Source-linked AI summary
Experimental Authentication of Quantum Key Distribution with Post-quantum Cryptography
Wang Liu-Jun, Zhang Kai-Yi, Wang Jia-Yong, Cheng Jie, Yang Yong-Hua, Tang Shi-Biao, Yan Di, Tang Yan-Lin, Liu Zhen, Yu Yu, Zhang Qiang, Pan Jian-Wei
TL;DR
QKD needs authentication on its classical channel, but pre-shared symmetric keys make pairwise network connections burdensome. This paper tests Aigis-Sig with PKI for QKD authentication and reports experimental feasibility, stable operation, and simpler access for new users, under a short-term PQC security assumption.
Problem
QKD requires its classical channel to be authenticated, while pairwise pre-shared symmetric keys become burdensome as the network grows.
Source: pp. 1–2Method
The authors combine PKI certificates with Aigis-Sig signatures, nonce-bound message digests, and two-way authentication for QKD.
Source: Methods · p. 5Results
Experiments verified PQC authentication in QKD links and networks; key rates matched pre-shared-key authentication within statistical error, and new users could connect after obtaining certificates.
Source: pp. 2, 4Takeaways & Limitations
Each user can use one PKI certificate for authentication, and new users need not distribute symmetric keys with all existing users.
Source: pp. 3–4The security claim assumes PQC remains secure during authentication; Aigis-Sig security relies on the conjectured quantum resistance of its underlying lattice problems.
Source: p. 2, Methods · p. 5
Abstract
from arXiv · showhide
Quantum key distribution (QKD) can provide information theoretically secure key exchange even in the era of quantum computer. However, QKD requires the classical channel to be authenticated, and the current method is pre-sharing symmetric keys. For a QKD network of $n$ users, this method requires $C_n^2 = n(n-1)/2$ pairs of symmetric keys to realize pairwise interconnection. In contrast, with the help of mature public key infrastructure (PKI) and post-quantum cryptography (PQC) with quantum resistant security, each user only needs to apply for a digital certificate from certificate authority (CA) to achieve efficient and secure authentication for QKD. We only need to assume the short-term security of the PQC algorithm to achieve the long-term security of the distributed keys. Here, we experimentally verified the feasibility, efficiency and stability of the PQC algorithm in QKD authentication, and demonstrated the advantages when new users join the QKD network. Using PQC authentication we only need to believe the CA is safe, rather than all trusted relays. QKD combined with PQC authentication will greatly promote and extend the application prospects of quantum safe communication.
Methods
The implementation combines BB84 decoy-state QKD with Aigis-Sig signatures and PKI for two-way authentication. It uses certificate verification, nonce-bound message digests, and message signatures verified with the peer’s confirmed public key.
Methods
- BB84 with decoy states and polarization encoding ran at 625 MHz, with finite-key effects included in data processing.The system used 256-bit SM3 message digests for authentication.Source: Methods · pp. 4–5
- Figure 3 shows a four-user all-pass QKD network, ring and cross networks, and a 10-node metropolitan QKD network of two relay networks; replacing trusted relays with optical switches forms an all-pass network with new users U11 and U12.The distance between any two users is the sum of their respective distances from the optical switch.Source: Figure 3 · p. 5
- Aigis-Sig is a lattice-based signature scheme based on variants of LWE and SIS problems.Its post-quantum security relies on the conjectured quantum resistance of the underlying lattice problems.Source: Methods · p. 5
- Aigis-Sig authentication first verifies exchanged CA-issued certificates, then signs message digests with private keys and verifies signatures using confirmed peer public keys.The protocol implements two-way authentication.Source: Methods · p. 5
- Random nonces are exchanged before signing and concatenated with message digests to prevent replay attacks.The nonce is generated by Intel chips.Source: Methods · p. 5
- Signature generation and verification took less than 1 ms on the reported Windows 10, Intel i7-9750H, 8 GB RAM setup.The signature size was 2445 bytes.Source: Methods · p. 5
Supplementary information
The supplementary experiments report successful PQC-authenticated QKD in a relay network and continuous operation over 30 hours at 40 km. The reported key-rate fluctuations track polarization feedback, while daytime feedback was more frequent than nighttime feedback.
Supplementary information
- The relay-network experiment successfully established QKD between the relay and three users, with key rates and QBERs averaged over five minutes and reported in Table IV.The relay hosts a QKD receiver and the users host transmitters; the fiber lengths represent typical metropolitan distances.Source: Supplementary information · pp. 6–7, Table IV · p. 7, Figure 4 · p. 7
- 144.1 kbps was the 30-hour average secure key rate over 40 km, with rates ranging from 100 to 180 kbps during continuous PQC operation.The experiment reported that the PQC program ran normally while the QKD systems continuously generated keys.Source: Supplementary information · p. 7, Figure 5 · p. 8
- The 30-minute average QBER was 0.876%, with readings between 0.65% and 1.1%.The QBER was recorded once per second.Source: Supplementary information · p. 7, Figure 6 · p. 8
- Key-rate dips followed polarization feedback triggered when QBER reached 3% or continuous operation reached 30 minutes; feedback was more frequent during daytime.The authors attribute the daytime pattern to greater interference from human activity and temperature fluctuations.Source: Supplementary information · p. 7, Figure 5 · p. 8