Quantum crypto's demise is greatly exaggerated
Connecting state and local government leaders
A method of intercepting quantum crypto keys in commercial products, demonstrated earlier this year, is easily defeated by properly implementing the hardware used to distribute the keys, according to researchers from Toshiba’s Cambridge Research Laboratory.
Using quantum physics to exchange secret cryptographic keys is safe after all, according to researchers. You just have to be sure the hardware is properly set up.
In September, a group of European researchers demonstrated that commercial implementations of quantum key distribution (QKD), which by its nature should be secure, could be cracked using off-the-shelf equipment. But new research has found that such an attack is easily countered by properly implementing the hardware.
Scientists at Toshiba’s Cambridge Research Laboratory in England, in an article to be published in the December issue of Nature Photonics, report that the protocol for quantum distribution of digital encryption keys across optical fiber is perfectly secure from eavesdropping. The vulnerability found in the earlier research arises from real-world implementation of the protocol in commercial products that fall short, the authors write.
Related stories:
Quantum crypto products cracked by researchers
A quantum leap for cryptography
The Cambridge findings confirm the opinion of a scientist at the National Institute of Standards and Technology, who said shortly after the demonstration was reported that “this hacking can be easily prevented.”
Xiao Tang, NIST quantum communications project leader, said that the light pulses used in the attack could be easily detected by the recipient of the key, which could raise alarms about a possible eavesdropper. Increased error rates in the transmission caused by the interception also would be an indicator of a third party, he said.
Quantum key distribution uses the quantum state of individual photons for the exchange of data. Each photon, properly detected, conveys a single bit of data, which in theory cannot be read or interfered with without detection. The technique has been proved in laboratories, including those a NIST, and several commercial products using it are available.
The researchers who reported the weakness in August, also in Nature Photonics, tested their scheme on products sold by ID Quantique and MagiQ Technologies. They wrote that the photon detectors in QKD systems could be spoofed using a bright laser, which would prevent an intrusion from being detected and allow an eavesdropper to intercept information.
The Cambridge team, however, reports that potential eavesdroppers can be thwarted by ensuring that redundant resistors are not included with a single-photon detector, and setting discrimination levels appropriately. Monitoring the photocurrent generated by the detector also can detect and prevent the bright light attack used to intercept data during the key exchange.
The technique uses a laser to blind the detector used to receive key data, so that it responds to laser pulses rather than individual photons that contain the data. The eavesdropper intercepts and resends the stolen key data via laser to the recipient, so that the eavesdropper also has a copy of the key that has been exchanged.
The Toshiba team showed that this detector blinding is ineffective when the single-photon detectors used in the key exchange are implemented and used correctly.
The researchers who demonstrated the original attack technique said at the time that it was an indication of the immaturity of quantum cryptography rather than an inherent insecurity.
Andrew Shields, assistant managing director of Toshiba Research Europe, said his team’s work demonstrates a new phase of maturity for quantum cryptography “in which the security of particular implementations is carefully analyzed and tested. This is important to uncover any security loopholes and to devise appropriate countermeasures. It will allow real-world devices to approach the perfect security that can be proven for the protocol.”