News

Quantum Crypto Products Cracked by Researchers

• By William Jackson
• 09/13/2010

The use of quantum physics to exchange secret cryptographic keys is, in theory, inherently secure. But a team of European researchers has demonstrated that commercial implementations of quantum key distribution (QKD) are subject to eavesdropping with off-the-shelf equipment.

"Here we demonstrate experimentally that the detectors in two commercially available QKD systems can be fully remote-controlled using specially tailored bright illumination," the researchers write in a letter published Aug. 29 in the journal Nature Photonics. "This makes it possible to tracelessly acquire the full secret key."

Lars Lydersen, Carlos Wiechers, Christoffer Wittmann, Dominique Elser, Johannes Skaar and Vadim Makarov, researchers from the Norwegian University of Science and Technology, the University of Erlangen-Nürnberg and the Max Planck Institute for the Science of Light in Erlangen, wrote that the vulnerability they exploited is likely to be present in most QKD systems because their photon detectors can be spoofed using a bright laser.

However, a scientist from the National Institute of Standards and Technology disputed the conclusion, saying the attack technique isn't as subtle as the researchers claim, and can be prevented.

"This type of attack is not new and is based on the idea of the intercept-resend attack," a kind of man-in-the-middle attack in which the eavesdropper intercepts information and then passes it along to the intended recipient, said Xiao Tang, NIST's quantum communications project leader. This type of attack, which leaves the third party in possession of the data, has already been described conceptually,Tang said.

The researchers demonstrated a practical implementation of it, but it can be easily prevented, Tang said.

Quantum key distribution uses the quantum state of individual photons for the exchange of data. Each photon properly detected conveys a single bit of data, which in theory cannot be read or interfered with without detection. The technique has been proved in laboratories and several commercial products using it are available. The researchers tested their scheme on products sold by ID Quantique and MagiQ Technologies.

An eavesdropper, commonly referred to as Eve by cryptologists, inserts herself between Alice, who is sending the key material, and Bob, who is receiving it. Eve receives the photons from Alice and detects their state, getting the data for the key. She uses a laser to blind Bob's detector so that it responds to laser pulses rather than individual photons, then resends the stolen key data via laser to Bob. Eve then has a copy of the key exchanged by Alice and Bob.

But if Bob is paying attention, he should be able to see that something has happened, Tang said. Because the state of each photon can only be properly detected half of the time, there is a 50 percent error rate between Alice and Bob. When Eve inserts herself between the two of them, that should increase Bob's error rate by another 50 percent, which should be detectable.

"So I do not think that their method can obtain a perfect copy of the raw key without leaving any trace of Eve's presence," as the researchers claim, Tang said. In addition, the light used to control and fool Bob's detector could also be a giveaway. "The laser and bright light pulses can be easily detected by Bob, therefore this kind of eavesdropping can be prevented by simply adding some detecting devices," Tang said.

The researchers wrote that their demonstration is not intended to discredit quantum key distribution, but to strengthen what they see as an emerging practical technology.

"In our view, quantum hacking is an indication of the mature state of QKD rather than its insecurity," they wrote. "Rather than demonstrating that practical QKD cannot become provably secure, our findings clearly show the necessity of investigating the practical security of QKD. Any large loopholes must be eliminated, and remaining imperfections must be incorporated into security proofs."

They said that both ID Quantique and MagiQ Technologies were notified of the vulnerability and exploit before publication of the article. ID Quantique has implemented countermeasures, they said, and the MagiQ product used in their demonstration has been discontinued.