1
00:00:02,160 --> 00:00:04,640
This is a secret message.

2
00:00:04,840 --> 00:00:07,380
Its contents are known only by me.

3
00:00:07,480 --> 00:00:10,220
I'll put it away safely and securely.

4
00:00:10,960 --> 00:00:23,120
Now when you have some information that you wish communicated to only specific parties, be it a pen test report or your Netflix credentials, how would you ensure only your intended target was able to receive the message?

5
00:00:23,120 --> 00:00:29,980
I hope for everyone watching today the answer is either some form of cryptographic solution or sod off I'm not showing my Netflix.

6
00:00:29,980 --> 00:00:36,160
As I'm sure many of you are aware, there is a looming technology that is set to change the landscape of cryptography.

7
00:00:36,960 --> 00:00:38,400
Quantum computers.

8
00:00:38,460 --> 00:00:40,960
They will force a change that's already begun.

9
00:00:41,060 --> 00:00:52,220
Although the NTSC, for example, predict that quantum computers won't be cryptographically relevant for another 10 years, the drive to move to cryptographic standards resistant to this new threat has already begun.

10
00:00:52,220 --> 00:01:01,880
In this talk, we will provide an introduction to this cutting edge field, discuss paradigms for security testing and the types of things to look for when offering remediation advice.

11
00:01:02,100 --> 00:01:09,920
Quantum cryptography and quantum resistant cryptography are set to play increasing roles within our industry and jobs in the next few years.

12
00:01:10,600 --> 00:01:14,600
So before we begin, it probably makes a little bit of sense for me to introduce myself.

13
00:01:14,600 --> 00:01:19,720
My name is Imran and I have MSc in theoretical physics from the University of Nottingham.

14
00:01:19,720 --> 00:01:23,100
In particular, my area of study was gravity particles and fields.

15
00:01:23,100 --> 00:01:26,860
And my dissertation was on error correcting codes in quantum computers.

16
00:01:26,860 --> 00:01:29,820
So this is a subject that is near and dear to my heart.

17
00:01:29,960 --> 00:01:36,540
During my studies, I participated in online bug bounty programs and found a P2 in a Fortune 10 company.

18
00:01:36,720 --> 00:01:43,440
Largely because of this, I was part of the group awarded the Bug Crowd 2017 VIP Researcher Accolade.

19
00:01:43,440 --> 00:01:52,780
It was at this point that my interest in cybersecurity transitioned from something of a fun hobby to something I wanted to pursue full time.

20
00:01:52,920 --> 00:01:57,080
And because of that, I started actively looking for jobs within the industry.

21
00:01:57,080 --> 00:02:05,940
I was fortunate enough to be able to join Cybrus in January of 2018 and have been happily working as a security consultant ever since.

22
00:02:06,040 --> 00:02:09,280
Okay, now with that out the way, let's get going.

23
00:02:09,280 --> 00:02:23,300
So to begin the discussion on quantum information, we've got to first look at classical information theory, which largely originates from Shannon's seminal 1948 paper, in which he puts forward two really important points for our talk today.

24
00:02:23,300 --> 00:02:28,340
The first is the concept of entropy, which can be thought of, amongst other things, as a measure of information.

25
00:02:28,440 --> 00:02:36,700
And the second is that it's possible to communicate reliably over noisy channels, provided that the rate of communication is less than the channel capacity.

26
00:02:36,700 --> 00:02:45,020
Now, quantum information begins with the idea that quantum systems are the ultimate physical medium for storing and processing of information.

27
00:02:45,160 --> 00:02:55,980
It tries to extend Shannon's theory by replacing bits of information with generic 2D quantum systems called qubits, and classical channels by their noisy quantum channel counterparts.

28
00:02:56,480 --> 00:03:03,640
In quantum cryptography, much like in classical cryptography, one would like to transmit or share information securely.

29
00:03:03,640 --> 00:03:12,640
Except now we try and leverage the fundamental properties of our universe, such as the fact that quantum states cannot be learned without being disturbed, in order to do so.

30
00:03:13,680 --> 00:03:19,580
So, before we start talking about quantum computers, let's have a quick recap on classical computers.

31
00:03:19,580 --> 00:03:29,360
Now we know that information is stored in bits, 1s and 0s, and if storing one number takes 64 bits, then storing n numbers would take 64 times n bits.

32
00:03:29,360 --> 00:03:33,000
Calculations are done essentially the same way as they are by hand.

33
00:03:33,080 --> 00:03:44,140
And as such, the class of problems that can be solved efficiently are the same as those that can be solved by hand, where efficiency is referring to the idea that the evaluation time doesn't grow too quickly with the size of the input.

34
00:03:45,520 --> 00:03:51,900
Now with quantum computers, information is also stored in bits, except now they're quantum bits, or qubits.

35
00:03:52,020 --> 00:03:55,760
A qubit can be in a state of 0 and 1, much like a classical bit.

36
00:03:55,760 --> 00:04:02,000
However, it can also be in a superposition of these states, a0 plus b1, where a and b are complex numbers.

37
00:04:02,120 --> 00:04:12,440
We use complex numbers as they provide benefits in the calculation and comprehension of qubit states, such as the ability to map states to positions on a sphere, as shown in the image.

38
00:04:13,440 --> 00:04:23,040
So where a bit can either exist as a 0 or a 1, a qubit can exist in a continuum of states, confined by the boundary of the sphere, with poles at 0 and 1.

39
00:04:23,040 --> 00:04:29,280
Calculations are performed by mathematical operations, called unitary transformations, on the state of the qubits.

40
00:04:29,400 --> 00:04:42,460
When combined with the principles of superposition, this creates possibilities not available for hand calculations, which translates into more efficient algorithms for factoring, searching, and simulation of quantum mechanical systems.

41
00:04:42,480 --> 00:04:45,480
It also allows for more information to be stored in a qubit.

42
00:04:45,480 --> 00:04:50,500
For every extra qubit you get, you get twice as many numbers that you're able to store.

43
00:04:51,620 --> 00:04:59,860
So, if it takes 1 qubit to store 2 numbers, for example, it'd take 2 qubits to store 4, or 3 qubits to store 8.

44
00:04:59,860 --> 00:05:06,780
In fact, there's an equation there on that graph, that if manipulated, will tell you exactly how many qubits you'd need to store n numbers.

45
00:05:06,780 --> 00:05:09,580
I'll leave that as a little puzzle for the mathematically inclined.

46
00:05:10,200 --> 00:05:18,420
But the takeaway message is that the more qubits you add to the system, the greater the storage capacity, and by an exponential amount.

47
00:05:18,420 --> 00:05:22,280
It's not a linear increase in storage, but an exponential one.

48
00:05:23,580 --> 00:05:27,660
So, quantum computers, they sound amazing, but are they better at everything?

49
00:05:27,660 --> 00:05:34,780
Well, quantum computers utilise quantum mechanics to solve certain problems much faster than is possible with a classical computer.

50
00:05:34,980 --> 00:05:37,720
Quantum mechanics relies on the principles of probability.

51
00:05:37,880 --> 00:05:45,400
In quantum mechanics, we depend on numbers called probability amplitudes, which can be positive, negative, or complex numbers.

52
00:05:46,180 --> 00:05:54,880
A simplification of the process is that we try and orchestrate it so that some wrong answers have positive amplitudes, whilst others have negative amplitudes.

53
00:05:54,880 --> 00:05:58,920
That way, they destructively interfere and cancel each other out.

54
00:05:58,920 --> 00:06:07,140
Now, this is made more complicated by the fact that we don't know what the wrong answers are ahead of time, and so coding such things is non-trivial.

55
00:06:07,140 --> 00:06:09,960
However, this is loosely how the process works.

56
00:06:10,740 --> 00:06:23,180
In general, problems that can utilise parallelism, the ability to split a problem into several parts and then solve them all simultaneously, are problems that will benefit from the gains quantum computers have to offer.

57
00:06:23,300 --> 00:06:35,100
Problems like prime number factorisation, or finding the most efficient route through a complicated city grid, are great candidates, whereas you're unlikely to see much of an FPS increase in your favourite video games.

58
00:06:35,100 --> 00:06:37,440
So, apologies to any Fortnite fans.

59
00:06:37,960 --> 00:06:40,900
So, where are we currently with quantum computers?

60
00:06:40,940 --> 00:06:45,700
Well, the largest gate-model processor was released by Google, and it's called Bristlecone.

61
00:06:45,740 --> 00:07:01,080
It weighs in at about 72 qubits, and whilst there are far larger quantum annealing processors, which are designed to solve a very specific set of problems, gate-model processors are what most people think of when they think of quantum computers, and are applicable to a wider set of problems.

62
00:07:01,080 --> 00:07:04,100
They are considered universal quantum computers.

63
00:07:04,100 --> 00:07:10,640
We also have our first commercial quantum computer, released by IBM, and called the Q-System-1.

64
00:07:10,640 --> 00:07:12,480
It weighs in at 20 qubits.

65
00:07:12,480 --> 00:07:26,500
Mr Morimoto, director of IBM Research Tokyo, and global VP, said IBM intends to commercialise quantum computers within three to five years, when he expects quantum computers to be able to outperform supercomputers in specific domains.

66
00:07:26,500 --> 00:07:31,060
So, this first commercial system can be taken as a bit of a statement of intent.

67
00:07:32,940 --> 00:07:39,400
UNSW Sydney have succeeded in producing a qubit that functions at 1.5 Kelvin.

68
00:07:39,540 --> 00:07:51,920
Now, this is many times warmer than common quantum processors that are currently developed, and it may enable integrating classical control electronics within a qubit array, which would end up reducing costs substantially.

69
00:07:52,040 --> 00:07:58,620
The cooling requirements necessary for quantum computing have traditionally been one of the toughest roadblocks for the field so far.

70
00:07:59,480 --> 00:08:07,960
And a research breakthrough has succeeded in showing experimental evidence for a new state of matter, topological superconductivity.

71
00:08:08,160 --> 00:08:09,500
Catchy, I know.

72
00:08:09,620 --> 00:08:23,780
Whilst the emergence of this state has been seen in 2D systems so far, it is believed that the system could be scalable and used for the construction of qubits, yielding the potential for increased calculation speeds and boosted storage.

73
00:08:23,780 --> 00:08:31,140
Finally, IBM's Q Experience and Amazon Bracket have effectively brought quantum computers to your home.

74
00:08:31,140 --> 00:08:38,200
With cloud quantum computing, this allows for experiments to be run on quantum systems and simulators available to the public.

75
00:08:38,280 --> 00:08:45,040
The cloud promises to facilitate great strides in quantum-related fields by allowing more people access to the technology.

76
00:08:45,940 --> 00:08:52,460
This is a really exciting development, and it's something we'll look at a little bit more closely later on in this presentation.

77
00:08:52,460 --> 00:08:55,000
So that's a bit about quantum computers.

78
00:08:55,280 --> 00:08:57,380
But what's this all got to do with cryptography?

79
00:08:57,640 --> 00:09:03,360
Well, again, it probably makes sense to start with classical cryptography before we start talking about quantum cryptography.

80
00:09:03,360 --> 00:09:08,800
And I appreciate there may be many people watching who know a great deal more about classical cryptography than I do.

81
00:09:08,800 --> 00:09:12,120
So I apologize if this is a bit like teaching grandma to suck eggs.

82
00:09:12,120 --> 00:09:15,720
But I think it's important we all start from the same page before going forward.

83
00:09:15,720 --> 00:09:19,700
So we've kind of all got the same sort of grounding about what we're going to be discussing.

84
00:09:19,700 --> 00:09:22,740
So what's the goal with classical cryptography?

85
00:09:22,880 --> 00:09:27,860
Well, we want to allow secure communications of secret messages over public channels.

86
00:09:27,860 --> 00:09:30,620
And this can be accomplished in a number of ways.

87
00:09:31,340 --> 00:09:42,120
We could use the one-time pad algorithm, for example, in which two parties, A and B, or Alice and Bob, use a one-time pre-shared key to encrypt information.

88
00:09:42,380 --> 00:09:49,000
An issue with this approach is that of secure key distribution, which has historically made it impractical for most applications.

89
00:09:49,000 --> 00:09:50,960
So what are some alternatives?

90
00:09:50,960 --> 00:09:54,540
Well, a popular one would be the public-private key pair.

91
00:09:54,540 --> 00:09:59,260
Now, this relies on the fact that certain mathematical tasks are computationally hard.

92
00:09:59,260 --> 00:10:05,880
For instance, the factorization of large numbers into prime factors, as used in the RSA algorithm.

93
00:10:07,160 --> 00:10:13,960
So, as I said, the RSA algorithm relies on the difficulty of factoring large numbers into prime factors.

94
00:10:13,960 --> 00:10:20,100
The largest factored RSA number that I know of so far is 232 decimal digits long.

95
00:10:20,100 --> 00:10:27,440
As computers become more powerful, larger prime factors are going to need to be used in order to preserve the security of the algorithm.

96
00:10:27,620 --> 00:10:38,020
However, in 1994, Peter Shaw kind of threw a spanner in the works and showed that a quantum computer could factor large numbers in polynomial time.

97
00:10:38,040 --> 00:10:41,920
Now, polynomial time algorithms are said to be fast algorithms.

98
00:10:41,920 --> 00:10:50,680
On a classical computer, operations such as addition, multiplication, square roots and logarithms can be performed in polynomial time.

99
00:10:50,680 --> 00:11:03,620
As you can imagine, this will compromise the security of the RSA algorithm and others that use similar techniques if you could find prime factors on a quantum computer as quickly as you could find logarithms on a classical one.

100
00:11:04,500 --> 00:11:15,380
So, with quantum computers threatening many of the cryptographic standards we use today, we need some form of alternative, something resilient to this new threat.

101
00:11:15,400 --> 00:11:23,840
Now, alternatives that have been proposed are numerous and the one we're primarily going to be looking at today is quantum cryptography.

102
00:11:23,840 --> 00:11:28,580
Quantum cryptography derives its strength from a few weird properties of quantum mechanics.

103
00:11:28,580 --> 00:11:35,840
There's the no-cloning theorem, which states that it's impossible to create an identical copy of an arbitrary unknown quantum state.

104
00:11:35,840 --> 00:11:38,800
And it's important to stress that it has to be an unknown quantum state.

105
00:11:38,800 --> 00:11:41,460
If it's a known quantum state, it can be copied.

106
00:11:41,460 --> 00:11:46,040
But there is no physical device capable of copying unknown quantum states.

107
00:11:46,040 --> 00:11:51,760
As such, intercepted replay attacks are inherently protected against, as we will see later.

108
00:11:51,760 --> 00:11:59,340
We also have quantum superposition, in which two or more quantum states can be summed to create another valid quantum state.

109
00:11:59,340 --> 00:12:05,420
That is to say, every quantum state can be thought of as a sum of two or more distinct states.

110
00:12:05,420 --> 00:12:14,000
As we have seen, this principle is critical to how quantum computers work and contributes to many of the benefits such systems offer.

111
00:12:15,420 --> 00:12:29,740
Finally, we have what is arguably the most famous property of quantum mechanics, and that is quantum entanglement, which is the interaction of quantum systems resulting in the quantum state of each system no longer being independent of one another.

112
00:12:29,740 --> 00:12:36,780
So you can't talk about one system without describing the other, or affect one system without also affecting the other.

113
00:12:36,780 --> 00:12:45,220
This has massive implications for secure communications and the teleportation of information, with active research taking place in the field.

114
00:12:45,220 --> 00:12:51,580
And in fact, I came across, not too long ago, a really good analogy for quantum entanglement.

115
00:12:51,580 --> 00:12:56,120
Now like all analogies, it does break down if looked at too closely.

116
00:12:56,120 --> 00:13:01,030
But it is really good at getting across the gist of what quantum entanglement is.

117
00:13:02,170 --> 00:13:10,350
So, as the world's been in lockdown, and we've all kind of discovered that exercise is a thing, I've got two resistance bands here.

118
00:13:10,350 --> 00:13:13,830
I have a red resistance band, and a blue resistance band.

119
00:13:13,830 --> 00:13:34,550
Now, if I were to put each resistance band in its own box, and then seal these boxes, and put them under the table, I have a system, and I have the system that comprises of these two sealed boxes, each with a resistance band in it.

120
00:13:34,550 --> 00:13:37,170
We no longer know what colour is in what box.

121
00:13:37,170 --> 00:13:41,130
I've mixed them around, and I randomly pick one.

122
00:13:41,290 --> 00:13:47,030
Now, we can say that the band inside that box is either red or blue.

123
00:13:47,030 --> 00:13:55,210
Or we could also say that the band is in a superposition state of being both red and blue.

124
00:13:55,270 --> 00:13:59,550
And it will stay that way until we observe it, and force it to pick a colour.

125
00:14:00,210 --> 00:14:04,210
So we take one of these boxes, and we give it to someone.

126
00:14:04,210 --> 00:14:05,630
Say you, right there.

127
00:14:05,690 --> 00:14:11,250
And we ask you to run at the fastest speed you could possibly run.

128
00:14:11,250 --> 00:14:12,630
In fact, run faster than that.

129
00:14:12,630 --> 00:14:16,210
Run at the speed of light, and just keep running in a straight line.

130
00:14:16,210 --> 00:14:19,790
Run right off the surface of the planet, and just keep going into outer space.

131
00:14:19,790 --> 00:14:22,010
Just keep going for 30 years.

132
00:14:22,010 --> 00:14:22,830
We'll all wait.

133
00:14:22,830 --> 00:14:23,910
It's fine.

134
00:14:24,470 --> 00:14:29,430
And then 30 years later, I pick up the other box.

135
00:14:30,350 --> 00:14:35,050
And I say, I wonder what colour band we've got.

136
00:14:35,990 --> 00:14:44,470
Now, in opening this box, I will be describing part of my system, or part of the system.

137
00:14:44,570 --> 00:14:49,830
And in doing so, I can't help but describe the other part of the system.

138
00:14:49,970 --> 00:14:57,450
And so I open our box, and I see inside that we have the red resistance band.

139
00:14:57,450 --> 00:15:14,330
Which means, that without having violated any laws of physics, we know that there is a very exhausted person, 30 light years away from Earth, with a sealed box that inside it has a blue resistance band.

140
00:15:14,330 --> 00:15:18,770
By forcing our resistance band to be red, we have forced theirs to be blue.

141
00:15:18,770 --> 00:15:23,250
By affecting our part of the system, we have affected their part of the system.

142
00:15:23,250 --> 00:15:28,030
And by describing our part of the system, we have described their part of the system.

143
00:15:28,190 --> 00:15:33,370
And if you take it on the surface level, that is how entanglement works.

144
00:15:34,170 --> 00:15:38,930
So quantum cryptography, it has a lot going for it, but it also has its share of issues.

145
00:15:38,950 --> 00:15:42,910
So one of the pros is that it cannot be unknowingly intercepted.

146
00:15:42,910 --> 00:15:51,830
We'll see this in more detail later, but due to the properties of the no-cloning theorem and quantum entanglement, it's impossible for information to be unknowingly intercepted.

147
00:15:51,830 --> 00:15:55,750
It's also secure irrespective of computing power.

148
00:15:55,750 --> 00:15:59,810
The security comes from the underlying physical properties of these devices.

149
00:15:59,810 --> 00:16:05,090
It's baked into the universe itself and isn't something that can be cracked with greater computing power.

150
00:16:05,090 --> 00:16:09,810
It's also able to secure communications at a physical level.

151
00:16:09,910 --> 00:16:16,150
Quantum cryptography can secure the complete end-to-end connection without the need for SSL or a VPN.

152
00:16:16,470 --> 00:16:21,630
But as I said, as great as this sounds, it's not as if it does not have its own issues.

153
00:16:21,630 --> 00:16:24,270
For example, it's very expensive.

154
00:16:24,270 --> 00:16:32,390
Due to this being the cutting edge of cryptography, research and development costs are high, as are the fabrication costs of specialist components.

155
00:16:32,390 --> 00:16:34,870
And this all affects the final sale price.

156
00:16:35,530 --> 00:16:39,830
Leading on from this, it requires its own independent infrastructure.

157
00:16:39,970 --> 00:16:47,450
The requirement for exacting conditions to be met dictates the need for independent infrastructure capable of supporting quantum cryptography.

158
00:16:47,450 --> 00:16:50,410
And this also has its own associated costs.

159
00:16:51,230 --> 00:16:54,750
Finally, there are practical problems in implementation.

160
00:16:54,830 --> 00:16:59,550
As this is very new technology, there are still problems that need to be overcome.

161
00:16:59,550 --> 00:17:04,430
Such as fiber-based quantum key distribution can only travel so far.

162
00:17:04,590 --> 00:17:10,690
However, a lot of these cons, if not all of them, will be overcome as time goes on.

163
00:17:10,690 --> 00:17:15,830
And we've already made significant progress in many of these areas.

164
00:17:15,830 --> 00:17:24,930
I talked about the fact that we can now have what are considered hot qubits, which are qubits that run at 1.5 Kelvin.

165
00:17:25,050 --> 00:17:30,210
Also, quantum key distribution being limited to only traveling a certain distance.

166
00:17:30,370 --> 00:17:41,430
Luca Marini et al., as we will discuss a little bit more later, has put forward a proposed solution which can help extend the range of quantum key distribution.

167
00:17:41,430 --> 00:17:52,390
And so these cons are not necessarily indicative of this being an impractical solution to the issues quantum computers pose to cryptography.

168
00:17:52,390 --> 00:17:55,690
And there is still much promise within this field.

169
00:17:57,250 --> 00:18:00,370
So where are we with quantum cryptography today?

170
00:18:00,370 --> 00:18:08,770
Well, we have true random number generators, which are essential for the creation of secure encryption keys and entropy enhancement.

171
00:18:08,770 --> 00:18:17,010
Entropy, as I said earlier, can be described as a measure of information or disorder or randomness or uncertainty in a system.

172
00:18:17,090 --> 00:18:22,130
And so the introduction of truly random number generators are of obvious benefit here.

173
00:18:22,190 --> 00:18:26,670
In fact, Shannon had a great anecdote about coming up with the term entropy.

174
00:18:26,750 --> 00:18:30,370
He said, my greatest concern was what to call it.

175
00:18:30,370 --> 00:18:34,310
I thought of calling it information, but that word was overly used.

176
00:18:34,310 --> 00:18:36,770
So I decided to call it uncertainty.

177
00:18:36,770 --> 00:18:40,490
When I discussed with John von Neumann, he had a better idea.

178
00:18:40,570 --> 00:18:44,930
Von Neumann told me, you should call it entropy for two reasons.

179
00:18:44,990 --> 00:18:51,210
In the first place, your uncertainty function has been used in statistical mechanics under that name.

180
00:18:51,210 --> 00:18:52,910
So it already has a name.

181
00:18:52,930 --> 00:18:58,230
And in the second place, and more importantly, no one really knows what entropy really is.

182
00:18:58,230 --> 00:19:00,950
So in a debate, you'll always have the advantage.

183
00:19:01,790 --> 00:19:07,210
We also have quantum key distribution devices that are commercially available.

184
00:19:07,510 --> 00:19:11,210
These allow for secure key exchange, which can be used for encryption.

185
00:19:11,210 --> 00:19:20,190
Devices are made by ID Quantica with their Cerberus 3 system, Magic Technology with QPN, and Quintessence Labs with QProtect.

186
00:19:20,210 --> 00:19:26,690
Sales of quantum key distribution systems are currently led by high-end financial and government communication systems.

187
00:19:26,690 --> 00:19:39,630
Last year, the financial segment dominated the market with a share of 38%, followed by government and defense, which accounted for around 31% and 27% of the market, respectfully.

188
00:19:39,630 --> 00:19:47,730
Plans for new quantum key distribution networks exist in the US with Battelle, Japan with NICT, and China with Quantum Ctech.

189
00:19:47,730 --> 00:19:58,170
The global quantum key distribution market size is estimated to grow to about 4.8 billion by 2023, coming from 1.7 billion in 2018.

190
00:19:58,610 --> 00:20:05,170
So there is massive amounts of investment that's taking place in this area, and so there are certainly many people who believe in this technology.

191
00:20:05,890 --> 00:20:10,670
So I've kind of alluded to it already, but what is QKD?

192
00:20:10,670 --> 00:20:18,890
Well, QKD, or quantum key distribution, is perhaps the best-known and certainly most well-developed branch of quantum cryptography.

193
00:20:18,890 --> 00:20:25,010
It has the goal of providing an information-theoretically secure solution to the problem of key exchange.

194
00:20:25,010 --> 00:20:36,290
Utilizing QKD protocols, two parties should be able to establish a key that can be used for secure communication, without the key being unknowingly intercepted by a third party.

195
00:20:36,290 --> 00:20:41,050
This should remain the case even if all communications were over public channels.

196
00:20:41,150 --> 00:20:53,410
Whilst unconditional security can be proven mathematically, that is to say there are no constraints placed on the abilities of the eavesdropper, and this is not something that's possible with classical distribution.

197
00:20:53,410 --> 00:20:56,430
There are some assumptions that do need to be made.

198
00:20:56,430 --> 00:21:02,130
One being that the universe hasn't had a change of heart, and the laws of quantum mechanics still apply.

199
00:21:02,130 --> 00:21:08,350
And another being that the two genuine parties can both successfully authenticate each other.

200
00:21:08,350 --> 00:21:14,550
If these two assumptions stand, however, we should have a seemingly secure protocol.

201
00:21:14,550 --> 00:21:17,850
However, issues do exist within implementation.

202
00:21:17,950 --> 00:21:23,030
Key generation rate, for example, and transmission distance are both areas of concern.

203
00:21:23,030 --> 00:21:27,870
However, as I alluded to earlier, in 2018 Luca Marini et al.

204
00:21:27,870 --> 00:21:31,610
put forward a way to possibly overcome the rate distance limit.

205
00:21:31,610 --> 00:21:43,990
The proposed twin-field QKD scheme suggests that optimal key rates could be achieved on 550km of standard optical fibre, which are already used in communications today.

206
00:21:44,530 --> 00:21:54,570
And whilst we're about to see quantum key distribution happen on far bigger scales than 550km, that is a non-trivial distance, I'm sure you'll agree.

207
00:21:55,210 --> 00:22:04,270
And whilst a lot of work within the field of quantum cryptography has been focused on the development of QKD, this has not been the only branch where work is taking place.

208
00:22:04,370 --> 00:22:22,330
Other areas that address issues with QKD, such as the inefficiency of quantum key distribution for large networks, utilising symmetric cryptosystems, and this is due to key management overheads, or areas related to other cryptographic tasks and functions are also being actively researched.

209
00:22:23,350 --> 00:22:27,850
OK, so now that we've had a quick primer in QKD, let's see it in action.

210
00:22:28,590 --> 00:22:40,550
In a paper submitted in early 2018, a joint Austrian-Chinese team were able to perform quantum key distribution between a low-Earth orbit satellite and multiple ground stations.

211
00:22:40,550 --> 00:22:46,710
The satellite was called MESIUS, and the protocol involved three steps.

212
00:22:46,710 --> 00:22:53,690
In the first, the satellite establishes a secure key with the first location, say, Jinglong in China.

213
00:22:53,690 --> 00:22:56,050
And we'll call this key MX.

214
00:22:56,050 --> 00:23:01,810
The second step involves repeating this procedure with another location, say, Graz in Austria.

215
00:23:02,070 --> 00:23:05,950
This creates a second secure key, and we'll call that one MG.

216
00:23:05,950 --> 00:23:09,950
So we have MX with Jinglong, and MG with Graz.

217
00:23:09,950 --> 00:23:18,030
At this point, MESIUS has established secure keys with both locations, and is ready to act as a trusted relay between them both.

218
00:23:18,030 --> 00:23:33,230
The third and final step is for MESIUS to receive a command from one of the ground stations, prompting the satellite to perform a bitwise exclusive OR operation between MX and MG, creating a new key MXMG.

219
00:23:33,890 --> 00:23:47,410
This can then be sent through classical communications channels to Jinglong or Graz, where it can be decoded with another exclusive bitwise OR operation to recover the original key.

220
00:23:48,330 --> 00:23:58,890
So if you wanted the MG key for Graz and you were Jinglong, MESIUS would give you the MXMG key.

221
00:23:58,890 --> 00:24:05,230
You'd perform a bitwise OR operation with your MX key, and you'll recover Graz's MG key.

222
00:24:05,230 --> 00:24:17,130
In other words, MESIUS uses MX to encrypt MG, and Jinglong decrypts the ciphertext to recover MG, which was shared with Graz.

223
00:24:17,130 --> 00:24:24,970
So the key is known to the two communicating locations and the satellite, but not to any external fourth party.

224
00:24:24,970 --> 00:24:39,130
This way, the secret key, constructed between locations in China and Europe, separated by 7600 km, is secured using the properties of quantum mechanics.

225
00:24:39,130 --> 00:24:47,110
A picture of MESIUS, which was about 5.3 kilobytes, was transferred from Beijing to Vienna.

226
00:24:47,110 --> 00:24:52,910
And a picture of Schrodinger, which was around 4.9 kilobytes, from Vienna to Beijing.

227
00:24:52,910 --> 00:24:57,950
This was done using a secure quantum key for one-time pad encoding.

228
00:24:58,670 --> 00:25:08,710
A videoconference was also held between China and Austria, using the satellite-based QKT network, also in combination with fibre-based quantum networks.

229
00:25:08,710 --> 00:25:20,150
And this is a promising start in finding an efficient solution for an ultra-long-distance global quantum network, which could lay the groundwork for a potential future quantum internet.

230
00:25:20,150 --> 00:25:26,530
But what exactly was the QKT protocol that was used by MESIUS to establish the quantum key?

231
00:25:26,630 --> 00:25:33,870
Well, it's one of the most popular QKT protocols, and is the basis for many commercial systems that are being sold today.

232
00:25:34,050 --> 00:25:44,210
It's called the BB84 protocol, and it has the goal of establishing a key between Alice and Bob, such that an eavesdropper Eve cannot learn it by listening to their conversation.

233
00:25:44,210 --> 00:25:50,830
Once this key has been established, it can then be used to communicate securely, using the one-time pad algorithm, for example.

234
00:25:50,930 --> 00:26:02,870
The basic idea is that Alice and Bob use quantum systems to establish the key, and if Eve tries to learn the state of the system, this will inevitably disturb the state, which can be detected by Alice and Bob.

235
00:26:03,190 --> 00:26:09,170
Eve can sabotage the protocol, sure, in which case Alice and Bob won't be able to establish the key.

236
00:26:09,170 --> 00:26:17,770
However, the goal is to make sure that if Alice and Bob agree that the protocol was successful, then the chance that Eve knows the key would be very small.

237
00:26:17,970 --> 00:26:27,270
And as a point of interest, it's called BB84, as it's a key distribution system proposed by Bennett and Brassard in 1984, and has nothing to do with spherical droids.

238
00:26:28,110 --> 00:26:30,590
So what are the steps of the protocol?

239
00:26:30,810 --> 00:26:36,450
Well, to begin with, Alice prepares a qubit randomly in one of four states and sends it to Bob.

240
00:26:36,450 --> 00:26:44,330
Bob measures the received qubit in one of two bases, randomly, so with a probability of half for each basis.

241
00:26:44,330 --> 00:26:49,990
Alice and Bob then both reveal the basis in which the qubit was respectively prepared and measured.

242
00:26:49,990 --> 00:27:00,530
They do this via a classical channel, but it's very important that they do not share the state or respective outcome of their measurement, merely the basis they chose for the measurement.

243
00:27:00,530 --> 00:27:04,510
If the basis coincide, they add the bit to their list of key bits.

244
00:27:04,510 --> 00:27:06,710
Otherwise, they disregard that qubit.

245
00:27:06,710 --> 00:27:15,730
In order to make sure Eve hasn't tampered, they pick a proportion, say half, of their agreed bits and compare them using a classical channel.

246
00:27:15,730 --> 00:27:18,270
They should find no significant differences.

247
00:27:18,270 --> 00:27:32,170
If they do find differences that are above the error rate of the channel, then they know that they have an eavesdropper, and they can choose to either restart the protocol or convince themselves that whatever they were trying to share was not that important and they should just scrap it and go home.

248
00:27:33,150 --> 00:27:36,010
But how secure is the BB84 protocol?

249
00:27:36,130 --> 00:27:40,370
Well, there are several mathematical proofs attesting to the security of the protocol.

250
00:27:40,510 --> 00:27:45,070
One such proof is provided in the further reading slide for anyone interested in the maths.

251
00:27:45,210 --> 00:27:48,730
However, today we'll go through the intuition behind the proof.

252
00:27:48,730 --> 00:27:56,110
The central principle is that in order for Eve to learn the key, the qubits sent by Alice must be intercepted and measured.

253
00:27:56,110 --> 00:28:04,650
If Eve knows the basis to which the prepared state belongs, she could measure the state in that basis and learn it without altering it.

254
00:28:04,730 --> 00:28:15,310
However, Eve doesn't know which basis has been used, and as such, she can't perform the above measurement with absolute certainty she's not going to alter the state of the qubit.

255
00:28:15,310 --> 00:28:18,230
This leaves two possible alternatives.

256
00:28:19,550 --> 00:28:28,890
So Eve's first option is that she can choose one of the two bases randomly, measure in that basis and then pass the system on to Bob.

257
00:28:28,890 --> 00:28:38,450
If Eve chooses the same basis that Alice used to prepare the state, then she obtains the result she's looking for and can pass the state on to Bob undisturbed.

258
00:28:38,450 --> 00:28:41,150
Happy days, her presence is not known.

259
00:28:41,150 --> 00:28:50,330
However, on the other hand, if Eve measures in the basis that Alice didn't encode in, then the state she sends to Bob will have been altered.

260
00:28:50,370 --> 00:28:56,610
And when Bob makes his own measurement, there is only a 1 in 4 chance that he will obtain Alice's prepared state.

261
00:28:56,610 --> 00:29:04,090
So those aren't great odds, and her chance of being undetected further diminishes the more bits are used in the key generation process.

262
00:29:04,090 --> 00:29:10,110
As every time Alice sends a bit, Eve has to roll that dice when measuring the state.

263
00:29:10,790 --> 00:29:13,050
So that doesn't sound particularly great.

264
00:29:13,050 --> 00:29:14,530
What's Eve's second option?

265
00:29:14,910 --> 00:29:25,450
Well, Eve's second option is that she can keep the system sent by Alice and measure it only after classical communication declares which basis were used for encoding.

266
00:29:25,450 --> 00:29:28,070
But she needs to send Bob something, right?

267
00:29:28,070 --> 00:29:34,050
So she has to essentially make up a bunch of her own data and send it on to Bob.

268
00:29:34,050 --> 00:29:42,210
And just hope, through sheer chance, that her made-up data matches Alice's signal perfectly.

269
00:29:42,210 --> 00:29:48,490
She can't clone Alice's signal because it's made up of unknown qubit states, quantum states even.

270
00:29:48,490 --> 00:29:54,710
And so there is no physical device capable of replicating unknown quantum states.

271
00:29:54,710 --> 00:30:10,990
She sends her own signal, and then she waits and prays that when Bob makes his measurements, they do not give a different result than Alice's original signal would have given.

272
00:30:12,450 --> 00:30:19,750
However, no matter what state she chooses, there is a significant chance that Bob's measurements will differ.

273
00:30:19,750 --> 00:30:28,770
And so using the first option, there's a very small likelihood of successful eavesdropping, which further diminishes as the number of qubits used in the protocol increases.

274
00:30:28,790 --> 00:30:37,190
And with the second option, as she's just making up information and sending it along, hoping it matches Alice's, there's no real chance.

275
00:30:37,190 --> 00:30:40,310
And she's scuppered there because of the no-cloning theorem.

276
00:30:41,170 --> 00:30:50,130
In general, Eve may employ more sophisticated attacks in which several successive qubits are measured, which makes the proof of the security more complicated.

277
00:30:50,130 --> 00:30:57,110
However, the heart of the proof is the fact that quantum information cannot be copied, as dictated by the no-cloning theorem.

278
00:30:57,330 --> 00:31:07,050
Now, quantum cryptography is fast approaching the stage of technological applications, with several companies in the process of producing cryptographic systems based on the BB84 protocol.

279
00:31:07,050 --> 00:31:13,190
In fact, as we've discussed earlier, there are QKD systems already available for sale.

280
00:31:13,190 --> 00:31:17,320
You can buy a pair of ID Quantica's QKD Cerberus III boxes.

281
00:31:17,650 --> 00:31:27,930
And generally, in commercial systems, the four states of the qubits that Alice would send, or encode in, are implemented with four polarizations of a single photon state.

282
00:31:28,010 --> 00:31:36,730
Companies that manufacture quantum cryptography systems include Toshiba, ID Quantica, SecureNet, Quintessence Labs, and Magic Technologies.

283
00:31:37,410 --> 00:31:45,690
So now that we know a little bit about BB84, how popular it is, testaments to its security, let's break it.

284
00:31:45,770 --> 00:31:52,150
What I want you to take away from this talk is a paradigm on how to approach pen testing of quantum systems.

285
00:31:52,290 --> 00:31:55,510
Vulnerabilities can be broken down into two broad classes.

286
00:31:55,510 --> 00:31:58,670
We have inherent flaws, and we have implementation flaws.

287
00:31:58,750 --> 00:32:04,550
Now, inherent flaws exist where an assumption made during the creation of a protocol doesn't hold to be true.

288
00:32:04,550 --> 00:32:09,990
A new mathematical technique or approach, for instance, may break the security of the protocol.

289
00:32:09,990 --> 00:32:14,470
An example of a protocol with inherent flaws would be SSL version 3.

290
00:32:14,490 --> 00:32:20,890
Implementation flaws, on the other hand, exist because real-world physical systems aren't perfect.

291
00:32:21,090 --> 00:32:25,330
And neither is our adaptation of theoretical principles to physical mediums.

292
00:32:25,330 --> 00:32:32,030
Such imperfections can be exploited to compromise an otherwise secure protocol, as we're about to see.

293
00:32:32,030 --> 00:32:36,220
So our first attack is called the indirect copying attack.

294
00:32:36,550 --> 00:32:41,670
And in it, Eve constructs a list of all possible states Alice can use to encode her qubits.

295
00:32:41,670 --> 00:32:51,350
Now, we said that in commercial devices, Alice's qubits are usually encoded photons.

296
00:32:51,410 --> 00:32:56,410
And these are done through using different polarizations of a single photon.

297
00:32:56,410 --> 00:33:03,130
These different polarizations are horizontal, vertical, or plus and minus 45 degrees.

298
00:33:04,010 --> 00:33:12,250
So Eve lists these potential states, and then she intercepts Alice's qubits as they're transmitted to Bob.

299
00:33:12,250 --> 00:33:15,230
She measures them to find each qubit's value.

300
00:33:15,230 --> 00:33:28,130
And having found this information, she has to discard the intercepted qubits, as she's altered them, at least some of them, as she would have guessed and measured in the wrong basis, compared to what Alice originally prepared the qubits in.

301
00:33:28,850 --> 00:33:40,510
However, now that she has got her measurements, and she has a list of Alice's original states, she can work backwards and recreate Alice's original signal.

302
00:33:40,510 --> 00:33:53,370
She's not violating the no-cloning theorem, as these are no longer unknown quantum states to her, and so she can use the information that she gained in measuring Alice's qubits to recreate that signal and send it on to Bob.

303
00:33:53,370 --> 00:34:01,850
It's important to note that this attack only works in protocols like BB84, where the quantum state is encoded in transit.

304
00:34:01,870 --> 00:34:19,770
Alongside this, Eve has to know all possible states Alice can use to encode her qubits, and try to keep her time interval between successive qubits as close as possible to Alice's original sequence, alongside keeping the delay between Alice sending and Bob receiving as small as possible,

305
00:34:19,770 --> 00:34:22,130
so that her presence isn't felt.

306
00:34:22,870 --> 00:34:38,330
If she manages to do this, she will have Alice's original signal, which she then passes on to Bob, and then when Alice and Bob communicate and create their key, Eve can listen in and create her key right alongside them.

307
00:34:38,430 --> 00:34:58,670
Another attack that we could employ leverages the hardware limitations of current devices, and that limitation is that perfect single-photon sources are incredibly difficult to create, and so we can use the photon number splitting attack, or PNS attack for short.

308
00:34:58,670 --> 00:35:07,410
Because single-photon sources are difficult to create, weak coherent pulses are generally used in actual cryptographic devices.

309
00:35:07,750 --> 00:35:17,070
A weak coherent pulse is a photon pulse that has a low mean photon number, and that is to say a low number of photons in that pulse on average.

310
00:35:17,070 --> 00:35:23,370
It could be achieved by passing short, low-powered laser pulses through an attenuator.

311
00:35:23,370 --> 00:35:32,990
The PNS attack takes advantage of a limitation present in weak coherent pulse generators, which is that sometimes multiple photon pulses are emitted.

312
00:35:34,290 --> 00:35:41,430
If that's the case, Eve can intercept a portion of this multiple photon pulse and send the remainder on to Bob.

313
00:35:42,110 --> 00:35:53,270
Eve then all she has to do is wait for Alice and Bob to announce their respective transmission and detection bases, and measure her captured photons right alongside Alice and Bob.

314
00:35:53,270 --> 00:35:57,030
Again, as they build up their key, she builds up her key alongside them.

315
00:35:57,030 --> 00:36:01,770
Sounds great in theory, however the PNS attack is actually quite complex to implement.

316
00:36:01,890 --> 00:36:14,770
First of all, the probability that a multiple photon beam is emitted is around 5%, and as such, Eve has to check whether the emitted pulse contains multiple photons or not, which demands proper hardware and algorithms.

317
00:36:14,770 --> 00:36:30,050
Given this though, it would be very hard for Bob to detect Eve's presence, especially if she is able to hide within the error rate of the channel, and suppress single photon pulses, only allowing multiple photon pulses through, making it look like it's absorption within the channel,

318
00:36:30,050 --> 00:36:39,090
for example, and Bob only seeing those multiple photon pulses, which Eve knows she has a portion of those photons.

319
00:36:39,090 --> 00:36:47,770
However, this can again be protected against using decoy states, as was the case with the mesias relay, which used decoy states.

320
00:36:47,770 --> 00:36:59,470
Here, multiple intensity levels are used at the transmitter's source, so that's to say that the qubits that are transmitted by Alice are done so using randomly chosen intensity levels.

321
00:36:59,470 --> 00:37:02,830
One signal state, and several decoy states.

322
00:37:02,830 --> 00:37:07,270
This results in varying photon number statistics throughout the channel.

323
00:37:07,270 --> 00:37:14,890
At the end of the transmission, Alice announces publicly which intensity level was used for the transmission of each qubit.

324
00:37:14,890 --> 00:37:24,010
A successful PNS attack requires maintaining that bit error rate at the receiver's or Bob's end, so that Eve can hide within that.

325
00:37:24,010 --> 00:37:28,010
However, this cannot be accomplished with multiple photon number statistics.

326
00:37:28,010 --> 00:37:36,490
By monitoring the bit error rate associated with each intensity level, the two legitimate parties will be able to detect a PNS attack.

327
00:37:36,490 --> 00:37:42,990
And finally, we get to my favourite of the attacks, and this is the light injection attack.

328
00:37:42,990 --> 00:37:49,990
So for this one, let's remove a bit of abstraction from the BB84 protocol, and think about Alice and Bob's setup.

329
00:37:50,110 --> 00:37:55,290
So for Alice, we need a process for encoding qubits, some sort of photon generator.

330
00:37:55,390 --> 00:37:56,310
A laser.

331
00:37:56,530 --> 00:37:59,870
And for Bob, we need some sort of observation machine.

332
00:37:59,950 --> 00:38:01,750
Something to carry out measurements.

333
00:38:02,030 --> 00:38:03,390
A photon detector.

334
00:38:03,390 --> 00:38:09,170
Eve can exploit hardware weaknesses in both these components to compromise BB84.

335
00:38:09,610 --> 00:38:13,350
Eve can execute this attack against Alice or Bob.

336
00:38:13,350 --> 00:38:17,110
Let's take the case of Alice to begin with, and then we can circle back to Bob.

337
00:38:17,150 --> 00:38:24,630
So Eve sends a light pulse at one of the devices, in this case Alice's photon generator, and registers the reflected pulse.

338
00:38:24,630 --> 00:38:34,770
Because of the design of QKD hardware, the reflected pulse will indicate which process, or photon generator, will be used by Alice to generate the next qubit.

339
00:38:34,830 --> 00:38:39,210
Eve knows which process Alice is about to use to encode her qubit.

340
00:38:39,210 --> 00:38:47,610
So she can perform an intercept and replay attack with 100% certainty that she'll be using the correct observer for each incoming qubit.

341
00:38:47,690 --> 00:38:57,890
She knows that her measurements will not affect the state of the qubit, since she'll be measuring in the exact same basis Alice used to encode the qubit.

342
00:38:57,890 --> 00:39:03,610
She can then pass the state on to Bob undisturbed.

343
00:39:03,610 --> 00:39:10,970
She can capture the entire key as Alice sends it, and send the qubits on to Bob, without Alice or Bob being able to detect her presence.

344
00:39:11,410 --> 00:39:17,950
Using the information communicated over the classical channel, Eve will then be able to create the same key as Alice and Bob.

345
00:39:17,950 --> 00:39:22,150
Now if she was to target Bob with this attack, it would be a very similar situation.

346
00:39:22,150 --> 00:39:27,850
She sends a light pulse at Bob's photon detector.

347
00:39:27,850 --> 00:39:34,270
She sees exactly what basis Bob is about to use to measure Alice's qubit.

348
00:39:34,270 --> 00:39:40,330
She measures in the exact same basis that Bob would use to measure the incoming qubit.

349
00:39:40,350 --> 00:39:44,550
When Eve is wrong, then Bob is also wrong.

350
00:39:44,550 --> 00:39:54,890
Sure, Eve has messed up the state of that qubit, but Bob was about to mess it up anyway, and Alice is just going to tell him to get rid of that qubit, since he measured in the wrong basis.

351
00:39:54,890 --> 00:40:00,630
But when Bob measures in the correct basis, Eve also measures in the correct basis.

352
00:40:00,630 --> 00:40:13,890
She doesn't mess up the state of the qubit, Bob adds it to the qubit, and again, when Alice and Bob create their final key, Eve can create hers right alongside them.

353
00:40:15,850 --> 00:40:21,150
All these attacks are understandably problematic for the BB84 protocol.

354
00:40:21,210 --> 00:40:23,790
So what can be done to protect the protocol?

355
00:40:23,890 --> 00:40:31,410
Well, safety measures can include passive measures, which are inherent properties of the infrastructure that make them resistant to such attacks.

356
00:40:31,410 --> 00:40:38,370
If we take the example of the light injection attack, a passive measure for Alice could be to add an attenuator at the output of her setup.

357
00:40:38,370 --> 00:40:44,450
This would mean Eve would need a more powerful laser to enumerate the encoding basis Alice is about to use.

358
00:40:44,450 --> 00:40:57,490
If Alice then uses an optical isolator and bandpass filter so that she can get her photons out, but Eve would have great difficulty getting her photons in, then Eve's power requirements become untenable.

359
00:40:57,490 --> 00:41:04,950
We do have to state that if we're using an attenuator, we can't deal with single photon states anymore, and we'll have to use weak coherent pulses.

360
00:41:04,950 --> 00:41:11,970
But as we already mentioned, most commercial devices tend to use weak coherent pulses anyway, so this isn't a massive issue.

361
00:41:12,150 --> 00:41:17,610
Active measures are tools that are designed to mitigate against certain attacks.

362
00:41:17,610 --> 00:41:26,970
So an active measure may involve a detector to warn Alice and Bob should average and or peak power of an incoming pulse rise above a specified level.

363
00:41:26,970 --> 00:41:35,270
If this happens, then they know that Eve is trying to enumerate either Bob's detection basis or Alice's encoding basis.

364
00:41:35,350 --> 00:41:37,390
Now we can also have a combination of both.

365
00:41:37,390 --> 00:41:53,650
So we can have active for Alice, where she has her attenuator, optical isolator, bandpass filter introduced to her setup, and an alarm system, a warning, a detector, for Bob should incoming light pulses rise above a certain threshold.

366
00:41:55,170 --> 00:42:04,330
So those are some potential attacks and defense measures that can be used to harden quantum cryptographic protocols.

367
00:42:04,330 --> 00:42:11,290
However, quantum cryptography is not the only source of quantum-resilient cryptography being researched today.

368
00:42:11,290 --> 00:42:27,870
We also have post-quantum cryptography, and that is an incredibly popular flavor, and one we'll give a brief overview to now, as no discussion of quantum-resilient cryptography would really be complete without at least touching upon post-quantum cryptography.

369
00:42:28,410 --> 00:42:41,030
So, as we've stated, the problem with many algorithms in use today is that their security is based on a class of mathematically difficult problems, all of which can be solved on a sufficiently powerful quantum computer.

370
00:42:41,030 --> 00:42:54,470
Even though current, publicly known quantum computers lack the processing power to be cryptographically relevant, many cryptographers are designing new algorithms to prepare for when quantum computers become powerful enough to be a threat.

371
00:42:54,470 --> 00:42:59,770
There are currently four main flavors of public-key post-quantum cryptosystems.

372
00:43:00,510 --> 00:43:03,510
Firstly, we have lattice-based cryptosystems.

373
00:43:03,510 --> 00:43:09,950
This is the most well-understood and widely studied family of hard math problems being researched for post-quantum cryptography.

374
00:43:09,950 --> 00:43:25,510
It is perhaps the most popular flavor due to its historic mathematical interest and the versatility of cryptographic schemes possible, allowing for the replacement of essentially all endangered protocols, but also the introduction of entirely new classes of cryptographic tools,

375
00:43:25,510 --> 00:43:29,270
not available when using factoring or other hard math problems.

376
00:43:29,550 --> 00:43:38,750
Second, we have code-based cryptosystems, which is another popular flavor that includes cryptosystems which rely on error-correcting codes, such as the Michaelis algorithm.

377
00:43:38,750 --> 00:43:45,290
The original Michaelis signature, using random Goppa codes, has withstood scrutiny for over 30 years.

378
00:43:45,290 --> 00:43:51,510
However, many variants which aim to structure the code more so as to minimize key size, have been shown to be insecure.

379
00:43:51,950 --> 00:43:54,570
Third, we have hash-based cryptosystems.

380
00:43:54,570 --> 00:44:04,170
Hash-based digital signatures, which were invented in the 70s, fell out of vogue as there is a limit to the number of signatures that can be signed using the corresponding set of private keys.

381
00:44:04,250 --> 00:44:07,970
Post-quantum cryptography, however, has renewed interest in the field.

382
00:44:07,970 --> 00:44:12,890
Finally, we have multivariate public-key cryptosystems.

383
00:44:12,890 --> 00:44:19,090
This includes encryption schemes based on the difficulty of solving systems of multivariate equations.

384
00:44:19,090 --> 00:44:29,210
Whilst attempts to build secure multivariate equation encryption protocols have failed, such schemes could provide a basis for the construction of a quantum-secure digital signature.

385
00:44:29,210 --> 00:44:32,730
I also quickly wanted to touch upon symmetric key encryption.

386
00:44:32,730 --> 00:44:38,630
Given that suitably large keys are used, systems like AES are already quantum-resistant.

387
00:44:38,630 --> 00:44:47,710
In addition to this, key management protocols which employ symmetric keys, like Kerberos, are inherently secure against attacks from a quantum computer.

388
00:44:47,710 --> 00:44:55,450
Some researchers suggest expanded use of Kerberos-like key management as a way to get post-quantum cryptography today.

389
00:44:55,650 --> 00:45:02,310
So with the security of post-quantum cryptography schemes still being evaluated, how do we approach adoption?

390
00:45:02,430 --> 00:45:03,690
And why the rush?

391
00:45:03,690 --> 00:45:07,310
Why not wait until we are wholly confident in the schemes proposed?

392
00:45:07,890 --> 00:45:24,250
Well, the Mosca inequality states that if the time data is to be preserved for, in addition to the time it will take our security systems to migrate from classical to post-quantum, is more than the time it will take for quantum processors to become capable of compromising existing encryption,

393
00:45:24,250 --> 00:45:25,910
then we have a problem.

394
00:45:25,910 --> 00:45:28,590
Some believe we have already reached this point.

395
00:45:28,610 --> 00:45:35,850
But at the very least, the pressure to begin being able to implement some form of post-quantum cryptography is very real.

396
00:45:36,010 --> 00:45:37,510
So how are we doing this?

397
00:45:37,510 --> 00:45:43,270
In the first instance, it would make sense to use a hybrid of classical and post-quantum schemes.

398
00:45:43,270 --> 00:45:52,970
This affords us the security of rigorously tested schemes that are classical, alongside a safety net against the threat that quantum computers pose.

399
00:45:53,910 --> 00:45:58,210
As long as one of the two schemes are secure, the data is protected.

400
00:45:58,590 --> 00:46:04,050
Should there be a flaw in the post-quantum scheme, the classical scheme may buy us time to address it.

401
00:46:04,050 --> 00:46:10,070
And if quantum computers render classical schemes obsolete, we have the protection of the post-quantum scheme.

402
00:46:10,070 --> 00:46:22,350
An advantage of the hybrid approach is the backwards compatibility, whereby you can fall back to better supported classical algorithms, should you find support for your shiny new post-quantum cryptography algorithms lacking.

403
00:46:22,350 --> 00:46:38,390
Other things to bear in mind when designing and implementing hybrid schemes, in addition to backwards compatibility, is performance, with computation and data consumption overheads alongside minimizing impact to latency and data flows.

404
00:46:38,910 --> 00:46:45,630
Much like quantum cryptography, post-quantum cryptography has its associated pros and cons.

405
00:46:45,630 --> 00:46:48,670
So a massive pro is the cost.

406
00:46:48,690 --> 00:47:01,230
Due to decreased R&D expenses relative to quantum cryptography, in addition to it being far less resource intensive, the cost of post-quantum cryptography is significantly lower than its quantum counterpart.

407
00:47:01,850 --> 00:47:05,090
Alongside this, it works on current infrastructure.

408
00:47:05,090 --> 00:47:12,570
This feeds into the lower cost as expensive and specialized equipment is not required in order to facilitate post-quantum cryptography.

409
00:47:12,570 --> 00:47:21,450
This form of cryptography should be capable of running on current classical computers, and as such may have a larger scope of possible applications.

410
00:47:22,170 --> 00:47:32,950
And due in no small part to the prior two reasons, this field is massively popular, with tons of active research taking place and many supporters, including the NCSC.

411
00:47:34,070 --> 00:47:36,770
However, it's not all sunshine and roses.

412
00:47:36,790 --> 00:47:49,550
Due to this being such a young field, essentially being born as a response to the increasing threat quantum computers continue to place on current cryptography, there may be many flaws and inherent weaknesses that are yet to be uncovered.

413
00:47:49,550 --> 00:47:59,630
Simply due to the field's immaturity, any such issue, when discovered, would immediately threaten the confidentiality of data protected by the relevant encryption.

414
00:48:00,310 --> 00:48:07,990
Another particular challenge of post-quantum cryptography is the implementation of quantum-safe algorithms into existing systems.

415
00:48:07,990 --> 00:48:18,730
I'm sure many of us have come across clients who are forced to run outdated and vulnerable cryptography due to legacy systems which don't support modern TLS implementations.

416
00:48:18,730 --> 00:48:25,450
This issue will only be made worse by the introduction of post-quantum cryptography unless these issues are overcome.

417
00:48:27,550 --> 00:48:30,030
Finally, we have key size.

418
00:48:30,030 --> 00:48:36,170
There are often trade-offs related to key size and computational efficiency alongside ciphertexts or signature size.

419
00:48:36,170 --> 00:48:47,630
As such, care must be taken when choosing which post-quantum cryptographic algorithms to employ, weighing, for example, the effort required to send large public keys over the internet.

420
00:48:48,110 --> 00:48:52,630
So when it comes to quantum cryptography, why are we talking about it now?

421
00:48:52,630 --> 00:48:55,950
Why is it relevant to have this conversation today?

422
00:48:55,990 --> 00:49:01,330
Well, no one is sure when a cryptographically relevant quantum computer will be available.

423
00:49:01,350 --> 00:49:05,850
Depending on who you ask, estimates range from a few years to never.

424
00:49:05,850 --> 00:49:09,850
But the general consensus is that we should plan for around a decade.

425
00:49:10,110 --> 00:49:19,430
As such, a worst-case scenario can be put forward of the complete failure of a massive proportion of cryptographic systems within 10 years.

426
00:49:19,430 --> 00:49:27,990
We should put in place a strategy early enough that will allow for quantum resilience in time to protect sensitive data for the full term of its security life.

427
00:49:27,990 --> 00:49:36,430
The strategies we put in place need testing and assurance, so that in an attempt to address vulnerability issues, we don't end up introducing more.

428
00:49:36,470 --> 00:49:39,950
For some data, it can be argued that it's already too late.

429
00:49:39,950 --> 00:49:45,890
Harvesting attacks could already be intercepting data for decryption when quantum computers mature.

430
00:49:46,810 --> 00:49:51,670
So this all sounds great, and you've decided to build your own quantum cryptography lab.

431
00:49:51,670 --> 00:49:53,650
Now there are two ways to go about this.

432
00:49:53,650 --> 00:50:00,610
One is building a physical system to test particular protocols in implementation, and the other is through virtualization.

433
00:50:00,750 --> 00:50:06,710
With a physical apparatus, you'd be forgiven for thinking building one would require exorbitant sums of money.

434
00:50:06,710 --> 00:50:21,950
However, essentially, all you need to model, say, the BB84 protocol would be a source, some kind of laser most likely, a photon detector, some polarization filters and beam splitters, and then some electronics to control the equipment and register output.

435
00:50:21,950 --> 00:50:30,710
There are kits available which contain all the necessary components to create an analogous setup for QKT protocols, and these cost around two and a half thousand pounds.

436
00:50:30,710 --> 00:50:34,610
So not the millions and millions you'd be forgiven for thinking it would cost.

437
00:50:34,610 --> 00:50:39,290
However, with virtualization, we can model the protocols and components.

438
00:50:39,290 --> 00:50:42,190
We never need to have physical devices in front of us.

439
00:50:42,190 --> 00:50:54,290
We can leverage the quantum cloud, which allows for the exploration of quantum applications via systems and simulators to model and test QKT protocols using real world quantum systems.

440
00:50:54,290 --> 00:50:59,550
However, please stick to hacking the protocols and not the platform itself.

441
00:50:59,550 --> 00:51:01,430
Don't want you getting in trouble.

442
00:51:02,110 --> 00:51:12,630
We can also use software such as MATLAB or Visual Basic to model all of our components and code the logic of these protocols, and thus create an inexpensive virtual lab.

443
00:51:12,630 --> 00:51:20,350
There is quite a lot of material available to help in such endeavors, and there are several academic papers that take this approach.

444
00:51:20,350 --> 00:51:35,710
My personal recommendation would be to start with a virtual lab, and once you've identified potential vulnerabilities, then build an analogous physical model to determine how best to exploit the issues identified, and also determine whether they constitute legitimate vulnerabilities,

445
00:51:35,710 --> 00:51:38,130
and if so, under what conditions.

446
00:51:39,050 --> 00:51:47,930
So in conclusion, there is no better physical medium for storing and processing information than quantum systems, according to quantum information theory.

447
00:51:47,930 --> 00:51:56,310
You are essentially working with the fundamental building blocks of the universe, and are as close to the metal as you can possibly be, to borrow a programming analogy.

448
00:51:56,590 --> 00:52:01,950
With quantum cryptography, you can secure communication on the physical level.

449
00:52:02,150 --> 00:52:07,510
We know there are many pros, but also several cons and physical hurdles that are yet to be overcome.

450
00:52:07,510 --> 00:52:12,290
However, commercial systems relying on quantum principles are already beginning to emerge.

451
00:52:12,290 --> 00:52:23,690
We've talked about IBM's Q-System 1, which is the first commercial quantum computer available, and that there is such a thing as the quantum cloud, allowing quantum computing to be accessed by the masses.

452
00:52:24,190 --> 00:52:29,670
In addition to this, commercially available quantum key distribution systems are already with us.

453
00:52:30,110 --> 00:52:35,930
The landscape of cryptography is changing under our feet, and it's up to us to adapt to it.

454
00:52:35,930 --> 00:52:45,870
With the introduction of new protocols, some completely secure in theory, there still exists many pen testing applications in the physical implementations of such systems.

455
00:52:45,870 --> 00:52:49,710
If you can't find an inherent flaw, look for an implementation flaw.

456
00:52:49,710 --> 00:52:52,510
What components were used in the construction of this system?

457
00:52:52,510 --> 00:52:54,410
What are their technical limitations?

458
00:52:54,410 --> 00:52:57,710
How can these limitations be abused and protected against?

459
00:52:57,710 --> 00:53:07,110
Technical details for many components are publicly available, and so research into the compromise of these devices can be done without ever needing to have one in front of you.

460
00:53:07,970 --> 00:53:15,870
So if anyone's interested in any further reading, I've compiled a list of resources that I found particularly useful in constructing this talk.

461
00:53:15,870 --> 00:53:18,030
So this would be a great place to start.

462
00:53:18,030 --> 00:53:22,690
Here we've got the obligatory image references, just so that no one shouts at me.

463
00:53:22,890 --> 00:53:29,090
And finally, thank you to Cyberus for allowing me the time and resources to put this presentation together.

464
00:53:29,090 --> 00:53:34,590
In particular, to Mark Crowther, Catherine Fair, and Ian Lonsborough for their guidance and encouragement.

465
00:53:34,670 --> 00:53:39,110
And to DefCon Crypto and Privacy Village for providing such a stellar platform.

466
00:53:39,110 --> 00:53:41,990
And finally, and most importantly, to you all for listening.

467
00:53:41,990 --> 00:53:43,150
So thank you very much.

468
00:53:43,150 --> 00:53:46,350
If you've got any questions, please feel free to reach out.

469
00:53:53,190 --> 00:53:54,430
All right.

470
00:53:54,430 --> 00:54:00,530
Thank you to Imran Shaheem for his talk that has just wrapped up, entitled Quantum Computers and Cryptography.

471
00:54:00,530 --> 00:54:07,010
We have Imran here for a live Q&A, so please continue putting any questions you have in the Discord CPV Q&A channel.

472
00:54:07,010 --> 00:54:08,430
You can find the link below.

473
00:54:08,750 --> 00:54:12,590
Let's get started off with... we have a few questions queued up already.

474
00:54:12,690 --> 00:54:14,070
Good morning, Imran.

475
00:54:14,070 --> 00:54:18,170
So our first question is, where can we get that reference slide you mentioned?

476
00:54:18,170 --> 00:54:21,270
Some folks would like to read more about BB84.

477
00:54:21,270 --> 00:54:22,670
Yep, absolutely.

478
00:54:22,670 --> 00:54:30,290
So I do believe it flashed very briefly on the screen during the presentation, but I appreciate it probably wasn't on for very long at all.

479
00:54:30,510 --> 00:54:40,090
I'll probably chuck it onto, I don't know, LinkedIn or Twitter or I'll link to it somewhere and I'll make sure it's available out there for everyone.

480
00:54:40,330 --> 00:54:46,650
But worst case scenarios, you can always go back and just pause that, that reframe where it's on there.

481
00:54:46,650 --> 00:54:48,730
OK, wonderful.

482
00:54:48,730 --> 00:54:49,990
So next question.

483
00:54:49,990 --> 00:54:54,690
Have any of these attacks been demonstrated in real life or are these still theoretical?

484
00:54:54,930 --> 00:55:00,730
So it depends on what you mean by real life.

485
00:55:00,730 --> 00:55:05,370
So they have been done with real physical components.

486
00:55:05,370 --> 00:55:16,270
So the light injection attack, for example, there is a paper on it where they created a quantum analogous setup and attacked it using physical systems.

487
00:55:16,270 --> 00:55:25,910
Whether actual commercial devices are exploitable and these vulnerabilities exist within them.

488
00:55:25,910 --> 00:55:33,950
I don't think if you kind of spent millions creating a device, you'd shout about the vulnerabilities and you'd probably try and fix it pretty sharpish.

489
00:55:34,310 --> 00:55:40,010
So I couldn't tell you whether the commercially available devices have any of these vulnerabilities in it.

490
00:55:40,010 --> 00:55:46,790
But certainly physical quantum key distribution systems have been tested and proven to be exploitable.

491
00:55:48,310 --> 00:55:49,470
Gotcha.

492
00:55:49,510 --> 00:55:51,750
OK, so next question.

493
00:55:51,810 --> 00:56:02,290
If quantum crypto requires specialized hardware on both ends, then how is it better than requiring synchronized hardware one time pads on each end, given that one time pads are cheaper to produce?

494
00:56:02,290 --> 00:56:03,330
Right.

495
00:56:03,330 --> 00:56:03,750
Yeah.

496
00:56:03,750 --> 00:56:05,530
So that's an absolutely fair point.

497
00:56:05,530 --> 00:56:22,550
I'd say that one advantage QKV has is when implemented properly, when those vulnerabilities we just discussed aren't there within the system, it intrinsically protects against man-in-the-middle attacks.

498
00:56:22,730 --> 00:56:30,350
It's theoretically impossible for an eavesdropper to be able to listen into the communication and enumerate the key.

499
00:56:30,350 --> 00:56:42,490
On top of that, whilst it's quite expensive at the moment, these QKV devices, they shouldn't always be as prohibitively expensive as they are now.

500
00:56:42,490 --> 00:56:48,370
Like I mentioned in the talk, we're literally dealing with the cutting edge of cryptography.

501
00:56:48,370 --> 00:56:59,150
And as this becomes better and better developed, we will have cheaper systems and there will be a bunch of different applications with quantum cryptography.

502
00:56:59,150 --> 00:57:09,090
Key distribution being just one very narrow aspect, admittedly the most well-developed at the moment, but one very particular part of quantum cryptography as a whole.

503
00:57:09,090 --> 00:57:22,930
But I would agree that at the moment, if you were looking for a cryptography kind of solution, I would definitely bear more towards a classical solution than a quantum one.

504
00:57:22,950 --> 00:57:27,630
This is more what's coming as opposed to what's currently here.

505
00:57:28,190 --> 00:57:28,990
Great.

506
00:57:30,330 --> 00:57:33,690
Quantum computing makes the hard math of RSA easy.

507
00:57:33,810 --> 00:57:36,950
So classic symmetric key distribution by asymmetric is broken.

508
00:57:37,630 --> 00:57:38,890
QKV can solve that.

509
00:57:38,890 --> 00:57:43,270
But what about some of the other uses of asymmetric encryption, like authentication and digital signatures?

510
00:57:43,270 --> 00:57:44,890
What's the quantum safe version of those?

511
00:57:44,890 --> 00:57:46,030
And this will be our last question.

512
00:57:46,030 --> 00:57:48,130
We can take additional questions on the Discord.

513
00:57:48,310 --> 00:57:48,590
Sure.

514
00:57:48,590 --> 00:57:52,430
Yeah, I'd be happy to stick around on Discord and answer any other questions that pop up.

515
00:57:52,430 --> 00:58:01,910
But to answer this question, I would say, as I mentioned, quantum key distribution is the best developed branch of quantum cryptography.

516
00:58:01,910 --> 00:58:03,190
It's certainly not the only one.

517
00:58:03,190 --> 00:58:07,270
And entity authentication, digital signatures, these are things that are being researched.

518
00:58:07,270 --> 00:58:18,630
But I would say the lack of maturity in the field right now kind of leaves us without a quantum safe alternative in kind of the realm of quantum cryptography.

519
00:58:34,870 --> 00:58:35,590
Wonderful.

520
00:58:40,110 --> 00:58:40,370
All right.

521
00:58:40,370 --> 00:58:41,770
Well, thank you again, Enron.

522
00:58:41,810 --> 00:58:43,770
This is a great talk, great Q&A.

523
00:58:43,770 --> 00:58:45,430
Take care and enjoy the rest of DEF CON.

524
00:58:45,430 --> 00:58:46,450
Thank you very much.

525
00:58:46,450 --> 00:58:47,050
Thank you.

526
00:58:47,050 --> 00:58:48,110
All right.