Source-linked AI summary
Memory Attacks on Device-Independent Quantum Cryptography
Jonathan Barrett, Roger Colbeck, Adrian Kent
TL;DR
Whether device-reusing device-independent protocols remain composable has been neglected, despite the practical interest in reusing devices. The paper describes attacks in which devices use later outputs to leak earlier secrets, and reports that repeated implementations can make an earlier key insecure.
Problem
Whether device-reusing device-independent protocols remain composable—whether individually secure protocols remain secure when combined—has been generally neglected.
Source: p. 1Method
Results
Takeaways & Limitations
The attacks point to new protocol designs, while the discussed countermeasures appear effective only in the restricted setting where two users use their devices for QKD exchanges with one another.
Source: §7 · p. 5
Abstract
from arXiv · showhide
Device-independent quantum cryptographic schemes aim to guarantee security to users based only on the output statistics of any components used, and without the need to verify their internal functionality. Since this would protect users against untrustworthy or incompetent manufacturers, sabotage or device degradation, this idea has excited much interest, and many device-independent schemes have been proposed. Here we identify a critical weakness of device-independent protocols that rely on public communication between secure laboratories. Untrusted devices may record their inputs and outputs and reveal information about them via publicly discussed outputs during later runs. Reusing devices thus compromises the security of a protocol and risks leaking secret data. Possible defences include securely destroying or isolating used devices. However, these are costly and often impractical. We propose other more practical partial defences as well as a new protocol structure for device-independent quantum key distribution that aims to achieve composable security in the case of two parties using a small number of devices to repeatedly share keys with each another (and no other party).
Appendix A: Separation of sources and measurement devices
The protocol requires Bob’s state-generating device to be isolated from his measurement device. Combining those roles in one device would let it encode earlier raw-key information in later transmissions.
Appendix A: Separation of sources and measurement devices
- Bob’s state-generation device must remain separate from his measurement device.The passage identifies this separation as crucial to the generic protocol.Source: Appendix A · pp. 6–7
- A combined source-and-measurement device could hide day 1 raw-key information in states sent on day 2.The information could also be encoded in signal timing or unused quantum degrees of freedom.Source: Appendix A · p. 7
- Such transmissions could mask the encoded data as noise or use signal features outside the protocol.The passage gives protocol-compliant states, timing, and unused quantum degrees of freedom as possible channels.Source: Appendix A · p. 7
Appendix B: Toxic device disposal
Device isolation depends on indefinitely protected screened space, while secure destruction raises its own security concerns. The resource costs of isolation, destruction, and replacement cast doubt on their practicality.
Appendix B: Toxic device disposal
- Permanent isolation requires a screened sub-laboratory protected indefinitely, consuming secure space and screening material.Devices can be reused after the secrets they know become public by other means.Source: Appendix B · p. 7
- Secure destruction can pose a disposal risk if a device changes its chemical composition according to its output bit.Source: Appendix B · p. 7
- Costs and problems of isolation, destruction, and device renewal raise doubts about these options’ viability for practical device-independent cryptography.Source: Appendix B · p. 7
Appendix C: Privacy Amplification
Privacy amplification compresses a shared string to reduce an eavesdropper’s knowledge, with the required compression tied to smooth conditional min-entropy. The protocol describes how the parties generate and process per-device strings before producing a shorter shared string.
Appendix C: Privacy Amplification
- Privacy amplification compresses a shared string so that an eavesdropper’s knowledge is reduced to nearly zero.Alice’s private randomness selects a function applied to the string.Source: Appendix C · p. 7
- Two-universal hashing uses a seed roughly as long as the final string, while Trevisan’s extractor needs roughly the logarithm of the initial string’s length.The latter may allow the seed to be sent privately.Source: Appendix C · p. 7
- The compression amount is quantified by smooth conditional min-entropy, defined using nearby states.The smooth form is given in terms of nonsmooth conditional min-entropy, with the maximization over states close to the original state.Source: Appendix C · p. 7
- Alice and Bob isolate the devices, generate outputs over M rounds, test selected pairs, and use public error correction before processing strings from each device.The protocol also includes state generation over an insecure quantum channel and sifting of some output pairs.Source: Appendix C · p. 8
- The table’s protocol uses m ≥2 isolated measurement devices for each party and a separate device for Bob to create states.Source: Table 2 · p. 8
- Alice selects the hash output length based on the parameter-estimation test, then announces a randomly chosen hash function for Bob to apply to his error-corrected string.The intended outcome is a final state close to one in which Eve has no knowledge of the final string.Source: Appendix C · p. 8
- To tolerate one error-corrected string being revealed through an abort attack, Alice chooses the final length roughly (m − 1)/m shorter than otherwise.This rule assumes each of the m device pairs contributes roughly equally to the concatenated string’s smooth min-entropy.Source: Appendix C · p. 8, Table 2 · p. 8
Appendix D: Memory attacks on multi-device QKD protocols
The appendix extends the discussion of memory attacks to protocols using multiple devices. It sets out to break iterated versions of two well-known protocols.
Appendix D: Memory attacks on multi-device QKD protocols
- The section turns to multi-device protocols to demonstrate the generality of the attacks.Source: Appendix D · p. 8
- Its stated focus is breaking iterated versions of two well-known protocols.Source: Appendix D · p. 8
- The passage frames these examples as attacks on multi-device protocols.Source: Appendix D · p. 8
Attacks on compositions of the BHK protocol
The section shows how reused BHK devices can reveal a previously secret bit through later public outputs, and describes related attacks and device-depletion costs for the HR protocol. It presents limited BHK defences but notes that reuse remains insecure.
Attacks on compositions of the BHK protocol
- BHK yields one secret bit per run and requires essentially noise-free channels and error-free measurements, despite illustrating the attack clearly.Its setup uses many device pairs, with all but one selected output pair publicly compared.Source: Attacks on compositions of the BHK… · p. 8
- A later public output can reveal BHK’s first secret bit, while the described cheating can escape Alice and Bob’s tests.Eve’s device stores its first-run inputs and outputs, then reproduces the secret-bit output after a hidden signal identifies it.Source: Attacks on compositions of the BHK… · p. 9
- Sharing fewer BHK outputs publicly delays leakage and raises detection risk, but does not make the iterated protocol secure.Destroying or isolating devices that produced the secret bit prevents its later leakage, but illustrates BHK’s inefficiency and motivates a more efficient protocol.Source: Attacks on compositions of the BHK… · p. 9
Attacks on compositions of the HR protocol
- In the HR protocol, reused devices can gradually release day-one raw-key outputs in later runs, allowing Eve to recover the secret key after public reconciliation and privacy-amplification functions.The attack can be programmed to proceed gradually even when Eve cannot communicate directly with the devices for a long time.Source: Attacks on compositions of the HR… · p. 9
- Destroying or isolating HR devices that generate raw key consumes one-sixth of the devices per run, leaving shorter keys and bounding total key generation at approximately six times the first-run key length.The stated bound follows from repeated device depletion, with noise fluctuations potentially worsening it.Source: Attacks on compositions of the HR… · p. 9
- The HR example makes the attack a generic problem for the device-independent QKD protocols considered, despite its faster secret-key rate requiring equally fast device depletion.The authors characterize devices generating secret key as toxic and not reusable.Source: Attacks on compositions of the HR… · p. 9
Appendix E: Device-independent randomness expansion protocols: attacks and defences
The appendix examines memory attacks on device-independent randomness expansion, where devices supplied by Eve are tested using seed randomness. Reuse can leak first-round outputs through later output lengths, while proposed protections impose strict operating conditions or additional costs.
Appendix E: Device-independent randomness expansion protocols: attacks and defences
- Device-independent randomness expansion uses seed randomness for nonlocality tests, then privacy amplification to produce a longer, essentially fully secret string if the tests pass.The devices and states may be supplied by Eve, and the tests occur within one or more secure laboratories.Source: Appendix E · pp. 9–10
- A single-run protocol can fail composable security if the final secret-string length depends on the initial seed, a dependence Eve may infer from how the string is used.The passage notes this vulnerability even when the protocol is performed in a single secure laboratory.Source: Appendix E · p. 10
- For device reuse, the appendix calls for devices to stay in one secure laboratory, with no public output communication and isolation from classical communication and computation.These conditions aim to prevent devices from learning reconciliation and privacy-amplification details.Source: Appendix E · p. 10
- When reused, devices can encode first-round raw outputs as artificial noise that changes later random-string lengths, letting Eve infer the earlier outputs from those lengths.This compromises the first-round output string except for information determined by the secret seed.Source: Appendix E · p. 10
- Fixing the generated random-string length at a value chosen for a maximum acceptable noise level is one proposed defence against length-based leakage.The proposal always reduces the generated string to that fixed length, regardless of measured noise.Source: Appendix E · p. 10
- Without a restriction on the number of uses, devices can communicate earlier raw outputs by choosing which round to abort.This abort attack applies to QKD protocols described in the main text.Source: Appendix E · p. 10
- A proposed abort-attack defence concatenates and privacy-amplifies raw sub-keys generated by several isolated devices, so exposing one sub-key does not significantly compromise the final key.The passage describes this defence as moderately costly and apparently effective, and says it appears equally effective for device-independent randomness expansion.Source: Appendix E · p. 10
- Reuse may pose no problem for short-lived randomness once that data has been revealed, as in some gambling applications.The example is bets placed about random data that later becomes public.Source: Appendix E · p. 10