Shaping the future of quantum cryptography in Europe

The value and the volume of confidential digital data is increasing in a virtually unbounded way, contributing to a cybersecurity market value of over € 100bn. A central element in today’s complex cybersecurity architecture is key generation and distribution. Approved asymmetric methods like RSA and ECDH will no longer be safe in a few years, when powerful enough quantum computers are available. A large-scale breaking of asymmetric cryptography would trigger a world-wide crisis, with experts predicting an event horizon as soon as 2030, the so-called Y2Q.

One way to mitigate this risk could be the use of post-quantum cryptography (PQC) algorithms, which are believed to be resistant to both classical and quantum computing attacks. NIST has chosen the algorithms that will dictate the emerging standards for PQC encryption and authentication, but finalization and implementation of these standards will still take years. Critics of PQC point to the fact that its principles are based on mathematics, which is both complex and not fully understood. Consequently, some fairly fundamental attacks can prove effective, as in the case of the round 4 NIST candidate SIKE.  This is worrying because the “attack seemingly came out of nowhere” (Jonathan Katz, University of Maryland at College Park).

Quantum Key Distribution (QKD) is a secure method of key generation and key distribution, based on the principles of quantum physics. A major advantage of QKD is its “waterproof” security concept. It is the only known encryption key distribution mechanism that makes no assumptions about the mathematical methods or computational power of the attacker.

As a user, QKD offers guaranteed forward secrecy and future-proof key distribution security.

Photons, electrons and other elementary particles are known to behave in some very strange ways. For instance, it is impossible to read information encoded in a photon without leaving a trace. It’s like catching a soap bubble in your hand – try it and it will burst!

This principle (observation causes perturbation) is exploited by QKD to provide key security. Single photons encoding key information are sent over a fibre or free-space channel (satellite) by the transmitter. After detecting the photons by the receiver the two parties carry out an error correction and privacy amplification process. If there were an attempt to intercept or eavesdrop on the transmission channel, both parties would have noticed when comparing non-sensitive information in this phase. In the absence of such a trace, they end up with a secret, identical key on both sides which can be used for encryption and authentication.

QKD is simply deployed as a parallel channel, next to the data channel between two end points. QKD then delivers keys to the encryptors on different layers, typically on L1, L2, or L3 (see the OSI layer model). To overcome distances larger than 100 km, the state of the art is to have intermediate relay stations for the QKD, called Trusted Nodes.

Today, QKD products are industrialized and have been well tested in real-world scenarios. Many countries are already testing and deploying QKD products to protect their Critical Infrastructure. China, Korea, the EU, and Singapore are just a few that have deployed, or have plans to use, QKD in production as a future-proof key distribution method. Private and public organisations are also advanced in constructing their private QKD networks.

What does a quantum network look like? One possible architecture is outlined in the ITU-T recommendations Y.3800. In practice, most QKD network architectures are based on individual point-to-point QKD links, each up to 100km long. A routing protocol is used to distribute keys to a pair of users sitting on an individual network node. Large-scale networks that span an entire country, or even a continent, will be able to use satellite-based, free-space QKD to distribute keys to remote users.