Thanks, glad I was of some help Please bear in mind I'm not an expert, though - it's just my understanding here.


No, it's not impossible to break the security at source. QKD as with many things has vulnerabilities where the theory meets actual real-world implementation. This article goes into some depth on the subject, and may be of interest.

So how is QKD any use at all? Well, the strength is not that the key can't be intercepted during the transmission process, it's that the entangled nature of the photons means that the recipients are able to determine whether or not the key has been intercepted. QKD isn't a perfect solution, it's just a mechanism that employs properties of quantum mechanical systems to improve upon existing classical processes.

Quantum cryptography does continue to advance, and it may one day provide ultimate 100% guaranteed security, due to its basis on and exploitation of immutable physical laws. But for the immediate future, we also need post-quantum cryptographic algorithms to for example protect bitcoin.

Hi again

I suppose I'm saying that quantum cryptography is not limited to QKD, it's much bigger and more fundamental than that.

QKD is an approach to key distribution that uses quantum properties, and so is a part of quantum cryptography. It was certainly an early part, yes 1980s with the BB84 protocol. QKD has been the main implementation of quantum cryptography for a long time. And QKD does indeed have limitations, as discussed above. It's an improvement on the equivalent classical process, that's all.

But my point really is that the laws of quantum mechanics provide us with a theoretical framework through which, by exploiting properties such as entanglement, quantum teleportation and the no-cloning theorem, some sort of unhackable communication process may be possible.

QKD is an early implementation. I'm not saying it's the perfect end-state, it's not. I'm saying that quantum mechanics gives us a valuable toolset, and we would be remiss to focus entirely on post-quantum cryptography - which is, fundamentally, classical. PQC is no doubt hugely important and will certainly provide the initial defences against a future quantum attack. But the best long-term defence against quantum attack is not necessarily classical. There can be quantum defences, too. If we dismiss any possible quantum defence and limit ourselves purely to the classical, then we are missing something important.

QKD is a first implementation of quantum cryptography. There have been developments since then. I've mentioned Kak's 3-stage protocol before, a sort of quantum double-lock. This is quantum cryptography, and is a big improvement on QKD. There will be further developments and further improvements. Quantum mechanics offers us a world of possibilities. I'm just saying we need to follow this path in addition to the path of PQC.

----------------------------
Yes, dear interlocutor, there are no objections, I am ready to defend every word you have written.

Post quantum cryptography is really classical, because it is built on complex mathematics and large numbers. But that's not all - it has a key.

Modern crooks don't even break pre quantum cryptography, and they never will, they're not smart enough.
They do it in a simple and elegant way - steal keys. And successful, too.
Real cryptography isn't classic cryptography - it's keyless cryptography. There's a theory about this model of encryption that I can send out.

And that's why it is needed, that's briefly, what happens with key (and passwords, it's the same) methods:

- Recently, unknown persons attacked UN units, "as a result, components of key infrastructure in Geneva and Vienna were compromised ..." - quotes Dujaric Reuters (stealing keys);

- The CIA, together with the German Federal Intelligence Service (Bundesnachrichtendienst, BND), has been reading secret messages from officials in more than 120 countries for the past fifty years (!) through Crypto AG, a company that produces special encryption equipment (via encryption keys);

- security researchers from ESET discovered the dangerous vulnerability Kr00k (CVE-2019-15126) in widely used Wi-Fi chips from Broadcom and Cypress and affects more than a billion devices worldwide (smartphones, tablets, laptops, routers and IoT devices) that use the WPA2-Personal or WPA2-Enterprise protocol with the AES-CCMP encryption algorithm. Now Amazon (Echo, Kindle), Apple (iPhone, iPad, MacBook), Google (Nexus), Samsung (Galaxy), Raspberry (Pi 3), Xiaomi (RedMi) and access points from Asus and Huawei are under attack. The Kr00k vulnerability is related to Key Reinstallation Attack (KRACK), which allows attackers to crack Wi-Fi passwords protected by the WPA2 protocol (keys again);

- huge problems with device shells that contain embedded vulnerabilities such as embedded passwords and embedded SSH/SSL keys. The appearance of one such device in your home, including an IOT device, connecting it to your home wi-fi, allows you to attack all your other devices connected to the same access point (keys, passwords);

- experts found a database with unencrypted e-mail addresses and passwords of more than 1 billion users on the Web, put up for sale by a cybercriminal under the pseudonym DoubleFlag (passwords);

- of the 175 million RSA certificates analyzed, over 435,000 are vulnerable to attack. At the international conference IEEE TPS (Trust, Privacy and Security) in Los Angeles, California, a group of researchers from Keyfactor presented these results (vulnerability of key infrastructures in general).

So what will quantum cryptography solve if it is key?
It's nothing.
It's also expensive.
And not for everyone, only those who sit on fiber optic cable.
And also for those who can't visit any website on this device, otherwise they'll get a spy program and steal the keys.

Nothing but a commercial result to the creators, this method does not give. These keys will be stolen the moment they are used for encryption.
And then you will be listened to and read everything that you encrypt, and you will know nothing. End of game.

And in keyless technology, there's nothing to steal, no keys.

Are we just talking about the distinction between symmetric and asymmetric cryptography?

I don't know about the 'keyless cryptography' you mention, but I suspect it needs a shared something, a key by another name? I think we have mentioned OTPs before. The weakness with OTPs is that initial sharing of the key. QKD used in conjunction with OTP gives a strong solution to that problem. With QKD you can tell when there has been an interception/hacking attempt; it's a great way to share a key. Yes there remain certain vulnerabilities in implementation, it's not perfect, just an improvement on the analogous classical method.

Asymmetric cryptography by contrast is great for things like bitcoin and cryptocurrencies. The problem comes with quantum computers running the Shor algorithm, which obliterates public key cryptography. Where a classical computer takes an unimaginably huge 2¹²⁸ operations to derive the bitcoin private key, a QC running Shor takes a mere 128³.

It's still a shared secret though, right? It's still a key?

Maybe I'm being stupid, but I don't see how this can exist.
Surely there are two ways that the data can be decrypted: either you need a shared secret, or else the communication itself contains the means of deciphering it.
So in the first instance, the secret is the key - whether we call it a key or not, that's what it is.
And in the second instance, there is zero security because anyone can derive the data from a thing that is entirely self-contained.

There has been another recent advance in quantum computing, which may be an important step towards the development of large scale QCs.

The QCs developed thus far have to work at very low temperatures in order to keep the energy of the system low enough that the qubits remain stable. Very low temperatures, which means close to absolute zero. In practice this means below about 0.1K, or within a tenth of a degree of absolute zero.

A paper last year outlined how in theory this minimum working temperature could be raised to around 1.5 Kelvin. Still absurdly cold, but in relative terms this is a huge jump up from 0.1K. This is a quantum-dot-based system, and the mechanism by which they can work with the higher temperature is by isolating the quantum dots and then using magnetically-controlled electron quantum tunnelling to read the qubit state. (As an interesting aside, it is the phenomenon of quantum tunnelling that sets a barrier to the size reduction of traditional processors, which could end Moore's Law.)

Why does a change from 0.1k to 1.5K mean a big reduction in the difficulty of producing large scale QCs? Well, each time you make the machine bigger, and more powerful, each time you add more qubits, you are introducing extra energy, higher temperatures, which means even more cooling is required. There is a several orders-of-magnitude difference in the dollar cost between cooling to 1.5K and cooling to 0.1K. As one of the paper's authors stated: "This [1.5K] is still very cold, but is a temperature that can be achieved using just a few thousand dollars' worth of refrigeration, rather than the millions of dollars needed to cool chips to 0.1 Kelvin."

So this was the theory, an increase in workable temperature for QCs from 0.1K, up x15 to 1.5K. The big advancement is that this theory has now been experimentally verified, by the team at Delft that I've mentioned in previous posts.

Whilst it's good that more companies are getting involved, I'm extremely skeptical of Honeywell's claim. Their assessment is based on the assumption that Quantum Volume is the defining metric for QC power, and that's very much open to question. Quantum Volume is the metric that IBM uses:


The thing is... absolutely no-one else uses that metric. IBMs QC is currently the most powerful in the world, based on Quantum Volume, because it is the only one that uses Quantum Volume as a metric.
It looks like Honeywell are trying to put out a QC that is more powerful than IBM's, using Quantum Volume to determine that power... thereby becoming the "most powerful" QC in the world by improving on its only competitor on that metric.

It is great that another company is entering the space, and it will certainly be a big achievement if newcomers Honeywell can out-perform IBM... I just think that the "most powerful" claim is a little misleading.

You can change the algorithms of all the active wallets, but some wallets have lost keys or the people who had those keys died and they can't change the signing algorithm which means those wallets will be captured by quantum computers. So we will know what quantum computers exist when satoshi's coins move... That's one of the reasons why they will move. Eventually they will move and they will move because eventually someone will be able to break the keys. But for the rest of the eco system we can migrate quite easily to another algorithm. It's not really as big of a threat that people think it is."

This is very true. When advances in quantum computing are reported, the focus is often solely on the number of qubits involved. Whilst a degree of simplification is understandable when reporting what is certainly a complex and technical subject, this can mislead people into thinking it's the only important metric. Information loss through decoherence is a huge issue and the major barrier to production of large-scale QCs, and maintaining that near-absolute-zero temperature is a key requirement in minimising that decoherence.

However, whilst this is important and, as you say, expensive, the problem is perhaps not insurmountable. These are after all engineering challenges rather than absolute, universal constraints. My post above links to recent experimental verification of a process whereby the minimal viable temperature is increased by a factor of 15, resulting in an orders-of-magnitude cost reduction for cooling. But it is not necessarily all about cooling or the space required. Development is continuing at pace across the field, with advances being made all the time. Techniques are being refined, and new approaches adopted. Noise is being reduced and coherence is improving. Indeed, just last week Trinity College Dublin released a paper detailing a new technique in qubit-creation that may make the process both more powerful and much more controllable. Traditionally the quantum-dot-based approach to qubit emission involves affixing a metal point near to the dot... but the new approach involves controlled optical excitation of the point, which can then be scanned over the surface. Not only is this simpler than the current method, the new optical approach also generates greater quantities of single photon outputs and can force entanglement of dot pairs. The whole process is becoming more controllable all the time, and with increased control comes less noise, and so greater coherence.

---

Edited for clarity; seems my sentence construction also suffers from coherence issues.

I sort of agree with this. The reason we need QCs to be cooled almost to absolute zero is to reduce decoherence. Cooling is a (partial) solution to a problem. There may be other solutions where cooling is not required (or where a smaller amount of cooling is sufficient).

I sort of agree here, too. A system is only as strong as its weakest link. That weakest link often turns out to be human errors or laziness. However we can't really argue that a) people will make errors or be negligent, therefore b) there is no point to implementing secure cryptographic systems.

Because the power of a QC scales exponentially due to superposition and entanglement. Superposition meaning that a qubit can be - to simplify somewhat - both 0 and 1 at the same time. Entanglement meaning that multiple qubits can be combined into a single state. So the number of classical outcomes that can be assessed scales 2^n. The nature of QCs means that they are strong on integer factorisation and the discrete logarithm problem (both normal and ECC). Shor's algorithm can dismantle current asymmetric cryptography.
There are as you know various quantum-resistant approaches to asymmetric cryptography that offer potential defences against a QC, however these do also bring new challenges such as increased key size.

Going beyond bitcoin and cryptocurrencies, one common assumption is that there is no danger until a sufficiently powerful QC appears. This is not the case. Quantum-safe security needs to be implemented as soon as reasonably possible. I am quite sure that people are storing today's encrypted traffic for the future, so that it can be decoded once a QC is available. Anything communicated by public-key today can be deciphered tomorrow.