Feeds

Quantum crypto boffins in successful backdoor sniff

Erroneous error-handling undermines bulletproofness

Internet Security Threat Report 2014

Computer scientists have pulled off what is claimed to be the first successful attack against a commercial system based on theoretically uncrackable quantum cryptography.

Quantum key exchange, which forms the basis of quantum cryptography, relies on a principle of quantum physics that means it is not possible to eavesdrop on single quanta - generally photons in an optical fibre - without changing their state. Alterations would be detected as errors, immediately alerting the intended recipient of a key that there's a problem. When properly implemented, quantum key distribution/exchange offers bullet-proof security.

In practice, however, it is not possible to completely eliminate errors in electronic communications because of factors such as noise and signal degradation. So practical systems accept key exchanges where the error rate is less than 20 per cent.

Feihu Xu, Bing Qi and Hoi-Kwong Lo at the University of Toronto in Canada have developed a subtle "intercept and resend attack" where they eavesdrop on some of the quantum bits sent during a quantum key exchange but not so many as push the error rate over the 20 per sent threshold. The boffins demonstrated such a "phase remapping" attack against commercial quantum cryptography systems from ID Quantique.

As the boffins explain, their attack takes advantage of the mistaken assumption that the sender can prepare the required quantum states without errors.

The ID Quantique system is not broken, they say, but requires tweaking to get over the unsafe assumption that error rates of less than 20 per cent must be due to noise and can be safely disregarded. The attack, as is so often the case in the history of the battle between code makers and code breakers, is an implementation weakness rather than a systemic one.

The work of the Canadian team follows lab-based attacks on quantum crypto set-ups that relied on exploiting internal reflections in kit that generates quantum bits, or the interception of stray photons between detectors and lasers to eavesdrop on supposedly secure communications channels. The Canadian team's paper, Experimental demonstration of phase-remapping attack in a practical quantum key distribution system, can be found here.

A summary of their work can be found in a story by Technology Review here. ®

Internet Security Threat Report 2014

More from The Register

next story
You really need to do some tech support for Aunty Agnes
Free anti-virus software, expires, stops updating and p0wns the world
USB coding anarchy: Consider all sticks licked
Thumb drive design ruled by almighty buck
Attack reveals 81 percent of Tor users but admins call for calm
Cisco Netflow a handy tool for cheapskate attackers
Privacy bods offer GOV SPY VICTIMS a FREE SPYWARE SNIFFER
Looks for gov malware that evades most antivirus
Patch NOW! Microsoft slings emergency bug fix at Windows admins
Vulnerability promotes lusers to domain overlords ... oops
Oi, Europe! Tell US feds to GTFO of our servers, say Microsoft and pals
By writing a really angry letter about how it's harming our cloud business, ta
prev story

Whitepapers

Choosing cloud Backup services
Demystify how you can address your data protection needs in your small- to medium-sized business and select the best online backup service to meet your needs.
A strategic approach to identity relationship management
ForgeRock commissioned Forrester to evaluate companies’ IAM practices and requirements when it comes to customer-facing scenarios versus employee-facing ones.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Website security in corporate America
Find out how you rank among other IT managers testing your website's vulnerabilities.
Top 5 reasons to deploy VMware with Tegile
Data demand and the rise of virtualization is challenging IT teams to deliver storage performance, scalability and capacity that can keep up, while maximizing efficiency.