cross-posted from: https://rss.ponder.cat/post/16876
I’m guessing for quantum cryptography. It would allow you to have perfect crypto (assuming the non quantum hardware isn’t hacked (a big if)).
You can have post-quantum cryptography using classical computation, though
(“Simply” pick a problem with no quantum acceleration. I think Elliptic Curves Cryptography works, but I’m not an expert)
Quantum crypto is different than cracking encryption with a quantum computer. The point of quantum crypto is that the key exchange is perfectly secret. If it is observed, the people exchanging keys will know due to entanglement bs that I’m too dumb to understand.
But you basically get the perfect uncrackable encryption of one time pads without having to manage one time pads.
Oh yeah, that. My bad, mixed 'em up.
The original algorithm doesn’t use entanglement, though! Just the fact that measurements can change the state. You can pick an axis to measure a quantum state in. If you pick two axes that are diagonal to each other, measuring a state in the “wrong” axis can give a random result (the first time), whereas the “right” one always gives the original data.
So the trick is to have the sender encode their bits into a randomly-picked axis per bit (the quantum states), send the states over, and then the receiver decodes them along a random axis as well. On average, half the axes will match up and those bits will correspond. The other bits are junk (random). They then tell each other the random axes they picked, which identifies the right bits!
They can compare a certain amount of their “correct” bits: if there’s an eavesdropper, they must have measured in the wrong state half the time (on average). Measurement changes the state into its own axis, so the receiver gets a random bit instead of the right one half the time. 25% of the time, the bits mismatch, when they should always correspond.
The problem with the one-time pads is that they’re also the most inefficient cipher. If we switched to them for internet communication (ceteris paribus), it would basically cut internet bandwidth in half overnight. Even moreso, it’s a symmetric cipher, and symmetric ciphers cannot be broken by quantum computers. Ciphers like AES256 are considered still quantum-computer-proof. This means that you would be cutting the internet bandwidth in half for purely theoretical benefits that people wouldn’t notice in practice. The only people I could imagine finding this interesting are overly paranoid governments as there are no practical benefits.
It also really isn’t a selling point for quantum key distribution that it can reliably detect an eavesdropper. Modern cryptography does not care about detecting eavesdroppers. When two people are exchanging keys with a Diffie-Hellman key exchange, eavesdroppers are allowed to eavesdrop all they wish, but they cannot make sense of the data in transit. The problem with quantum key distribution is that it is worse than this, it cannot prevent an eavesdropper from seeing the transmitted key, it just discards it if they do. This to me seems like it would make it a bit harder to scale, although not impossible, because anyone can deny service just by observing the packets of data in transit.
Although, the bigger issue that nobody seems to talk about is that quantum key distribution, just like the Diffie-Hellman algorithm, is susceptible to a man-in-the-middle attack. Yes, it prevents an eavesdropper between two nodes, but if the eavesdropper sets themselves up as a third node pretending to be different nodes when queried from either end, they could trivially defeat quantum key distribution. Although, Diffie-Hellman is also susceptible to this, so that is not surprising.
What is surprising is that with Diffie-Hellman (or more commonly its elliptic curve brethren), we solve this using digital signatures which are part of public key infrastructure. With quantum mechanics, however, the only equivalent to digital signatures relies on the No-cloning Theorem. The No-cloning Theorem says if I gave you a qubit and you don’t know it is prepared, nothing you can do to it can tell you its quantum state, which requires knowledge of how it was prepared. You can use the fact only a single person can be aware of its quantum state as a form of a digital signature.
The thing is, however, the No-cloning Theorem only holds true for a single qubit. If I prepared a million qubits all the same way and handed them to you, you could derive its quantum state by doing different measurements on each qubit. Even though you could use this for digital signatures, those digital signatures would have to be disposable. If you made too many copies of them, they could be reverse-engineered. This presents a problem for using them as part of public key infrastructure as public key infrastructure requires those keys to be, well, public, meaning anyone can take a copy, and so infinite copy-ability is a requirement.
This makes quantum key distribution only reliable if you combine it with quantum digital signatures, but when you do that, it no longer becomes possible to scale it to some sort of “quantum internet.” It, again, might be something useful an overly paranoid government could use internally as part of their own small-scale intranet, but it would just be too impractical without any noticeable benefits for anyone outside of that. As, again, all this is for purely theoretical benefits, not anything you’d notice in the real world, as things like AES256 are already considered uncrackable in practice.
You can break elliptic curve cryptography with quantum computers. Post-quantum cryptography is instead based on something called the lattice problem, sometimes called lattice-based cryptography.
