Using Quantum Effects for Computer Security

Transcription

1 Using Quantum Effects for Computer Security Arran Hartgroves, James Harvey, Kiran Parmar Thomas Prosser, Michael Tucker December 3, Introduction Computer security is a rapidly changing field. New algorithms are under constant development to try and improve security in cryptography and encoding schemes, often with mixed results. Classic encryption such as RSA achieves security by obscurity: information is kept secure by exploiting the in abilities of modern computers, such as factoring large numbers. Physicists in the 1930 s first began to try and provide explanations for unknown results in certain experiments. This new breed of thinking gave birth to was is affectionately known as quantum mechanics. Using these effects it has been possible to exploit quantum mechanical properties in such a way as to perform highly effective computations. These new style of quantum computers can be conceptually viewed as highly parallel conventional machines, making them ideal for solving problems such as factorization of numbers. They are also able to exploit physical phenomena such as entanglement to securely transmit data, guaranteed by the laws of physics rather than the inability of machines. This handout gives a brief outline of quantum mechanics and how science has harnessed them to improve security. 1.1 Quantum Mechanics Figure 1: Unexplained results The above illustration is a picture of an electron diffraction experiment. We see a beam of electrons that are focused on a piece of metal that has two slits in it that are a certain distance from each other. In classical physics it was thought that electrons were only particles and thus had the attributes of particles. Hence we would expect to see an accumulation of electrons in front of each slit as an electron would either pass through one slit or the other, this is illustrated by the picture on the left. However the actual results found that electrons had accumulated opposite the centre of the two slits with the electron distribution dispersing away from the centre. It was eventually found that the electron was splitting itself up with half of the electron passing through one slit and the other half passing through the other slit simultaneously and joining back up once they had passed through the slits. This however 1

2 was a property of waves not particles hence this was termed the particle-wave duality. Experiments such as this brought into question traditional physics and the study of such strange behaviour became known as quantum mechanics. 1.2 Quantum Computers Classical computation is built on a binary system i.e. there are two absolute states 0 and 1. A quantum computer is built upon qubits which are like classical bits but have some extra properties. Qubits have a Quantum property, amongst others, called superposition. A qubit can be in a combination of two states at the same time i.e. a normal bit can be in states 0 or 1 where as a qubit can be in a combination of 0 and 1. When a direct measurement is made on a qubit, the state is set as 1 or 0. The selection of the states 1 or 0 is probabilistic and is based upon how much the qubit was in the states 1 and 0 prior to being measured. Subsequent measurements of the qubit will give the same state i.e. a qubit is simultanesouly in states 0 and 1 but once it s measured it will take the state 0 or 1 and will keep giving that value. Figure 2: Schrodinger s Cat An analogy to help simply the concept of superposition is Schrdinger s Cat. From the right hand side to left we have a radioactive particle that is linked to a Geiger counter to detect the decay of the radioactive particle, the detector is linked to a hammer which is above a flask full of poison, and sitting next to the flask is a cat. All this is encased inside a box which we cannot see into. The idea is when the radioactive particle decays it will be detected by the Geiger counter that will trigger the hammer to fall on the flask breaking it and thus killing the cat. However the decay of the radioactive particle is governed by quantum mechanics and has a certain probability of decaying. Until we measure the radioactive particle the particle is in a mixture of states of being decayed and not-decayed, therefore the cat is in a mixture of states of being dead and alive. We cannot tell which state the cat or the atom is in until we make a measurement i.e. look inside the box. 1.3 Practical Effects on Classical Computation One practical advantage is parallelism. This is an exploitation of the superposition of an atom. Superposition makes it is possible to do computations simultaneously as an atom is in all states simultaneously (but the method to extract the answer is rather complicated as reading a single answer destroys all the other answers). Another advantage is quantum search algorithms. As we have seen with some brute force methods to compromise cryptographic methods they usually rely on a search mechanism. Classical search methods take O(N) time to complete however a quantum search algorithm such as Grover s would take O( N). We therefore achieve a large performance gain hence brute force attacks are easier on classical cryptographic methods. For example Shor s algorithm, which is a factoring algorithm using quantum methodologies, 2

3 can do factoring in O(n 2 log n log log n). Both gains in algorithms are due to the ability of a quantum computer being able to simultaneously calculate all numbers. Finally another important advantage is the ability to have secure communication by using Quantum Teleportation which will be detailed later in the handout. 2 Breaking unbreakable codes 2.1 Introduction For a long time, all cryptography was achieved via symmetric keys. Both parties who wished to communicate securely needed to agree on a key before hand which would then be used to encrypt the message and the same key would be required to reverse the encryption. With such a system there is a need to ensure that a key is only used once and then thrown away to prevent would be attackers from gaining enough information from the messages to figure out the original key. Another problem with such a method is that there needs to be a way of distributing keys without them being intercepted by anyone other than the desired target. While the United States and Russian governments can almost ensure their keys are kept secure after covert exchanges, people with less rescources could be vulnerable. In the 70 s a new method was invented that involved 2 keys, one that is used to encrypt messages and the other that is used to decrypt them. The key for encrypting messages (public key) can be freely distributed to all parties who want to send an encrypted message to the owner of the decrypt key (private key). From just the public key alone it should be impossible to infer the private key and hence gain access to all the encrypted data. These methods rely on the supposed intractibility of certain mathematical problems. 2.2 RSA Overview Many of these public/private key cryptosystems exist but the most widely used today is RSA. It is based on the intractibility of factoring large numbers. That is, given a very large number it will take a very long time to find the prime factors. A basic summary of RSA is as follows n is the product of two large primes p and q a number d is found using p and q (d,n) is the private key another number e is found using d, p and q (e,n) is the public key If we wish to send a message to someone, we first encrpyt the message with the recipitents public key. When they recieved the message, they decrypt it using their private key. As intruders cannot access the persons private key, even if they get hold of the message they cannot decode it succesfully. 2.3 Breaking RSA! Since an intruder has e and n (in the public key) they can then factor n into p and q. They now have the message that was sent to the public key holder, and the numbers e, p and q. Next we find d from e, p and q (as achieved in the RSA algorithm) and we now have the private key number pair, d and n! We then decrypt the message using d and n. Of course, in this explanation we have assumed that the factoring of n into p and q is possible. In reality it is virtual intractable using classical methods. 3

4 Number Size Prize Status 174 digits $10,000 Factored 193 digits $20,000 Not factored 212 digits $30,000 Not factored 232 digits $50,000 Not factored 270 digits $75,000 Not factored 309 digits $100,000 Not factored 463 digits $150,000 Not factored 617 digits $200,000 Not factored Table 1: RSA efforts! 2.4 RSA Numbers RSA 129 was a 129 digit number that took 17 years to factor. During that period of time, computing power increased 2000 fold. Yet even with this increase in power, the number still took a network of 1600 machines to factor. Using this knowledge, you might be bold enough to estimate a 250 digit number would be a safe n (as in our previous example) to use RSA securely into the future. However, as techniques and computing power have inceased, larger and larger number are being factored (see table 1). It is also entirely possible that a new method for factorisation will be invented, and allow classical factorisation of large numbers to become tractable. In 1994, Vazirani characterized the difficult of factoring a 2000 digit number classically. He said that if every particle in the universe were a classical computer running at full speed for the remaining life of the universe, you would not be able to factor the number. So we can simply use a 2000 digit number (a bit of a overhead!) to ensure safe communications? 2.5 Shor s Algorithm In 1994, Peter Shor of AT&T Bell Labs showed how to factor a large number efficiently using a quantum computer. He used a quantum method for finding the period of a certain periodic function. The period describes the number of values between repeating outputs of a function; in the case of a sin function, this would be 2π radians. Once we have the period for this function, we can efficiently find the factors of large numbers using classical mathematical methods. Overall we have a very efficient algorithm! The number field sieve is the best known classical algorithm for finding prime factors of a number. O(exp (c n 1 3 )) The number field sieve is super-polnomial complexity, and although not exponential, it is considered intractable. Shor s algorithm however is tractable and has the below complexity! O(n 2 log n log log n) Shor s algorithm was the killer app that proved that Quantum computers were not only more powerful than classical computers when dealing with trivial cases such as the square root of the not function! 2.6 Shor s Algorithm close up F n (a)=x a mod n Above is the afformentioned function for which we want to find the period. First we select an n, which is the number that we wish to factor. We then select as x that is co-prime to n. By co-prime we mean that the greatest common factor between n and x is 1. We the input increasing values of a into the function and record the results. This will leads to a repeating pattern of lengths r of the function, as a increases. When we find r, we can use classical mathematics to find the factors of n. However, using 4

5 classical methods finding r is intractable as the period for some large numbers could be huge and for each argument a, we have to evaluate the function. We need a quantum approach to this problem, and this is exactly what Shor s algorithm uses! Register 1 stores all of a in superposition (otherwise we would have to calculate the function for each a). We then calculate in quantum parallel all results of the function F n (a)=x a mod n and store this in register 2 Measurement of register 2 causes the values in register 1 to collapse into arguments that would result in the measured value from register 2 After these steps register 1 is left with all arguments, that when fed into our function, will give the same output. This will constitue of an initial value, plus extra values that correspond to the inital value plus some multiple of the period r. Register 1 = { a, a+r, a+2r, a+3r } We then apply an Inverse Quantum Fourier transformation operation on register 1. This step is essential and reveals valuable information to us about the period r. Note, we cannot simply measure register 1 a number of times as we would collapse the state of the register after one measurement onto one of the input values, and the information we have extracted from the procedure could have been achieved using classical methods (one input and a result). It is also important to note that an operation is not a measurement on the register and hence will not collapse the state. After the Inverse Quantum Fourier Transform, the register is in a new configuration and the probability of picking a value that is a multiple of the inverse of the period is now very high. Providing that when we now measure the register we get a multiple of the inverse peiod, we can deduce r by using classical mathematical methods. A few iterations through this algorithm will allow us to determine r conclusively. This is because after the inverse quantum fourier transofrm, their is a probability that we can pick a value that is not a multiple of the inverse period r, from which we cannot deduce r. It turns out that the larger the size of a quantum register we use in our quantum system, the less chance we have of picking such bad values. We can then continue to factor n using classical number number theory. As the period of the function repeats every r terms for a certain number n (to be factored) and a certain x that is co-prime to n, the following formulae is true. x r =1mod n We can then convert this algorithm into the difference of two squares form. (x r )=1mod n (x r )-1=0mod n (x r 2 ) 2-1=0mod n (x r 2 +1)(x r 2-1)=0mod n This means that (x r 2 +1)(x r 2-1) is a integer multiple of n and the greatest common divisors of (x r 2 +1) and n and (x r 2-1) and n will lead us to factors of n! 2.7 Conclusions Currently, the number 15 has been factored using a very small quantum computer and the process described above. Of course, this small number has very little implication for worldwide RSA security. However, technology moves fast, and if a larger number than 15 was factored using a quantum computer, such a success may not be published for a variety of reasons. 5

6 3 Quantum Key Distribution The advance of computer technology and further understanding of quantum mechanics has allowed for more secure versions of existing encryption schemes to be implemented. There are protocols that allow private keys to be distributed securely by encoding them as polarised photons and transmitting them through a fibre optic cable. The advantage of using this method is that the two parties exchanging the key can detect if an evesdropper is monitoring the key transfer and then abort if they think the key may have been interfered with. This is made possible because when a quantum state is measured it is disturbed and made to collapse onto a single state. 3.1 Transmitted Polarised Photons Photons can be polarised using two different modes Figure 3: Possible polarisation modes The reason for having two modes for polarisation is to increase security Both methods allow you to encode a bit as 1 or 0. State Encoded as 0 Encoded as 1 The state used to polarise a photon must also be used to measure it. The reason for this is best explained using an example; A photon is polarised, using the + state, to be 1. If this photon is then measured using the x state it s vertical component could be interpreted as either of the x polarisations because both of them have vertical components as part of their polarisations. This means that a photon that was originally meant to represent 1 could end up as 0 or 1 even if it was measured using the + state. 6

7 3.2 BB84 BB84 is an example of a Quantum Key Distribution algorithm and was the first algorithm invented for this problem. It isn t the most secure algorithm but it s the most simple to explain. In BB84 a new private key is created for each transmission which increases the security. If the same key is used multiple times it would be possible to gather enough statistical data to figure out the key. 1. Alice creates a string of random bits 2. She then coverts this into a photons, randomly choosing which state to use to polarise the photon 3. Alice sends the photons to Bob through a fibre optic cable 4. Bob receives the photons and randomly chooses which state to use to measure each one 5. Alice and Bob then compare the states used for each photon, ones where different states were chosen are now disregarded 6. Bob then translates the remaining measurements into bits 7. Alice and Bob can compare some of these bits to make sure the transmission was successful 7

8 8. If the number of matching bits is within a pre-decided limit then the undisclosed bits are used as the private key for this transmission If the number of matching bits is not within the decided limit then the transmission is aborted because there are errors on the line or it is unsecure 3.3 Possible attacks BB84 stops undetected eavesdropping because if an eavesdropper wanted to read the photons during transmission she would have to select which state to use to measure each photon. If she chooses a different state than the one to which the photon was originally polarized in then her measurement could cause the photon to collapse into a different polarisation. So when Alice and Bob compared their bits the number of matching ones will not be within the limit and they will be able to tell there is a problem. Unfortunately they would be unable to tell if the error was because of eavesdropping or simply noise or an error on the transmission line. This version is susceptible to man-in-the-middle attack if the attacker can intercept both channels of communication and convince Alice that he is Bob and convince Bob that he is Alice. There are other algorithms for Quantum Key Distribution that are more secure because they use entanglement and other protocols to prevent man-in-the-middle attacks, e.g. the enhanced version of BB84. 4 Teleportation Although sounding as though lifted straight from a science-fiction movie, teleportation is a working physical process that allows the transmission of information between locations, without using any physical communications medium e.g. fibre optic links. This underlying principle of teleportation relies upon a behaviour termed entangled. By utilizing entangled particles, it is possible to transmit information between any two points in space. Below is an outline of entanglement behaviour. 4.1 Entangledment - An Overview Background Einstein, Podolsky and Rosen first conceived the idea of particle entanglement in a paper published in 1935, and hence is known simply as EPR effect. It is the creation of a relationship between two particles regardless of their independent physical locations, or, Spooky action at a distance!, Einstein An Entanglement Example Let us illustrate entanglement using an example. Consider an atom in a confined environment. We assume that the atom is able to emit particles; in this case, photons (P x ). The atom simultaneously emits a pair of identical particles (P 1 and P 2 ). These particles are emitted simultaneously by the same parent atom and are atomically identical: because of this they are said 8

9 to be entangled. This is just one way to entangle particles; it can also be done using huge expensive equipment too! Conceptually we view these two separate particles as a single quantum system (S 1 ) due to The Law of Conservation. This states that in any quantum system, if a particle has a particular value when measured (e.g. a value 1), then the other particle must have the exact opposite value so that the system is balanced. 4.2 Effects of Entanglement From the relationship that exists between the entangled pair (P 1, P 2 ) arises some interesting behaviour. Application of Law of Conservation : When we measure one of the entangled particles, it collapses onto a state. For example, when we measure a qubit, it may collapse onto either 1 or 0. This still holds true for an entangled pair of particles. If we measure P 1 of the pair, then due to the Law of Conservation, P 2 will collapse into the exact opposite value when measured, thus keeping the system balanced. This happen instantly and currently cannot be explained by physicists! Relationship is location independent : Although viewed as a single quantum system, it is possible to physically separate P 1 and P 2, but the link between them will still persist, hence spooky action at a distance! For example, if we take P 1 to one area of space and P 2 to another area, the relationship will still persist. Even though they are physically separated, if P 1 is measured, P 2 will collapse in exactly the same way as if the pair were right next to each other. (See above) Relationship cannot be destroyed : Once two particles have been entangled as a system, S, it is impossible to break this relationship. 1 This is termed non-factorizable as S can never be broken back into P 1 and P 2 as it would violate the Law of Conservation. 4.3 Entanglement Applied Using the principles of entanglement, it is possible to use an entangled pair of qubits as a communications channel. To illustrate this, we will use Alice and Bob as an example. 1. First, we create an entangled pair of qubits, P 1 and P 2. We then give one of qubits to Alice, P 1, and the other, P 2, to Bob. Neither of these qubits have been measured and are in a superposition of states. We can then use the link between them as a communications channel! 2. Alice now wishes to send some data, D, to Bob. This data is encoded in a qubit. Weird link! D P 1 Figure 4: Alice and Bob s entangled photons P 2 1 Although strictly impossible to break, the relationship ceases when one of the entangled pair is measured. 9

10 3. We now take a measurement on Alice s part of the entangled pair, P 1, and D. This projects the pair into a Bell state. It also entangles P 1 and D. P 1 Weird link! D Weird link! P 2 Figure 5: Alice and data entangled photons 4. Alice now measures her data, D. Due to Law of Conservation, any particles entangled with D are put into the exact opposite state. Hence, P 1 is now in the exact opposite state of D. Alice now measures P 1. Consistent with Law of Conservation, P 2 (Bob s qubit) is now in the exact opposite state to P 1. Hence, due to the transitivity relationship between D, P 1 and P 2, P 2 is now exactly the same as D. 5. When we projected P 1 and D into a Bell state, we slightly rotated the entanglement between these particles. Hence, P 2 is also rotated. Before Bob measures it, he must first un-rotate it to restore it to the original state. P 1 Weird link! D Weird link! P2 Figure 6: Bob s rotated particle 6. Once Alice measures P 1, she uses the information to tell Bob how to un-rotate P 2. This information is sent via a classical communication channel. When Bob applies this rotation, his qubit is exactly the same as the data Alice tried to send him. We have now created an exact replica of the original data at Bob s location! Because we destroy the original version at Alice s location when we measure it, we have essentially destroyed the information contained in the original and re-created it somewhere else, hence teleportation! 4.4 Teleportation: Advantages and Disadvantages So we have now teleported information from Alice to Bob. Apart from being cool (!) and sounding like something from Star Trek, what are the advantages and disadvantages of being able to send information in this way? Advantages As stated, the relationship between two entangled particles cannot be broken. This means that an attacker, Eve, cannot perform a man in the middle attack as there is no way she can access the communication channel between the particles, unless she breaks the laws of physics! In the same vein, it is also impossible for Eve to eavesdrop on communications for the same reason. 10

11 This seems to suggest that teleportation is entirely secure Disadvantages When we measure any particle, it can only be measured once before assuming a fixed state. In terms of the entangled pair, when we measure one of the particles, we destroy the link between the pair. This means that the pair can only ever be used as a communication channel once. Because of this, we can only send a single message using an entangled pair. This then gives rise to the entangled pair distribution problem. If Alice wants to send data to Bob, but they have never met, Bob must have part of an entangled pair to act as an end-point of a communication channel. So how do we give Bob this particle without there being a possibility of Eve intercepting it? The final disadvantage is the use of a classical communication channel to send rotation information. Without this information, Bob cannot un-rotate his particle. If Eve blocks this communication, Bob can never get his data from the particle. However, this denial-of-service has not compromised the data in any way; it is still in tact and cannot be read by anyone other than Bob. If Eve reads the information on the classical communication channel, she is still not able to extract any information from Bob as she doesn t physically have any access to Bob s particle. The only possible attack Eve could use is to perform a man in the middle attack on the classical channel. She can intercept messages from Alice and send Bob different rotation information. This would cause Bob to rotate P 2 in the wrong way, thus destroying the information when read. However, if Alice and Bob use quantum key distribution, they can use a private key to encrypt the rotation information, thus protecting it. 4.5 Special Relativity and Entangled pairs For those of you who are interested, the following gives information about how entangled pair s fit into Special Relativity. As we know, Special Relativity infers that nothing can travel faster than the speed of light, otherwise it is possible to send information back in time. If we measure P 1, this instantly effects the value of P 2 (Law of Conservation). If we take P 1 to one part of the universe, and P 2 to the other, so that both are infinitely far apart (i.e. light from one part will never reach the other, even in infinite time) if we measure P 1, the value of P 2 will still alter. This seems to infer that quantum entanglement breaks the laws of special relativity by information travelling faster than light. So, if we teleport information from P 1 to P 2, how does it not travel faster than the speed of light? This is because to measure P 2 successfully, P 1 must send information as to how to rotate it to re-construct the original data. To send the data, P 1 can only use a classical communication channel, which is limited by the speed of light, hence, teleportation of information faster than the speed of light is not possible. It is this paradox that inspired Einstein et al to publish their famous paper in 1935 describing the EPR effect. References [1] J. Bub. Quantum entanglement and information. [2] A. Ekart. Quantum cryptoanalysis. 11

12 [3] A. Ekart. What is quantum cryptography? [4] R. Jozsa, W. Wootters, C. Bennett, G. Brassard, C. Crepeau, and A. Peres. Teleportation research at ibm. [5] Multiple. Wikipedia online encyclopedia. [6] M. Nielsen and I. Chuang. Quantum Computation and Quantum Information. Cambridge University Press, [7] E. G. Rieffel and W. Polak. An introduction to quantum computing for non-physicists. ACM Comput. Surv., 32(3): , [8] I. Style. Introduction to quantum computation. Lecture notes, [9] Unknown. How quantum computers will work. [10] S. Vittorio. Quantum cryptography: Privacy through uncertainty. [11] C. Williams and S. Clearwater. Explorations in Quantum Computing. Springer-Verlag New York Inc.,