Quantum cryptography and quantum hacking. Dr. Lars Lydersen

Transcription

1 Quantum cryptography and quantum hacking Dr. Lars Lydersen GOVCERT.NL, Rotterdam 5. November 2

2 Quantum Hacking group NTNU, Trondheim & UNIK, Kjeller Prof. Johannes Skaar Postdoc Vadim Makarov PhD students Qin Liu, Lars Lydersen, Øystein Marøy Collaborations: CQT Singapore, KTH Stockholm, Max Planck inst. Erlangen...

3 Quantum Hacking group. Discovering vulnerabilities Security proofs Demonstrating attacks Hardware countermeasures

4 What is quantum cryptography? Quantum = quantum physics = small particles Cryptography = coding of secrets Often called Quantum Key Distribution (QKD) Secret key used to code the message Provably secure Eavesdropping attempts detected 4

5 Quantum key distribution Alice Bob Optical fiber Internet (authenticated) 5

6 Photons as quantum bits Propagation direction H/V-basis ±45 -basis 6

7 BB84 7

8 What about Eve? Eve causes 25% QBER (Quantum bit error rate) 8

9 Post-processing All errors are assumed due to Eve Alice and Bob use error correction Eve's information is removed through privacy amplification key random matrix = raw key QKD offers perfect security with perfect devices (QBER < %) 9

10 How secure is practical QKD?

11 How avalanche photo diodes (APDs) work Geiger mode IAPD IAPD Ith Pth Popt Ith ng i h enc u Q Single photon VAPD Breakdown voltage Vbr L. Lydersen et al. Nat. Photonics 4, (2)

12 Faked-state attack in APD linear mode Identical bases & bit values Eve Alice.Bob.Alice Bright state Bob Listen, do same, get same final key Eve using right basis: Eve using wrong basis: Bits get lost! 2 L. Lydersen et al. Nat. Photonics 4, (2)

13 Launching bright pulse after the gate... VAPD Vbr Vbias afterpulses, increased QBER t bright C. Wiechers et al., New J. Phys. 3, 343 (2) < 2 photons L. Lydersen et al. Phys. Rev. A 83, 3232 (2) Add CW light... Bias to APD (Vbias) Rbias VHV 4 V VAPD Vbr Detector blind! Zero dark count rate Vbias t 3 L. Lydersen et al. Nat. Photonics 4, (2)

14 Detector blinding ID Quantique Clavis2: MagiQ Technologies QPN 555: 4 L. Lydersen et al. Nat. Photonics 4, (2)

15 Full detector control ID Quantique Clavis2: 5 L. Lydersen et al. Nat. Photonics 4, (2)

16 Photo 2 Vadim Makarov Testing MagiQ Technologies QPN 555

17 Countermeasures suggested by Yuan et al. Vgate Input gate (PECL) DD SYH842 Vcomp R 72 DA MAX96 C.n APD Vclick == R2 5 C2 n R4 5 Output click (PECL) Vbias Resistor shorted R3 k Vth 8 mv VHV 43 V Changes proposed by Yuan et al.: - Rbias = or - Reduce Vth Z. L. Yuan et al. Nat. Photonics 4, 8 (2) Rbias = and reducing Vth is insufficient! L. Lydersen et al. Nat. Photonics 4, 8 (2) 7

18 Sinkhole blinding L. Lydersen et al. Opt. Express 8, (2)

19 Sinkhole blinding Vgate Input gate (PECL) DD SYH842 Vcomp AC-coupling R 72 DA MAX96 C.n APD Vclick == R2 5 C2 n R4 5 Output click (PECL) Vbias R3 k Vth 8 mv VHV 43 V Shorter sinkholes lower amplitude 9 L. Lydersen et al. Opt. Express 8, (2)

20 How avalanche photo diodes (APDs) work Geiger mode IAPD IAPD Ith Pth Popt Ith ng i h enc u Q Single photon VAPD Breakdown voltage Vbr 2 L. Lydersen et al. Nat. Photonics 4, (2)

21 D e te cto r D e te cto r ptical illumination, mw mw CW Ooptical illumination, Blind! 2.4 rre nt 3 4 cu 3 5 TE C Cold plate temperature, C 2 5 l o C d a pl te te m p a er t e ur ITEC, A Heat dissipation in the APD, mw Thermal blinding.6 C old pla te te m p e ra tu re TEC cu rre n t Total heat dissipation in the APDs, mw L. Lydersen et al. Opt. Express 8, (2) 2

22 Thermal blinding of frames 22 L. Lydersen et al. Opt. Express 8, (2)

23 Eavesdropping on installed QKD line on campus of the National University of Singapore 29 m of fiber S4 S3 Bob S2 Alice S5 Satellite image Google Eve

24 Eve does not affect QKD performance Before attack: 3 Raw key rate (cps) During attack: 2 QBER (%) Time (s) Time (s)

25 Stages of secure technology Quantum cryptography. Idea / proof-of-the-principle Initial implementations Weeding out implementation loopholes (spectacular failures patching) Now! 4. Good for wide use 25

26 Can we eavesdrop on commercial systems? ID Quantique s Cerberis: Dual key agreement PKI RSA-248 Key Symmetric cipher QKD PKI Key AES-256 Symmetric cipher Photo 2 Vadim Makarov QKD BB84

27 Summary Imperfect implementations may be disastrous QKD-systems were vulnerable to detector control (responsibly disclosed). Full intercept-resend attack has been implemented on an experimental QKD-setup, catching the full key. QKD is forward secure. 27