Move Over, Quantum Cryptography: Classical Physics Can Be Unbreakable Too 126
MrSeb writes "Researchers from Texas A&M University claim to have pioneered unbreakable cryptography based on the laws of thermodynamics; classical physics, rather than quantum. In theory, quantum crypto (based on the laws of quantum mechanics) can guarantee the complete secrecy of transmitted messages: To spy upon a quantum-encrypted message would irrevocably change the content of the message, thus making the messages unbreakable. In practice, though, while the communication of the quantum-encrypted messages is secure, the machines on either end of the link can never be guaranteed to be flawless. According to Laszlo Kish and his team from Texas A&M, however, there is a way to build a completely secure end-to-end system — but instead of using quantum mechanics, you have to use classical physics: the second law of thermodynamics, to be exact. Kish's system is made up of a wire (the communication channel), and two resistors on each end (one representing binary 0, the other binary 1). Attached to the wire is a power source that has been treated with Johnson-Nyquist noise (thermal noise). Johnson noise is often the basis for creating random numbers with computer hardware."
Hehehe (Score:5, Funny)
Johnson noise.
Re: (Score:1)
Wish I had mod points ... or an account.
Re: (Score:2, Funny)
Re: (Score:1)
Johnson noise.
Mine is very silent :P
Re: (Score:1)
Re: (Score:1)
Real Geniuses (Score:5, Funny)
I want to know if the Laszlo in this story also has an underground room where he prepares and sends in entries to the publishers clearing house sweepstakes. And who's dorm room closet does he come out of?
Unbreakable encryption is easy! (Score:5, Insightful)
Re: (Score:2)
I was thinking...I can encrypt a hard drive, but smashing it and then throwing all of it hot liquid magma.
Re: (Score:1)
It sounds like you may be interested in our 'Store an Infinite Amount of Encrypted Data' device...
Re: (Score:1)
Re: (Score:2)
The check is in the mail to your address in the alternate universe where /dev/null can be read to reproduce the input message using wanktty(1). Also, since /dev/null is a character-based pseudo-device, >> (append) is redundant for the stated purpose, and you simply need > (output).
Re: (Score:2)
2) grep ">>
Re: (Score:2)
Not a law (Score:1, Funny)
The problem with using the second law of thermodynamics for this is that it is a statistical observation, not a natural law.
Re: (Score:2)
"The problem with using the second law of thermodynamics for this is that it is a statistical observation, not a natural law."
Why was this modded down?
http://en.wikipedia.org/wiki/Fluctuation_theorem [wikipedia.org]:
misconception of what "law" means in science (Score:2)
Many "laws" in physics and chemistry are merely useful approximations or things that are usually but not always true. Take Ohm's Law, in a real world material current is not perfectly linearly dependant on potential, you get interesting curves instead, and some materials even have inverse relationship. Besides, the "laws" of physics are man-made attempts to model the behaviour of reality, and might be refined or replaced at a future date with something more useful or more accurate. Good scientists are mo
Kish again? (Score:5, Informative)
Re:Kish again? (Score:5, Funny)
It's not a dupe, that one was based on Kichoffs's Law. [wikipedia.org] This one is based on Johnson-Nyquist noise. [wikipedia.org]
It's totally different. // Doesn't actually know if it's different /// Is really, really impressed with Dwonis' memory. //// Is general Slashdot commentter with know knowledge of the things upon which he comments.
Re: (Score:2)
It's not a dupe, that one was based on Kichoffs's Law. [wikipedia.org] This one is based on Johnson-Nyquist noise. [wikipedia.org]
It's totally different. // Doesn't actually know if it's different
Heh. It's the same thing, as far as I can tell. The title of the 2005 paper linked by the old Slashdot article was: "Totally Secure Classical Communication Utilizing Johnson (-like) Noise and Kirchoff's Law".
I think all of these physical "crypto"systems are snake oil. They claim to be unbreakable, but in reality, they're physical systems subject to the same engineering challenges (such as manufacturing tolerances) as any other system. I would never use one of these systems instead of, say, a point-to-poi
Re: (Score:1)
Re: (Score:2)
Computational power can simply brute any public key into the private, given enough time.
How much do you really care that your great, great, great, great, great, great, great, great, great, great, great, great, great, great, great, great, great, great, great, great, great, great, great, great, great, great, great, great, great, great, great, great, great, great, great, great, great, great, great, great, great, great, great, great, great, great, great, great, great, great, great, great, great, great, great, great, great, great, great, great, great, great, great, great, great, great, great, great
A coincidence? (Score:4, Funny)
Is it a coincidence that Johnson-Nyquist noise sounds exactly like an accordion and bagpipe duo playing La Marseillaise?
Re: (Score:1)
That's the thing about truly random things: you can never be sure they aren't.
Re: (Score:3, Funny)
Re: (Score:2)
unbreakable been around for a while (Score:3, Informative)
Claude Shannon proved in the 1940's that the Vernam cipher with a key the same size as the message, aka one time pad, has perfect security. The USA built the world first digital audio system [wikipedia.org] during WWII in order to give such perfect security to voice communications between Roosevelt and Churchill, among others.
Re:unbreakable been around for a while (Score:5, Insightful)
Re:unbreakable been around for a while (Score:5, Interesting)
The important point that people seem to be missing is that quantum encryption *is* one-time pad. The system of quantum encryption consists of using entangled particles to be the shared source of randomness. Because both parties would be aware if anyone besides the two of them were observing the shared randomness, they can't exactly communicate via entanglement, but they can reach an arbitrary (ie. not decided by either of them) consensus on the values in a random stream. This random stream is then used as the key of a one-time-pad where the ciphertext is transported over a traditional channel of communication.
For this reason, I consider the term "quantum encryption" to be a bit of a misnomer - nothing about the actual en/de cryption is quantum. A better name would be "quantum key distribution" or "quantum consensus generation"
Re:unbreakable been around for a while (Score:5, Informative)
Funnily enough, "quantum key distribution" is what it's actually generally referred to in the field.
Re: (Score:1)
Thank you, this is a really eye-opening and succinct explanation.
Re: (Score:2)
Except one-time pads don't have keys.
Yes, yes they do.
Re: (Score:2)
Except one-time pads don't have keys.
Yes, yes they do.
Actually they don't, they ARE keys.
Re:unbreakable been around for a while (Score:4, Interesting)
> send someone over with a flash drive full of random bits
No, they would just have to send a mailman over every few years with a new credit card which they already do. I just did some back of the envelope math and if you assume a transaction could be sent in 64 bytes and you store only 1Gib of random pad in the card you could almost make a transaction per minute with it and even with a 5year expiration date you wouldn't have to reuse the pad and break the security. The problem is Visa would need to retain that gigabit of data until the card expires and it might cost a bit to keep that much key material secure but it would be a very secure system. Apparently they believe the fraud losses are cheaper.
Something to keep in mind next time you hear em whining. Or hear a Lifelock ad. It is only cheaper for them because they offload so much of the expense for their being cheap bastards onto us.
Re: (Score:2)
One-time-pads couldn't provide any practical improvement in security over what could be achieved with two-factor authentication and custom software (for example not accepting any CA certificate). The weak point is not the crypto.
Re: (Score:2)
> So you can send the user 1GB of data to use for one time pads, but you have trust
> that they keep it secure, but if they get a bit of malware on their system it could copy
> all that data and thus the user's account is compromised.
If you are stupid enough to give the user the data, what you say is true. So don't be stupid.
The card itself has an epaper screen and a touchscreen. When you stick it on the front of the merchant's terminal it is powered from there and receives a request for a transact
Re: (Score:2)
http://xkcd.com/538/ [xkcd.com]
Still breakable (Score:3)
This approach assumes that only Alice and Bob know the current and voltage of the power source. This can be brute forced until a tangible message is found. Next...
Re:Still breakable (Score:4, Informative)
Knowing V and I don't help you because you don't know how much of the R that resulted in I given V was from Alice's end and how much from Bob's. Only they know that.
Re: (Score:2)
Fer instance?
Re: (Score:2)
So your attack depends on Alice and Bob deliberately blindfolding themselves to the effects of Eves attack?
Re: (Score:2)
Moreover, as I understand it, all that this gains you is knowledge that someone has tapped into the system. That doesn't actively prevent them from gleaning the message it simply alerts you that they are.
Not to mention needing special setups between very distant locations (not feasible)
Re:Still breakable (Score:5, Informative)
Re:Still breakable (Score:5, Informative)
Re: (Score:2)
Re: (Score:2)
Sure, so you're going to run (thousands of) miles of dedicated cable so that you can grab a key for a OTP to communicate over standard channels?
This solves nothing.
Re: (Score:2)
Re: (Score:2)
You do that using bits of paper. Here's the situation:
Party A wants to create a OTP for communication with Party B.
1) Generate some randomness, however you like
2) feed that randomness into transport method
3) communicate using a key based on that randomness
Now, here's a very simple way to get randomness from party A to party B:
1) write it down
2) book a flight
3) deliver it in person, knowing that not another sole has seen it.
That costs a few thousand dollars at the upper end.
Here's another way to do it:
1) run
Re: (Score:2)
Re: (Score:2)
You aren't terribly bright are you? You replied to my statement about running thousands of miles of cable with "this replaces quantum entangled bits".
That's wrong.
This "replaces" the current methods of OTP, which is to say it doesn't.
It also doesn't replace QEB because those are actually potentially practical.
I'm sure I'm wasting my time here... you clearly don't understand that this entire paper is garbage wrapped in stupidity. It isn't even original, FFS.
Re: (Score:2)
In fact, YOUR statement was wrong. Then entire POINT of the dual-resistor with unknown voltage/current system is to create a system where you don't have to "hope" nobody intercepted it, you KNOW if someone did. Now instead of insulting people that are trying to explain something to you, why don't you actually READ the summary of the article you claim to understand and leave the real work
Re:Still breakable (Score:4, Interesting)
Maybe I'm just being silly, but if you also encrypt the message using standard means it will look identical to random noise, making it impossible to tell if you stumbled upon the correct current and voltage in the first place. Alternatively, Alice and Bob are able to detect your trying to intercept their communications, which means they can alter their behavior long before you stumble upon the correct settings.
Re: (Score:2)
Maybe I'm just being silly, but if you also encrypt the message using standard means it will look identical to random noise, making it impossible to tell if you stumbled upon the correct current and voltage in the first place. Alternatively, Alice and Bob are able to detect your trying to intercept their communications, which means they can alter their behavior long before you stumble upon the correct settings.
What is stopping the observe from measuring the voltage at two points along the wire? The wire has some non-zero resistance so the difference in voltage between the points should yield the current flow. Basically you'd use the wire itself as the shunt resistor which would not be noticed.
Re:Still breakable (Score:5, Informative)
No, you can't. There is nothing to "brute force": the current and voltage is essentially random. You can't brute-force that for the same reason you can't brute-force a one-time pad: there is nothing to brute-force. Also, while I'm not sure, I don't think Alice needs to know the current and voltage: it looks to me like only Bob does (Alice attaches a resistor with the resistance she wants, Bob does so randomly, Bob compares the current he sees with what it was originally minus the resistor he attached: only Bob needs to know the original current). The only way to decrypt the data stream is if you know what resistor either side attached, and you can't do that without adding energy to the system, which Bob will notice (Alice too if she knows what the current was originally, but that would mean Alice and Bob already have a shared randomness, which means they don't need any tricks to encode a message: they can just use that randomness as a one-time pad).
Re: (Score:2)
Really?
It would seem you still can. If you can decrypt something that means there is a method to do so. You pass the message and one-time pad into this "function" and receive output.
I know that whole million monkeys can make Shakespeare deal, but do you really think that there are going to be a large number of outputs that are intelligible communication? Or even match a dataset that can be decoded by various encoders representing audio/video formats?
Of course, doing so may not be currently possible in a
Re: (Score:2)
Brute-forcing is only practical when you have some known system to compare it against. For example, you can attempt to brute-force a key by using that key to decrypt the data: if you produce an intelligible result, you have the correct key (depending on the encrypting technique, there shouldn't be two keys that can be used to decrypt the date, which means if you produce an intelligible result for a sufficiently large file [i.e. more than a few words] you have the correct key). Same for brute-forcing a hash:
Re: (Score:2)
Unless I've misunderstood your point, I think you've misunderstand why a one-time pad is "unbreakable".
If you have a 10 character message, even with infinite processing power, your message could be any combination of letters in that 10 character array. There is no defined pattern to breaking the message. Given any secret key, you could make any message possible out of the characters; each being a correct solution. It is only with the secret key that you get the intended message. There is no way to extra
Re:Still breakable (Score:5, Informative)
If you can decrypt something that means there is a method to do so. You pass the message and one-time pad into this "function" and receive output.
Yes, but how do you know when the output is correct?
This is why an OTP provides perfect secrecy, if the key is secret. For a given ciphertext, there is some key that transforms it into every possible plaintext of the right length. This means that the result of brute force searching the keyspace for an n-bit ciphertext is every possible n-bit message. Thus, the only information you can get out of an OTP-encrypted message is the message length -- assuming it wasn't padded. With padding, the only information you can get is the maximum length.
The same problem actually occurs with "normal" ciphers and short messages. If I use AES to encrypt a one-bit message (perhaps padding the rest of the block with random bits), every possible AES key will result in an apparently-valid decryption -- the first bit will be either 0 or 1. But I have no way to tell which is right, even though I know that 2^128-1 of them are wrong. Claude Shannon defined the concept of the "unicity distance" to describe this, "unicity distance" being, basically, the length of the smallest amount of ciphertext which an attacker with infinite resources needs in order to determine the correct key, by examining resulting plaintexts. With an OTP, the unicity distance is infinite because as the message grows so dos the key, without bound.
Assuming the key is secret... which is the hard part with one-time pad protocols.
Re:Still breakable (Score:5, Informative)
IMHO, the fallacy in the claim of unbreakable one-time pad encryption is the reliance that all computed plain-texts for the key space are equally possible to be the correct plain-text for the cipher text.
Imagine you are being that exists beyond time and space and can experience all possibilities at the same time. I would think that all possible computed plain-texts would mostly look a huge pile of crap, but an exceedingly few amount are going to look like something you recognize, and then one of them will look like an Apple.
Once again, that does not mean one-time pads are not very secure. They are very secure, just not truly unbreakable.
No, a one time pad with a true random key is truly unbreakable.
What you've overlooked is that when your hypothetical Godlike being sees all possible computed plain texts, that consists of every possible message of the length of the cipher text.
Note that what the Godlike being sees when he tries all possible decryptions does not depend on what the message is (other than the length). Thus, he gets absolutely no information from the cipher text (other than the length).
Try thinking about it with a small example and that should help you see it. For instance, do a 3 bit message. We've got 8 possible messages: 000, 001, 010, 011, 100, 101, 110, and 111. Let's say you know that only 001, 010, and 100 make any sense. Alice sends to Bob the encrypted message 110.
When your Godlike being considers all possible decryptions, he gets 000, 001, 010, 011, 100, 101, 110, and 111, depending on whether the key was 110, 111, 100, 101, 010, 011, 000, or 001.
So he looks at these, and picks out 001, 010, and 100 as the only meaningful messages. Now what? He has no idea which is the right message.
Now perhaps he knows that some of the meaningful messages are more likely than others. Maybe he knows that 99% of the time, Alice sends 010. So he will probably be right if he guesses that this message was 010.
However, he'd have had exactly the same chance of being right if he had guessed 010 without even looking at Alice's message!
Re: (Score:2)
No, the power source can be standard. What must be kept secret is which resistors Alice and Bob switch into the circuit at what time.
The fundamental idea (Score:5, Informative)
Re:The fundamental idea (Score:4, Insightful)
Re: (Score:2)
So I want to send a 0 (low bit). I put in my low bit resister. The recipient also (happens) to put in a low bit resistor (50% chance). Now, the attacker knows I wanted to send 0.
So how does this not leak half the bits of the message? You cannot say "disregard" the message after you've already sent it.
Re: (Score:1)
You aren't sending a message. You are negotiating keys for a symmetric cipher over which you will send a message. So Alice and Bob can (and should) each select a resister at random until they collect enough undetected and non-colliding bits.
Re: (Score:2)
D'oh! Thanks, that makes sense.
Re: (Score:1)
It's a two step process:
Step 1: generate a key by switching the resistors arbitrarily, and discarding the "double 1s" and "double 0s". This leaves you each with a list of 1's and 0's such that if Alice has a 1, Bob has a 0, meanwhile Eve just knows that Alice and Bob generated a bunch of bits. You can disregard the doubles because you aren't sending information yet, you're just generating coordinated noise. Eve will not be able to know who got a 1 and who go a 0 for the bits you intend to use.
Step 2: XOR yo
Re: (Score:2)
You seem to understand it.
A defect of this method is electromagnetic radiation, which means that undetectable eavesdropping can be done, and the speed of light and relativity, which means there is no simultaneity of changing of resistors.
In other words, Eve can eavesdrop by passively listen at two different locations on the wire, thus seeing differences in Alice and Bobs signaling.
Security ... (Score:1)
Through obscurity
Throw in a buch of gobble-de-gook and only know which bit is meaningful, that's the answer.
Welp (Score:5, Funny)
Re: (Score:3)
I don't know about y'all, but I like my cats dead when I open the box.
Agreed. Considering the default state of a cat, which is a cold hatred for all human life, dead is infinitely preferable to the third alternative: bloody furious. [wikia.com]
In the original experiment (Score:2)
They discovered, upon opening th box, that Dr Schrodinger had killed the cat with a hammer.
It's been proposed, and it won't work. (Score:5, Insightful)
As someone pointed out, this was on Slashdot 7 years ago. Here's the referenced paper. [arxiv.org]
The idea is simple. At both ends of the wire, random data modulated with content is being emitted. At any point on the wire, you see the sum of two random sources. But each end knows their own random data, and can subtract it out.
To break the system, you need two taps on the wire, some distance apart. Now you get to see the sums of the signals from each end, but with different time shifts between them due to propagation delay. With that data, you can separate out what's coming from each end. This allows recovering the original signals.
"No new encryption system is worth looking at unless it comes from someone who has already broken a very hard one." - Friedman.
Re: (Score:3)
The idea is simple. At both ends of the wire, random data modulated with content is being emitted. At any point on the wire, you see the sum of two random sources. But each end knows their own random data, and can subtract it out.
Actually, the proposal (which you linked to) does not involve transmitting the content on the wire at all. The circuit consists of a loop with resistors in two places, and no power source. The random signal consists of induced current from thermal noise or an external noise source; the power distribution of the noise is affected by the resistors. Supposedly there is no way to know from measuring the noise where each resistor is in the circuit.
I'm not prepared to claim that the system is as secure as the pap
Re: (Score:3)
Re: (Score:2)
Except that any such taps are instantly detectable, at which point communication stops. Thus, at most 1 bit of information leaks out to an eavesdropper.
This paper is a follow-up to the previous work you cited.
Re: (Score:2)
Except that any such taps are instantly detectable, at which point communication stops. Thus, at most 1 bit of information leaks out to an eavesdropper.
That's a property of quantum communication, where observation affects the result. Not this.
Re: (Score:2)
I'd upvote this if I could. This is exactly correct, and part of the reason the system as described is infeasible - for any reasonable length of wire, multiple passive taps can extract the direction of propagation for changes in noise level.
It should be noted that the article explicitly addresses this issue, however they only do so by declaring that the frequency response of the noise sources be substantially lower than the wire transit times - so if you're talking about a a wire with 10 us of delay (2 km
If you have to go that far.. (Score:1)
Use messengers. I think this is an old idea. As far as quantum security, I will wait for quantum computers. Unbreakable come on. Anything can be hacked eventually.
Re: (Score:2)
As far as quantum security
We can make quantum-secure cryptosystems without any special electronic systems or quantum computers. Plenty of work on this has been done; McEliece is a famous one, but there are others based on lattice problems. If quantum computers were tomorrow's headline, the only real problem would be that popular crypto standards do not include quantum-secure algorithms.
Won't work In An Operational Environment (Score:1)
Given the variety of additional factors, such as path loss, crosstalk, temperature differences, difference in cable materials, etc., etc., the system is limited to only particular environments. It would never work on a standard telephone line to a house for example.
Back to the drawing board.
I don't get this basic definition of quantum... (Score:1)
Re: (Score:2)
Not sure if you later read the other comments, but you use quantum cryptography to transmit a one-time pad and you can then detect eavesdropping. Yes, after reading that one-time pad, it would be impossible to read it again. If you couldn't read the pad, you know someone is eavesdropping, so you don't send your pad until you resolve that problem (which could be difficult).
Once you have exchanged a one-time pad, that has not been eavesdropped, you can begin to exchange messages encrypted by the one-time pa
Ridiculous, quantitatively. (Score:4, Interesting)
A ridiculouos idea, if you're an electrical engineer, for many reasons:
(1) The noise on the wire, for reasonable values of resistors and bandwidth, is down in the low microvolts. If the cable is unshielded, it's going to pick up several microvolts of radio signals per foot. Even if it's really well shielded, we're still talking microvolts per kilometer.
(2) Eve can put a probe signal on the wire, it just has to be random noise. Alice and Bob have no way of proving that a small spike of random noise, only half a standard deviation above the average, isn't perfectly fine Johnson noise coming from the other end. Eve knows the amplitude of the noise she is putting on the wire, so she can subtract that amount, and the difference reveals the values of the resistors.
(3) For any moderately long wire, in the kilometer range, there is a time delay, allowing Eve to inject short bursts of noise and get the resistor info from each end coming back, spread out in time.
(4) Bell Labs proposed this idea, the part about injecting noise inn from both ends, back around 1955.
Re: (Score:2)
I think it's a bit ridiculous, but not for these reasons.
(1) They suggest using very high temperatures, presumably to avoid exactly this issue.
(2) Not sure what you mean. She subtracts what from what? But see below.
(3) The authors propose adding low-pass filters for exactly this reason. They'll filter out high-frequency signals, leaving low-frequency components that have no effective time delay.
My attack would be for Eve to add a small probe signal -- she would insert a voltage source in the line, wi
Re: (Score:2)
Let's see: Eve takes two sets of two, then faces them in opposite directions -->|--S1-->|-- and --|--S2--|-- and then inserts these two into the wire in parallel such that S1 and S2 isolate the electrical flow in each dirction respectively. S1 and S2 are each separately coupled to ground using a very small cap --)|-- . A voltage comparator is used to determine whether S1 or S2 has the higher voltage to ground at any given time. At any given time the arrows on the schematic diodes point to the lower r
Re: (Score:2)
Word "diode" disapeared in a few places. Basically serial resistence isn't that hard to figure out in AC based purely on voltage drop in the two directions as the AC waveform reverses. In DC you just measure voltage. The noise is just noise and it provides a little back-charging for the cmparators.
I'm not a double-E but given how hard it is to make -smoth- electricity, detecting good signal in -lumpy- electricty is kid of a gimmie.
Not so fast... (Score:2)
First and foremost is that there has to be TWO conductors unless we are dealing with static voltages. You can use one wire and the ground as the second conductor, but there is going to be significant resistance in any kind of useable length. This means that there are at least two places for someone to be making measurements to figure out the necessary information.
Second, this method has a limited number of logical states (LL, LH, HL, HH) that encode two bits of data which will be clearly observable on the
Interesting stuff (Score:2)
Qbit communication not secure in practice (Score:1)
Re: (Score:2)
eh, some of us took thermogodamnics in school. we hated it, but we understand it