[14266] in cryptography@c2.net mail archive
Re: quantum hype
daemon@ATHENA.MIT.EDU (Greg Troxel)
Wed Sep 24 11:59:36 2003
X-Original-To: cryptography@metzdowd.com
X-Original-To: cryptography@metzdowd.com
To: Matt Crawford <crawdad@fnal.gov>
Cc: cryptography@metzdowd.com
From: Greg Troxel <gdt@ir.bbn.com>
Date: 24 Sep 2003 08:54:24 -0400
In-Reply-To: <504E78B6-EABB-11D7-A716-000A95A0BF96@fnal.gov>
I'm always stuck on that little step where Alice tells Bob what basis
she used for each photon sent. Tells him how? They need integrity
protection and endpoint authentication for N bits of basis. Is the
quantum trick converting those N bits to N/2 privacy-protected bits
really as exciting as it's made out to be?
They need integrity and data origin authentication, but not
confidentiality. This is what is referred to as the "public channel"
in QC papers. The standard approach (in papers) is to use universal
hashing. This is just math, with no quantum aspects. But, it enables
authenticating an arbitrarily long string of bits with a single key,
just like one can MAC a long message with HMAC-SHA1.
The difference is that because of the hash construction there are two
key property changes from an HMAC such as used in IPsec:
One can prove that the odds of a forgery are vanishingly small (1 in
$2^{n-1}$ for n bit keys, or something like that), even with an
adversary with infinite computional power.
You can only use the key once (or perhaps twice). Otherwise, an
adversary can recover it. This results in needing a constant stream
of authentication keying material.
Whether these two properties are a good tradeoff from HMAC in practice
for any particular situation and threat model is an interesting
question.
See "Universal Classes of Hash Functions", by Carter and Wegman,
Journal of Computer and System Sciences 18, 143-154 (1979) for the
canonical paper on universal hashing.
--
Greg Troxel <gdt@ir.bbn.com>
---------------------------------------------------------------------
The Cryptography Mailing List
Unsubscribe by sending "unsubscribe cryptography" to majordomo@metzdowd.com
