How quantum physics can make encryption stronger | Vikram SharmaHe starts with scare stories about data breaches, including saying that the cyberthreat is now affecting our democrat processes because some Democrat National Committee emails were stolen.
Tuesday, March 27, 2018, 7:58 AM
As quantum computing matures, it's going to bring unimaginable increases in computational power along with it -- and the systems we use to protect our data (and our democratic processes) will become even more vulnerable. But there's still time to plan against the impending data apocalypse, says encryption expert Vikram Sharma. Learn more about how he's fighting quantum with quantum: designing security devices and programs that use the power of quantum physics to defend against the most sophisticated attacks.
Except that we don't actually know that a cyberattack had anything to do with those emails. It was widely reported that 17 intelligence agencies looked at this, but in fact none did, as the DNC refused to let the FBI look at the servers, presumably because they contained incriminating data.
Many also believe that DNC insider Seth Rich leaked those emails to WikiLeaks.
It also appears that these leaks improved our democratic processes because they exposed primary favortism and fundraising collusion within the DNC.
And his companies products would not be any help. He brags about a product that generates "true random numbers" by hardware, not software. And he raves about the potential of quantum key distribution.
His products and plans are nearly worthless. Random numbers are not hard. The following method has been around for 25 years or so. Flip a coin 160 times. Apply SHA-1 repeatedly to this bit string followed by a counter, to generate all the random numbers you want.
Quantum key distribution doesn't really solve any problems, because you need to replace all your routers with quantum computers, and because you cannot authenticate anything, and because it is nearly impossible to make equipment that matches the theoretial models.
He also repeats this nonsense that physical assurances of security are somehow better than mathematical assurances. He and others in this field like to say that they are relying on the laws of physics to be truly uncrackable, instead of math-based cryptography that has shown to be fallible again and again.
I can't think of a single example of a business or orgranization that suffered some loss because of a break in math-based cryptography, when the system was following generally accepted best practices. That goes for DES, RSA, SHA, DSA, ECDSA, etc. Systems have been broken because of bugs and implementation flaws and even hardware failures, but not from breaking the math.
On the other hand, the quantum key distribution devices have all been broken.
QKD theory will make assumptions like the device emitting a single photon with a particular frequency and polarization, and a detector will measure that photon's polarization. This sort of precision is physically impossible. You can emit light that is probably 0, 1, or 2 photons in approximately the right color and orientation. But you need special info that might leak info in a hardware attack.
This entire desire to have quantum cryptography is a circular shit storm of dishonesty. I'm sorry, but there really is no way to put it politely.
ReplyDeleteFBI: "We have a right to spy on you...see, we made something up that you are now guilty of which gives us the right to ..."
CIA: "We have a right to spy on you because...national security...and we can even make it look like someone else spied on you, while planting whatever we want to incriminate you with on your computers...evidence is so quaint."
IRS: "We have a right to spy on every last thing you do because we OWN you, your very potential to earn anything at all belongs to US."
DOJ: "We have a right to prosecute you, after we have taken something made up about you...based on something the FBI spied on, to condemn you with. Due process is literally whatever we say it is...depending on your political party, on a given day, at any particular hour."
NSA: "Just because we spy on every last thing you do, does not mean we are actually spying on you, since we ourselves are the middlemen, it's just our business, nothing personal, and the constitution does not apply since we said so...see, no harm done..., oh yeah, you left the lights on downstairs you might want to turn them off, , you are almost out of toilet paper, the milk in your fridge is almost two days past it's expiration date, and the missing green sock you are presently searching for is under the bed on the left side next to the nightstand where you keep your watch...no, a little more to the right, there you go!"
FaceBook, Twitter, Google, Apple, Microsoft, Silicon Valley, and Academia (Chorus in unison) : "We promise to tell you we are keeping your private information private even while we are actually actively selling it to whomever we can, and reading every last thing you say and write in order to lecture you about hate crime and tell you what to think, but we have everything under control so no worries, so please trust us with your private information! We love you!"
US Government: "We demand that no matter what kind of cryptography you use, we must always have the ability to bypass it. By the way, we are also spending billions of dollars of your money to invent quantum encryption so that you little people can't spy on us, or find out how much we have been illegally spying on you."
(Everyone in unison): "We want quantum cryptography, it will make us all so much safer when we can spy on you but deny you the legal right to keep secrets from us!!"
This comment has been removed by the author.
DeleteWe could end this nonsense, if we revealed mathematics as just another useless liberal art: "If you know a set of basic parameters concerning the ball at rest, can compute the resistance of the table (quite elementary), and can gauge the strength of the impact, then it is rather easy to predict what would happen at the first hit. The second impact becomes more complicated, but possible; and more precision is called for. The problem is that to correctly compute the ninth impact, you need to take account the gravitational pull of someone standing next to the table (modestly, Berry’s computations use a weight of less than 150 pounds). And to compute the fifty-sixth impact, every single elementary particle in the universe needs to be present in your assumptions! An electron at the edge of the universe, separated from us by 10 billion light-years, must figure in the calculations, since it exerts a meaningful effect on the outcome." (The Black Swan p. 178) https://www.youtube.com/watch?v=mUOsHxPRosE
DeleteThere is certainly nothing wrong with cryptography but a million things wrong with software security outside of crypto algorithms. Many are quite tricky or common, like timing attacks or buffer overflows (outdated programming IDEs and techniques). There are multiple quantum safe encryption protocols that can be used by a classical computer anyway. 512-bit encryption is amazingly strong: "For example, a computer with the mass of the entire Earth operating at the Bremermann's limit could perform approximately 10^75 mathematical computations per second. If one assumes that a cryptographic key can be tested with only one operation, then a typical 128-bit key could be cracked in under 10^−36 seconds. However, a 256-bit key (which is already in use in some systems) would take about two minutes to crack. Using a 512-bit key would increase the cracking time to approaching 10^72 years, without increasing the time for encryption by more than a constant factor (depending on the encryption algorithms used)." https://en.wikipedia.org/wiki/Bremermann%27s_limit
ReplyDelete