Internet DRAFT - draft-licalsi-quantum-crypto-difficulty
draft-licalsi-quantum-crypto-difficulty
Quantum Internet Research Group D. Li Calsi
Internet-Draft P. Kohl
Intended status: Informational JH. Choi
Expires: 17 May 2024 J. Nötzel
TQSD Technische Universität München
14 November 2023
On the difficulty of Quantum Cryptography in presence of packet losses
draft-licalsi-quantum-crypto-difficulty-01
Abstract
From the communication viewpoint, qubits are different from classical
bits. A qubit may be transmitted directly but it can’t be cloned or
measured without altering its state, so existing copy-and-resend
schemes can’t be used to handle a transmission failure. Moreover, in
some cases, the sender does not know the state of the transmitted
qubit, so a qubit loss may cause irrevocable damage. This draft
presents the causes of transmission failures, and analyses the
vulnerabilities of several crypto protocols that such defects may
bring forth. Thus, quantum teleportation is highly recommended for
certain applications.
Status of This Memo
This Internet-Draft is submitted in full conformance with the
provisions of BCP 78 and BCP 79.
Internet-Drafts are working documents of the Internet Engineering
Task Force (IETF). Note that other groups may also distribute
working documents as Internet-Drafts. The list of current Internet-
Drafts is at https://datatracker.ietf.org/drafts/current/.
Internet-Drafts are draft documents valid for a maximum of six months
and may be updated, replaced, or obsoleted by other documents at any
time. It is inappropriate to use Internet-Drafts as reference
material or to cite them other than as "work in progress."
This Internet-Draft will expire on 17 May 2024.
Copyright Notice
Copyright (c) 2023 IETF Trust and the persons identified as the
document authors. All rights reserved.
Li Calsi, et al. Expires 17 May 2024 [Page 1]
Internet-Draft Quantum crypto difficulty November 2023
This document is subject to BCP 78 and the IETF Trust's Legal
Provisions Relating to IETF Documents (https://trustee.ietf.org/
license-info) in effect on the date of publication of this document.
Please review these documents carefully, as they describe your rights
and restrictions with respect to this document. Code Components
extracted from this document must include Revised BSD License text as
described in Section 4.e of the Trust Legal Provisions and are
provided without warranty as described in the Revised BSD License.
Table of Contents
1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 2
2. Problems of direct transmission . . . . . . . . . . . . . . . 3
2.1. Quantum information limit . . . . . . . . . . . . . . . . 3
2.2. Transmission limit . . . . . . . . . . . . . . . . . . . 4
2.2.1. Absorption due to Material Choice . . . . . . . . . . 4
2.2.2. Dispersion and Spectral Broadening . . . . . . . . . 6
2.2.3. Polarisation-dependency . . . . . . . . . . . . . . . 7
2.3. Transduction limit . . . . . . . . . . . . . . . . . . . 7
3. Vulnerabilities . . . . . . . . . . . . . . . . . . . . . . . 8
3.1. Attacks to public-key encryption and digital signature . 9
3.2. Attacks to authentication . . . . . . . . . . . . . . . . 10
3.3. Attacks to quantum money . . . . . . . . . . . . . . . . 11
3.4. Attacks to Oblivious Transfer . . . . . . . . . . . . . . 11
4. Conclusion . . . . . . . . . . . . . . . . . . . . . . . . . 12
4.1. Quantum teleportation . . . . . . . . . . . . . . . . . . 12
4.2. Security by design . . . . . . . . . . . . . . . . . . . 13
5. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 13
6. Security Considerations . . . . . . . . . . . . . . . . . . . 13
7. References . . . . . . . . . . . . . . . . . . . . . . . . . 13
7.1. Informative References . . . . . . . . . . . . . . . . . 13
Acknowledgements . . . . . . . . . . . . . . . . . . . . . . . . 15
Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . 15
1. Introduction
Despite our efforts to mitigate this phenomenon, real networks are
subject to packet losses. The problem is still present in classical
communication, where it causes disruptions to communications
requiring re-transmissions. The problem is a consequence of several
phenomena such as network congestion, strong channel noise, and
hardware/software faults. Quantum communication is much more
sensitive to noise than classical communication due to the physical
nature of the communication medium. Because of that, it is
reasonable to assume that data losses will eventually occur in real
quantum communication systems. While classically this is often
regarded as a threat to communication performance, in quantum
communications it also threatens the security of some protocols. In
Li Calsi, et al. Expires 17 May 2024 [Page 2]
Internet-Draft Quantum crypto difficulty November 2023
fact, several quantum cryptography protocols are provably secure
because attackers can only access a single copy of some target
quantum state and cannot clone quantum information. For instance,
the majority of QKD protocols assume that Alice and Bob exchange
qubits once and no retransmission is needed, although some qubits
might be lost. If we drop these assumptions, the security of such
protocols is threatened, although with varying degrees. While some
protocols can tolerate replicas of quantum states, others suffer much
more from these attacks, and could potentially be broken. The threat
is a consequence of the fact that losses and malicious man-in-the-
middle attacks are fundamentally indistinguishable. When some packet
is lost in classical or quantum networks, it is impossible to tell
whether that happened due to innocent errors or due to malicious
agents. While classical cryptography is agnostic to how many copies
of some message the attacker can access, (that is possessing m>1
copies of some message will not help the attacker) the same cannot be
claimed for most quantum cryptography protocols. In the following we
consider some cryptographical primitives using quantum states to
defend against attackers. We show attacks based on the presence of
data losses threatening their security or practicality, and discuss
possible mitigations.
2. Problems of direct transmission
2.1. Quantum information limit
Qubits may be directly transmitted by encoding them into a physical
medium, such as photons and sending them over a quantum channel, e.g.
an optical fiber. However, a qubit is more vulnerable to a link
failure than a classical bit, so direct transmission may cause some
serious, even irrevocable problem.
In fact quantum states often are rather fragile to environmental
noise, so a transmission failur in the direct link is more likely.
Furthermore, the qubit's state description and evolution is governed
by the laws of quantum mechanics, such as the quantum measurement
postulate and the no-cloning theorem. The latter entails the severe
constraint that it’s impossible to read and copy an arbitrary unknown
qubit without altering its state. Hence, the classical recovery
mechanisms such as copy-and-retransmission are often unfeasible.
In some quantum applications, e.g. BB84 QKD [Bennett] a sender may
know the state of the qubit to send, so, in case of a link failure it
can prepare and resend the same state. However, for some
applications this is not possible. For example, a bank may issue a
quantum banknote (using Wiesner’s scheme for quantum money [Wiesner])
to a user. If the user sends the banknote's qubits to the bank for
verification via direct transmission, and (some part of) the banknote
Li Calsi, et al. Expires 17 May 2024 [Page 3]
Internet-Draft Quantum crypto difficulty November 2023
is lost just once due to a link failure, then it cannot be recovered.
That is because the user has no idea of the state of the quantum
banknote, else he would be able to generate an arbitrarily high
number of copies and break the scheme.
Even when a retransmission is possible, that may result in a security
vulnerability. Several quantum cryptography protocols rely on the
characteristic that qubits can’t be copied. However, retransmission
may allow a malicious node to acquire a copy of the state. For
example, as we will see later, some Quantum Public Key scheme
[Nikolopoulos1], assumes only limited number of public keys are
distributed. An attacker may falsely claim a link failure and
acquire another copy of public key to compute the matching private
key.
2.2. Transmission limit
Transmission is limited by different phenomena in the real world. We
will focus on fibre optical networks here, as they are widely
employed commercially.
There are different mechanisms of loss which can occur in optical
fibres, resulting in insertion loss e.g. intrinsic absorption/
scattering, dispersion, absorption due to splicing/connections,
Radiation Induced Attenuation, and micro- and macrobends.
Additionally there is return loss caused by reflection of signal at
material interfaces. Polarisation can be another source of losses as
polarisation is not necessarily (perfectly) maintained in
transmission and also source and receiver may have a polarisation
dependence.
In theory one could use a single fibre to connect two endpoints
avoiding splicing and connections, and also use perfectly straight
fibre, resulting in no loss due to bends. Additionally radiation
induced attenuation due to cosmic radiation and the like cannot be
easily quantified. Thus we will focus here on intrinsic absorption,
dispersion and polarisation as they are more independent of a
specific implementation.
2.2.1. Absorption due to Material Choice
Optical fibres exhibit losses when light is transmitted through them
like any other material. Obviously optical fibres are engineered in
a way, s.t. losses of light are minimised, but some absorption is
intrinsic. If one looks at the intrinsic properties of the fibres it
is evident which wavelengths are advantageous. These wavelengths are
often employed in telecommunication applications. Generally fibre
optical networks use silica (SiO2) fibres with very little
Li Calsi, et al. Expires 17 May 2024 [Page 4]
Internet-Draft Quantum crypto difficulty November 2023
attenuation in the infrared (IR) range. The light with wavelengths
from 600 nm to 1800 nm exhibits low absorption in silica fibres.
[Kohl]
There are different local minima in those ranges, which are created
by different loss mechanisms in the fibres. With increasing
wavelength λ the elastical scattering on particles with diameter d ≪
λ is governed by the Rayleigh scattering cross-section Cs,λ ∝ 1/λ^4.
[Howell] This means increasing λ yields lower attenuation. This is
counteracted by the increasing absorption of IR by SiO2 with
increasing wavelength. Additionally, there is the OH– absorption
peak around ∼ 1440 nm. This results in the lowest attenuations in
the so-called O-band around ∼ 1310 nm and the so-called C-band around
∼ 1550 nm which includes the global minimum of attenuation. [Kohl]
The O-band is worth mentioning, because it includes the region for
zero wave packet dispersion, which minimises signal distortion due to
chromatic effects [Zeuner] [Portalupi] and also using the same fibre
for classical communication and quantum key distribution (QKD) via
Wavelength Division Multiplexing (WDM) works best for the O-band in
metropolitan area networks. [Gruenenfelder] This explains the choice
of wavelength bands used in telecommunication, but also shows that
still in the best case scenario there is absorption of around 0,2 dB/
km in commercial networks using the C-band. It would be possible to
consider hollow-core optical fibres to reduce absorption and achieve
an in general different behaviour, but those fibres are not widely
employed in commercial networks (yet?). Additionally, this does not
change the general principle that there always will be intrinsic
losses. In quantum communication applications encoding qubits e.g.
in the polarisation of single photons this loss mechanism may lead to
problems, as physical qubits may be lost in transmission. To
mitigate this, one would for example employ error correction
procedures which encode the information of one logical qubit in
multiple physical ones, where the number of physical qubits is high
enough to correct errors arising from missing photons due to
absorptive effects in transmission. On the other hand, encoding of
information into laser pulses in different time bins – i.e. arrival
times of photons – may not suffer as strongly from absorption. So in
summary – depending on the encoding of information into a physical
property of the sent photons – absorption may pose a significant
challenge.
Li Calsi, et al. Expires 17 May 2024 [Page 5]
Internet-Draft Quantum crypto difficulty November 2023
2.2.2. Dispersion and Spectral Broadening
Another fundamental effect which may be problematic in transmission
is dispersion – i.e. wavelength dependency of the refractive index in
a material. This may lead to broadening of a pulse with non-zero
spectral linewidth (non-zero linewidth is unavoidable in reality),
because the different frequencies the light is consisting of travel
with different velocities through the medium. This broadens the
pulse temporally.
Similarly there is also spectral broadening. Even atomic transitions
are not able to produce perfectly monochromatic light. Some
intrinsic effects produce a Lorentzian distribution of wavelengths in
the best case, while accounting for thermal effects produces a
Gaußian distribution. [Fox] This broadening might contribute to
losses due to wavelength-dependent efficiency of detectors. Also
absorption is wavelength dependent as shown above, thus it may also
lead to attenuation in this way. It is also obvious that a finite
energy pulse of light which broadens spectrally has to obey
conservation of energy, that means the same amount of energy has to
be spread over more wavelengths than before, implying that the energy
spreads as well, reducing the amplitude of the peak as a whole.
The problem with dispersion is the following: As quantum computation
and e.g. quantum repeaters with photons rely on two-photon
interference (Hong-Ou-Mandel effect), photons need to be
indistinguishable, i.e. identical in every respect. Dispersion now
introduces variation in the photon wavepacket impacting the success
rate of quantum operations. Especially if photons travel through a
different path dispersion will introduce some distinguishability,
which might prove fatal. [Portalupi] As mentioned before in the
O-band around 1310 nm photons exhibit zero wave packet dispersion in
SiO2 fibres. [Zeuner] Thus, depending on the requirements and
structure of a specific setup or implementation of protocol it may be
advisable to choose the C-band if dispersion effects can be mitigated
– e.g. if all photons traverse the same fibre or they do not have to
interfere, but have to travel longer distances – while choosing the
O-band in applications where dispersion might hinder interference.
The concept of soliton is worth mentioning in this context, as in
this case nonlinear effects and dispersion cancel. [Taylor] So if
one is able to generate solitons one is able to counteract the
effects of dispersion. This might be a route construct physical
systems circumventing this problem.
Li Calsi, et al. Expires 17 May 2024 [Page 6]
Internet-Draft Quantum crypto difficulty November 2023
2.2.3. Polarisation-dependency
Depending on application and encoding the polarisation of light is
instrumental in quantum cryptography (often QKD protocols use
polarisation encoding). Thus, it is important to note that in
transmission in a real fibre (even a polarisation maintaining (PM)
fibre) the polarisation is not maintained perfectly. This can be
measured via the polarisation extinction ratio (PER) given in [dB].
Thus over long distances it is possible that the polarisation state
of light is altered, which may result in loss of quantum information.
Additionally, many optical components have a polarisation dependence
with different efficiencies for the different polarisation states,
e.g. detectors may have a higher sensitivity for one polarisation
rather than the other, resulting in statistically skewed results.
In consequence one has to calculate the impact of all of these
effects in a given setup and ponder if this significantly impacts the
given system.
2.3. Transduction limit
Not only the transmission limits are a concern, but also the
transduction limits. Transduction limits would be the limiting
factors, which are not due to the actual losses in transmission, but
due to the losses which occur in the conversion from flying qubits to
stationary qubits and vice versa.
This is obviously highly dependent on the implementation of a given
system, but normally one uses photons as flying qubits, which have to
interface with a system used as a stationary qubit. These light-
matter interactions can be described by cavity quantum
electrodynamics (QED).
Typically in cavity QED one considers a matter Two-Level System (TLS)
in a resonator cavity. This matter system would then be the
stationary qubit and light entering the cavity to interact with the
matter TLS would be the flying qubit to be transduced. The complete
systems dynamics are determined by different properties: The emitter
decay rate γ is the rate of decay of the TLS into the cavity mode,
which is often approximated by the lifetime τ of the excited state in
the TLS via γ ≈ 1/τ. The cavity loss rate κ is the rate of photons
exiting the cavity, which is determined by the quality factor Q of
the resonator: κ ∝ 1/Q. Also very important is the coupling strength
g0 between TLS and photon, which is dependent on the mode volume V0
of the resonator: g0 ∝ √1/V0. [Mueller]
Li Calsi, et al. Expires 17 May 2024 [Page 7]
Internet-Draft Quantum crypto difficulty November 2023
The cavities built around the TLS can take different forms. There
are e.g. micropillar resonators which use the principle of the Fabry-
Pérot interferometer with Q ∼ 2000 and V0 = 5 · (λ/n)^3 where n is
the refractive index inside the cavity and λ is the wavelength of the
emitted light from the TLS, microsphere cavities with Q ∼ 8 · 10^9
and V0 ∼ 3000 μm^3, or photonic crystals with Q ∼ 13000 and V0 = 1,2
· (λ/n)^3. [Mueller] Those are some cavities which can be built
around the TLS according to ones requirements. Those TLS include for
example semiconductor quantum dots (QDs). It has been shown, that
InAs QDs can have electron spin lifetimes exceeding 1 s (albeit in
this case the QD was charged electrically). [Gillard] In case of
QDs, it has to be kept in mind that normally the spin coherence times
seem to be more on the order of tens of microseconds but they have
excellent optical properties which allow generation of spin-photon
entanglement efficiently. Other material systems like vacancy
centers in diamond exhibit spin coherence time of whole seconds but
with low emission efficiencies. [Dusanowski] So there seems to be a
trade-off between advantageous spin and photonic properties. Spin
decoherence also limits the lifetimes of stationary qubits apart from
the losses in transduction. With such information one could estimate
how good a flying qubit can be transduced to a stationary one and how
good the stationary qubit can be preserved.
3. Vulnerabilities
Several protocols in quantum cryptography found their security upon
(at least one of) two core assumptions:
* Bounded copies: adversaries have up to N copies of some quantum
state, with N depending on the cite protocol. In some cases, N =
1.
* Unknown State: despite holding one or more copies of some
state |ψ>, adversaries do lack information on what state they
hold.
Despite such assumptions being theoretically sound and convenient,
the limits presented in Section 2 jeopardize their validity. This
may lead to protocol-specific attacks, either leaking partial
information or completely breaking the protocol’s security or
usability. In the following, we explain how such a vulnerability may
result in an attack against popular quantum cryptographic protocols.
Li Calsi, et al. Expires 17 May 2024 [Page 8]
Internet-Draft Quantum crypto difficulty November 2023
3.1. Attacks to public-key encryption and digital signature
We start by considering the quantum public-key encryption scheme
devised by [Nikolopoulos1]. Such a protocol is a fit example, as it
bases its security on both the aforementioned assumptions. In fact,
it supposes an upper bound to the number of distributed public keys,
and that public key holders do not know which state they hold. If
one of these assumptions is broken, it is trivial to leak the private
key from the quantum public key.
We can compute the upper limit of N based on acceptable security
risk. Suppose that Alice generates m′ copies of her public key, with
m′ is less than N, and distributes them in a quantum network. Due to
the inherent limits of telecommunication, it is likely that some of
these quantum keys are lost. However, the cause for this loss is
quite tricky and could be one of the following:
* Benign faults: the quantum key is lost forever due to
unforeseeable hazards.
* Malicious attack: some attacker could fake a hazard and steal the
quantum key for future attacks.
The two situations are indistinguishable to Alice, as she does not
have a global view of what happens in the network. Therefore, Alice
has two options when some agent claims a public key loss:
* Optimism: Alice trusts the claim, i.e., she believes it was the
consequence of a benign fault. She then prepares one or more
copies of the public key, and re-transmits them.
* Pessimism: Alice does not trust the claim, as she fears it is the
result of a malicious attack. She will not replace the lost
quantum key.
A pessimistic policy works from a security viewpoint, but jeopardizes
the protocol's usability. In fact, if Alice misjudges and the loss
resulted from benign faults, then benign users will no longer be able
to encrypt a message for Alice, as they lack the public key to run
encryption. On the other hand, an optimistic policy guarantees
enough public key copies for every user, but may jeopardize the
protocol's security. Malicious users could exploit this policy to
collect enough public key copies, measure them, and find the private
key. A similar reasoning holds for the quantum digital signature
scheme by Gottesman and Chuang [Gottesman]. The latter distributes
quantum public keys obtained from a classical private key via a
classical-quantum one-way function. The one-way property follows
again from the bounded-copies assumption. What if one public key
Li Calsi, et al. Expires 17 May 2024 [Page 9]
Internet-Draft Quantum crypto difficulty November 2023
copy is lost? If Alice plays optimistically, malicious users can
exploit her trust to gather several public key copies. If such an
action is repeated over time, it can lead to information leakage and
possibly an inversion of the one-way function. On the other hand, if
Alice plays pessimistically, benign users who lost a public key due
to noise will be unable to verify signatures.
3.2. Attacks to authentication
In the following, we show how the phenomenon of data loss may
jeopardize the security of some authentication protocols. Hong et
al’s protocol [Hong] is based on measuring single photons for m
rounds, and implicitly makes the bounded-copies assumption. It is
assumed that Alice and Bob pre-share a classical secret key, and at
authentication time they verify that their keys are the same. For
this purpose Bob encodes two classical key bits into one state from
{|0⟩, |1⟩, |+⟩, |−⟩} according to pre-defined rules, then sends it to
Bob for verification. To prove the protocol’s security, they assume
that at authentication time Alice and Bob are able to send and
measure each photon once. Let us now assume that some losses occur
when Bob prepares a photon in position i in state |ψ_i> ∈
{|0⟩, |1⟩, |+⟩, |−⟩}. If Bob acts optimistically, he will prepare a
copy of state |ψ_i> and re-send it to Alice. The latter could
possibly happen m times, depending on the number of faults. This
allows malicious users to exploit this behavior and accumulate m
copies of state |ψ_i>, then use them to distinguish which of the four
possible states it is. This allows adversaries to leak the
corresponding key bits k_i. On the other hand, if Bob plays
pessimistically, he will not re-send state |ψ_i>. This scenario may
lead to security issues or impracticality depending on which policy
Alice takes. If Alice decides to skip that position, the protocol’s
security decreases, since attackers with a partial knowledge of the
shared key can still be successfully authenticated. The attacker may
simply claim that his qubit was lost, and still pass authentication.
On the other hand, if Alice is intransigent, she may just reject
Bob’s authentication attempt, and ask him to re-attempt later. While
that works fine when data losses are occasional accidents, curren and
future quantum technologies will likely undergo a loss rate such that
with a high probability one loss will occur in every protocol. This
implies that even an honest Bob will likely be unable to prove his
identity, as most authentication attempts will fail due to Alice’s
intransigent policy. Despite employing security measures such as
random decoy states and a thresholding mechanism to prevent an
exceedingly high number of lost states, such mechanisms do not
prevent all qubit-loss-based attacks, as they require restricting
assumptions to work, such as knowledge of the physical communication
link or passive adversaries.
Li Calsi, et al. Expires 17 May 2024 [Page 10]
Internet-Draft Quantum crypto difficulty November 2023
Other proposals are more resilient to lost qubits. Kanamori’s
protocol [Kanamori] uses a random session key ϕ to mask the
information on the classical pre-shared key. In case of a single
qubit, even if an attacker with no a prior knowledge intercepts it,
it can't extract any information on it, as they would only receive a
maximally-mixed state that is independent of the secret key.
3.3. Attacks to quantum money
Wiesner’s quantum money [Wiesner] also relies on the bounded-copies
and unknown-state assumptions. If one possesses several copies of
the same quantum note, one may use them to attack the scheme.
Specifically, they can use simple measurements and operations to
learn the note’s quantum state, and produce arbitrarily many copies.
Let's consider a quantum note with n qubits. If an attacker wants to
cheat with probability δ, it needs approximately m copies of the note
where m = -log_2(1-δ^(1/n)).
We remark that once the attack is repeated for all the n qubits, you
know all their bases and values, and may therefore forge as many
banknotes as you like. Now, suppose a user claims that a quantum
note was lost. If Alice acts optimistically and re-issues the
banknote, some attacker can exploit this to gather copies of the note
and later run the attack. On the other hand, Alice could act
pessimistically and refuse to re-issue the lost qubits. Although
this preserves the protocol’s security, it prevents benign users from
verifying the note in the future.
3.4. Attacks to Oblivious Transfer
The BBCS [Brassard] protocol is extremely sensitive to multicopy
attacks. In fact, suppose that Bob obtains two copies of the qubits
generated by Alice in the BB84 phase. He may run a very simple
attack:
* Measure each qubit of the first copy in the computational basis
* Measure each qubit of the second copy in the Hadamard basis
* Once Alice has revealed her true bases, Bob keeps the measurement
outcomes obtained by measuring in the right basis
Such a simple attack allows him to learn both messages with
certainty. Hence, if Alice receives the claim of a lost BB84 qubit,
she must play pessimistically and refuse to re-send it. Fortunately,
in this scenario, Alice may get away with a simple counterattack:
because the BB84 phase happens at an early stage, she may prepare a
different random BB84 state and send it to Bob. This preserves the
Li Calsi, et al. Expires 17 May 2024 [Page 11]
Internet-Draft Quantum crypto difficulty November 2023
protocol’s correctness at no security cost. Furthermore, re-
preparing a random qubit comes with negligible overhead, thus
preserving the protocol’s practicality.
4. Conclusion
4.1. Quantum teleportation
Overall, in some cases, direct transmission of qubit is problematic
because of its quantum characteristics, e.g., no cloning. For some
applications a transmission failure may cause an irrevocable damage.
Even if a sender can retransmit a qubit in case of a failure , e.g.
[Nikolopoulos1], this may bring forth a security breach. We believe
that the risks described above can be mitigated by sharing entangled
pairs between a sender and a receiver over the (imperfect) link and
then perform quantum teleportation procedure. Usually, it’s easier
to directly transmit a qubit in a known state than one in an unknown
state. Hence, since the EPR pairs that we wish to exchange have a
known state, it is safe to assume they are technically more simple to
transmit. Although a problem during an entanglement swapping may
arise, such failure can be recovered with enough trials. Such a
failure is, unlike other aforementioned failures, perfectly
recoverable. Moreover, entangled pairs can be stored in the form of
a matter qubit [Childress]. Hence, the result of quantum computation
can be directly transferred without going through transducer, thus
reducing the chance of qubit losses. Finally, direct transmission
allows a man-in-the-middle to intercept a quantum state fairly
easily. If qubits are teleported rather than directly transmitted,
such an attack is no longer feasible. In fact, the man-in-the-middle
can only intercept the two classical bits required to finalize the
teleportation protocol. However, such bits only provide information
on how the receiver should transform their local state to obtain the
input state, and are essentially meaningless to the attacker. As
[RFC9340] indicates, we may, in turn, create link-local entanglement
between neighboring nodes, establish end-to-end entanglement with
entanglement swapping, then perform distillation to improve the
fidelity. Using entangled pairs of high enough fidelity, we may use
quantum teleportation to send even an irrecoverable quantum state.
Teleportation is therefore a powerful tool, but it introduces new
questions and problems. For instance, using teleportation for
cryptographic purposes not only requires correct pre-shared
entanglement, but also trustworthy entangled states. Entangled
states should come with some form of cryptographically secure
certificate proving that the received states are indeed entangled
with the intended receiver. Furthermore, for some crypto primitives,
prescribing pre-shared entangled state leads to circular
requirements. In fact, if trustworthy pre-shared entanglement is
required for authentication, then the two users must have already run
Li Calsi, et al. Expires 17 May 2024 [Page 12]
Internet-Draft Quantum crypto difficulty November 2023
some form of authentication when sharing entanglement, else they have
no guarantees of being entangled with the correct user.
4.2. Security by design
As argued above, some protocols are secure by design. We have
already cited the BBCS and Kanamori’s authentication protocol, but
more are likely to exist. For instance, repeating the same reasoning
showing BBCS' security one may find a simple mitigation for BB84 QKD
[Bennett]. These proposals base their security on randomness, either
as a form of masking/encryption or because they send some random
quantum states that do not encode secret information. Security by
design has lightweight requirements compared to teleportation, as it
does not pose the problem of trustworthy entanglement sharing and
storage. However, it is considerably harder for cryptographers to
design a quantum protocol that is inherently resilient to message
losses. Hence, in future applications, a hybrid use of both
mitigations is advised.
5. IANA Considerations
This memo includes no request to IANA.
6. Security Considerations
This document do not introduce any new security considerations.
7. References
7.1. Informative References
[RFC9340] Kozlowski, W., Wehner, S., Van Meter, R., Rijsman, B.,
Cacciapuoti, A. S., Caleffi, M., and S. Nagayama,
"Architectural Principles for a Quantum Internet",
RFC 9340, DOI 10.17487/RFC9340, March 2023,
<https://www.rfc-editor.org/info/rfc9340>.
[I-D.irtf-qirg-quantum-internet-use-cases]
Wang, C., Rahman, A., Li, R., Aelmans, M., and K.
Chakraborty, "Application Scenarios for the Quantum
Internet", Work in Progress, Internet-Draft, draft-irtf-
qirg-quantum-internet-use-cases-19, 16 October 2023,
<https://datatracker.ietf.org/doc/html/draft-irtf-qirg-
quantum-internet-use-cases-19>.
[Kohl] Kohl, P., "Optical characterisation of telecommunication
wavelength quantum dots", Master’s Thesis, Technical
University of Munich, 2023.
Li Calsi, et al. Expires 17 May 2024 [Page 13]
Internet-Draft Quantum crypto difficulty November 2023
[Howell] Howell, E.F., Daun, K.J., Siegel, R., and M.P. Meng¨u¸c,
"Thermal radiation heat transfer, seventh ed.", 2021.
[Zeuner] Zeuner, K., "Semiconductor Quantum Optics at Telecom
Wavelengths", Ph.D. thesis, KTH, 2020.
[Portalupi]
Portalupi, S.L., Jetter, M., and P. Michler, "InAs quantum
dots grown on metamorphic buffers as non-classical light
sources at telecom C-band", a review, Semiconductor
Science and Technology 34, 2019.
[Gruenenfelder]
Grünenfelder, F., Sax, R., Boaron, A., and H. Zbinden,
"The limits of multiplexing quantum and classical
channels: Case study of a 2.5 GHz discrete variable
quantum key distribution system", Applied Physics Letters
119, 124001, 2021.
[Fox] Fox, M., "Quantum Optics: An Introduction", Master Series
in Physics, Vol. 15 (Oxford University Press), 2006.
[Taylor] Taylor, J.R., "Optical Solitons: Theory and Experiment",
1992.
[Mueller] Müller, K., "Lecture notes in photonic quantum
technologies", summer semester, 2021.
[Gillard] Gillard, G., Griffiths, I.M., Ragunathan, G., Ulhaq, A.,
McEwan, C., Clarke, E., and E.A. Chekhovich, "Fundamental
limits of electron and nuclear spin qubit lifetimes in an
isolated self-assembled quantum dot", npj Quantum
Information 7, 2021.
[Dusanowski]
Dusanowski, Ł., Nawrath, C., Portalupi, S.L., Jetter, M.,
Huber, T., Klembt, S., Michler, P., and S. Höfling,
"Optical charge injection and coherent control of a
quantum-dot spin-qubit emitting at telecom wavelengths",
Nature Communications 13, 2022.
[Nikolopoulos1]
Nikolopoulos, G.M., "Applications of single-qubit
rotations in quantum public-key cryptography", Physical
Review A 77, 2008.
Li Calsi, et al. Expires 17 May 2024 [Page 14]
Internet-Draft Quantum crypto difficulty November 2023
[Gottesman]
Gottesman, D. and I. Chuang, "Quantum digital signatures",
arXiv:quant-ph/0105032 [quant-ph], 2001.
[Hong] Hong, C.H., Heo, J., Jang, J.G., and D. Kwon, "Quantum
identity authentication with single photon", Quantum
Information Processing 16, 2017.
[Kanamori] Kanamori, Y., Yoo, S.M., Gregory, D., and F. Sheldon, "On
quantum authentication protocols", GLOBECOM ’05, 2005.
[Wiesner] Wiesner, S., "Conjugate coding", SIGACT News 15, 1983.
[Bennett] Bennett, B. and G. Brassard, "Quantum cryptography: Public
key distribution and coin tossing", 1984.
[Childress]
Childress, L. and R. Hanson, "Diamond NV centers for
quantum computing and quantum networks", MRS Bulletin
volume 38, 2013.
[Brassard] Bennett, C., Brassard, G., Crepeau, C., and M-H.
Skubiszewska, "Practical quantum oblivious transfer",
Advances in Cryptology — CRYPTO ’91, 1991.
Acknowledgements
This work was financed by the DFG via grant NO 1129/2-1 (JN) and by
the BMBF via grants 16KISQ039 (JHC), 16KISQ077 (DLC) and 16KISR026
(PK). The authors acknowledge the financial support by the Federal
Ministry of Education and Research of Germany in the programme of
“Souverän. Digital. Vernetzt.”. Joint project 6G-life, project
identification number: 16KISK002
Authors' Addresses
Davide Li Calsi
TQSD Technische Universität München
Theresienstraße 90
80333 Munich
Germany
Email: davide.li-calsi@tum.de
Li Calsi, et al. Expires 17 May 2024 [Page 15]
Internet-Draft Quantum crypto difficulty November 2023
Paul Kohl
TQSD Technische Universität München
Theresienstraße 90
80333 Munich
Germany
Email: paul.kohl@tum.de
JinHyeock Choi
TQSD Technische Universität München
Theresienstraße 90
80333 Munich
Germany
Email: jin.choi@tum.de
Janis Nötzel
TQSD Technische Universität München
Theresienstraße 90
80333 Munich
Germany
Email: janis.noetzel@tum.de
Li Calsi, et al. Expires 17 May 2024 [Page 16]
