Building the DARPA Quantum Network Building a QKD Network out of Theories and Devices December 17, 2005 David Pearson BBN Technologies [email protected] Building the DARPA Quantum Network Harvard Copyright © 2005 by BBN Technologies. University Why QKD? Why now? • Unconditional security, guaranteed by the laws of physics, is very compelling • Public-key cryptography gets weaker the more we learn – even for classical algorithms • If we had quantum computers tomorrow we’d have a disaster on our hands. • Future proofing – secrets that you transmit today using classical cryptography may become vulnerable next year (RSA ’78 predicted 4 x 10 9 years to factor a 200-digit key, but it was done last May) • The technology of QKD seems to be mature enough that we can start to create usable systems. Building the DARPA Quantum Network Harvard Copyright © 2005 by BBN Technologies. University 2 DARPA Quantum Network - Goals Encrypted Traffic Private via Internet Private Enclave Enclave End-to-End Key Distribution QKD Repeater QKD Switch QKD QKD Endpoint Endpoint QKD Switch QKD Switch Ultra-Long- Distance Fiber QKD Switch WeWe areare designingdesigning andand buildingbuilding thethe world’sworld’s firstfirst QuantumQuantum Network,Network,deliveringdelivering end-to-endend-to-end networknetwork securitysecurity viavia high-speedhigh-speed QuantumQuantum KeyKey Distribution,Distribution, andand testingtesting thatthat NetworkNetwork againstagainst sophisticated sophisticated eavesdroppingeavesdropping attacks.attacks. AsAs anan option,option, wewe willwill fieldfield thisthis ultra-high-securityultra-high-security networknetwork intointo commercicommercialal fiberfiber acrossacross thethe metrometro BostonBoston areaarea andand operateoperate itit betweenbetween BU,BU, Harvard,Harvard, andand BBN.BBN. Building the DARPA Quantum Network Harvard Copyright © 2005 by BBN Technologies. University 3 ‘Mark 2’ Weak Coherent QKD Links 4 Nodes Continuously Operational Since October 2003 • Polarization Independent • Sync & Data at 1550 nm • Active Path Length Control C B V F 0 B P B F B D0 D1 D0 D1 Transmitter C B V F 1 Receiver B P B F B OPC OPC DIO Card C B V F 0 DIO Card B P B F B D0 D1 10 MHz 14 Bits 14 Bits 2 Pulse Clock trig. Buffering SYNC Buffering Thresholds Pulse Pulse Signal Generator DAC trig. Generator Gates Splitter Signal 3-Way DAC Splitter Amp Splitter Signal TTL Amp Splitter 3 Pulse Pulse Threshold NIM Generators Gate Delay Line Delay Line E-O 1550.92 nm 1550.92 nm E-O Delay Phase Sync Laser Delay Sync Pulse Phase Faraday Loop Shifter Loop Receiver Shifter Mirrors DWDM φ Circulator φ DWDM Link 1550.12 nm Fiber 50 / 50 50 / 50 Optical Polarizer QKD Adjustable Air Gap Delay Delay Coupler Coupler Attenuator Adjustable Air Gap Delay 1550.12 nm Data Laser Loop QKD Cooled APDs Transmitter (Alice) Receiver (Bob) November 5, 2003 Building the DARPA Quantum Network Harvard Copyright © 2005 by BBN Technologies. University 4 QKD Software Suite and Protocols QKD Endpoint QKD Protocols IPsec Authentication IKE Privacy Amplification Entropy Estimation IP Error Detection SPD SAD and Correction Ethernet Ethernet Ethernet Device Device Device Sifting Driver Driver Driver VPN Internet (public Interface channel) Optical Process Control Optical Hardware Building the DARPA Quantum Network Harvard Copyright © 2005 by BBN Technologies. University 5 Status as of 3½ Years Ago DARPADARPA QuISTQuIST NetworkNetwork TestbedTestbed GoesGoes HereHere Building the DARPA Quantum Network Harvard Copyright © 2005 by BBN Technologies. University 6 The Year 1 Weak-Coherent Link Bob Alice Building the DARPA Quantum Network Harvard Copyright © 2005 by BBN Technologies. University 7 The Cooled Detector Package 2 Epitaxx detectors (EPM 239 AA SS ) Dual Peltier coolers Approx. 2 x 10 -2 Torr Operates near –60 C, achieves –80 C max Building the DARPA Quantum Network Harvard Copyright © 2005 by BBN Technologies. University 8 First Days Up and Running Typical (Untuned) QBER Range Days in Continuous Operation Mean emission = 0.1 photons/pulse; Perfect results would be 0.05; 10% quant. Eff. would be 0.005 Good Sifted Bits / Pulse (Untuned System) Errors Per Properly-Sifted Detect Event D0 D1 D1 D0 Time in Hours, Data Segment ended 2 Jan 03 Building the DARPA Quantum Network Harvard Copyright © 2005 by BBN Technologies. University 9 Bounding Eve’s Information (the heart of QKD) A L Classical Channel B I EVE O C Quantum Channel B E Information Eve learns: t Bits from probing single-photon pulses q Classical bits leaked ν Bits from imperfect quantum channel After we get the bound, we use privacy amplification to reduce Eve’s knowledge to ε << 1 Building the DARPA Quantum Network Harvard Copyright © 2005 by BBN Technologies. University 10 Imperfections in the Quantum Channel (taking security proofs w/ a grain of salt) • Multi-photon pulses (weak coherent ≠ single photon) • Unbalanced detectors • Timing imperfections in detectors •Alice Active probes of Alice/Bob interferometers (OTDR)Bob • Breakdown flash from APDsLow-loss channel • Memory effectsEve of APDsQuantum Eve splits off one photon from any . memory multi-photon pulse, keeps one in a . quantum memory and sends the other through to Bob over a special low-loss A consensus list of vulnerabilitieschannel. would If she be doesn’t a very get a photon, valuable thing! she blocks the pulse. When bases are announced she measures her stored Some of the vulnerabilities we wantqbit in theto correctfix in basis the optics, some by monitoring, and some by privacy amplification (with extensions to the proofs) Building the DARPA Quantum Network Harvard Copyright © 2005 by BBN Technologies. University 11 Imperfections in the Quantum Channel (taking security proofs w/ a grain of salt) • Multi-photon pulses (weak coherent ≠ single photon) • Unbalanced detectors • Timing imperfections in detectors • Active probes of Alice/Bob interferometers (OTDR) • Breakdown flash from APDs • Memory effects of APDs D0 . A consensus list of vulnerabilities would be a very valuable thing!D1 Some of the vulnerabilities we want to fix in the optics, some by monitoring, and some by privacy amplification (with extensions to the proofs) Building the DARPA Quantum Network Harvard Copyright © 2005 by BBN Technologies. University 12 Imperfections in the Quantum Channel (taking security proofs w/ a grain of salt) • Multi-photon pulses (weak coherent ≠ single photon) • Unbalanced detectors • Timing imperfections in detectors • Active probes of Alice/Bob interferometers (OTDR) • Breakdown flash from APDs • Memory effects of APDs D1 . Detector . sensitivityA consensus list of vulnerabilities would be a very D0 valuable thing! Some of the vulnerabilities we want to fix in the optics, Time some by monitoring, and some by privacy amplification (withEve injects extensions to the proofs) pulse here Building the DARPA Quantum Network Harvard Copyright © 2005 by BBN Technologies. University 13 Imperfections in the Quantum Channel (taking security proofs w/ a grain of salt) • Multi-photon pulses (weak coherent ≠ single photon) • Unbalanced detectors • Timing imperfections in detectors • Active probes of Alice/Bob interferometers (OTDR) • Breakdown flash E-Ofrom APDs 1550.92 nm Delay Phase Sync Laser Shifter • Memory effectsLoop of APDs . φ . Link Optical DWDM 1550.12 nm Fiber 50 / 50 Attenuator Polarizer A consensusQKD listAdjustable of Airvulnerabilities Gap Delay would be a very Data Laser Coupler valuable thing! Alice Some of the vulnerabilities we want to fix in the optics, some by monitoring, and some by privacy Eve amplification (with extensions to the proofs) Building the DARPA Quantum Network Harvard Copyright © 2005 by BBN Technologies. University 14 Imperfections in the Quantum Channel (taking security proofs w/ a grain of salt) • Multi-photon pulses (weak coherent ≠ single photon) • Unbalanced detectors • Timing imperfections in detectors • Active probes of Alice/Bob interferometers (OTDR) • Breakdown flash from APDs • Memory effects of APDs . A consensus list of vulnerabilities would be a very valuable thing! Some of the vulnerabilities we want to fix in the optics, some by monitoring, and some by privacy amplification (with extensions to the proofs) Building the DARPA Quantum Network Harvard Copyright © 2005 by BBN Technologies. University 15 Imperfections in the Quantum Channel (taking security proofs w/ a grain of salt) • Multi-photon pulses (weak coherent ≠ single photon) • Unbalanced detectors • Timing imperfections in detectors • Active probes of Alice/Bob interferometers (OTDR) • Breakdown flash from APDs • Memory effects of APDs . A consensus list of vulnerabilities would be a very valuable thing! Some of the vulnerabilities we want to fix in the optics, some by monitoring, and some by privacy amplification (with extensions to the proofs) Building the DARPA Quantum Network Harvard Copyright © 2005 by BBN Technologies. University 16 Howard Brandt’s entangling probe for BB84 (quant-ph/0509088) Uses an entangling probe with a POVM which can sometimes unambiguously discriminate between 0 (in either basis) and 1. With loss, allows PNS-type attack for true single-photon source Shapiro showed that Brandt left out part of the error rate (thank goodness!) But it was plausible that the attack worked, despite the proofs Building the DARPA Quantum Network Harvard Copyright © 2005 by BBN Technologies. University 17 Quantum Networking Building the DARPA Quantum Network Harvard Copyright © 2005 by BBN Technologies. University 18 Quantum Networking • Without a network, QKD