QCrypt: Implemenng a Next-Generaon Quantum Key Disllaon Engine in - PowerPoint PPT Presentation

Context Classical Channel Overall Security . . . . . . . . . . . . . . . . . . . . . QCrypt: Implemen�ng a Next-Genera�on Quantum Key Dis�lla�on Engine in Prac�ce P. Junod (HEIG-VD) Joint work with A. Burg, J. Constan�n (EPFL), Ch. Portmann (ETHZ & Uni. of Geneva) R. Houlmann, Ch. L. Ci Wen, N. Walenta, H. Zbinden (Uni. of Geneva) N. Kulesza (ID Quan�que SA) ESC 2013 - Mondorf-les-Bains (Luxembourg) - January 18, 2013 1 / 29

Context Classical Channel Overall Security . . . . . . . . . . . . . . . . . . . . . Outline 1 Context Classical Channel 2 Authen�ca�on Error Correc�on Privacy Amplifica�on 3 Overall Security Random Numbers Security Parameter 2 / 29

Context Classical Channel Overall Security . . . . . . . . . . . . . . . . . . . . . QCrypt in a Nutshell 4-year project funded by the SNF Nano-Tera ini�a�ve (2009-2013) Researchers from Uni. of Geneva, ETHZ, EPFL, HEIG-VD and ID Quan�que SA Two different goals: 1 Build a next-genera�on high-speed QKD engine 2 Build a 100 Gbps (classical) encryp�on engine 3 / 29

Context Classical Channel Overall Security . . . . . . . . . . . . . . . . . . . . . GAP - University of Geneva / ID Quan�que SA Pioneers in the domain of prac�cal quantum cryptography 4 / 29

Context Classical Channel Overall Security . . . . . . . . . . . . . . . . . . . . . QCrypt - Fast Encryptor 10 Ethernet channels of 10 Gbps each 100 Gbps layer-2 AES-GCM encryp�on engine 100 Gbps data channel over a single fiber (Securely) get keys from the QKD engine 5 / 29

Context Classical Channel Overall Security . . . . . . . . . . . . . . . . . . . . . QCrypt - QKD Engine Based on the Coherent One-Way ( COW ) Protocol Simple data channel with no ac�ve elements at Bob Interference visibility as measure of Eve's informa�on Fast single photon detectors with gate frequencies of up to 2.3 GHz. Target throughput for the dis�lled key: 1 Mbps 6 / 29

Context Classical Channel Overall Security . . . . . . . . . . . . . . . . . . . . . Outline 1 Context Classical Channel 2 Authen�ca�on Error Correc�on Privacy Amplifica�on 3 Overall Security Random Numbers Security Parameter 7 / 29

Context Classical Channel Overall Security . . . . . . . . . . . . . . . . . . . . . Informa�on-Theore�cally Secure Authen�ca�on Like for BB84 and other QKD protocols, one needs to exchange informa�on on a non-confiden�al, but authen�cated channel. Requirements on the MAC: 1 Informa�on-theore�c security 2 Process blocks of 2 20 bits 3 Authen�ca�on tag of 127 bits 8 / 29

Context Classical Channel Overall Security . . . . . . . . . . . . . . . . . . . . . (Strong) Universal Hashing Defini�on (Universal Func�ons) Let X and Y be two finite sets. A family H of hash func�ons ! Y is called " -almost universal if the following condi�on h : X � holds: for any x 6 = x 0 2 X , Pr [ h ( x ) = h ( x 0 )] � " . Defini�on (Strongly 2-Universal Func�ons) Let X and Y be two finite sets. A family H of hash func�ons ! Y is called " -almost strongly 2-universal if the following h : X � condi�on folds: for any x 1 6 = x 2 2 X and any y 1 ; y 2 2 Y , " Pr [ h ( x 1 ) = y 1 ; h ( x 2 ) = y 2 ] � jYj 9 / 29

1 Context Classical Channel Overall Security . . . . . . . . . . . . . . . . . . . . . (Strong) Universal Hashing Theorem (Wegman-Carter, 1981 / S�nson, 1991) Suppose that H is an " -strongly 2-universal family of hash func�ons. Then H is an informa�on-theore�cally secure message authen�ca�on code with � = jYj and � � " . Here, � denotes the impersona�on probability and � the subs�tu�on probability. 10 / 29

m 1 Context Classical Channel Overall Security . . . . . . . . . . . . . . . . . . . . . Towards a Concrete Construc�on (1) We consider the two following families of hash func�ons: ( ) x i k i : x i ; k 2 GF ( 2 n ) H ~ X = h k ( x ) = i = 0 H � f h ( a ; b ) ( x ) = [ ax ] n � 1 + b : a 2 GF ( 2 n ) and b 2 GF ( 2 n � 1 ) g = H ~ is also called polynomial hashing . Theorem (Wegman-Carter, 1979) H ~ is a m 2 n -almost universal family of hash func�ons. Theorem (Wegman-Carter, 1981) The set H � is a 2 n � 1 -almost strongly universal family of hash func�ons. 11 / 29

Context Classical Channel Overall Security . . . . . . . . . . . . . . . . . . . . . Towards a Concrete Construc�on (2) Theorem (S�nson, 1994) Suppose H 1 is an " 1 -almost universal family of hash func�ons mapping X to Y and suppose that H 2 is an " 2 -almost strongly universal family of hash func�ons mapping Y to Z . Then the composi�on H 2 � H 1 is an ( " 1 + " 2 ) -almost strongly universal family of hash func�ons mapping X to Z . Corollary Combining the H ~ and H � families result in a m + 2 2 n -almost strongly universal family of hash func�ons where ` = n ( m + 1 ) is the length in bits of the input message. 12 / 29

Context Classical Channel Overall Security . . . . . . . . . . . . . . . . . . . . . Towards a Concrete Construc�on (3) Finite field of size 2 128 Given a message m 128-bit block, one needs m + 1 mul�plica�ons and m + 1 addi�ons in the field 3 n � 1 secret key bits are consumed for each block 13 / 29

Context Classical Channel Overall Security . . . . . . . . . . . . . . . . . . . . . Implemen�ng Key Reuse One can decrease the key bits consump�on using the following trick (proposed by Wegman and Carter): Instead of genera�ng a new strongly-universal hash func�on for each message, generate a single-one and keep it secret. Then, encrypt every authen�ca�on tag using a one-�me pad For authen�ca�ng t messages n bits each, you need 3 n � 1 + t ( n � 1 ) bits instead of t ( 3 n � 1 ) . Recently shown by Portmann (2012) to be " -UC-secure , i.e., the overall authen�ca�on error probability will be upper-bounded by t " for t messages. 14 / 29

Context Classical Channel Overall Security . . . . . . . . . . . . . . . . . . . . . Implemen�ng Key Reuse Concretely, as we need about t = 7 : : : 10 opera�ons of authen�ca�ons on blocks of 2 20 bits for dis�lling 10 5 bits, we get an upper bound on the a�ack probability in the order of t � 2 � 114 for the authen�ca�on part. About 2 : 4 % of the dis�lled key bits will be dedicated to authen�ca�on. 15 / 29

Context Classical Channel Overall Security . . . . . . . . . . . . . . . . . . . . . Error Correc�on Engine Error correc�on is comprised of forward error correc�on followed by a (randomised) integrity verifica�on. Implemented through the quasi-cyclic LDPC code defined in IEEE 802.11n. Syndrome encoding with a block code length of 1944 bits The code rate can be set to 1 = 2 , 2 = 3 , 3 = 4 or 4 = 5 depending on the QBER. 16 / 29

Context Classical Channel Overall Security . . . . . . . . . . . . . . . . . . . . . Error Correc�on Engine An integrity check (UHF with collision probability upper bound of 2 � 32 ) is required since the error detec�on capability of the FEC decoding is insufficient to guarantee that all errors will be corrected. The integrity check is performed prior the privacy amplifica�on (PA) to avoid revealing informa�on to Eve without being able to account it with the PA process. 17 / 29

Context Classical Channel Overall Security . . . . . . . . . . . . . . . . . . . . . Privacy Amplifica�on The privacy amplifica�on (PA) mechanism is responsible to decrease the informa�on of Eve about the corrected key. The PA mechanism uses a fixed compression ra�o of 10-to-1. It processes input blocks of 10 6 bits and outputs block of 10 5 bits. It relies on a universal hash func�on. 18 / 29

t 1 t 0 t 0 t 2 t 1 t 0 Context Classical Channel Overall Security . . . . . . . . . . . . . . . . . . . . . Toeplitz Hashing Origin: a construc�on by Wegman and Carter Let M be an n � m matrix over GF ( 2 ) . Then, the mapping y = M x is universal. However, it would require to transmit m = 10 11 random bits. Mansour et al. (1993) and Krawczyk (1994) showed that restric�ng the matrix to Toeplitz matrices keeps universality, but requires only n + m � 1 random bits. 0 : : : 1 t n � 2 t n � 1 : : : B t � 1 t n � 3 t n � 2 C B C : : : B C t � 2 t � 1 t n � 4 t n � 3 B . . . . . . C T = ; . . . . . . B C . . . . . . B C B C B : : : C t � m + 2 t � m + 3 t � m + 4 t n � m � 2 t n � m � 1 @ A : : : t � m + 1 t � m + 2 t � m + 3 t n � m � 1 t n � m 19 / 29

Context Classical Channel Overall Security . . . . . . . . . . . . . . . . . . . . . LFSR Hashing Even be�er: Krawczyk (1994) proposed a construc�on that requires only 2 m bits relying on genera�ng the pseudo-random bits using an random LFSR. But... This construc�on is only almost -universal, which is not sufficient for PA Genera�ng quickly random irreducible polynomials of degree 10 5 is ... challenging, to say the least! 20 / 29