You're right, there's no fundamental advantage there it seems. It could still just be a convenient way of rekeying very often (assuming it can "conveniently" be verified to be free of mitm)
> You must be joking.
Only half, for my day job I work with UAV operations, and inspecting 600km of lines daily would be peanuts for something with military scale funding.
> No matter how hard anyone tries to find QKD to be better than classical crypto
Well I hope you don't think I was doing that, I'm just trying to figure out a use for it.
No. ECDH is just fine. PQ crypto is also just fine.
And no, QKD cannot be "conveniently" verified to be free of MITMs -- this is more important than whether QKD can be a "convenient way of rekeying very often" (which it isn't anyways).
> Only half, for my day job I work with UAV operations, and inspecting 600km of lines daily would be peanuts for something with military scale funding.
A UAV cannot police 600km of fiber optics 24/7. 10 UAVs cannot either. The cost of this is nuts compared to the cost of using classical crypto -- and for what benefit?! There is no benefit to QKD, not any benefit at all.
> Well I hope you don't think I was doing that, I'm just trying to figure out a use for it.
It may be useful to train quantum physicists. Hmm, that may be its only use -- I can't think of any others.
Of course, this depends on your equipment not leaking extra photons or having other sidechannels... which seems harder than ordinary asymmetric crypto.
But you would combine QKD with asymmetric crypto so that both would have to be broken to lose your link security.
I don't think it's that generally interesting, but if you already have dedicated private fiber between your super secret secure facilities, -- why not?
QKD only works for point-to-point links.
If PQ happens and we have no PQ classical asymmetric algorithms, QKD cannot save us. We do not have time to rebuild the Internet around hop-by-hop security in a world of QKD, and anyways, QKD can be trivially MITMed, so this just doesn't work.
Fortunately we do have some PQ classical algs. Fortunately we're not in a PQ world yet. If we end up being unfortunate (PQ happens before we deploy PQ classical algs) then QKD cannot help us.
> I don't think it's that generally interesting, but if you already have dedicated private fiber between your super secret secure facilities, -- why not?
Because I might as well use classical symmetric keying and not worry about PQ.
In that case the attacker could potentially compromise your security with an analysis breakthrough on the symmetric cipher, and a passive (e.g. bend the fiber a bit and see the light that comes out the side) attack.
The QCD requires an active attack, you have to actually insert active equipment into the line, not just peel off some stray photons.
So assume you're already using multiple layers of independently keyed state of the art cryptography, and still have money left over in your link security budget...
How much is it worth to you to make it so that attackers have to insert equipment vs just siphon off a bit of extra light with a tiny bend in the fiber (assuming they have space alien grade mathematical breakthroughs)?
It's probably worth more than nothing.
Now, I would agree that any who is promoting this stuff with claims greater than "probably worth slightly more than nothing" is misleading people.
And as an area of pure research it gives us a lot of room to learn about practical realizations of quantum-sensitive systems, optics, photonics, electronics, etc. There is plenty of research with no known practical application at all. Having a really minor application isn't a great sin.
You're going to be using classical crypto for bulk no matter what, so, no, you don't get that advantage, and anyways, what does anyone care what a session key is when they can get the session plaintext? Worried about decryption of ciphertext the attacker did not earlier get the plaintext to? Just re-key often.
> If you can guarantee the physical integrity of the line for the entire 600km, you're also basically set.
You must be joking.
With classical crypto I just don't have to care if the physical link is secure (except for DoS concerns -- please don't backhoe-cut my links!). For bulk symmetric crypto PQ is not even that much of a concern. And if we ever get to a PQ world, the lack of quantum authentication technology means that QKD will not be a solution to our PQ problems.
No matter how hard anyone tries to find QKD to be better than classical crypto, it just isn't.