Can QKD replace asymmetric key exchange algorithms?

The transition to quantum-resistant cryptography is generating a strong debate between supporters and opponents of alternatives to resistant key exchange channels, including the deployment of QKD. This is a rather turbulent area, where all the proposed and used solutions have their advantages and disadvantages. In the case of deployment, it is therefore necessary to know the limitations of these proposals and choose the protection method carefully according to the desired purpose.

What is QKD?

Quantum cryptography is a field of cryptography that uses the properties of quantum mechanics to protect communication and securely distribute keys. Unlike classical cryptography, whose security is mostly based on the computational difficulty of mathematical problems, it uses some fundamental properties of quantum systems. Current systems primarily address the issue of how to securely obtain a shared secret key.

In the classical world, we can copy and analyze data transmitted over a network without changing its content. This is generally not possible with quantum states, because the measurement itself can affect the measured state. Quantum mechanics proves that it is not possible to simply "observe" a system without affecting it. If an attacker intercepts a transmitted quantum state in order to obtain information about its value, he must measure it. If he measures it, he changes it. This change has an impact in the form of increased error rate.

How is this achieved? Communication in QKD is based on several properties of the quantum world:

• The superposition principle states that a quantum system can exist in a combination of multiple states at the same time. But only until a measurement occurs that leads to one of the possible outcomes.
• Entanglement describes the property where two quantum systems can be prepared in such a way that their measurement results exhibit strong correlations (connections). It is important for the quantum world that some of these correlations cannot be explained by the classical model of predetermined values. Quantum cryptography itself then uses the consequences, because it is precisely these correlations that allow us to verify the existence of entanglement and detect third-party interference.
• The Heisenberg principle describes the law of the quantum world where some pairs of system properties cannot be known exactly at the same time. It is most often explained in the following way. It is not possible to simultaneously measure the position and momentum of a particle with any precision. The more precisely you determine one property, the less precisely you know the other. The smaller the particle we measure, the higher energy we have to use and the more we change the observed system.
• The inseparability of measurement and change of quantum state is related to the principles of quantum measurement. It describes the limitations of the current knowledge of some pairs of physical quantities.
• The no-cloning theorem limits the attacker in another way. According to current knowledge, there is no universal way to perfectly copy an unknown quantum state without knowing the original state.

Cryptologists' comments on QKD

Quantum Key Distribution is not just a toy. In the past, this technology was overlooked, considered only an interesting physics experiment, a kind of academic fun that will not be used in practice. But it brings several interesting elements that can increase communication security under certain conditions. Quantum key distribution can transmit key material, but it has certain shortcomings. At the current level of knowledge, we do not know of a way to verify the basic properties of such a channel, which are among the standard security requirements within the framework of current asymmetric cryptography. These required properties include terms such as integrity, identity, and authenticity of the sender, if such an identity exists at all. Therefore, QKD needs and will still need a classical authenticated operating channel for its operation. It is for this reason that there is some skepticism about the deployment of this technology as a universal solution to the problem of quantum computers. The individual arguments can be arranged approximately as follows:

• The need for security evidence. It is important to realize that the existence of a theoretical security proof of a protocol and the existence of security evidence for a given implementation are two different matters.
• Key exchange without authentication does not provide protection against an active attacker. Without verification of identity and authenticity, a MITM attack is possible, so this is a fundamental weakness of the concept. For this reason, it is necessary to create an additional regular channel for each QKD channel that ensures these steps.
• Quantum computers are not the only threat. Although QKD is considered a perfect solution from a marketing perspective, this is not the case. Cryptography is developing and quantum computers are one of the threats, but they are not an apocalypse. Solutions that resist these computers exist and are being developed. In contrast, QKD is focused on a narrowly defined area of security. Secure key distribution is intended for the subsequent deployment of conventional cryptography, but this channel does not solve most of the other security problems of modern communication systems.
• QKD will not be possible to use throughout the entire Internet. It is used for a limited range of applications, because there are areas where its deployment is beneficial. At the moment, there are hundreds of implementations, among operators, data centers, or users with these specific needs. The economic impacts alone associated with deploying this technology throughout the Internet are strong enough to scare even a hardened economist.
• Physical hardware will always be more expensive than mathematics. That is true, the implementation of PQC algorithms is cheaper, on the other hand, there are areas with a requirement for a high degree of confidentiality, where such a solution makes sense. Nevertheless, there are areas where the economic side of solving the problem may be uninteresting in terms of the scope of the impacts . In addition, it is necessary to count on the gradual reduction in the cost of implementing quantum cryptography over time. Today's cutting-edge technologies may be commonplace in a few decades.

What does asymmetric cryptography offer?

Asymmetric cryptography is a field that has been developing for several decades. The original algorithms based on the difficulty of solving certain problems are currently past their zenith, their security is seriously threatened by quantum computers. New solutions, the so-called quantum resistant cryptography (PQC – Post Quantum Cryptography or QRC – Quantum Resistant Cryptography) are preparing to enter the scene. Some algorithms are standardized, their implementations are verified, and they can slowly be used. ML-KEMs are available in this area today, HQC-KEM should be available this year, I will not mention digital signature algorithms here.

The name asymmetric cryptography comes from the approach where one key is used for data encryption and the other for decryption. But if we look at it from the user's perspective, what does asymmetric cryptography actually offer at the moment? It is a solution to several groups of problems in the field of computer science:

• KEM (Key Exchange Mechanism), i.e. a key exchange mechanism. This group of algorithms is divided into Key Agreement and Key Transport. Within the framework of Key Agreement, an agreement is reached on a shared secret, where the counterparties agree on a secret without the need to send it from one side to the other. In the case of Key Transport, the secret is created on one side and sent to the other side.
• DSA (Digital Signature Algorithm), i.e. a digital signature mechanism. It provides the ability to create a unique mathematical output over certain data, which can be verified using a public key. Due to the complexity of the algorithm, unambiguous evidence linking the key to its owner is provided.
• Authentication of parties, which allows verification of the identity of the counterparty, can use asymmetric cryptography, but this is not a requirement.
• Verification of the existence of the identity of the counterparty linked, for example, to PKI, built on top of digital signatures, using asymmetric cryptography.

Thus, this form of protection of communication channels ensures the foundations of trust in the untrustworthy Internet. Without these protective mechanisms, it is impossible to ensure trust and verifiability of counterparties. Furthermore, from a legal point of view, asymmetric cryptography allows proving the identity of the signatory, the authenticity and integrity of data, and also the expression of will associated with a digital signature. These properties are crucial for the legal recognition of electronic acts. However, a similar solution for QKD does not currently exist.

To be continued next time...

The next part will focus on individual protocols and the principles on which they are built.

Autor článku:

Jan Dušátko

Jan Dušátko has been working with computers and computer security for almost a quarter of a century. In the field of cryptography, he has cooperated with leading experts such as Vlastimil Klíma or Tomáš Rosa. Currently he works as a security consultant, his main focus is on topics related to cryptography, security, e-mail communication and Linux systems.