Cool, what does this mean? Fasterer internet in 10 years or instant Jupiter-Earth internet next year?
this post was submitted on 07 Jun 2025
12 points (100.0% liked)
technology
23824 readers
2 users here now
On the road to fully automated luxury gay space communism.
Spreading Linux propaganda since 2020
- Ways to run Microsoft/Adobe and more on Linux
- The Ultimate FOSS Guide For Android
- Great libre software on Windows
- Hey you, the lib still using Chrome. Read this post!
Rules:
- 1. Obviously abide by the sitewide code of conduct. Bigotry will be met with an immediate ban
- 2. This community is about technology. Offtopic is permitted as long as it is kept in the comment sections
- 3. Although this is not /c/libre, FOSS related posting is tolerated, and even welcome in the case of effort posts
- 4. We believe technology should be liberating. As such, avoid promoting proprietary and/or bourgeois technology
- 5. Explanatory posts to correct the potential mistakes a comrade made in a post of their own are allowed, as long as they remain respectful
- 6. No crypto (Bitcoin, NFT, etc.) speculation, unless it is purely informative and not too cringe
- 7. Absolutely no tech bro shit. If you have a good opinion of Silicon Valley billionaires please manifest yourself so we can ban you.
founded 4 years ago
MODERATORS
Definitely not the latter and probably neither (i mean, yeah, the internet will be faster in ten years but not necessarily because of this). What this means is more secure encrypted communications which is not just about national security or privacy, it has economic implications because of how electronic financial transfers are conducted.
Neither, this is using quantum effects for ensuring private communication. The technique allows ensuring there is no man in the middle attack.
Both QKD and QSDC are vulnerable to man-in-the-middle attacks. It doesn't allow eavesdroppers, but that is not the same thing. An eavesdropper simply sniffs the packets of information transmitting between two nodes. A man-in-the-middle attack sets up two nodes in a network, let's call them X and Y, and then if A and B want to communicate, then they have X pretend to be B and Y pretend to be A, so A and B talk to X and Y and think they are talking to A and B.
You then perform either QKD or QSDC twice between nodes X and A and Y and B, which are both valid implementations of the protocol as B would expect the data to become readable at Y because they falsely think Y is A, and A would expect the data to become readable at X because they falsely think X is B. This, however, allows for the data to pass through in a completely readable form between nodes X and Y, which the man-in-the-middle could then read it at those points.
It is sort of like if I took your computer and then pretended to be you. It doesn't matter how good the encryption algorithm is, if everyone thinks I am you, they will send me information meant for you in a way that they intend for it to be readable when I receive it. A man-in-the-middle attack doesn't really exploit a flaw in the algorithm itself, but a flaw in who the algorithm is intended for / directed at. Even classical algorithms have the same problem, you can defeat Diffie-Hellman with a man-in-the-middle attack as well.
You can only solve it through public key infrastructure. My biggest issue with the "quantum internet" is that I've seen very little in the way of scalable quantum PKI. The only algorithm I've seen is fundamentally not scalable because the public keys are all consumable. If the intention really is to replace the whole internet, that's kind of a big requirement. But if the intention is just small-scale secure communication like for internal government stuff, that's not as big of an issue.
My understanding was that you exchange the key out of band, and you know what key you're expecting. So, if you had a man in the middle, and the encryption was tampered with then it would modify the quantum state of the key.
The specific article mentions QSDC which doesn't actually exchange a key at all, QKD does exchange a key, but both operate on similar concepts. To measure something requires physically interacting with it, an interaction has to be specified by an operator in QM, and the rules of constructing physically valid operators don't allow you to construct one that is non-perturbing, so you inevitably perturb the qubits in transit if you measure them in a way that can later be detected.
But, again, we are talking about "in transit," that is to say, between nodes. If you and I are doing QKD, and are node A and B, we would exchange the qubits over a wire between A and B, and anyone who sniffs the packets in transit would perturb them in a detectable way. But if someone snipped the wire and setup an X and Y node in the middle, they could make X pretend to be you and Y pretend to be me, and so I would exchange a key with X and you would exchange a key with Y, and so the key exchange occurred over nodes A-X and B-Y and not over A-B.
The middle-man would then have two keys, they would decrypt the messages sent from A-X with one and re-encrypt them using the second key to transmit from B-Y, and vice-versa. Messages sent from A to be B would still arrive at B and messages sent from B to A would still arrive at A, but A wouldn't know the key they established was with X and not B, and B wouldn't know the key they established was with Y and not A. From their perspectives it would appear as if everything is working normally.
You have to have some sort of authentication of the nodes in any security infrastructure. That's what public key infrastructure is for. Man-in-the-middle attack is basically a form of impersonation, and you can't fight impersonation with encryption or key distribution algorithms. It's just a totally different kind of problem. You authenticate people's identities with signatures. Similarly, on the internet, you authenticate nodes on a network with digital signatures. Anyone can make up a random signature on the spot, so you have to compare a provided signature to one provided by a trusted database of signatures called certificate authorities. That's what public key infrastructure is, and it's one of the major backbones of the internet.
I guess I was thinking of something else here. The method I was thinking of is where the encryption key is sent as a stream of quantum particles, like photons. If anybody tries to observe the key during transmission, the act of observing it changes the particles. The sender and receiver can compare parts of the key to see if it was altered. Once a secure key is established, you send data encrypted with the key using any regular channel. This method makes the key distribution unhackable because any attempt to intercept the key fundamentally alters it, alerting the sender and receiver.
You are just straight-up not reading my posts.
Ok sorry, I did misread you. You're talking about both parties exchanging the key with the attacker thinking the attacker is the other party. So yeah, you're right that you'd need some public key system for ensuring the identity of the node you're talking to.