Hackers Eavesdrop On Quantum Crypto With Lasers 161
Martin Hellman writes "According to an article in Nature magazine, quantum hackers have performed the first 'invisible' attack on two commercial quantum cryptographic systems. By using lasers on the systems — which use quantum states of light to encrypt information for transmission —' they have fully cracked their encryption keys, yet left no trace of the hack.'"
It seems that you could detect this (Score:3, Interesting)
Eve gets round this constraint by 'blinding' Bob's detector — shining a continuous, 1-milliwatt laser at it.
So Bob could just detect the blinding signal and stop transmitting.
Re: (Score:2)
I'm sure its not as simple as that. Then agian I didn't understand half the technical stuff of this article.
Re:It seems that you could detect this (Score:5, Insightful)
However, the hack shows (once again), that a system may be secure in theory, but actual implementations of that system may, and will, have bugs that render them insecure. This negates one of the most strong arguments for quantum crypto, i.e. the "proveable" security. If that argument does not hold, you could as well use any common "classical" key exchange algorithm, which also delivers "good, but not 100%" practical security, does not need fixed point-to-point fiber and expensive equipment, and is probably much better tested than the quantum systems.
Re: (Score:2)
This negates one of the most strong arguments for quantum crypto, i.e. the "proveable" security
No it doesn't – it just makes the software more expensive to write. It's entirely possible to write software that has key properties proved to be correct and bug free, it's just hard, time consuming, and done by people who get paid a very large amount of money.
Re:It seems that you could detect this (Score:4, Insightful)
No it doesn't – it just makes the software more expensive to write. It's entirely possible to write software that has key properties proved to be correct and bug free,
It's not only the software. There's a lot of hardware involved, most of which could have bugs of some kind (e.g. for this hack you'd have to prove that your sensor can reliably detect that it's still in "quantum mode"). And after you have proven a lot of properties off all your hard- and software, you'll have to prove that all those properties are actually sufficient for achieving perfect security.
Re: (Score:2)
No it doesn't – it just makes the software more expensive to write. It's entirely possible to write software that has key properties proved to be correct and bug free, it's just hard, time consuming, and done by people who get paid a very large amount of money.
And then gets undercut by slightly cheaper snake oil coded by the lowest bidder in a sweatshop. Everyone cheers the invisible hand and the triumph of the free market, especially Eve.
Re: (Score:2)
Alice is the transmitter, Bob is the receiver (from A to B, see?).
Yes I can see my mistake, though once Bob knows the link is compromised he can ignore the contents, so the hacker can't predict his behaviour. Also Bob could use a different channel to notify Alice of the problem.
Re: (Score:3, Informative)
So OK... (Score:5, Funny)
Re:So OK... (Score:4, Funny)
Re: (Score:2)
That's going to take some time. None of the other universes have sharks or ill-tempered mutant sea bass to control the lasers.
What flavors have the hackers copied? (Score:2)
I'm curious, how many flavors does this hack comes in?
not really that bad (Score:5, Informative)
Makorov informed both companies of the details of the hack before publishing, so that patches could made, avoiding any possible security risk.
Re: (Score:3, Funny)
if (continuousLaserBeam) hack = true;
Re: (Score:3, Insightful)
Yeah the good guys inform the company of the hack. The question is how many bad guys were aware of this before now, and for how long?
It took these guys two months in a university lab to figure this out. How long do you suppose it took the NSA (and their counterparts in other countries) who have much bigger budgets?
This research proves that if you're using these devices, the NSA has your data.
Re: (Score:2)
Perhaps, but there's a larger issue. Quantum crypto was supposed to be the end of the story, iirc. It was supposed to be theoretically impossible to crack. Discussion over.
Now, it appears that quantum crypto is engaged in the same kind of more arms race that other crypto mechanism are subject to. So it might be pretty solid, but it's apparently no silver bullet.
Re: (Score:2)
Yup. The detectability is the whole point of quantum crypto.
You don't send secrets over quantum crypto. You send encryption keys, and then if they weren't intercepted you use those keys to send encrypted secrets over a channel of your choosing. If the keys are intercepted you simply discard them - an unused encryption key is just a random number, so nothing is lost.
It almost sounds to me like a bunch of vendors decided to turn quantum crypto into a marketing term, without thinking hard about security. I
Re: (Score:2)
Yes, exactly. This is like saying that one-time pad encryption has been broken because someone found a bug in an implementation (or rather, an implementation of something other than one-time pad encryption).
Description of the hack by its authors (Score:3, Informative)
A massive implementation flaw? (Score:2)
Re: (Score:2)
Re: (Score:2)
Quantum is for Quacks (Score:3, Funny)
This is what you get when even educated men can't make sense of your technology.
Pretty obvious now we need to return to traditional cryptosystems such as rot13 etc.
Arguably not the most secure, but it is efficient. And for military use, where security
requirements are higher, triple-rot13 is an option.
alice and bob (Score:4, Funny)
Re: (Score:2)
...until they met Ted and Alice, the couple that moved in next door. Then the sex became even more interesting.
(boy I feel so old)
quantum hackers? (Score:2)
Is anyone REALLY surprised? (Score:2)
And here is the biggest problem with dealing with anything that evolves. Someone or something else will come along and evolve a way to defeat it. This happens in the world of biological viruses and bacteria, this happens in the world of animals, this happens in the world of Electronic Viruses and Spyware, and this happens with encryption.
I remember when the contest was to crack either the 56-bit or the 64-bit (do not remember exactly which) and it was done in a matter of days and not the years it was though
Re: (Score:2)
xcept that in cryptography that doesn't always happen [wikipedia.org].
Re: (Score:2)
The method at the theoretical level isn't breakable, but actual real world implementations are. Either people re-use the OTP or the pad itself is intercepted. The interception starts with the sender presuming it's absolutely safe/
Re: (Score:2)
One suggestion for "practical unbreakable OTPs" was to gather noise from live radio astronomical observations. Alice sends to Bob the pseudo-random radio source location and the precise time to start gathering the OTP. This information need only be secure until that start time plus the baseline for the observers. After that, the pad is no longer retrievable by any third party. Since the pad itself is never transmitted, the risk of the OTP falling into the wrong hands is greatly reduced.
This is, admittedly,
Re: (Score:2)
And that is what makes the undead so dangerous.
There's still better privacy (Score:2)
Re: (Score:2)
> Don't write or talk anything. None will intercept it.
They are working on that...
Obligatory (Score:2, Funny)
Can we get truth in advertizing? (Score:2)
How about hacked quantum systems downgraded to std transmission?
There was no hacking of quantum crypto here.
Why 'hackers' and not 'researchers'? (Score:5, Insightful)
.
Re:Why 'hackers' and not 'researchers'? (Score:5, Interesting)
I'm not sure the manufacturers would approve the existence of our lab [iet.ntnu.no] if they could dictate it. Thankfully we are independent and need not seek their approval. The manufacturers did appreciate responsible disclosure, though. I don't know how this hacking affects their business in the short term (may as well be detrimental to sales), even though it is surely good for business in the long term as it leads to more secure systems.
Re: (Score:2)
The USA Industry & Congress.... (Score:2)
The USA Defense Industry and Congress will write a law that will prevent anyone (except .Com, .Gov & .Mil) from criminally hacking qEncrypt, making USAll safe from Norwegian Hacker Scientist. Also, US, EU, RU, CN... people and governments will be happy to comply with more legal control.
%~P=WeRFycked+*
Tank (Score:2, Funny)
Unfortunately, not everyone has the space required for an aquarium to contain the sharks with those fricken lasers.
Quantum Key Generation (Score:2)
I'm more interested in quantum computing to generate encryption keys that can't be broken by other quantum computing. Is there even a theoretical model for that?
Article Makes No Sense (Score:5, Interesting)
I've tried reading the actual journal paper, but unfortunately they just seem to handwave this problem away. Maybe there's a reason they can, but its sure as hell not explained as far as I can see unless they're assuming Eve has also compromised the classical channel as well as the quantum channel.
Re: (Score:2)
We h
Re: (Score:2)
Re: (Score:3, Informative)
So you exploited TWO flaws. (Score:2)
We are not controlling Bob's basis: he chooses his detection basis randomly. What we do is to send a bright-light state that does not cause a detection event if Bob chooses a basis not matching Alice's, but causes a detection event in a specific detector if Bob chooses the same basis as Eve.
So you're actually exploiting the combination TWO flaws:
- One in Bob's detector - which you can get to efficiently mimic the reception you achieved despite your lack of knowledge of Bob's expected polarization.
Re: (Score:3, Informative)
The QKD protocol is designed to cope with a huge bit loss, both due to detector inefficiency and the loss in the fiber line; in fact, in a typical setup only 1 in 1000 Alice's photon's may be detected by Bob. The loss in the line is the killer item: the best optical fiber is has loss about 0.2 dB per km. This means over 50 km, nine out of ten photons sent by Alice will be lost. (In our
Re: (Score:2)
Thanks. (I figured that out after posting. B-b ).
If I've got it correctly:
- Normally Bob loses 50% of the bits by not being aligned with Alice.
- Eve loses 50% of the bits by not being aligned with Alice, then
- Bob loses 50% of the bits by not being aligned with Alice, but
- The classical signal from Eve to Bob is strong and does not lose
(a significant number of) bits in the Eve->Bob stretch of fiber.
This (along with other allowa
Re: (Score:2)
Re:pwned (Score:5, Informative)
"We have exploited a purely technological loophole that turns a quantum cryptographic system into a classical system, without anyone noticing," says Makarov.
Re:pwned (Score:5, Insightful)
a kick in the balls (Score:5, Insightful)
A kick in the balls (breaking all current implementations) is not the same as cutting them out and mounting them in a trophy case (proving there can be no secure implementation).
Either one hurts though.
Re: (Score:2)
Which also means that it may end up being more predictable and sensitive to attack.
As soon as a crypto is predictable the road left to crack a given message is shorter. Not that it's easy, it will still require some computing power.
Re: (Score:3, Interesting)
This wouldn't even work if this quantum link weren't so simple. This system is at least as simple as a serial link, and what they've done is like unplugging that link from the intended recipient computer and plugging it into their own.
It looks like the only real security in the system 100% depended on MITMs being impossible - which is still true (from what I understand) - they've just diverted the traffic altogether rather than doing a MITM.
If there were any authentication involved or the data being sent wa
Re: (Score:2)
Re: (Score:2)
Unfortunately without that caveat the article isn't as scary.
Come on editors, Do a better job, don't just put the article through, read it yourself.
Re: (Score:2)
You mean with that caveat?
Re:pwned (Score:5, Interesting)
Re: (Score:2, Interesting)
So, I guess the encryption system used here isn't really "quantum", since above doesn't apply, is it?
Re:pwned (Score:5, Informative)
If you read the article, you'll notice that the 'hack' is a classic man in the middle attack, and the receiving end can receive both classic and quantum messages. The man in the middle (after reading the quantum message) passes it on as a classic message, and the receiving device does not give a warning that the message received is a classic message, instead of a quantum message.
So it's really an design error on the device side, not a true hack in that quantum states were undisturbed regardless of reading them.
Re: (Score:2)
So it's really an design error on the device side, not a true hack in that quantum states were undisturbed regardless of reading them.
Thanks for pointing that out! It makes the system so much more secure, knowing that...
This is a "true hack" in the same way that the cost of sending a mission to Mars is a "real problem": scientists and engineers often want to simplify the world by restricting the domain of "real problems" to ones they know how to solve. But reality doesn't care about human domain boundaries.
In this case, they have hacked the system, which has the effect of being able to read the communications that pass through it. No
Re: (Score:2)
not a true hack in that quantum states were undisturbed regardless of reading them.
Dammit, I had hoped to base my perpetuum mobile on these hackers' violation of the laws of physics :(
Re: (Score:2)
"100% security" ... "100% minus any bugs in the implementation"
I truly wonder if there is anything like "100% security". Probably if there is no 'security' at all (if it is not needed? impossible to observe?).
CC.
Re: (Score:2)
Re:pwned (Score:5, Interesting)
Well, there are several points here:
Re: (Score:2)
That isn't necessarily the case for side channel attacks, as the side channel to capture isn't known in advance of exploits. Similarly man in the middle attacks need to be live.
Re: (Score:2)
However, one difference betweeen the classical and quantum case is that in the quantum case any possible exploit has to be "online" (i.e. you have to actually intercept the actual sent message and manage to manipulate the receiving system), while for classical key exchange the breaking can also be after the fact (i.e. if all you want is the exchanged information, you can passively record all data and then try to break it afterwards).
But note that these systems only use quantum encryption to perform a key ex
Re: (Score:2)
Inigo:
You keep using that word. I do not think it means what you think it means.
Re: (Score:2)
Re: (Score:2)
Scotty: "The more complicated the plumbing, the easier it is to stop up the drain."
Re: (Score:2)
Re: (Score:3, Informative)
You would be right if you weren't so wrong :(
The problem with torture is that it has a way of making up information where there is none. If you're convinced your guy has the information, but he doesn't, then torture is an element of a random story generator. And there's pretty much no way of telling the quality of information that you receive.
Case in point: I think that a big problem with some Gitmo inmates is that they were set up by bounty hunters, and they are simply wrong people in a wrong place at the
Re: (Score:2)
Re: (Score:3, Insightful)
Logic whoosh.
No matter how uneasy, not-quick and not-cheap the torture is, you won't get information that isn't there. That's all I claim, yet you somehow feel the need to muddy the waters.
I'm very clear: I claim that there is/was a bunch of people in Gitmo who in fact know nothing, and who are held solely on an informant's paid (in money or in kind) claim that they, to the contrary, do know something.
You can have $1 billion per detainee and use all the tricks that anyone knows, or had known (think ancient
Re: (Score:2)
I'm not claiming that it doesn't work universally. But it can only work when the subject knows what you're after. What you're saying that it universally works, or else I just don't understand your rather plain words. It can't be true, unless you can magically ensure that everyone knows everything.
I think I have an example that shows cracks in your argument. Say I supposedly broke into a safe, containing highly sensitive papers, that uses 1000th through 2000th decimal digits of PI as the combination. From ot
Re: (Score:2)
Nope.
You torture them because you believe they have the information. As long as you hold on to that belief no matter what (IOW, you're stupid even when told so), then there's nothing for the prisoner to do other than to make stuff up. If they don't, they will presumably die -- they don't have the information in the first place.
So, it's not a delay if you torture someone who feeds you misinformation for lack of the real information you seek. It's your problem, not prisoner's problem. You will either kill the
Re: (Score:2)
You have evidence of that? I am not actually aware of any incidents where this was shown to be the case... and many incidents where information was given up without torture.
Generally speaking, torture is used to produce confessions and convictions no matter what, not to produce truth. Thats how its been used for a long time now, its what the techniques were developed to produce.
SO far the only "evidence" to the contrary has been by the Dick Cheney's vague "trust us this works" statement that he conveniently
Re: (Score:2)
While it's not reliable in general, it is reliable in cases where you can easily check whether the information given to you is correct.
You realize you've just defined extracting information under torture as an NP-Complete problem... and then implied that this was the "easy" case.
Re: (Score:2)
Not quite.
He was describing a system that gives a result probabilistically, with the probability of a correct response being proportional to the ease of verifying it.
There are two cases, one in which the result can be easilly verified. That case would be NP, and realistically BPP. The other case has no easy way to verify, making it emphatically not NP, but the exact category is not determined. Needless to say though that it has problems much harder than NP-complete problems.
Re: (Score:2)
You can make it easy. If you're willing to undergo an hour of torture without cracking then you can keep your secret key (if you have it).
Re: (Score:2)
I actually debated with myself if it was NP or NP-complete or NP-hard, and I'll stand by the NP-Complete designation. If you tortured a travelling salesman for the optimal route he could easily spit out (along with his teeth, presumably) various possibles, which you could then "easily check" (including keeping an eye out for repetitions, of course.) Ergo: NP-Complete.
I also debated with myself about the word "easy", which is why I put it in scare-quotes. By "easy" I meant "imaginable that you might get r
Re: (Score:2)
Since a salesman (or anyone else) generally doesn't know the optimal solution to the travelling salesman problem, torturing him will not reliably get you the correct solution, despite being able to check the solution.
Sure it will. It'll just take a very long time.
And since you never really know if the person you're torturing has the information you want--and in all practical cases your degree of uncertainty is extremely large, so this isn't some semantic quibble about "really knowing"--you never know if you're trying to solve an NP-complete problem or not. Good luck wit that.
Re:Lessons (Score:5, Informative)
[..] years of dedicated effort in an open environment.
Re: (Score:2)
And that's why quantum based voting fails. No citizen can verify that they don't just use classic computers.
Re: (Score:2)
Should it be called just a loophole?
Actually getting a physical object to behave like quantum entanglement is present is a challenging task, much like getting an object to reliably store data in a form that doesn't degrade with repeated access in the first place. There are only a few ways to store data in forms that can take 100,000+ access cycles, give the date back quickly enough to be useful to other parts of the system, or have low enough rates of corruption to be gen
Re: (Score:3, Insightful)
It's a pretty damn big loophole. They used a 1 mW beam which is about as powerful as a laser pointer. That's many orders of magnitude larger than a single-photon level signal and should be very easy to detect. Not noticing a milliwatt of light hitting the detector in a quantum scheme is something like leaving a key written in plain text on a sticky note on your monitor and being shocked when your key is "hacked."
Re: (Score:2)
The underlying principle still is valid, those people exploited a technical loophole ...
As I recall, the underlying principle of quantum cryptography was that you can't intercept the information in the FIRST PLACE to make a clone of it. These guys intercepted it, cloned the information from it, then made a signal that fooled the receiving detector.
The idea was that your signal either encoded a bit on a single photon as 0/90 degrees or +-45 degrees. The receiver had to know (from a previously distributed s
Re: (Score:2)
Upon further reading I see that the quantum cryptosystems are doing key exchange - so they don't have a shared secret from which to generate a shared idea of which polarization to use when looking. They have to throw away half the bits due to looking wrong and sort it out later.
The flaw is still partly rooted in their excessive redundancy to cover for sufficiently large losses in the data path. But the crack also depends on being able to stimulate "Bob"'s receiver by something that does not correspond to
Commercial Systems (Score:3, Interesting)
I was surprised to discover that there were commercial systems of quantum cryptography. Quantum cryptography is academic at this point. It is not as strong as old fashioned cryptography (like AES) and is much more expensive. Then I realized that there is no reason that someone can't use both. It would be pretty ridiculous if someone were using quantum cryptography as their only security, and not encrypting the data first with old fashioned cryptography.
Re:Commercial Systems (Score:4, Interesting)
Quantum cryptography is academic at this point. It is not as strong as old fashioned cryptography (like AES) and is much more expensive. Then I realized that there is no reason that someone can't use both.
Quantum crypto (at this point) is a key exchange mechanism. Thus, it doesn't compare to AES at all. You HAVE to use quantum crypto together with a classical exncryption algorithm. However, if you use quantom crypto you care about 100% theoretical security. Else you would simply use DH or any other well-known classical key exchange. And if you care about 100% theoretical security, there is no alternative to OTP.
Re: (Score:3, Insightful)
Except that to be able to use quantum crypto at all, you need to provide a physical way to pass the quantum state. And with that requirement, why won't you just pass the key the good old fashioned way? Strictly more secure, and much cheaper.
Re:Commercial Systems (Score:4, Interesting)
Except that to be able to use quantum crypto at all, you need to provide a physical way to pass the quantum state. And with that requirement, why won't you just pass the key the good old fashioned way? Strictly more secure, and much cheaper.
More secure? Hardly. All you have to do is eavesdrop on the key exchange and you have the key. In a real world scenario, typically this means bribing a few security guards, breaking into one of the communicators' homes or offices and retrieving the key from their computer, or intercepting a message sent over a physical line, probably encrypted via a non-100%-reliable cryptographic system, with the (at least) theoretical possibility that the encryption on the key exchange can be broken.
In a properly implemented quantum crypto system, this is theoretically impossible: the key passes directly from one endpoint to the other, and any interference between the two is easily detectable. It isn't stored for longer than the message takes to be sent, so breaking in to retrieve it is impractical. Done properly, the quantum crypto system is as secure as it is possible to be. As it happens, the system here was not done properly; it failed to detect interference on the line (and as ability to detect interference is, essentially, the point of quantum crypto, this is bad news).
Re: (Score:2)
If your endpoint has been compromised, there isn't anything you can do.
Re: (Score:2, Interesting)
In a real world scenario, typically this means bribing a few security guards, breaking into one of the communicators' homes or offices and retrieving the key from their computer, or intercepting a message sent over a physical line
Using the old fashioned way, you divide the key into 5 or 6 pieces before it leaves the cryptosystem, you distribute responsibility of the pieces. The pieces are stored on devices, and given to guards.
The guards have physical possession of the devices, but not the PIN number f
Re: (Score:2)
Quantum crypto is about passing a key and being sure it wasn't read by a third party (or borking if it has been). Old fashion plaintext passing of that key does not have that particular property which makes it _NOT_ more secure even if it is cheaper.
That the system would have an error mode where it just starts ignoring the overloaded quantum state sensor seems like braindead design to me...
Re: (Score:2)
Re: (Score:2)
Well I'd hazard a guess that most people who are buying in to this don't know what the fuck they are doing. They are the types that believe the NSA has secret evil cracking machines that ban break all current crypto (and that the NSA gives a shit about what they are doing). They also hear stories about amazin' new unbreakable quantum crypto. They see it on the market and say "We need to have that!"
For that matter, I don't know if these products are actual quantum crypto. Just because they call it that doesn
Re: (Score:2)
(and that the NSA gives a shit about what they are doing)
Well for one, it isn't generally the NSA that 'gives a shit', it's other agencies.
Two: If you make it a point to collect and store everything, even if it isn't of immediate interest to you NOW, it might be LATER.
Re: (Score:2)
Re: (Score:2)
Where's an Arc Light strike when you need one?