start	end	text
2160	10220	This is a secret message. Its contents are known only by me. I'll put it away safely and securely.
10960	23120	Now when you have some information that you wish communicated to only specific parties, be it a pen test report or your Netflix credentials, how would you ensure only your intended target was able to receive the message?
23120	29980	I hope for everyone watching today the answer is either some form of cryptographic solution or sod off I'm not showing my Netflix.
29980	36160	As I'm sure many of you are aware, there is a looming technology that is set to change the landscape of cryptography.
36960	40960	Quantum computers. They will force a change that's already begun.
41060	52220	Although the NTSC, for example, predict that quantum computers won't be cryptographically relevant for another 10 years, the drive to move to cryptographic standards resistant to this new threat has already begun.
52220	61880	In this talk, we will provide an introduction to this cutting edge field, discuss paradigms for security testing and the types of things to look for when offering remediation advice.
62100	69920	Quantum cryptography and quantum resistant cryptography are set to play increasing roles within our industry and jobs in the next few years.
70600	74600	So before we begin, it probably makes a little bit of sense for me to introduce myself.
74600	79720	My name is Imran and I have MSc in theoretical physics from the University of Nottingham.
79720	83100	In particular, my area of study was gravity particles and fields.
83100	86860	And my dissertation was on error correcting codes in quantum computers.
86860	89820	So this is a subject that is near and dear to my heart.
89960	96540	During my studies, I participated in online bug bounty programs and found a P2 in a Fortune 10 company.
96720	103440	Largely because of this, I was part of the group awarded the Bug Crowd 2017 VIP Researcher Accolade.
103440	112780	It was at this point that my interest in cybersecurity transitioned from something of a fun hobby to something I wanted to pursue full time.
112920	117080	And because of that, I started actively looking for jobs within the industry.
117080	125940	I was fortunate enough to be able to join Cybrus in January of 2018 and have been happily working as a security consultant ever since.
126040	129280	Okay, now with that out the way, let's get going.
129280	135020	So to begin the discussion on quantum information, we've got to first look at classical information theory,
135020	143300	which largely originates from Shannon's seminal 1948 paper, in which he puts forward two really important points for our talk today.
143300	148340	The first is the concept of entropy, which can be thought of, amongst other things, as a measure of information.
148440	156700	And the second is that it's possible to communicate reliably over noisy channels, provided that the rate of communication is less than the channel capacity.
156700	165020	Now, quantum information begins with the idea that quantum systems are the ultimate physical medium for storing and processing of information.
165160	171860	It tries to extend Shannon's theory by replacing bits of information with generic 2D quantum systems called qubits,
172220	175980	and classical channels by their noisy quantum channel counterparts.
176480	183640	In quantum cryptography, much like in classical cryptography, one would like to transmit or share information securely.
183640	192640	Except now we try and leverage the fundamental properties of our universe, such as the fact that quantum states cannot be learned without being disturbed, in order to do so.
193680	199580	So, before we start talking about quantum computers, let's have a quick recap on classical computers.
199580	209360	Now we know that information is stored in bits, 1s and 0s, and if storing one number takes 64 bits, then storing n numbers would take 64 times n bits.
209360	213000	Calculations are done essentially the same way as they are by hand.
213080	218100	And as such, the class of problems that can be solved efficiently are the same as those that can be solved by hand,
218100	224140	where efficiency is referring to the idea that the evaluation time doesn't grow too quickly with the size of the input.
225520	231900	Now with quantum computers, information is also stored in bits, except now they're quantum bits, or qubits.
232020	235760	A qubit can be in a state of 0 and 1, much like a classical bit.
235760	242000	However, it can also be in a superposition of these states, a0 plus b1, where a and b are complex numbers.
242120	247800	We use complex numbers as they provide benefits in the calculation and comprehension of qubit states,
247800	252440	such as the ability to map states to positions on a sphere, as shown in the image.
253440	263040	So where a bit can either exist as a 0 or a 1, a qubit can exist in a continuum of states, confined by the boundary of the sphere, with poles at 0 and 1.
263040	269280	Calculations are performed by mathematical operations, called unitary transformations, on the state of the qubits.
269400	275900	When combined with the principles of superposition, this creates possibilities not available for hand calculations,
275900	282460	which translates into more efficient algorithms for factoring, searching, and simulation of quantum mechanical systems.
282480	285480	It also allows for more information to be stored in a qubit.
285480	290500	For every extra qubit you get, you get twice as many numbers that you're able to store.
291620	299860	So, if it takes 1 qubit to store 2 numbers, for example, it'd take 2 qubits to store 4, or 3 qubits to store 8.
299860	306780	In fact, there's an equation there on that graph, that if manipulated, will tell you exactly how many qubits you'd need to store n numbers.
306780	309580	I'll leave that as a little puzzle for the mathematically inclined.
310200	316700	But the takeaway message is that the more qubits you add to the system, the greater the storage capacity,
316700	322280	and by an exponential amount. It's not a linear increase in storage, but an exponential one.
323580	327660	So, quantum computers, they sound amazing, but are they better at everything?
327660	334780	Well, quantum computers utilise quantum mechanics to solve certain problems much faster than is possible with a classical computer.
334980	337720	Quantum mechanics relies on the principles of probability.
337880	345400	In quantum mechanics, we depend on numbers called probability amplitudes, which can be positive, negative, or complex numbers.
346180	354880	A simplification of the process is that we try and orchestrate it so that some wrong answers have positive amplitudes, whilst others have negative amplitudes.
354880	358920	That way, they destructively interfere and cancel each other out.
358920	367140	Now, this is made more complicated by the fact that we don't know what the wrong answers are ahead of time, and so coding such things is non-trivial.
367140	369960	However, this is loosely how the process works.
370740	378960	In general, problems that can utilise parallelism, the ability to split a problem into several parts and then solve them all simultaneously,
378960	383180	are problems that will benefit from the gains quantum computers have to offer.
383300	391020	Problems like prime number factorisation, or finding the most efficient route through a complicated city grid, are great candidates,
391020	395100	whereas you're unlikely to see much of an FPS increase in your favourite video games.
395100	397440	So, apologies to any Fortnite fans.
397960	400900	So, where are we currently with quantum computers?
400940	405700	Well, the largest gate-model processor was released by Google, and it's called Bristlecone.
405740	414220	It weighs in at about 72 qubits, and whilst there are far larger quantum annealing processors, which are designed to solve a very specific set of problems,
414220	421080	gate-model processors are what most people think of when they think of quantum computers, and are applicable to a wider set of problems.
421080	424100	They are considered universal quantum computers.
424100	430640	We also have our first commercial quantum computer, released by IBM, and called the Q-System-1.
430640	432480	It weighs in at 20 qubits.
432480	441200	Mr Morimoto, director of IBM Research Tokyo, and global VP, said IBM intends to commercialise quantum computers within three to five years,
441200	446500	when he expects quantum computers to be able to outperform supercomputers in specific domains.
446500	451060	So, this first commercial system can be taken as a bit of a statement of intent.
452940	459400	UNSW Sydney have succeeded in producing a qubit that functions at 1.5 Kelvin.
459540	463920	Now, this is many times warmer than common quantum processors that are currently developed,
463920	471920	and it may enable integrating classical control electronics within a qubit array, which would end up reducing costs substantially.
472040	478620	The cooling requirements necessary for quantum computing have traditionally been one of the toughest roadblocks for the field so far.
479480	487960	And a research breakthrough has succeeded in showing experimental evidence for a new state of matter, topological superconductivity.
488160	489500	Catchy, I know.
489620	499160	Whilst the emergence of this state has been seen in 2D systems so far, it is believed that the system could be scalable and used for the construction of qubits,
499160	503780	yielding the potential for increased calculation speeds and boosted storage.
503780	511140	Finally, IBM's Q Experience and Amazon Bracket have effectively brought quantum computers to your home.
511140	518200	With cloud quantum computing, this allows for experiments to be run on quantum systems and simulators available to the public.
518280	525040	The cloud promises to facilitate great strides in quantum-related fields by allowing more people access to the technology.
525940	532460	This is a really exciting development, and it's something we'll look at a little bit more closely later on in this presentation.
532460	537380	So that's a bit about quantum computers. But what's this all got to do with cryptography?
537640	543360	Well, again, it probably makes sense to start with classical cryptography before we start talking about quantum cryptography.
543360	548800	And I appreciate there may be many people watching who know a great deal more about classical cryptography than I do.
548800	552120	So I apologize if this is a bit like teaching grandma to suck eggs.
552120	555720	But I think it's important we all start from the same page before going forward.
555720	559700	So we've kind of all got the same sort of grounding about what we're going to be discussing.
559700	562740	So what's the goal with classical cryptography?
562880	567860	Well, we want to allow secure communications of secret messages over public channels.
567860	570620	And this can be accomplished in a number of ways.
571340	582120	We could use the one-time pad algorithm, for example, in which two parties, A and B, or Alice and Bob, use a one-time pre-shared key to encrypt information.
582380	589000	An issue with this approach is that of secure key distribution, which has historically made it impractical for most applications.
589000	590960	So what are some alternatives?
590960	594540	Well, a popular one would be the public-private key pair.
594540	599260	Now, this relies on the fact that certain mathematical tasks are computationally hard.
599260	605880	For instance, the factorization of large numbers into prime factors, as used in the RSA algorithm.
607160	613960	So, as I said, the RSA algorithm relies on the difficulty of factoring large numbers into prime factors.
613960	620100	The largest factored RSA number that I know of so far is 232 decimal digits long.
620100	627440	As computers become more powerful, larger prime factors are going to need to be used in order to preserve the security of the algorithm.
627620	638020	However, in 1994, Peter Shaw kind of threw a spanner in the works and showed that a quantum computer could factor large numbers in polynomial time.
638040	641920	Now, polynomial time algorithms are said to be fast algorithms.
641920	650680	On a classical computer, operations such as addition, multiplication, square roots and logarithms can be performed in polynomial time.
650680	656340	As you can imagine, this will compromise the security of the RSA algorithm and others that use similar techniques
656640	663620	if you could find prime factors on a quantum computer as quickly as you could find logarithms on a classical one.
664500	675380	So, with quantum computers threatening many of the cryptographic standards we use today, we need some form of alternative, something resilient to this new threat.
675400	683840	Now, alternatives that have been proposed are numerous and the one we're primarily going to be looking at today is quantum cryptography.
683840	688580	Quantum cryptography derives its strength from a few weird properties of quantum mechanics.
688580	695840	There's the no-cloning theorem, which states that it's impossible to create an identical copy of an arbitrary unknown quantum state.
695840	701460	And it's important to stress that it has to be an unknown quantum state. If it's a known quantum state, it can be copied.
701460	706040	But there is no physical device capable of copying unknown quantum states.
706040	711760	As such, intercepted replay attacks are inherently protected against, as we will see later.
711760	719340	We also have quantum superposition, in which two or more quantum states can be summed to create another valid quantum state.
719340	725420	That is to say, every quantum state can be thought of as a sum of two or more distinct states.
725420	734000	As we have seen, this principle is critical to how quantum computers work and contributes to many of the benefits such systems offer.
735420	742240	Finally, we have what is arguably the most famous property of quantum mechanics, and that is quantum entanglement,
742240	749740	which is the interaction of quantum systems resulting in the quantum state of each system no longer being independent of one another.
749740	756780	So you can't talk about one system without describing the other, or affect one system without also affecting the other.
756780	765220	This has massive implications for secure communications and the teleportation of information, with active research taking place in the field.
765220	771580	And in fact, I came across, not too long ago, a really good analogy for quantum entanglement.
771580	776120	Now like all analogies, it does break down if looked at too closely.
776120	781030	But it is really good at getting across the gist of what quantum entanglement is.
782170	790350	So, as the world's been in lockdown, and we've all kind of discovered that exercise is a thing, I've got two resistance bands here.
790350	793830	I have a red resistance band, and a blue resistance band.
793830	805030	Now, if I were to put each resistance band in its own box, and then seal these boxes, and put them under the table,
805950	814550	I have a system, and I have the system that comprises of these two sealed boxes, each with a resistance band in it.
814550	821130	We no longer know what colour is in what box. I've mixed them around, and I randomly pick one.
821290	827030	Now, we can say that the band inside that box is either red or blue.
827030	835210	Or we could also say that the band is in a superposition state of being both red and blue.
835270	839550	And it will stay that way until we observe it, and force it to pick a colour.
840210	845630	So we take one of these boxes, and we give it to someone. Say you, right there.
845690	852630	And we ask you to run at the fastest speed you could possibly run. In fact, run faster than that.
852630	859790	Run at the speed of light, and just keep running in a straight line. Run right off the surface of the planet, and just keep going into outer space.
859790	863910	Just keep going for 30 years. We'll all wait. It's fine.
864470	869430	And then 30 years later, I pick up the other box.
870350	875050	And I say, I wonder what colour band we've got.
875990	884470	Now, in opening this box, I will be describing part of my system, or part of the system.
884570	889830	And in doing so, I can't help but describe the other part of the system.
889970	897450	And so I open our box, and I see inside that we have the red resistance band.
897450	914330	Which means, that without having violated any laws of physics, we know that there is a very exhausted person, 30 light years away from Earth, with a sealed box that inside it has a blue resistance band.
914330	918770	By forcing our resistance band to be red, we have forced theirs to be blue.
918770	923250	By affecting our part of the system, we have affected their part of the system.
923250	928030	And by describing our part of the system, we have described their part of the system.
928190	933370	And if you take it on the surface level, that is how entanglement works.
934170	938930	So quantum cryptography, it has a lot going for it, but it also has its share of issues.
938950	942910	So one of the pros is that it cannot be unknowingly intercepted.
942910	951830	We'll see this in more detail later, but due to the properties of the no-cloning theorem and quantum entanglement, it's impossible for information to be unknowingly intercepted.
951830	955750	It's also secure irrespective of computing power.
955750	959810	The security comes from the underlying physical properties of these devices.
959810	965090	It's baked into the universe itself and isn't something that can be cracked with greater computing power.
965090	969810	It's also able to secure communications at a physical level.
969910	976150	Quantum cryptography can secure the complete end-to-end connection without the need for SSL or a VPN.
976470	981630	But as I said, as great as this sounds, it's not as if it does not have its own issues.
981630	984270	For example, it's very expensive.
984270	992390	Due to this being the cutting edge of cryptography, research and development costs are high, as are the fabrication costs of specialist components.
992390	994870	And this all affects the final sale price.
995530	999830	Leading on from this, it requires its own independent infrastructure.
999970	1007450	The requirement for exacting conditions to be met dictates the need for independent infrastructure capable of supporting quantum cryptography.
1007450	1010410	And this also has its own associated costs.
1011230	1014750	Finally, there are practical problems in implementation.
1014830	1019550	As this is very new technology, there are still problems that need to be overcome.
1019550	1024430	Such as fiber-based quantum key distribution can only travel so far.
1024590	1030690	However, a lot of these cons, if not all of them, will be overcome as time goes on.
1030690	1035830	And we've already made significant progress in many of these areas.
1035830	1044930	I talked about the fact that we can now have what are considered hot qubits, which are qubits that run at 1.5 Kelvin.
1045050	1050210	Also, quantum key distribution being limited to only traveling a certain distance.
1050370	1061430	Luca Marini et al., as we will discuss a little bit more later, has put forward a proposed solution which can help extend the range of quantum key distribution.
1061430	1072390	And so these cons are not necessarily indicative of this being an impractical solution to the issues quantum computers pose to cryptography.
1072390	1075690	And there is still much promise within this field.
1077250	1080370	So where are we with quantum cryptography today?
1080370	1088770	Well, we have true random number generators, which are essential for the creation of secure encryption keys and entropy enhancement.
1088770	1097010	Entropy, as I said earlier, can be described as a measure of information or disorder or randomness or uncertainty in a system.
1097090	1102130	And so the introduction of truly random number generators are of obvious benefit here.
1102190	1106670	In fact, Shannon had a great anecdote about coming up with the term entropy.
1106750	1114310	He said, my greatest concern was what to call it. I thought of calling it information, but that word was overly used.
1114310	1116770	So I decided to call it uncertainty.
1116770	1120490	When I discussed with John von Neumann, he had a better idea.
1120570	1124930	Von Neumann told me, you should call it entropy for two reasons.
1124990	1131210	In the first place, your uncertainty function has been used in statistical mechanics under that name.
1131210	1132910	So it already has a name.
1132930	1138230	And in the second place, and more importantly, no one really knows what entropy really is.
1138230	1140950	So in a debate, you'll always have the advantage.
1141790	1147210	We also have quantum key distribution devices that are commercially available.
1147510	1151210	These allow for secure key exchange, which can be used for encryption.
1151210	1160190	Devices are made by ID Quantica with their Cerberus 3 system, Magic Technology with QPN, and Quintessence Labs with QProtect.
1160210	1166690	Sales of quantum key distribution systems are currently led by high-end financial and government communication systems.
1166690	1171730	Last year, the financial segment dominated the market with a share of 38%,
1171730	1179630	followed by government and defense, which accounted for around 31% and 27% of the market, respectfully.
1179630	1187730	Plans for new quantum key distribution networks exist in the US with Battelle, Japan with NICT, and China with Quantum Ctech.
1187730	1195230	The global quantum key distribution market size is estimated to grow to about 4.8 billion by 2023,
1195230	1198170	coming from 1.7 billion in 2018.
1198610	1205170	So there is massive amounts of investment that's taking place in this area, and so there are certainly many people who believe in this technology.
1205890	1210670	So I've kind of alluded to it already, but what is QKD?
1210670	1218890	Well, QKD, or quantum key distribution, is perhaps the best-known and certainly most well-developed branch of quantum cryptography.
1218890	1225010	It has the goal of providing an information-theoretically secure solution to the problem of key exchange.
1225010	1232670	Utilizing QKD protocols, two parties should be able to establish a key that can be used for secure communication,
1232670	1236290	without the key being unknowingly intercepted by a third party.
1236290	1241050	This should remain the case even if all communications were over public channels.
1241150	1249330	Whilst unconditional security can be proven mathematically, that is to say there are no constraints placed on the abilities of the eavesdropper,
1249330	1253410	and this is not something that's possible with classical distribution.
1253410	1256430	There are some assumptions that do need to be made.
1256430	1262130	One being that the universe hasn't had a change of heart, and the laws of quantum mechanics still apply.
1262130	1268350	And another being that the two genuine parties can both successfully authenticate each other.
1268350	1274550	If these two assumptions stand, however, we should have a seemingly secure protocol.
1274550	1277850	However, issues do exist within implementation.
1277950	1283030	Key generation rate, for example, and transmission distance are both areas of concern.
1283030	1291610	However, as I alluded to earlier, in 2018 Luca Marini et al. put forward a way to possibly overcome the rate distance limit.
1291610	1301150	The proposed twin-field QKD scheme suggests that optimal key rates could be achieved on 550km of standard optical fibre,
1301150	1303990	which are already used in communications today.
1304530	1311210	And whilst we're about to see quantum key distribution happen on far bigger scales than 550km,
1311210	1314570	that is a non-trivial distance, I'm sure you'll agree.
1315210	1321090	And whilst a lot of work within the field of quantum cryptography has been focused on the development of QKD,
1321090	1324270	this has not been the only branch where work is taking place.
1324370	1330990	Other areas that address issues with QKD, such as the inefficiency of quantum key distribution for large networks,
1330990	1335370	utilising symmetric cryptosystems, and this is due to key management overheads,
1335370	1342330	or areas related to other cryptographic tasks and functions are also being actively researched.
1343350	1347850	OK, so now that we've had a quick primer in QKD, let's see it in action.
1348590	1356090	In a paper submitted in early 2018, a joint Austrian-Chinese team were able to perform quantum key distribution
1356090	1360550	between a low-Earth orbit satellite and multiple ground stations.
1360550	1366710	The satellite was called MESIUS, and the protocol involved three steps.
1366710	1373690	In the first, the satellite establishes a secure key with the first location, say, Jinglong in China.
1373690	1376050	And we'll call this key MX.
1376050	1381810	The second step involves repeating this procedure with another location, say, Graz in Austria.
1382070	1385950	This creates a second secure key, and we'll call that one MG.
1385950	1389950	So we have MX with Jinglong, and MG with Graz.
1389950	1398030	At this point, MESIUS has established secure keys with both locations, and is ready to act as a trusted relay between them both.
1398030	1403770	The third and final step is for MESIUS to receive a command from one of the ground stations,
1403770	1413230	prompting the satellite to perform a bitwise exclusive OR operation between MX and MG, creating a new key MXMG.
1413890	1419450	This can then be sent through classical communications channels to Jinglong or Graz,
1419450	1427410	where it can be decoded with another exclusive bitwise OR operation to recover the original key.
1428330	1438890	So if you wanted the MG key for Graz and you were Jinglong, MESIUS would give you the MXMG key.
1438890	1445230	You'd perform a bitwise OR operation with your MX key, and you'll recover Graz's MG key.
1445230	1457130	In other words, MESIUS uses MX to encrypt MG, and Jinglong decrypts the ciphertext to recover MG, which was shared with Graz.
1457130	1464970	So the key is known to the two communicating locations and the satellite, but not to any external fourth party.
1464970	1479130	This way, the secret key, constructed between locations in China and Europe, separated by 7600 km, is secured using the properties of quantum mechanics.
1479130	1487110	A picture of MESIUS, which was about 5.3 kilobytes, was transferred from Beijing to Vienna.
1487110	1492910	And a picture of Schrodinger, which was around 4.9 kilobytes, from Vienna to Beijing.
1492910	1497950	This was done using a secure quantum key for one-time pad encoding.
1498670	1508710	A videoconference was also held between China and Austria, using the satellite-based QKT network, also in combination with fibre-based quantum networks.
1508710	1520150	And this is a promising start in finding an efficient solution for an ultra-long-distance global quantum network, which could lay the groundwork for a potential future quantum internet.
1520150	1526530	But what exactly was the QKT protocol that was used by MESIUS to establish the quantum key?
1526630	1533870	Well, it's one of the most popular QKT protocols, and is the basis for many commercial systems that are being sold today.
1534050	1544210	It's called the BB84 protocol, and it has the goal of establishing a key between Alice and Bob, such that an eavesdropper Eve cannot learn it by listening to their conversation.
1544210	1550830	Once this key has been established, it can then be used to communicate securely, using the one-time pad algorithm, for example.
1550930	1562870	The basic idea is that Alice and Bob use quantum systems to establish the key, and if Eve tries to learn the state of the system, this will inevitably disturb the state, which can be detected by Alice and Bob.
1563190	1569170	Eve can sabotage the protocol, sure, in which case Alice and Bob won't be able to establish the key.
1569170	1577770	However, the goal is to make sure that if Alice and Bob agree that the protocol was successful, then the chance that Eve knows the key would be very small.
1577970	1587270	And as a point of interest, it's called BB84, as it's a key distribution system proposed by Bennett and Brassard in 1984, and has nothing to do with spherical droids.
1588110	1596450	So what are the steps of the protocol? Well, to begin with, Alice prepares a qubit randomly in one of four states and sends it to Bob.
1596450	1604330	Bob measures the received qubit in one of two bases, randomly, so with a probability of half for each basis.
1604330	1609990	Alice and Bob then both reveal the basis in which the qubit was respectively prepared and measured.
1609990	1620530	They do this via a classical channel, but it's very important that they do not share the state or respective outcome of their measurement, merely the basis they chose for the measurement.
1620530	1626710	If the basis coincide, they add the bit to their list of key bits. Otherwise, they disregard that qubit.
1626710	1635730	In order to make sure Eve hasn't tampered, they pick a proportion, say half, of their agreed bits and compare them using a classical channel.
1635730	1643850	They should find no significant differences. If they do find differences that are above the error rate of the channel, then they know that they have an eavesdropper,
1643850	1652170	and they can choose to either restart the protocol or convince themselves that whatever they were trying to share was not that important and they should just scrap it and go home.
1653150	1660370	But how secure is the BB84 protocol? Well, there are several mathematical proofs attesting to the security of the protocol.
1660510	1665070	One such proof is provided in the further reading slide for anyone interested in the maths.
1665210	1668730	However, today we'll go through the intuition behind the proof.
1668730	1676110	The central principle is that in order for Eve to learn the key, the qubits sent by Alice must be intercepted and measured.
1676110	1684650	If Eve knows the basis to which the prepared state belongs, she could measure the state in that basis and learn it without altering it.
1684730	1695310	However, Eve doesn't know which basis has been used, and as such, she can't perform the above measurement with absolute certainty she's not going to alter the state of the qubit.
1695310	1698230	This leaves two possible alternatives.
1699550	1708890	So Eve's first option is that she can choose one of the two bases randomly, measure in that basis and then pass the system on to Bob.
1708890	1718450	If Eve chooses the same basis that Alice used to prepare the state, then she obtains the result she's looking for and can pass the state on to Bob undisturbed.
1718450	1721150	Happy days, her presence is not known.
1721150	1730330	However, on the other hand, if Eve measures in the basis that Alice didn't encode in, then the state she sends to Bob will have been altered.
1730370	1736610	And when Bob makes his own measurement, there is only a 1 in 4 chance that he will obtain Alice's prepared state.
1736610	1744090	So those aren't great odds, and her chance of being undetected further diminishes the more bits are used in the key generation process.
1744090	1750110	As every time Alice sends a bit, Eve has to roll that dice when measuring the state.
1750790	1754530	So that doesn't sound particularly great. What's Eve's second option?
1754910	1765450	Well, Eve's second option is that she can keep the system sent by Alice and measure it only after classical communication declares which basis were used for encoding.
1765450	1768070	But she needs to send Bob something, right?
1768070	1774050	So she has to essentially make up a bunch of her own data and send it on to Bob.
1774050	1782210	And just hope, through sheer chance, that her made-up data matches Alice's signal perfectly.
1782210	1788490	She can't clone Alice's signal because it's made up of unknown qubit states, quantum states even.
1788490	1794710	And so there is no physical device capable of replicating unknown quantum states.
1794710	1810990	She sends her own signal, and then she waits and prays that when Bob makes his measurements, they do not give a different result than Alice's original signal would have given.
1812450	1819750	However, no matter what state she chooses, there is a significant chance that Bob's measurements will differ.
1819750	1828770	And so using the first option, there's a very small likelihood of successful eavesdropping, which further diminishes as the number of qubits used in the protocol increases.
1828790	1837190	And with the second option, as she's just making up information and sending it along, hoping it matches Alice's, there's no real chance.
1837190	1840310	And she's scuppered there because of the no-cloning theorem.
1841170	1850130	In general, Eve may employ more sophisticated attacks in which several successive qubits are measured, which makes the proof of the security more complicated.
1850130	1857110	However, the heart of the proof is the fact that quantum information cannot be copied, as dictated by the no-cloning theorem.
1857330	1867050	Now, quantum cryptography is fast approaching the stage of technological applications, with several companies in the process of producing cryptographic systems based on the BB84 protocol.
1867050	1873190	In fact, as we've discussed earlier, there are QKD systems already available for sale.
1873190	1877320	You can buy a pair of ID Quantica's QKD Cerberus III boxes.
1877650	1887930	And generally, in commercial systems, the four states of the qubits that Alice would send, or encode in, are implemented with four polarizations of a single photon state.
1888010	1896730	Companies that manufacture quantum cryptography systems include Toshiba, ID Quantica, SecureNet, Quintessence Labs, and Magic Technologies.
1897410	1905690	So now that we know a little bit about BB84, how popular it is, testaments to its security, let's break it.
1905770	1912150	What I want you to take away from this talk is a paradigm on how to approach pen testing of quantum systems.
1912290	1918670	Vulnerabilities can be broken down into two broad classes. We have inherent flaws, and we have implementation flaws.
1918750	1924550	Now, inherent flaws exist where an assumption made during the creation of a protocol doesn't hold to be true.
1924550	1929990	A new mathematical technique or approach, for instance, may break the security of the protocol.
1929990	1934470	An example of a protocol with inherent flaws would be SSL version 3.
1934490	1940890	Implementation flaws, on the other hand, exist because real-world physical systems aren't perfect.
1941090	1945330	And neither is our adaptation of theoretical principles to physical mediums.
1945330	1952030	Such imperfections can be exploited to compromise an otherwise secure protocol, as we're about to see.
1952030	1956220	So our first attack is called the indirect copying attack.
1956550	1961670	And in it, Eve constructs a list of all possible states Alice can use to encode her qubits.
1961670	1971350	Now, we said that in commercial devices, Alice's qubits are usually encoded photons.
1971410	1976410	And these are done through using different polarizations of a single photon.
1976410	1983130	These different polarizations are horizontal, vertical, or plus and minus 45 degrees.
1984010	1992250	So Eve lists these potential states, and then she intercepts Alice's qubits as they're transmitted to Bob.
1992250	1995230	She measures them to find each qubit's value.
1995230	2001390	And having found this information, she has to discard the intercepted qubits, as she's altered them, at least some of them,
2001390	2008130	as she would have guessed and measured in the wrong basis, compared to what Alice originally prepared the qubits in.
2008850	2015710	However, now that she has got her measurements, and she has a list of Alice's original states,
2015710	2020510	she can work backwards and recreate Alice's original signal.
2020510	2025570	She's not violating the no-cloning theorem, as these are no longer unknown quantum states to her,
2025570	2033370	and so she can use the information that she gained in measuring Alice's qubits to recreate that signal and send it on to Bob.
2033370	2041850	It's important to note that this attack only works in protocols like BB84, where the quantum state is encoded in transit.
2041870	2047310	Alongside this, Eve has to know all possible states Alice can use to encode her qubits,
2047310	2054250	and try to keep her time interval between successive qubits as close as possible to Alice's original sequence,
2054250	2062130	alongside keeping the delay between Alice sending and Bob receiving as small as possible, so that her presence isn't felt.
2062870	2070170	If she manages to do this, she will have Alice's original signal, which she then passes on to Bob,
2070170	2078330	and then when Alice and Bob communicate and create their key, Eve can listen in and create her key right alongside them.
2078430	2086110	Another attack that we could employ leverages the hardware limitations of current devices,
2086110	2093330	and that limitation is that perfect single-photon sources are incredibly difficult to create,
2093330	2098670	and so we can use the photon number splitting attack, or PNS attack for short.
2098670	2107410	Because single-photon sources are difficult to create, weak coherent pulses are generally used in actual cryptographic devices.
2107750	2117070	A weak coherent pulse is a photon pulse that has a low mean photon number, and that is to say a low number of photons in that pulse on average.
2117070	2123370	It could be achieved by passing short, low-powered laser pulses through an attenuator.
2123370	2129330	The PNS attack takes advantage of a limitation present in weak coherent pulse generators,
2129330	2132990	which is that sometimes multiple photon pulses are emitted.
2134290	2141430	If that's the case, Eve can intercept a portion of this multiple photon pulse and send the remainder on to Bob.
2142110	2149510	Eve then all she has to do is wait for Alice and Bob to announce their respective transmission and detection bases,
2149510	2153270	and measure her captured photons right alongside Alice and Bob.
2153270	2157030	Again, as they build up their key, she builds up her key alongside them.
2157030	2161770	Sounds great in theory, however the PNS attack is actually quite complex to implement.
2161890	2167130	First of all, the probability that a multiple photon beam is emitted is around 5%,
2167130	2174770	and as such, Eve has to check whether the emitted pulse contains multiple photons or not, which demands proper hardware and algorithms.
2174770	2178650	Given this though, it would be very hard for Bob to detect Eve's presence,
2178650	2182850	especially if she is able to hide within the error rate of the channel,
2182850	2188010	and suppress single photon pulses, only allowing multiple photon pulses through,
2188010	2191670	making it look like it's absorption within the channel, for example,
2191670	2199090	and Bob only seeing those multiple photon pulses, which Eve knows she has a portion of those photons.
2199090	2203510	However, this can again be protected against using decoy states,
2203510	2207770	as was the case with the mesias relay, which used decoy states.
2207770	2212910	Here, multiple intensity levels are used at the transmitter's source,
2212910	2219470	so that's to say that the qubits that are transmitted by Alice are done so using randomly chosen intensity levels.
2219470	2222830	One signal state, and several decoy states.
2222830	2227270	This results in varying photon number statistics throughout the channel.
2227270	2230090	At the end of the transmission, Alice announces publicly
2230090	2234890	which intensity level was used for the transmission of each qubit.
2234890	2241690	A successful PNS attack requires maintaining that bit error rate at the receiver's or Bob's end,
2241690	2244010	so that Eve can hide within that.
2244010	2248010	However, this cannot be accomplished with multiple photon number statistics.
2248010	2252210	By monitoring the bit error rate associated with each intensity level,
2252210	2256490	the two legitimate parties will be able to detect a PNS attack.
2256490	2262990	And finally, we get to my favourite of the attacks, and this is the light injection attack.
2262990	2267110	So for this one, let's remove a bit of abstraction from the BB84 protocol,
2267110	2269990	and think about Alice and Bob's setup.
2270110	2275290	So for Alice, we need a process for encoding qubits, some sort of photon generator.
2275390	2276310	A laser.
2276530	2279870	And for Bob, we need some sort of observation machine.
2279950	2281750	Something to carry out measurements.
2282030	2283390	A photon detector.
2283390	2289170	Eve can exploit hardware weaknesses in both these components to compromise BB84.
2289610	2293350	Eve can execute this attack against Alice or Bob.
2293350	2297110	Let's take the case of Alice to begin with, and then we can circle back to Bob.
2297150	2302430	So Eve sends a light pulse at one of the devices, in this case Alice's photon generator,
2302430	2304630	and registers the reflected pulse.
2304630	2310370	Because of the design of QKD hardware, the reflected pulse will indicate which process,
2310370	2314770	or photon generator, will be used by Alice to generate the next qubit.
2314830	2319210	Eve knows which process Alice is about to use to encode her qubit.
2319210	2323390	So she can perform an intercept and replay attack with 100% certainty
2323390	2327610	that she'll be using the correct observer for each incoming qubit.
2327690	2333090	She knows that her measurements will not affect the state of the qubit,
2333090	2337890	since she'll be measuring in the exact same basis Alice used to encode the qubit.
2337890	2343610	She can then pass the state on to Bob undisturbed.
2343610	2347730	She can capture the entire key as Alice sends it, and send the qubits on to Bob,
2347730	2350970	without Alice or Bob being able to detect her presence.
2351410	2354850	Using the information communicated over the classical channel,
2354850	2357950	Eve will then be able to create the same key as Alice and Bob.
2357950	2362150	Now if she was to target Bob with this attack, it would be a very similar situation.
2362150	2367850	She sends a light pulse at Bob's photon detector.
2367850	2374270	She sees exactly what basis Bob is about to use to measure Alice's qubit.
2374270	2380330	She measures in the exact same basis that Bob would use to measure the incoming qubit.
2380350	2384550	When Eve is wrong, then Bob is also wrong.
2384550	2389930	Sure, Eve has messed up the state of that qubit, but Bob was about to mess it up anyway,
2389930	2394890	and Alice is just going to tell him to get rid of that qubit, since he measured in the wrong basis.
2394890	2400630	But when Bob measures in the correct basis, Eve also measures in the correct basis.
2400630	2405130	She doesn't mess up the state of the qubit, Bob adds it to the qubit,
2405130	2413890	and again, when Alice and Bob create their final key, Eve can create hers right alongside them.
2415850	2421150	All these attacks are understandably problematic for the BB84 protocol.
2421210	2423790	So what can be done to protect the protocol?
2423890	2431410	Well, safety measures can include passive measures, which are inherent properties of the infrastructure that make them resistant to such attacks.
2431410	2438370	If we take the example of the light injection attack, a passive measure for Alice could be to add an attenuator at the output of her setup.
2438370	2444450	This would mean Eve would need a more powerful laser to enumerate the encoding basis Alice is about to use.
2444450	2451690	If Alice then uses an optical isolator and bandpass filter so that she can get her photons out,
2451690	2457490	but Eve would have great difficulty getting her photons in, then Eve's power requirements become untenable.
2457490	2464950	We do have to state that if we're using an attenuator, we can't deal with single photon states anymore, and we'll have to use weak coherent pulses.
2464950	2471970	But as we already mentioned, most commercial devices tend to use weak coherent pulses anyway, so this isn't a massive issue.
2472150	2477610	Active measures are tools that are designed to mitigate against certain attacks.
2477610	2486970	So an active measure may involve a detector to warn Alice and Bob should average and or peak power of an incoming pulse rise above a specified level.
2486970	2495270	If this happens, then they know that Eve is trying to enumerate either Bob's detection basis or Alice's encoding basis.
2495350	2505170	Now we can also have a combination of both. So we can have active for Alice, where she has her attenuator, optical isolator, bandpass filter introduced to her setup,
2505170	2513650	and an alarm system, a warning, a detector, for Bob should incoming light pulses rise above a certain threshold.
2515170	2524330	So those are some potential attacks and defense measures that can be used to harden quantum cryptographic protocols.
2524330	2531290	However, quantum cryptography is not the only source of quantum-resilient cryptography being researched today.
2531290	2537290	We also have post-quantum cryptography, and that is an incredibly popular flavor,
2537290	2547870	and one we'll give a brief overview to now, as no discussion of quantum-resilient cryptography would really be complete without at least touching upon post-quantum cryptography.
2548410	2557290	So, as we've stated, the problem with many algorithms in use today is that their security is based on a class of mathematically difficult problems,
2557290	2561030	all of which can be solved on a sufficiently powerful quantum computer.
2561030	2567990	Even though current, publicly known quantum computers lack the processing power to be cryptographically relevant,
2567990	2574470	many cryptographers are designing new algorithms to prepare for when quantum computers become powerful enough to be a threat.
2574470	2579770	There are currently four main flavors of public-key post-quantum cryptosystems.
2580510	2589950	Firstly, we have lattice-based cryptosystems. This is the most well-understood and widely studied family of hard math problems being researched for post-quantum cryptography.
2589950	2598250	It is perhaps the most popular flavor due to its historic mathematical interest and the versatility of cryptographic schemes possible,
2598250	2605510	allowing for the replacement of essentially all endangered protocols, but also the introduction of entirely new classes of cryptographic tools,
2605510	2609270	not available when using factoring or other hard math problems.
2609550	2618750	Second, we have code-based cryptosystems, which is another popular flavor that includes cryptosystems which rely on error-correcting codes, such as the Michaelis algorithm.
2618750	2625290	The original Michaelis signature, using random Goppa codes, has withstood scrutiny for over 30 years.
2625290	2631510	However, many variants which aim to structure the code more so as to minimize key size, have been shown to be insecure.
2631950	2637690	Third, we have hash-based cryptosystems. Hash-based digital signatures, which were invented in the 70s,
2637690	2644170	fell out of vogue as there is a limit to the number of signatures that can be signed using the corresponding set of private keys.
2644250	2647970	Post-quantum cryptography, however, has renewed interest in the field.
2647970	2652890	Finally, we have multivariate public-key cryptosystems.
2652890	2659090	This includes encryption schemes based on the difficulty of solving systems of multivariate equations.
2659090	2663930	Whilst attempts to build secure multivariate equation encryption protocols have failed,
2663930	2669210	such schemes could provide a basis for the construction of a quantum-secure digital signature.
2669210	2672730	I also quickly wanted to touch upon symmetric key encryption.
2672730	2678630	Given that suitably large keys are used, systems like AES are already quantum-resistant.
2678630	2683830	In addition to this, key management protocols which employ symmetric keys, like Kerberos,
2683830	2687710	are inherently secure against attacks from a quantum computer.
2687710	2695450	Some researchers suggest expanded use of Kerberos-like key management as a way to get post-quantum cryptography today.
2695650	2700550	So with the security of post-quantum cryptography schemes still being evaluated,
2700550	2703690	how do we approach adoption? And why the rush?
2703690	2707310	Why not wait until we are wholly confident in the schemes proposed?
2707890	2712250	Well, the Mosca inequality states that if the time data is to be preserved for,
2712250	2717810	in addition to the time it will take our security systems to migrate from classical to post-quantum,
2717810	2724250	is more than the time it will take for quantum processors to become capable of compromising existing encryption,
2724250	2725910	then we have a problem.
2725910	2728590	Some believe we have already reached this point.
2728610	2735850	But at the very least, the pressure to begin being able to implement some form of post-quantum cryptography is very real.
2736010	2737510	So how are we doing this?
2737510	2743270	In the first instance, it would make sense to use a hybrid of classical and post-quantum schemes.
2743270	2747930	This affords us the security of rigorously tested schemes that are classical,
2747930	2752970	alongside a safety net against the threat that quantum computers pose.
2753910	2758210	As long as one of the two schemes are secure, the data is protected.
2758590	2764050	Should there be a flaw in the post-quantum scheme, the classical scheme may buy us time to address it.
2764050	2770070	And if quantum computers render classical schemes obsolete, we have the protection of the post-quantum scheme.
2770070	2773930	An advantage of the hybrid approach is the backwards compatibility,
2773930	2777550	whereby you can fall back to better supported classical algorithms,
2777550	2782350	should you find support for your shiny new post-quantum cryptography algorithms lacking.
2782350	2787110	Other things to bear in mind when designing and implementing hybrid schemes,
2787110	2791370	in addition to backwards compatibility, is performance,
2791370	2798390	with computation and data consumption overheads alongside minimizing impact to latency and data flows.
2798910	2805630	Much like quantum cryptography, post-quantum cryptography has its associated pros and cons.
2805630	2812850	So a massive pro is the cost. Due to decreased R&D expenses relative to quantum cryptography,
2812850	2816070	in addition to it being far less resource intensive,
2816070	2821230	the cost of post-quantum cryptography is significantly lower than its quantum counterpart.
2821850	2825090	Alongside this, it works on current infrastructure.
2825090	2832570	This feeds into the lower cost as expensive and specialized equipment is not required in order to facilitate post-quantum cryptography.
2832570	2837690	This form of cryptography should be capable of running on current classical computers,
2837690	2841450	and as such may have a larger scope of possible applications.
2842170	2847470	And due in no small part to the prior two reasons, this field is massively popular,
2847470	2852950	with tons of active research taking place and many supporters, including the NCSC.
2854070	2859150	However, it's not all sunshine and roses. Due to this being such a young field,
2859150	2865410	essentially being born as a response to the increasing threat quantum computers continue to place on current cryptography,
2865410	2869550	there may be many flaws and inherent weaknesses that are yet to be uncovered.
2869550	2873610	Simply due to the field's immaturity, any such issue, when discovered,
2873610	2879630	would immediately threaten the confidentiality of data protected by the relevant encryption.
2880310	2887990	Another particular challenge of post-quantum cryptography is the implementation of quantum-safe algorithms into existing systems.
2887990	2893770	I'm sure many of us have come across clients who are forced to run outdated and vulnerable cryptography
2893770	2898730	due to legacy systems which don't support modern TLS implementations.
2898730	2905450	This issue will only be made worse by the introduction of post-quantum cryptography unless these issues are overcome.
2907550	2916170	Finally, we have key size. There are often trade-offs related to key size and computational efficiency alongside ciphertexts or signature size.
2916170	2922430	As such, care must be taken when choosing which post-quantum cryptographic algorithms to employ,
2922430	2927630	weighing, for example, the effort required to send large public keys over the internet.
2928110	2932630	So when it comes to quantum cryptography, why are we talking about it now?
2932630	2935950	Why is it relevant to have this conversation today?
2935990	2941330	Well, no one is sure when a cryptographically relevant quantum computer will be available.
2941350	2945850	Depending on who you ask, estimates range from a few years to never.
2945850	2949850	But the general consensus is that we should plan for around a decade.
2950110	2959430	As such, a worst-case scenario can be put forward of the complete failure of a massive proportion of cryptographic systems within 10 years.
2959430	2967990	We should put in place a strategy early enough that will allow for quantum resilience in time to protect sensitive data for the full term of its security life.
2967990	2976430	The strategies we put in place need testing and assurance, so that in an attempt to address vulnerability issues, we don't end up introducing more.
2976470	2985890	For some data, it can be argued that it's already too late. Harvesting attacks could already be intercepting data for decryption when quantum computers mature.
2986810	2991670	So this all sounds great, and you've decided to build your own quantum cryptography lab.
2991670	3000610	Now there are two ways to go about this. One is building a physical system to test particular protocols in implementation, and the other is through virtualization.
3000750	3006710	With a physical apparatus, you'd be forgiven for thinking building one would require exorbitant sums of money.
3006710	3021950	However, essentially, all you need to model, say, the BB84 protocol would be a source, some kind of laser most likely, a photon detector, some polarization filters and beam splitters, and then some electronics to control the equipment and register output.
3021950	3030710	There are kits available which contain all the necessary components to create an analogous setup for QKT protocols, and these cost around two and a half thousand pounds.
3030710	3034610	So not the millions and millions you'd be forgiven for thinking it would cost.
3034610	3042190	However, with virtualization, we can model the protocols and components. We never need to have physical devices in front of us.
3042190	3054290	We can leverage the quantum cloud, which allows for the exploration of quantum applications via systems and simulators to model and test QKT protocols using real world quantum systems.
3054290	3061430	However, please stick to hacking the protocols and not the platform itself. Don't want you getting in trouble.
3062110	3072630	We can also use software such as MATLAB or Visual Basic to model all of our components and code the logic of these protocols, and thus create an inexpensive virtual lab.
3072630	3080350	There is quite a lot of material available to help in such endeavors, and there are several academic papers that take this approach.
3080350	3098130	My personal recommendation would be to start with a virtual lab, and once you've identified potential vulnerabilities, then build an analogous physical model to determine how best to exploit the issues identified, and also determine whether they constitute legitimate vulnerabilities, and if so, under what conditions.
3099050	3107930	So in conclusion, there is no better physical medium for storing and processing information than quantum systems, according to quantum information theory.
3107930	3116310	You are essentially working with the fundamental building blocks of the universe, and are as close to the metal as you can possibly be, to borrow a programming analogy.
3116590	3127510	With quantum cryptography, you can secure communication on the physical level. We know there are many pros, but also several cons and physical hurdles that are yet to be overcome.
3127510	3143690	However, commercial systems relying on quantum principles are already beginning to emerge. We've talked about IBM's Q-System 1, which is the first commercial quantum computer available, and that there is such a thing as the quantum cloud, allowing quantum computing to be accessed by the masses.
3144190	3149670	In addition to this, commercially available quantum key distribution systems are already with us.
3150110	3155930	The landscape of cryptography is changing under our feet, and it's up to us to adapt to it.
3155930	3165870	With the introduction of new protocols, some completely secure in theory, there still exists many pen testing applications in the physical implementations of such systems.
3165870	3177710	If you can't find an inherent flaw, look for an implementation flaw. What components were used in the construction of this system? What are their technical limitations? How can these limitations be abused and protected against?
3177710	3187110	Technical details for many components are publicly available, and so research into the compromise of these devices can be done without ever needing to have one in front of you.
3187970	3198030	So if anyone's interested in any further reading, I've compiled a list of resources that I found particularly useful in constructing this talk. So this would be a great place to start.
3198030	3202690	Here we've got the obligatory image references, just so that no one shouts at me.
3202890	3209090	And finally, thank you to Cyberus for allowing me the time and resources to put this presentation together.
3209090	3214590	In particular, to Mark Crowther, Catherine Fair, and Ian Lonsborough for their guidance and encouragement.
3214670	3219110	And to DefCon Crypto and Privacy Village for providing such a stellar platform.
3219110	3223150	And finally, and most importantly, to you all for listening. So thank you very much.
3223150	3226350	If you've got any questions, please feel free to reach out.
3233190	3240530	All right. Thank you to Imran Shaheem for his talk that has just wrapped up, entitled Quantum Computers and Cryptography.
3240530	3248430	We have Imran here for a live Q&A, so please continue putting any questions you have in the Discord CPV Q&A channel. You can find the link below.
3248750	3252590	Let's get started off with... we have a few questions queued up already.
3252690	3261270	Good morning, Imran. So our first question is, where can we get that reference slide you mentioned? Some folks would like to read more about BB84.
3261270	3270290	Yep, absolutely. So I do believe it flashed very briefly on the screen during the presentation, but I appreciate it probably wasn't on for very long at all.
3270510	3280090	I'll probably chuck it onto, I don't know, LinkedIn or Twitter or I'll link to it somewhere and I'll make sure it's available out there for everyone.
3280330	3286650	But worst case scenarios, you can always go back and just pause that, that reframe where it's on there.
3286650	3294690	OK, wonderful. So next question. Have any of these attacks been demonstrated in real life or are these still theoretical?
3294930	3305370	So it depends on what you mean by real life. So they have been done with real physical components.
3305370	3316270	So the light injection attack, for example, there is a paper on it where they created a quantum analogous setup and attacked it using physical systems.
3316270	3325910	Whether actual commercial devices are exploitable and these vulnerabilities exist within them.
3325910	3333950	I don't think if you kind of spent millions creating a device, you'd shout about the vulnerabilities and you'd probably try and fix it pretty sharpish.
3334310	3340010	So I couldn't tell you whether the commercially available devices have any of these vulnerabilities in it.
3340010	3346790	But certainly physical quantum key distribution systems have been tested and proven to be exploitable.
3348310	3362290	Gotcha. OK, so next question. If quantum crypto requires specialized hardware on both ends, then how is it better than requiring synchronized hardware one time pads on each end, given that one time pads are cheaper to produce?
3362290	3372770	Right. Yeah. So that's an absolutely fair point. I'd say that one advantage QKV has is when implemented properly,
3372770	3382550	when those vulnerabilities we just discussed aren't there within the system, it intrinsically protects against man-in-the-middle attacks.
3382730	3390350	It's theoretically impossible for an eavesdropper to be able to listen into the communication and enumerate the key.
3390350	3402490	On top of that, whilst it's quite expensive at the moment, these QKV devices, they shouldn't always be as prohibitively expensive as they are now.
3402490	3408370	Like I mentioned in the talk, we're literally dealing with the cutting edge of cryptography.
3408370	3419150	And as this becomes better and better developed, we will have cheaper systems and there will be a bunch of different applications with quantum cryptography.
3419150	3429090	Key distribution being just one very narrow aspect, admittedly the most well-developed at the moment, but one very particular part of quantum cryptography as a whole.
3429090	3442930	But I would agree that at the moment, if you were looking for a cryptography kind of solution, I would definitely bear more towards a classical solution than a quantum one.
3442950	3447630	This is more what's coming as opposed to what's currently here.
3448190	3458890	Great. Quantum computing makes the hard math of RSA easy. So classic symmetric key distribution by asymmetric is broken. QKV can solve that.
3458890	3464890	But what about some of the other uses of asymmetric encryption, like authentication and digital signatures? What's the quantum safe version of those?
3464890	3468130	And this will be our last question. We can take additional questions on the Discord.
3468310	3472430	Sure. Yeah, I'd be happy to stick around on Discord and answer any other questions that pop up.
3472430	3481910	But to answer this question, I would say, as I mentioned, quantum key distribution is the best developed branch of quantum cryptography.
3481910	3487270	It's certainly not the only one. And entity authentication, digital signatures, these are things that are being researched.
3487270	3498630	But I would say the lack of maturity in the field right now kind of leaves us without a quantum safe alternative in kind of the realm of quantum cryptography.
3514870	3525430	Wonderful. All right. Well, thank you again, Enron. This is a great talk, great Q&A. Take care and enjoy the rest of DEF CON.
3525430	3527050	Thank you very much. Thank you.
3527050	3528110	All right.