Quantum Cryptography Broken and Fixed
Researchers at Linköping University in Sweden have found flaws in quantum cryptography. They also supply a fix. The announcement is here; a FAQ is here; full paper is at the IEEE here (but requires an IEEE membership).
The announcement says:
Jan-Åke Larsson, associate professor of applied mathematics at Linköping University, working with his student Jörgen Cederlöf, has shown that not even quantum cryptography is 100-percent secure. There is a theoretical possibility that an unauthorized person can extract the key without being discovered, by simultaneously manipulating both the quantum-mechanical and the regular communication needed in quantum cryptography.
Interestingly, the fix is to add some random bits into the channel. My understanding (I haven’t read the paper, just the announcement and the FAQ) is that this effectively adds a nonce to the protocol. I am amused that even an allegedly pure-physics security system needs a software patch.
This brings up an interesting question, though — if, with all its hype, quantum cryptography is not 100% secure, how secure is it? Is it 99.999999999999% secure? And why wouldn’t you just use 256-bit conventional crypto on a pair of IPsec routers you bought at Fry’s instead?
“why wouldn’t you just use 256-bit conventional crypto on a pair of IPsec routers you bought at Fry’s instead?”
Well, because Quantum encryption is so much more fun to try to observe!
Speaking of which:
If we encrypt something using quantum cryptography, and no one is around to decipher it – is it really encrypted information?
I love the title of this blog post. It’s a wave and a particle!
The important thing to remember about Quantum Crypto protocols is that it’s not just that you never know if they are broken until you open the box but that the protocol is simultaneously both secure and broken right up until the paper is published!
The full paper’s available for free from http://arxiv.org/abs/quant-ph/0611009 for those without IEEE membership
Nicko,
Don’t be silly. The system remains simultaneously secure and fixed until the paper is observed. And we all know that that’s not the same as publication.