Bennett-Brassard or the Ekert protocols, it turns out that entanglement-based cryptography allows privacy amplification to be carried out directly at the quantum level. This is more efficient, and has other advantages. In particular, when the technology is fully developed, it will allow quantum cryptography to be carried out over arbitrarily long distances by using quantum repeater stations along the communication route.

Limitation: no deniability

One limitation of quantum key exchange via Bennett and Brassards approach is that although it may be used to create one time pad keys providing 'perfect security', it may affect the one time pad's deniability property ie. that the sender (Alice) may encrypt a message with one key, but after having sent the encryption pretend that the message was a different one, encrypted with a different key.

The reason for this is that an eavesdropper (Eve) who only listens to a very small part of the key exchange (and therefore disturbs a few bits, but not enough to invalidate the protocol) will then know what has happened in a limited number of the bits exchanged. If challenged to reveal what was sent and the key used, Alice and Bob must change the key, and therefore must alter their records which were used to obtain it, in order to 'deny' the message. However, there is a non-zero probability that Eve has successfully listened to the parts of their records that they change. She will therefore know that the key they are pretending to have used is false, and therefore that they are lying.

This problem is related to in the impossiblity of 'bit commitment' using quantum protocols.

It is thought that other protocols using Eliptic curves, and quantum computers may allow deniability to be reascribed to QKE.

D Beaver On Deniability in QKE. EUROCRYPT conference 2002)

Attacks

In Quantum Cryptography, traditional man-in-the-middle attacks are impossible due the Observer Effect. If Mallory attempts to intercept the stream of photons, he will inevitably alter them. He cannot re-emit the photons to Bob correctly, since his measurement has destroyed information about the photon's full state and correlations.

If Alice and Bob are using an entangled photon system, then it is virtually impossible to hijack these, because creating three entangled photons would decrease the strength of each photon to such a degree that it would be easily detected. Mallory cannot use a man-in-the-middle attack, since he would have to measure an entangled photon and disrupt the other photon, then he would have to re-emit both photons. This is impossible to do, by the laws of quantum physics.

Because a dedicated fiber optic line is required between the two points linked by quantum cryptography, a denial of service attack can be mounted by simply cutting the line or, perhaps more surreptitiously, by attempting to tap it. If the equipment used in quantum cryptography can be tampered with, it could be made to generate keys that were not secure using a random number generator attack.

Quantum cryptography is still vulnerable to a type of MITM where the interceptor (Eve) establishes herself as "Alice" to Bob, and as "Bob" to Alice. Then, Eve simply has to perform QC negotiations on both sides simultaneously, obtaining two different keys. Alice-side key is used to decrypt the incoming message, which is reencrypted using the Bob-side key. This attack fails if both sides can verify each other's identity.

Adi Shamir has proposed an attack which applies at least to polarization schemes. Rather than attempt to read Alice and Bob's single photons, Mallory sends a large pulse of light back to Alice in between transmitted photons. Alice's equipment inevitably reflects some of Mallory's light. Even if the transmitting equipment is dead black it has some small reflectivity. When Mallory's light comes back to Mallory it is polarized and Mallory knows the state of Alice's polarizer.

History

Quantum cryptography was proposed first by Stephen Wiesner, then at Columbia University in New York, who, in the early 1970s, introduced the concept of quantum conjugate coding. His seminal paper titled "Conjugate Coding" was rejected by IEEE Information Theory but was eventually published in 1983 in SIGACT News (15:1 pp. 78-88, 1983). In this paper he showed how to store or transmit two messages by encoding them in two “conjugate observables”, such as linear and circular polarization of light, so that either, but not both, of which may be received and decoded. He illustrated his idea with a design of unforgeable bank notes. A decade later, building upon this work, Charles H. Bennett, of the IBM Thomas J. Watson Research Center, and Gilles Brassard, of the Université de Montréal, proposed a method for secure communication based on Wiesner’s “conjugate observables”. In 1990, independently and initially unaware of the earlier work, Artur Ekert, then a Ph.D. student at the University of Oxford, developed a different approach to quantum cryptography based on peculiar quantum correlations known as quantum entanglement.

Prospects

Entangled quantum states are rarely stable long enough for practical applications. The first commercial applications of quantum cryptography have thus a limited reach (100 kilometers maximum). Research is done into satellite transmission of the quantum states, since outside the atmosphere, there would be considerably less perturbating interactions.

Commercial quantum cryptography devices have become available that show promise of replacing such protocols as Diffie-Hellman key exchange in some high value applications. Factors weighing against wide application include the cost of equipment and dedicated fiber optic line, the requirement to trust the equipment vendor (as contrasted with open source encryption software running on off the shelf computers), and the lack of a demonstrated threat to existing key exchange protocols. The wide availability of inexpensive mass storage makes it easier to send large quantities of keying material by courier. For example, some quantum cryptography vendors offer systems that change AES keys 100 times a second. A year's supply of AES128 keys, changed at that rate, will fit on a high-end iPod or 11 DVD-Rs, and these have the additional advantage that they can be carried anywhere in the world with the parties.

See also


Retrieved from "https://en.wikipedia.org/w/index.php?title=Quantum_key_distribution&oldid=81260174"