1. CNS2009handout 21 :: quantum cryptography1 ELEC5616 computer and network security matt barrie mattb@alumni.stanford.org

2. CNS2009handout 21 :: quantum cryptography2 quantum cryptography What is quantum cryptography? –Using quantum computers to do cryptography What are quantum computers? –Quantum physics applied to computational tasks What does quantum cryptanalysis mean for classical cryptography? Is it feasible? Can we exploit quantum effects to solve our security woes?

3. CNS2009handout 21 :: quantum cryptography3 what we are NOT doing

4. CNS2009handout 21 :: quantum cryptography4 quantum physics Stuff is “quantised” –Atoms don’t behave like little billiard balls Atoms emit energy in discrete quanta, called “photons” Atoms sometimes interact in unexpected ways

5. CNS2009handout 21 :: quantum cryptography5 quantum physics Measurements are uncertain –Planck Length: 1.6x10 -35 m –Planck Mass: 2.2x10 -8 kg –Planck Time: 5.4x10 -44 s Heisenberg Uncertainty Principle Atomic properties are often undefined, expressed as a “superposition” of states –Atomic spin might be up, down, or both –Only defined when observed (“decoherence”)

6. CNS2009handout 21 :: quantum cryptography6 qubits Classical bit 0 1 qubit 0 ? 1

7. CNS2009handout 21 :: quantum cryptography7 qubit registers Classical bit registers 000100 001101 010110 011111 qubits registers (entangled qubits) ???

8. CNS2009handout 21 :: quantum cryptography8 qubit computation f(x) = 2*x (mod 8) Classical bits 000001101    000010010 qubits ???  ??0

9. CNS2009handout 21 :: quantum cryptography9 qubit computation (factoring y) f(x) = y mod x Classical bits (y=15=1111) 010011100…   001000011… qubits ???  000

10. CNS2009handout 21 :: quantum cryptography10 shor’s algorithm Peter Shor, AT&T (1994) Efficient factoring of n-bit integers with 2n-qubit registers IBM implemented the largest so far (December 2001) –7 qubit register –Factored 15 into 3*5

11. CNS2009handout 21 :: quantum cryptography11 quantum computer complexity BQP (Bounded-error, Quantum, Polynomial time) P  BQP NP-complete ? BQP (probably disjoint) Primality testing  P [Agrawal et al, 2004] Integer factorisation  BQP [Shor, 1994]

12. CNS2009handout 21 :: quantum cryptography12 most classical algorithms don’t last Anything relying on integer factorisation or the discrete logarithm problem can’t resist quantum cryptanalysis –RSA, DSA, Diffie-Hellman, El Gamal, ECC One-Time Pad is still fine – why?

13. CNS2009handout 21 :: quantum cryptography13 BB84: Bennett & Brassard (1984) Quantum key exchange with polarised photons Two basis pairs of two states (rectilinear and diagonal) Alice generates random bit string, and random basis sequence –e.g. 0110101 and Alice sends a photon per bit, polarised with the chosen basis Bob randomly picks a basis for each bit Alice and Bob compare notes later, only about chosen basis Any interception by Eve destroys initial photon state Immune to MITM if Alice and Bob can verify each other’s identity

14. CNS2009handout 21 :: quantum cryptography14 Practicality of BB84 Implementations are getting better –1989: 32 cm –March 2007: 148 km Still very slow and difficult, and doesn’t solve everything –authentication –non-repudiation (digital signatures) –and more … Moral: there are no “silver bullets” for security problems

15. CNS2009handout 21 :: quantum cryptography15 references Quantiki –www.quantiki.org