But then I thought about it for a while longer, and I came up with this: Maybe the advantage is that the private key never actually can be read by anyone, not even the two communicating parties, thus basically eradicating the possibility of spies or betrayal within your engineering ranks.
If you can guarantee the physical integrity of the line for the entire 600km, you're also basically set. The only actual attack on QKD is setting up those MITM's, maybe even only during the initial set up? I don't know how often the entanglement has to be reset, are they permanently entangled or is there a reestablishing every so often?
You're going to be using classical crypto for bulk no matter what, so, no, you don't get that advantage, and anyways, what does anyone care what a session key is when they can get the session plaintext? Worried about decryption of ciphertext the attacker did not earlier get the plaintext to? Just re-key often.
> If you can guarantee the physical integrity of the line for the entire 600km, you're also basically set.
You must be joking.
With classical crypto I just don't have to care if the physical link is secure (except for DoS concerns -- please don't backhoe-cut my links!). For bulk symmetric crypto PQ is not even that much of a concern. And if we ever get to a PQ world, the lack of quantum authentication technology means that QKD will not be a solution to our PQ problems.
No matter how hard anyone tries to find QKD to be better than classical crypto, it just isn't.
You're right, there's no fundamental advantage there it seems. It could still just be a convenient way of rekeying very often (assuming it can "conveniently" be verified to be free of mitm)
> You must be joking.
Only half, for my day job I work with UAV operations, and inspecting 600km of lines daily would be peanuts for something with military scale funding.
> No matter how hard anyone tries to find QKD to be better than classical crypto
Well I hope you don't think I was doing that, I'm just trying to figure out a use for it.
No. ECDH is just fine. PQ crypto is also just fine.
And no, QKD cannot be "conveniently" verified to be free of MITMs -- this is more important than whether QKD can be a "convenient way of rekeying very often" (which it isn't anyways).
> Only half, for my day job I work with UAV operations, and inspecting 600km of lines daily would be peanuts for something with military scale funding.
A UAV cannot police 600km of fiber optics 24/7. 10 UAVs cannot either. The cost of this is nuts compared to the cost of using classical crypto -- and for what benefit?! There is no benefit to QKD, not any benefit at all.
> Well I hope you don't think I was doing that, I'm just trying to figure out a use for it.
It may be useful to train quantum physicists. Hmm, that may be its only use -- I can't think of any others.
Of course, this depends on your equipment not leaking extra photons or having other sidechannels... which seems harder than ordinary asymmetric crypto.
But you would combine QKD with asymmetric crypto so that both would have to be broken to lose your link security.
I don't think it's that generally interesting, but if you already have dedicated private fiber between your super secret secure facilities, -- why not?
QKD only works for point-to-point links.
If PQ happens and we have no PQ classical asymmetric algorithms, QKD cannot save us. We do not have time to rebuild the Internet around hop-by-hop security in a world of QKD, and anyways, QKD can be trivially MITMed, so this just doesn't work.
Fortunately we do have some PQ classical algs. Fortunately we're not in a PQ world yet. If we end up being unfortunate (PQ happens before we deploy PQ classical algs) then QKD cannot help us.
> I don't think it's that generally interesting, but if you already have dedicated private fiber between your super secret secure facilities, -- why not?
Because I might as well use classical symmetric keying and not worry about PQ.
In that case the attacker could potentially compromise your security with an analysis breakthrough on the symmetric cipher, and a passive (e.g. bend the fiber a bit and see the light that comes out the side) attack.
The QCD requires an active attack, you have to actually insert active equipment into the line, not just peel off some stray photons.
So assume you're already using multiple layers of independently keyed state of the art cryptography, and still have money left over in your link security budget...
How much is it worth to you to make it so that attackers have to insert equipment vs just siphon off a bit of extra light with a tiny bend in the fiber (assuming they have space alien grade mathematical breakthroughs)?
It's probably worth more than nothing.
Now, I would agree that any who is promoting this stuff with claims greater than "probably worth slightly more than nothing" is misleading people.
And as an area of pure research it gives us a lot of room to learn about practical realizations of quantum-sensitive systems, optics, photonics, electronics, etc. There is plenty of research with no known practical application at all. Having a really minor application isn't a great sin.
> With QKD you only have to trust that the person you want to talk to is on the other side of the quantum link you've established, ...
Re-read that please. How is that different?
How do you know that there isn't a QKD MITM in your wire? It would be trivial to set one up. QKD is trivially vulnerable to MITM attacks because there's no quantum authentication system. All it costs is a pair of QKD devices, and physical access -- anywhere in the 600km will do.
But with classical crypto we get to arrange authentication that works. You don't have to trust a third party, just the employees doing the set up.
Anyone who tells you QKD is better than classical crypto is straight up lying to you.