Cryptography: the science of secret communications

Transcription

1 1 Quantum key distribution a new tool for the secure communications toolbox Richard Hughes Physics Division Los Alamos National Laboratory ; ; cryptographic key transfer by quantum (single-photon) communications overview of cryptography the BB84 QKD protocol QKD in practice internships are available in all aspects of quantum cryptography: experimental and theoretical physics, mathematics, computer science and electrical engineering

2 Cryptography: the science of secret communications 2 I am fairly familiar with all forms of secret writings The object of those who invented the system has apparently been to conceal that these characters convey a message. Sherlock Holmes The Adventure of the Dancing Men confidentiality encryption renders message unintelligible to 3 rd parties & authentication possible if sender and recipient share a secret: a key main assumption: passive eavesdropping

3 3

4 Kerckhoff s Principles: secrecy resides in the key 4 The system must be physically, if not mathematically, undecipherable; The system must not require secrecy and can be stolen by the enemy without causing trouble; It must be easy to communicate and remember the keys without requiring written notes, it must also be easy to change or modify the keys with different participants; The system ought to be compatible with telegraph communication; The system must be portable, and its use must not require more than one person; Finally, regarding the circumstances in which such system is applied, it must be easy to use and must neither require stress of mind nor the knowledge of a long series of rules.

5 The one-time pad 5 key material is a (truly) random bit sequence XOR= = addition (mod 2) = binary addition without carry unconditionally secure provided key is not reused key is as long as the message Alice encrypts plaintext... A = key cryptogram =... Z open channel Bob decrypts cryptogram key plaintext

6 6

7 (Quantum) Cryptography Eve: enemy cryptanalyst 7 Alice Bob message source encryption decryption destination open channel key source secure channel quantum cryptography = on-demand key transfer by quantum communications detectability and defeat of eavesdropping ensured by laws of physics & information theory avoids latent vulnerability of public key broadcasts passive monitoring ineffective today s quantum cryptography transmissions not vulnerable to tomorrow s technology reduces insider threat: key material does not exist until transmission time compatibility with optical communications/existing & planned infrastructures key distribution

8 8 FIRST QKD PROTOCOL Bennett & Brassard (1984) FIRST QKD EXPERIMENT Bennett et al.(1991) QKD FIBER EXPERIMENTS Rarity, Townsend et al. (UK, > 1994) Franson et al. (APL, 1994) Gisin et al. (Geneva, > 1995) Hughes et al. (LANL > 1995) Bethune et al. (IBM > 1999) Karlsson et al. (Stockholm > 2000) Polzik et al. (Denmark > 2001) FREE-SPACE EXPERIMENTS Franson et al. (1996) Hughes et al. (LANL > 1996) Rarity et al. (UK > 2000) ENTANGLED-PHOTON QKD Gisin et al. (Geneva, > 2000) Zeilinger et al. (Austria, 2000) Kwiat et al. (LANL, UIUC > 2000) SINGLE-PHOTON QKD Yamamoto et al. (2002) Grangier et al. (2002) CONTINUOUS VARIABLE QKD Grangier et al. (2002)

9 Quantum mechanics of ideal single photons & detectors 9 a single photon cannot be split beamsplitter single photon R T 0 detector 1 detector EITHER detector 0 fires OR detector 1 fires not both we cannot predict, even in principle, which detector will fire irreducible randomness of quantum physics

10 Quantum mechanics & (linearly) polarized single photons 10 polarizing beamsplitter polarizing beamsplitter vertically polarized single photon 0 detector θ -polarized single photon 0 detector 1 detector detector 0 never fires detector 1 always fires 1 detector detector 0 fires with prob = cos 2 θ OR, 1 fires with prob = sin 2 θ not both we cannot predict which one implications orthogonal polarization can be distinguished non-orthogonal polarizations cannot be faithfully distinguished after measurement a photon has no memory of its prior polarization [non-orthogonal polarizations cannot be faithfully copied ( no cloning )]

11 Conjugate coding 12 a bit of information can be encoded in orthogonal polarization states of single photons, in different bases: e.g. in the rectilinear basis 0 1 in the diagonal (45 ) basis ( conjugate ) 0 1 the bit can be faithfully decoded if the encoding basis is known if the wrong decoding basis is used, the outcome is random

12 The core ingredients of the BB84 QKD protocol 13 Alice has two sources of random bits long-term secret data bits independent, short-term secret encoding bits Bob has an independent source of short-term secret decoding bits they have a quantum channel allows the faithful transmission of polarized single photons they have a means to perform conjugate encoding and decoding ideal single photon sources and detectors they have an authenticated, but non-secret, conventional public channel they know they are communicating with each other, and not an impersonator ( Eve ) they know that Eve has not substituted her own messages

13 Core ingredients of the BB84 (QKD) Protocol (I) 14 bit encoding Alice 0 1 quantum channel decoding Bob bit value? secret, random bit and encoding secret, random decoding bit value Alice public but authenticated Bob Distilled Secret key sequence sifting: post-select matching encoding/decoding Distilled Secret key sequence

14 Alice data bit Alice basis A B quantum Bob basis An example of BB Bob 1 0/1 0 0/1 0/1 0/1 0 1 detects B A R D D D R R D R public A B Yes No Yes No No No Yes Yes public sift Alice and Bob now share 4 random ( sifted ) bits

15 Points to note 16 From Alice and Bob s perspective: on average the protocol is 50% efficient Alice and Bob cannot predict which bits they will share sifted key is a random sequence of random bits only photons that arrive can enter the sifted key photon loss merely reduces the key rate in practice other photons may enter the quantum channel source of errors? From Eve s perspective cannot passively monitor the quantum channel: a photon cannot be split no possibility of storing information for future analysis public channel conveys no information about the (secret) data bits cannot perform a man-in-themiddle attack public channel is authenticated use quantum physics methods to distinguish the quantum channel states?

16 Example: intercept-resend eavesdropping (I) 17 Eve inserts a polarizer at angle θ? Alice Eve??? Eve can only obtain partial information introduces a disturbance (errors) Bob e.g. 1: Eve tests randomly in the rectilinear and diagonal bases: on average learns 50% of Alice s bits has 50% bit error rate (BER) on the rest once she learns the basis information e.g.2: Eve tests every bit in the Breidbart basis (@ 22.5 ) learns each bit with prob ~ 85% e.g. Alice sends V, Eve tests θ P(Eve correct) = cos 2 θ sends Bob θ P(Eve wrong) = sin 2 θ sends Bob (90 θ) impacts: Eve can gain different types of partial information deterministic or probabilistic necessarily causes a disturbance Bob has a 25% BER if Eve tests every bit

17 Example: intercept-resend eavesdropping (II) 18 Alice Bob s errors Bob s sifted key contain errors relative to Alice s must be removed by further public communications from the number of errors in Bob s sifted key, he and Alice can establish a rigorous upper bound on Eve s partial information this information can be removed by privacy amplification Bob Eve s information Eve Eve's BER Bob's BER bit error rate (BER) bit error rate (BER) Eve e.g. Eve tests 40% of the bits Bob Eve's angle (degrees) Eve s polarizer angle

18 Bisective search interactive error correction: BINARY 1 19 [1] Bennett et al. (1991).

19 Reconciliation: post-facto error correction 20 Alice and Bob have sifted keys; Bob s has errors they communicate parity bits to find and correct errors e.g. bisective search: Eve gains side-information : at BER ε f(ε) = -log 2 ε (1 ε)log 2 (1 ε) bits/sifted bit (Shannon limit) reduces secret bit yield Alice: Bob : parity bits revealed to correct one error Alice Bob yield after error correction Shannon 1.19 Shannon bisective (data) Eve Eve s side information quantum BER

20 Estimating Eve s information 21 Bob finds that his sifted key has a BER = ε Alice and Bob conservatively assume an (optimal) strategy for Eve e.g. Eve intercepts/resends a portion p in the Breidbart basis (@ 22.5 ) Alice Eve Bob??? Eve would cause a BER, ε = 25% on a portion p of Bob s sifted key Alice and Bob estimate p from Bob s observed sifted BER, ε p = 4 ε Alice and Bob have an upper bound on Eve s knowledge of their reconciled keys a portion p, on which she knows each bit with prob ~ 0.85; guesses (1 p)

21 How to extract a secret 22 Alice and Bob have 6 bits: a, b, c, d, e, f e.g. 2. Eve has probabilistic information: she KNOWS x = {a, b, c, d, e, f} with p = ½, guesses otherwise e.g. 1. they KNOW Eve knows 3 deterministic bits, but not which three they can extract 2 SECRET bits: a b c d and c d e f Alice and Bob cannot extract ANY secret bit by hashing e.g. with probability ¾ Eve KNOWS a b c d e f combines known bits with unknown ones result = unknown Bennett et al. (1984): privacy amplification by public discussion hashing erases Eve s information in general: how much secret information can Alice and Bob extract (by hashing to a shorter final key)?

22 Side information? 23 Eve may also have side information: error correction bits Bob s sifted key has a BER = ε Alice and Bob conservatively assume the Breidbart strategy for Eve after reconciliation they use public communications to agree on which random subset parities to use as their secret key yielding: r = 1 4 ε log [ ε log 2 ε + ( 1 - ε ) log 2 ( 1 - ε ) ] secret bits / sifted bit (Shannon limit)

23 INGREDIENTS of QKD cryptographic quality random bits sifting error correction estimate bound on information leakage privacy amplification authentication entity identification message authentication key confirmation randomness tests standards Alice generates a secret random bit sequence Quantum transmissions from Alice to Bob sifting Alice & Bob reveal their encoding/decoding reconciliation error correction, bound Eve s information privacy amplification extract secret bits authentication of public channel messages, key confirmation final, secret key Security statement keys agree with overwhelming probability pass randomness tests Eve knows << 1 bit deception probability << 1 cryptography 24

24 Secrecy efficiency: ideal system 25 secrecy efficiency transmission protocol error = x & detection efficiency x correction x privacy amplification secret bits per initial bit physics introduce errors physics information theory reveals side information information theory collision entropy side information secrecy efficiency after error correction and privacy amplification against intercept/resend 0.8 ec + pa secret bit yield ad + ec + pa QKD may not be possible EVEN IF photons can be transmitted and detected sifted bit error rate

25 What does QKD offer? 26 from one-time authentication to self-sustaining key distribution drastically narrows an adversary s scope & window of opportunity: break initial authentication in real-time and attempt an invasive man-in-themiddle attack AUTHENTICATION quantum communications + information theory KEY DISTRIBUTION self-sustaining, copious shared secret key short, shared initial secret key replenish ENCRYPTION &/or AUTHENTICATION key key transfer (or key generation??)

26 Practical light sources, quantum channel & photon detectors single photon = weak Poissonian ( ) P n n e = n! = µ < 1 µ n µ sometimes send > 1 photon: security? detector efficiency = η PD µη ( 1 e ) = sometimes don t detect it ( ) P n = e n! µ n µ loss T ( ) P n loss = random partitioning T µ e = n! n = Tµ no-photon fraction and loss make it harder for Alice and Bob multi-photon fraction & noise introduce new opportunities for Eve revised privacy amplification secret bit rate? 27 ( Tµ ) n

27 Free-space QKD makes many types of secure key transfer possible 28 challenges photon production, transmission and detection atmospheric optics background photons timing and synchronization pointing, acquisition and tracking

28 The atmospheric QKD quantum channel low-loss transmission wavelength; high-efficiency detectors 29 secrecy efficiency as a function of wavelength: Proc SPIE 4635, 116 (2002) ~ 780 nm is optimal for QKD through the atmosphere single-photon detection with Si APDs challenges background photons daylight radiance ~ photons s -1 cm -2 Å -1 str -1 ~ 10 7 photons mode -1 temporal filtering: ~1 ns spectral filtering: 0.1 nm ~40,000 modes spatial filtering: 220-µrad FOV day/night ~ 10 6 Atmospheric transmission vs. wavelength Daylight background synchronization and timing atmospheric optics? not birefringent; intermittency: ~ 0.01-s

29 Free-space quantum key distribution Richard Hughes, Jane Nordholt, Derek Derkacs and Charles Peterson Transmitter Alice Sample of key material at 10-km range (day) one-airmass path: comparable optics to satellite-to-ground 30 A: B: A: B: key transferred by 772-nm single-photon communications 1-MHz sending rate; ~600-Hz key rate day: 45,576 secret bits/hour ; night: 113,273 secret bits/45 mins Receiver Bob From Pajarito Mtn., Los Alamos, NM to TA53, Los Alamos National Laboratory Transmitter Alice

30 BB84 subsystem 31 monolithic randomizer chip 2-MHz clock rate 1-MHz signal rate BB84 photons: attenuated 772-nm lasers 1-s quantum transmissions single-photon detectors: cooled Si APDs passive quench; η~61%; dead time ~ 1 µs quantum random number generation multi-detector system: upper bound on multiphoton pulses Alice 0 V - H basis 1 0 V - H basis laser 4 S1 S2 S3 S4 detector ± 45º basis ± 45º basis 1 beam monitor Bob 1

31 10-km atmospheric QKD range 32 Alice Bob

32 sifted bits / transmitted bit night: 18:45 to 19:29 MST 192,925 sifted bits noise, C ~ 1-2 s -1 detector dark counts channel efficiency, η opt / noise, C 10-km sifted key data: 4 October, 2001 photon number, µ 33 daylight: 17:42 to 18:44 MST 394,004 sifted bits noise, C < 50 s -1 background ~ 2 mw cm -2 µm -1 str -1 # sifted bits ~ µ η opt sifted BER, ε ~ C/ µ η opt photon number, µ transmitter channel efficiency, η opt receiver noise, C

33 Realistic security : BBBSS91 privacy amplification from sifted bits to secret bits cf. Bennett et al. (1991) 34 no photon one photon multi- photon µ = probability assume Eve identifies all multi-photon signals attribute all errors to intercept/resend on single-photon signals Eve gains error correction information privacy amplification Eve s collision entropy per bit is R ( ) ( ) 1 µ 4εlog εlog2ε + 1 ε log2 1 ε Alice and Bob extract ~ R secret bits/sifted bit by universal hashing random Boolean matrix no secrecy in certain parts of parameter space optimal choice of µ

34 e.g. in daylight from 18:40:26-18:40:27 MDT 4 October, In 1 s, from 10 6 transmitted bits with photon number µ = 0.29 Alice and Bob produce 651 (partially secret) sifted bits with 21 errors (BER, ε = 3.2%): Alice s and Bob s 264-bit final secret key: (produced as parities of random subsets) µ = 0.29 no photon one photon multi- photon probability Eve s entropy > 651 bits -155 bits (side information: error correction) - 40 bits (intercept-resend) -171 bits (multi-photon) - 2 bits (side information: bias) - 20 bits (safety factor) = 264 bits (secret) Eve s expected information < 10-6 bits

35 10-km secrecy efficiency: 4 October, 2001 (secret bits per transmitted bit) 36 produce ~ secret bits per 1-s transmission secrecy efficiency secret bits cannot be transferred in some regimes channel efficiency, η opt / noise, C photon number, µ photon number, µ transmitter channel efficiency, η opt receiver noise, C max ground-to-ground range (this system): 30 km (day); 45 km (night)

36 Secret key generated by free-space quantum communications over 10-km range e.g. 4 October, 2001 (daylight): 50,783 bits e.g. 4 October, 2001 (night): 118,064 bits

37 UNCLASSIFIED One-time pad encryption of an image using final key (error correction, privacy amplification & check) 38 Encrypted Image Alice encrypts by adding a word of her key to each pixel Bob decrypts by subtracting a word of his key from each pixel

38 Technologically feasible USD eavesdropping: Eve replaces quantum channel with a classical one? Bennett et al. (1991) 39 Yuen (1995) Chefles and Barnett Dusek et al transmitter receiver accessible loss = 1 - η opt yes yes can only be conventional channel transmitter yes receiver Eve no security: need three-photon emission < single-photon detection upper bound on photon number in terms of accessible loss: µ 3 /32 < η opt µ

39 PNS eavesdropping: strongest individual attack (not technologically feasible) 40 Eve intercept / resend single photon transmitter QND receiver n > 1 photons split store one photon (n - 1) photons lower-loss channel basis information uniquely identified security: need multi-photon emission < single-photon arrival upper bound on photon number in terms of accessible loss: µ 2 /2 < ηµ

40 Unconditionally-secure cryptographic authentication C. Wipf & K. Tyagi 41 protection against man-in-the-middle? Alice must know she is talking with Bob, and vice-versa impersonation? authentication of public channel communications substitution? Alice and Bob share a short (short-term) secret authentication key compute a keyed hash; apply as authentication tag cost is small: logarithmic in # bits authenticated ALICE BOB public communication tag A public communication tag hash function hash function tag B? authentication key authentication key

41 Authentication results: 10-km data from 4 October, bits sacrificed per successful QKD session mutual authentication with cumulative P d < 10 7 self-sustaining 10 km data: cumulative secret bits secret bits sacrificed bits authenticated bits Run run number

42 Atmospheric optics of 10-km path km path has extinction (1 AM), background and capture efficiency comparable to a path to space airmass : a measure of atmospheric extinction (and seeing ) zenith path from Los Alamos has ~ 0.8 AM AM = 1 AM = sec z height of atmosphere z sea level

43 Conceptual QKD LEO satellite downlink 44 downlink: turbulence in far field no leadahead/isoplanatism issue detectors on ground less susceptible to DoS 1 micro-radian pointing jitter on satellite 5 micro-radian tracking jitter at receiver LEO satellite 20-cm transmitter ~ m range ~ 5-m footprint ground station 50-cm receiver

44 Los Alamos 48-km optical fiber quantum key distribution experiment km fiber path Alice Bob receiver transmitter

45 The QKD Quantum Channel low-loss transmission medium; high-efficiency detectors 46 optical fiber QKD over telecommunications fiber networks? challenges: single-photon detection at 1.3 µm, (1.55 µm) Attenuation Coefficient vs Wavelength (Ge), InGaAs APDs Rarity et al., Cova et al., Gisin et al., Morgan et al. e.g. InGaAs APDs (Fujitsu) cooled to 140 K detection efficiency, time-resolution and noise increase with over-voltage 20% efficiency, 50 khz noise time-resolution [ps] dark counts [khz] noise = 7.4exp(9.2η) [khz] high noise rate can be offset by sub-ns time-resolution efficiency, η

46 QKD using single-photon interference 47 t ~ 300 ps attenuator long path T ~ 5 ns electro-optic phase-shifter Bob 1.3-µm pulsed laser 50/50 fiber couplers 48 km of underground optical fiber long-short (Alice) + short-long (Bob) interference: φ 1 Alice φ 2 air gap U L Cooled InGaAs APD detectors U detector η ~ 11% n ~ ±1.24% visibility 100kHz sending rate 22.9 db loss Counts/600s Counts/600s φ = 0 φ = π/2 φ=0 φ=π/ Counts/600s Time (ns) Time (ns) 400 φ φ=π= π φ = φ=3π/2 3π/2 Counts/600s Time (ns) Time (ns)

47 BB84 key generation 48 (0,1): φ A = (0,π) OR (π/2,3π/2) φ B = (0,π/2) 1.3-µm pulsed laser Alice φ µm pulsed laser WDM fiber couplers Room temp InGaAs APD φ 2 Bob U L Cooled InGaAs APD detectors Sample of 48-km BB84 key bits A B A B BER ~ 9.3 %; key rate ~ 20 Hz (2x B92)

48 QKD is evolving along dual tracks: theoretical secrecy & practical security 49 theoretical secrecy Bennett-Brassard 1984 authentication + quantum communications + information theory = QKD practical security computational security heritage influx QKD today security proofs capability enhancement? unconditional security future secure communications needs