“This was the first time that a commercial QKD system has been successfully hacked,” says Hoi-Kwong Lo.
Lo, a physics and electrical engineering professor at U of T, has successfully hacked into a real-world quantum key distribution (QKD) system, proving that such a system is not as secure as one may think.
“Quantum key distribution,” says Lo, “provides a secure means of distributing secret keys between two parties.” Before the birth of quantum cryptography, codes were much easier to crack. An encrypted message could be deciphered if one knew the key.
In the past, a key would have to be secretly exchanged between the two parties who wished to send each other encrypted messages. This was essential so that both would be aware of how to decipher the messages they would be sending each other. However, the key could be intercepted by an eavesdropper without either of the individuals knowing. The eavesdropper could then intercept the messages exchanged between the two individuals or parties, and decipher them effortlessly. Over time, more sophisticated methods of cryptography developed, but the development of quantum mechanics, and specifically a quantum algorithm, resulted in an extremely secure form of cryptography.
In 1994, Peter Shor at MIT’s AT&T Laboratories invented a quantum algorithm that could factor very large numbers that would take far too long for any human mathematician to factor. Thanks to this innovation, the number of encryption possibilities increased dramatically because a long and complex computational code could be decrypted quickly.
The quantum algorithm thus helped to precipitate a new kind of key exchange: Quantum Key Distribution (QKD). This distribution occurs over photons emitted from a laser. The key is encrypted in the photons which results in seemingly impermeable key distribution — meaning it would be very difficult for the eavesdropper to intercept the message without being detected.
This difficulty in intercepting the message occurs because of Heisenberg’s Uncertainty Principle. The principle, explains Lo, states that “it is fundamentally impossible to know the exact values of complementary variables, such as the particle’s momentum and its position.”
Since this is the case, it would seem fundamentally impossible for an eavesdropper to intercept the key that is encoded in the photons, without the eavesdropper being detected. In fact, a quantum cryptographic system appeared to be impenetrable because as soon as the photon stream becomes altered, the system’s detectors sense this change, shutting the system down automatically. Alternatively, the receiver (known as “Bob” to Quantum Information researchers) would be alerted of the key’s compromise and would be able to throw out this key and ask for another.
Lo’s hack into a commercial system in Geneva, Switzerland showed that there are, in fact, loopholes in the seemingly flawless QKD system. Lo’s research in quantum cryptography, which dates back many years, led him to develop assumptions about flaws in the system. He then set up an experiment that mimicked the commercial system. With this, he was able to prove his assumptions with the experiment and substantiate his claims with data.
Lo was able to hack into the system using a “time-shift” attack and an “intercept-and-resend” (or “phase-remapping”) attack.
In a QKD system, “Alice,” the sender, receives two strong laser pulses — a signal pulse and a reference pulse — from Bob, the receiver. According to Lo, she then “uses the reference pulse as a synchronization signal to activate her phase modulator.” This allows her to send the two pulses over one photon level and send them to Bob.
Signals are then sent between Alice and Bob. “Eve,” the eavesdropper, is able, in Lo’s findings, to find a weakness in the pulse by using a phase modulator on the reference pulse originally sent by Alice. Eve then modifies the pulse’s time variable and introduces a phase shift on the pulse. Finally Eve sends the pulse to Bob, as was originally intended by Alice. Essentially, the time variable and the displacement variable of the pulse can be modified by Eve so that neither Alice nor Bob nor the system detect that any change in the photons has occurred.
Lo proves this by showing that Bob receives an equal distribution of bits of information when he receives the pulse. This results in a quantum bit error rate of 19.7 per cent. A high quantum bit error rate, or QBER, means that the pulse and the encrypted bits were distorted enough to be detected, and cause it to shut down. Eve is detected when the QBER reaches 25 per cent, therefore Eve’s QBER should be less than that percent. Lo’s ability to hack into the system and achieve a QBER of 19.7 per cent is a great achievement.
Lo’s hope is that the company whose security system he proved to be defective will seriously consider his findings and implement changes immediately.
“Our goal is to find security loopholes and fix them quickly, and make these systems more secure.”
