Quantum key distribution

While we wait for the physical hardware to mature, we are actually using the fragility of quantum states to our advantage.

In quantum key distribution, or QKD, two parties use individual entangled photons of light to generate a shared secret encryption key.

And the brilliant part is how it reveals tampering.

Because of the rules of quantum mechanics, if a hacker tries to intercept and measure those photons while they are traveling through a fiber optic cable, their very observation forces the photons to collapse into a definite state.

you're in real trouble.

Should quantum key distribution have a seat at the PQC discussion table? Some kind of combination of physics and math-based solutions working to protect against the quantum computing threat, perhaps? Toshiba thinks so.

Find out about their just-released system for making it all possible in this episode of the Post-Quantum World.

I'm your host, Konstantinos Karagiannis.

But here's the twist.

Agencies like the NSA in the U.S. and the NCSC in the U.K., France and Germany too, keep warning against broad QKD rollouts.

Seriously? The folks who need the strongest lock are saying maybe not to the strongest lock?

Because it solves only part of the problem.

QKD gives you secrecy for transport, but it doesn't tell you who you're actually talking to.

No built-in authentication.

Right.

Exactly.

And the main thing that is math-based quantum resistance.

The next one is QKD, which is quantum key distribution.

And that's physics-based.

key material.

A couple of weeks back, you had Janet, the CEO of EPB, talk about how to secure quantum communications.

And she had mentioned that once, if I'm sending a secure transmission to you, if there's an eavesdropper using quantum key distribution, we'd know that there's an eavesdropper and terminate those conversations so that no one can hear us talk.

And this is where I'm going to go into this on how you fiber providers would be able to leverage QKD as newer services and why you guys are primed for this.

One thing that we had mentioned as well is CRQC, a cryptographical relevant quantum computer.

NSA doesn't buy it.

Their published position is that they don't recommend QKD for national security systems unless its limitations are overcome.

The list is specific.

It gives no source authentication, so you need either public key cryptography or pre-placed secret keys to prove who's on the other end.

You mentioned KMS.

So it begs the question, how do you feel about QKD, quantum key distribution? Is that useful or is that a distraction from real PQC work?

I think Q, I mean, for me as a physicist, you know, I could pull out my physics book and show you the chapter and verse where we studied this way back when in grad school.

So it's tremendously interesting to me.

There's lots of SISOs, some very influential in the field who say QKD is a distraction and we should get the rest of the house in order all the way over to some who are leading, you know, very innovative programs and say, hey, we need to look at this now.

I tend to come down in the middle.

I don't see how we can do it today.

However, things are moving so fast.

Okay, let's ground it.

Start with quantum key distribution.

The way I explain it on Red Team Briefings, Alice tries to share a key with Bob using single photons.

The prepare and measure family.

What is gonna happen once you get to this? And it's how do you think about transitioning? And so, one, large cryptographic migrations can take years, right? So you need to start thinking about what do I apply post-quantum cryptography to? How do I think about readying myself for that? That seems to be the faster.

And if I am in the type of organization that needs to reinvest and invest heavily within QKD or quantum key distribution, where am I going to do that? What is the lifespan of that technology, and is it worth investing now, or do I have to wait? And how do I prioritize all of that now? And then start thinking about your broad credentials and all of your certificates and starting to map that and build the foundations that you should have anyway.

Okay, so does quantum just raise the bar then for the ways that companies need to execute their security? For example, just making sure that encrypted data stays within their organizations, or is this really changing the fundamental landscape of security?

I think it raises the bar.

In fact, a couple of weeks ago I had the chance to, um, speak with Bill Vass, who's CEO of Booz Allen Hamilton and he even said very bluntly like quantum sensing is the industry already that exists.

Um, so a lot of experts, a lot of people are putting this as a contrary to, um, quantum computing where they're saying, "Hey, um, quantum sensing is, is much closer, uh, and is more defensible than QKD." Do you agree with that framing? Um, and if so, where do you think the timeline's actually realistic?

Look, if at all maybe this, this statement comes a bit, comes out a bit short, um, I would say, right? And, and then, yeah, so it, it's just saying yes, no, it's, it's maybe a bit limiting for the whole thing, right? Obviously we know that quantum computing is a, is a large field where there's a lot of development going on and, um, you find, uh, different, different claims being made and you find, yeah, you, you find, uh, you find a lot of, uh, great work being done and, and being published.

What I can say is yes, uh, quantum sensing is, is, it's very close to being, uh, also maybe it's a broad statement, right? But of course you, you will find, uh, you will find, uh, a whole range of, of startups and also larger companies that are already investing and even, uh, really actively building, building, building, um, quantum sensors that are, that are close to, close to being right, right? But you also find a lot of companies that are building, uh, um, QKD systems that are also very close to being, uh, being ready products that are being actively sold, right? Uh, so you, you can find all this already.

You can, in the computing space you will also find a lot of companies or small, smaller companies that are like supporting the supply chain, right? And you find a lot of companies that are, um, collaborating, uh, collaborating with, uh, with the research facilities, uh, in order to, to really push the development.

That's correct.