Quantum cryptography - Light fantastic

"Secure cryptography is only as safe as its weakest link." - The Economist.

IT SOUNDS foolproof. One of the fundamental tenets of quantum mechanics is that measuring a physical system always disturbs it. If the system in question is a message in a series of digital bits encoded in the polarisation of light, this means that intercepting and reading the message can no longer be done surreptitiously. The receiver should be able to detect an eavesdropper and take appropriate countermeasures.

To the hacker mind, though, the word “foolproof” is but a challenge. And to prove the point, two groups of academic spies have now shown that whatever the theory says, practical attempts to hide messages this way can still be vulnerable.

To encrypt a message, the sender, known conventionally as Alice, scrambles it using a secret key before sending it to the receiver, Bob. Even if Eve, the eavesdropper, intercepts the message, she cannot make sense of it without the key. The problem, then, is how to pass that key from Alice to Bob without Eve getting hold of it as well.

Quantum key distribution does this by encoding the information in the polarisation states of individual photons, the particles of light, which are sent from Alice to Bob over an optical fibre. If Eve taps into the line and intercepts the key, she disturbs the photons when she measures their polarisation. By comparing a subset of the photons that Alice sends with what Bob measures, the pair can check for the presence of errors introduced by Eve. If errors are detected, Bob can throw away the key and ask for another.

In practice, quantum-key-distribution systems rely on sophisticated optical equipment to prepare, transmit and detect the individual polarised photons that make up the key. And when these real-world components meet the clever academic theorems that guarantee security, holes emerge.

In the first piece of research, a team from the Norwegian University of Science and Technology and the National University of Singapore, led by Vadim Makarov and Ilja Gerhardt, hacked into a system that connects several buildings on the National University of Singapore’s campus. Their eavesdropping apparatus (which is small enough to fit in a suitcase) was designed to take advantage of a weakness in a particular sort of photon detector in Bob’s receiving equipment. If hit with a bright enough flash of light, such detectors are blinded. And if, on top of the bright pulse, a smaller pulse of just the right type is sent, the detector can be forced to record a one or a zero.

In essence, Eve now has control of Bob’s detector. After intercepting the key, she can make it record just the right pattern of bits without any of the telltale errors her eavesdropping was supposed to introduce. Using this technique, Dr Makarov and his team were able to steal the entire key without leaving any trace of their activities.

The second hack was carried out by a team from the University of Toronto, led by Hoi-Kwong Lo. They stole information from a research version of a system made by ID Quantique, a Swiss firm that is trying to commercialise quantum cryptography, by taking advantage of synchronisation signals that pass between Alice and Bob.