A Working, Quantum-Encrypted Intranet 305
192939495969798999 writes "This article points out how BBN, developers of ARPANET, have actually created a quantum-encrypted intranet that serves pages to a small group of research scientists. I firmly believe this is as significant as the very first internet transmission some years back. If the technology is working and 100% secure, how long until it makes its way at least into government websites? This might be the end of the hacked by Chinese index pages!"
Reader Kent adds "A New York based company, MagiQ
Technologies, has begun selling units for
commercial use while a group in Europe recently made the first quantum encrypted
bank transaction in Vienna, Austria - April 2004. But the Boston network -
though limited to three locations - is believed to be the first Internet-integrated
system
that runs
continuously
between multiple distant locations."
common logical fallacy (Score:5, Insightful)
Just because a computer uses encryption, doesn't mean that it is unhackable.
secure != eavesdropper-proof (Score:3, Informative)
I just wanted to get into this, because it seems like a lot of people are missing an important point.
Sure, it's true, nothing is 100% secure, or at least nothing worthwhile is. You can put an unpatched SQL server on this quantum network and it won't matter that no one can sniff the network. I'll go back to a quote I remember wrong, and will (possibly wrongly) attribute to some openssl documentation: "SSL does not make your application secure. SSL only protects your application's network connections from ea
Protecting the Wrong Interface Doesn't Help (Score:3, Informative)
Neither one helps the "hacked by Chinese" problem. That's because the hacked sites have connections to t
Re:common logical fallacy (Score:3, Insightful)
The biggest vulnerabilities are usually located between the chairs and the keyboards.
Re:common logical fallacy (Score:5, Informative)
Re:common logical fallacy (Score:2, Informative)
Re:common logical fallacy (Score:4, Informative)
Re:common logical fallacy (Score:3, Interesting)
Re:common logical fallacy (Score:3, Insightful)
Although, validating the authenticity of the source of data using these means could potential reduce script kiddies (think non-reputability)
Re:common logical fallacy (Score:5, Funny)
Re:common logical fallacy (Score:3, Insightful)
Encryption is often sold like this. I remember watching an interview with a salesman for a voting machine company. When asked if the voting machine had security problems, his response was that it used unbreakable encryption. So what does that mean? Nothing at all. Just becaus
Re:common logical fallacy (Score:2)
Re:common logical fallacy (Score:3, Insightful)
Beam me to my computer (Score:5, Funny)
FP? (Score:4, Interesting)
Re:FP? (Score:3, Insightful)
Re:FP? (Score:5, Informative)
they send the encrypted data only after they are sure no one else has the key.
Re:FP? (Score:4, Insightful)
This raises a question for me; if I (a theoretical man-in-the-middle bad guy) know of a quantum-encrypted channel that is being used, for example, by banks, what prevents me from tapping the wire, disrupting the quantum state, and forcing another attempt at transmission? Couldn't a man-in-the-middle become a denial-of-service between two parties by never allowing them to secure a line in the first place?
Re:FP? (Score:2)
sure I suppose... but in that case why not just sever the physical connection?
Re:FP? (Score:2)
I don't know about you, but I'd much prefer my uber secret conversations don't go through if someone has managed "tapping the wire". At least then you know there is a problem and can deal with it.
Re:FP? (Score:4, Insightful)
Re:FP? (Score:2)
On the other hand, it might be far easier to DOS a quantum-encryption system.
Re:FP? (Score:4, Insightful)
Re:FP? (Score:2, Insightful)
I can still use a man in the middle attack I just need to intercept both transmistions.
AKA you send 100 bits I tell you the 50 bit's I saw mean while I send you 100 bits and you tell me the 50 bits you saw. Then I send data back and forth while keeping a copy of everything or even changing the data sent to each person. You say move 100,000$ from act 100 to 123 and I tell them move 100,000$ from act 100 to 437. And then send you the ack signal on the transfer while spoofing it
Re:FP? (Score:5, Informative)
Bob at the other end RANDOMLY switches between filters, and thus gets only about 3/4 of the photons right (this is a little long and thus I won't do the math here). So he reads off, over an insecure line, which filters he used when. Alice tells him when he was right and when he was wrong. The series of bits that he got right will be used for a one time pad cipher. However, Eve, the evesdropper, can't get the one-time pad! Why? Because she and Bob will have used a different sequence of polarizers, and thus she would have gotten some of the one-time pad wrong. Plus, when Eve measured any photon along the line, it would change its polarization, so therefore before doing the encrypted transmission, Alice could send a portion of the one-time pad to Bob. If any of it changed, then obviously Eve was on the line.
Re:FP? (Score:5, Funny)
Re:FP? (Score:5, Insightful)
Re:FP? (Score:3, Informative)
Yes, it is theoretically possible.
If you're happy for the destination address of a message to be visible, then you don't have to encrypt that part. The router looks at that, and can route the rest of the message without affecting the quantum encryption (e.g. by moving a mirror to reflect the quantum encrypted signal to the destination port).
If you don't want that, then you can use onion source routing. Your message begins with an encrypted sequence which tells the first router where to forward the res
Re:FP? (Score:3, Interesting)
Re:FP? (Score:3, Informative)
Re:FP? (Score:5, Informative)
An eavesdropper will inevitably destroy some of the valid information which will introduce noise into the sent signal. The sender and receiver can detect this noise and deduce that they are being eavesdropped on.
Incidentally, the security of the most common scheme has been proven mathematically by Shor and Preskill.
100% secure? (Score:2, Insightful)
Re:100% secure? (Score:5, Funny)
Where do I get this nothing stuff?
Re:Schroedinger's Computer (Score:3, Funny)
that's fine, 100% chance is finite enough for me
Re:100% secure? (Score:2)
No such thing... (Score:2, Troll)
Re:No such thing... (Score:5, Insightful)
I've spent a lot of time educating clients regarding the "nature of things" as you described. However, when the client isn't at that level of interest/ability to understand/etc., I simply say "SSL is the same level of encryption that banks and credit card companies rely on . Your data will be safe." Sometimes I also use the "it would take sixty million years or so to brute force the encryption. I doubt you'll be worried about your 2004 data in sixty million years."
Re:No such thing... (Score:2, Insightful)
Encryption != Security (Score:5, Insightful)
Just because the network and all of the transmissions are encrypted, doesn't mean the server is secure. Having IIS running HTTPS exclusively doesn't mean you don't have to patch it.
Re:Encryption != Security (Score:2)
What a drag
let me help you understand (Score:3, Insightful)
You SECURE the server using the new encryption, and then it's much harder to hack. Encryption definitely doesn't EQUAL security, but great encryption can lead to great security if you implement it correctly.
What?! (Score:5, Insightful)
Re:What?! (Score:5, Funny)
Makes quantum networking look easy, no?
Re:What?! (Score:2)
when the poster said 'the technology is working and 100% secure' they meant the technology of the transmission, not the computer using it.
Excellent .. (Score:5, Funny)
Re:Excellent .. (Score:3, Insightful)
Re:Excellent .. (Score:5, Funny)
The EU too! (Score:5, Interesting)
tcd004
Re:The EU too! (Score:2)
Tcd004
100% secure? (Score:4, Insightful)
Re:100% secure? (Score:3, Informative)
Re:100% secure? (Score:2)
the important part is making sure that the key to this code gets to the receiver without anyone else getting it. so the key to this is not how good the encryption is,
Re:100% secure? (Score:5, Interesting)
This is indeed a truly new level of encryption. We probably can't say 100%, but breaking quantum encryption is definately a different order of difficulty than breaking conventional encryption.
what does this have to do with hacking websites. (Score:3, Insightful)
Does this mean Google will need to switch... (Score:5, Funny)
Depends on implementation? (Score:4, Insightful)
I would seriously hope that if this new encryption scheme goes anywhere the people that implement it have the common sense to lock it down tight. Otherwise those HACKED BY CHINESE pages aren't going anywhere anytime soon.
QC is not an encryption tech (Score:5, Insightful)
This might be the end of the hacked by Chinese index pages!
Uh, no. Quantum communication is not magic. (OK, maybe, but not that kind of magic.) What it is, is perfectly secure against physical eavesdropping. An attacker can't "tap the wire", as it were. The name "quantum encryption" is something of a misnomer, though: this technology is just a communication channel, albeit an uber-cool one.
Re:QC is not an encryption tech (Score:3, Insightful)
Don't you mean "theoretically perfect"?
Observe! Invocation of the Patriot Act!
All transport layers are now visible.
Re:QC is not an encryption tech (Score:4, Informative)
No, I actually did mean "perfectly secure" against physical eavesdropping. The laws of quantum physics are odd; they guarantee (with probability arbitrarily close to 1) that if you try to listen to the message in transit, you'll wreck it. The Patriot Act may let the eavesdropper mess with the endpoints of the channel, but the channel itself is secure against everything but attacks on the fundamental laws of nature :-).
Re:QC is not an encryption tech (Score:3, Insightful)
The trouble with quantum crypto networks right now is that you either need a fully meshed network (unrealistic for most applications), or the encryption can't be end-to-end (and your fav
Re:QC is not an encryption tech (Score:3, Insightful)
AFAIK (I am not a quantum cryptographer by trade, but I have degrees in physics and computer science), a quantum channel is secure against MIM attacks. You can make the probability that you are talking to an endpoint with the shared secret arbitrarily close to 1 by exchanging a series of authentication bits. (Or are you referring to the fact that you may leak a few bits before the MIM is caught? I think conventional crypto and unicity distance makes this not an effective attack in practice.)
This is why y
100% secure - but the transport medium only (Score:5, Informative)
this means only, that man-in-the-middle attack cant be done, or data during the flow cant be altered without recognization.
this is just a new transport media but not making the services and clients at both ends any more secure.
think of this as an ssl/ssh/vpn replacement.
if you have bugs in the rest of your software/hardware ssl/ssh/vpn/quantum cant help either.
nuff said
It's gotta be said: (Score:5, Funny)
Live/Dead Cat Powered Router... (Score:2, Funny)
Re:Live/Dead Cat Powered Router... (Score:5, Funny)
Quantum encryption is simple (Score:2, Funny)
You go BBN. You survived that monstrosity.
quantum: viewing changes Data.. (Score:5, Funny)
so it WAS a feature, not a bug.
who d'have thunk that MS had such advanced SECURITY tech...
A Good Thread About Quantum Crypto (Score:5, Informative)
Perhaps a more accurate characterization... (Score:5, Informative)
Further, what it secure? Not being altered by unauthorized parties (webpages need this), or not being read by unauthorzied parties (goverments need this) or somewhere in between (can't be read without the sender/receiver being notified)?
Security may well be one of the most misunderstood topics, with quantum physics just above it... =)
How will MS use this technology? (Score:5, Funny)
uhh, silly /.! (Score:3, Funny)
Just don't lose the encryption key! (Score:2)
I have to imagine it would be a very bad idea to lose your quantum encryption key...just think how bad it is when I lose my Wep key!
Rubber hoses and candy bars (Score:2)
ET's: Can You Hear Us Now? (Score:3, Interesting)
IIRC, In the movie "Contact" it was suggested that the ET's first heard from us when we began to beam our television signals into space for satellite relay or ground really...
Now one might wonder if the data we are placing into a "quantum medium" will somehow be detected by entities who know how to detect such events.
Hmmm...I wonder
Re:ET's: Can You Hear Us Now? (Score:2)
Re:ET's: Can You Hear Us Now? (Score:2)
The first radio broadcast with sufficient power to escape Earths pull was Hitlers speech at the 1936 Olympics in Munich.
What Contact showed was the first television signal which had sufficient power to escape to escape Earths pull. That also happened to be a signal from Hitlers Germany. A rally if I remember correctly.
how about read only? (Score:2, Interesting)
Infrastructure for this? (Score:5, Insightful)
Re:Infrastructure for this? (Score:3, Informative)
You need a dedicated fiber and can only do point-to-point, i.e. no routing. As a consequence the connection can be broken into at any router.
Funny, that is pretty much the same security level a modern fiber has, unless the attacker has some very sophisticated equipment.
And you are? (Score:3, Insightful)
I love it when
Sorry, personal gripe.
-Erwos
Qubits... (Score:2)
Parallel Network Required (Score:2, Funny)
Illegal in US? (Score:4, Interesting)
Re:Illegal in US? (Score:3, Insightful)
Only point-to-point security (Score:3, Interesting)
If you use https, then China couldn't hack your pages today. Now if you're implying that even https could be hacked, then quantum encryption doesn't provide you any benifit.
The reason is that you can only quantumly encrypt a single point-to-point channel (haven't read the article, so you could make a lier out of me). And unless you have a direct connection to the end-point in question, you're going to have to go through a gateway. That gateway necessarily needs to see the contents of your message [header]. And more importantly I believe all chinese internet connections run through state-owned gateways.
Additionally, even fiber-optics have limited range, and I suspenct that the quantum-encrypted messages are passing through such a medium. Thus there must be repeaters which will establish separate quantum connection segments. Each repeater is a possible exploit point. (Again, the article could prove me wrong).
Overkill? (Score:3, Insightful)
Besides, if its decryptable, its breakable. May not be worth the time/cost to read the average Joe's email, but if you belive you are 100% safe, you are a fool..
not a big deal (Score:5, Informative)
It's like replacing a steel deadbolt with titanium, meanwhile the door is still wooden, the hinges are brass, and there's a large window right next to it.
The only uses are extremely high-value applications like banking and the military. Even then I'd spend my money elsewhere.
PETA Members not comofrted by Quantum kitties (Score:3, Funny)
An impossible claim! (Score:5, Funny)
[groan]CRIKEY, gimme a fscking BREAK (Score:3)
I reported this story TWO MONTHS ago. [slashdot.org]
Re:Impressive... (Score:5, Insightful)
Actually, you have literally no idea of how a quantum encrypted network works. What's interesting about the quantum encrypted network is not whether it keeps password cracking from L33T hackers, but how it makes sniffing along the connection either impossible, or impossible without being noticeable, depending on the implementation.
You're both right (Score:4, Insightful)
Re:Impressive... (Score:3, Interesting)
Trying to route data that was encrypted "as it leaves the computer"... I'm not sure if
Re:Yess! (Score:5, Funny)
Hmm...Beyond the index page, Natalie Portman exists in a superposition of having and not having hot grits in her pants...until you click "ENTER"...
Re:Yess! (Score:2)
Re:IT? (Score:2)
Re:[Possibly OT] Quantum? (Score:2)
Don't be a crack head... The probability of that happening is just as likely regardless of you using quantum encryption. What you think just because you aren't taking advantage of living a world governed by the laws of quantum mechanics you don't have to abide by those laws? Closing your eyes doesn't really make the monsters go away either.
Uncrackable encryption (Score:2, Funny)
So here. Decrypt this hex:
1A 3F 23 31 37 F3 18 0B 12 66 20 DB 3D 28 2D 15 5E 80 1B 3F 12 82 FE 14 98 1D E6 23 D2 9F 88 26 D6 2A 38 77 23 90 E8 AB 23 A7 28 87 10 9E C3 B0 38 39
if no one can decrypt it, then I think I can publish it and
4) Profit
Re:What Every Teenager Wants (Score:4, Interesting)
Mine.
Actually, my oldest is 9, so no teenagers yet. The kids' computer is connected to the home network, but blocked COLD at the router from ever touching the internet. No, they can't use mine because they don't know the 18-character password and I can type it in 1-2 seconds, so they won't be shoulder-surfing it either.
Some time in the future, when I allow internet access from that machine, there will be a sniffing process on a separate machine that has tamper indications. The sniffed data will be grepped for our street name, phone number, name of their school, words indicative of pr0n being sent/received, etc. and any match will trigger human review.
Don't flame me and say I'm invading their privacy. This is a duty that I owe to my daughters. Furthermore, I can decide that as their parent and until they are 18, their privacy goes out the window when safety is in question. If you heard a window break in your kid's room, a scream, and an unfamiliar voice, would you knock on the door first and say, "are you dressed? Can I come in?" or would you grab the shotgun and kick the door open immediately?
-paul
Re:What Every Teenager Wants (Score:4, Insightful)
I'd kick the door opened immediatly if i heard that. But i would not put a cam and mic in their room and monitor all their personnal activities just in case it can happen, which is exactly what you plan to do with your sniffer...
I think grepping for the house adress and phone, things like that is a good idea. Monitoring for porn or their personnal conversations is not. Did your mother search your whole room in every freaking corners every day to see if you hadn't hidden a porn book somewhere ? Would you have liked it ? If you had hidden one, and she had found and confiscated it, would that have helped you in any way in your life ?