Hacking Physics

An Exploitatory Analysis of Quantum Communications

Photo by NASA on Unsplash

Information, as Rolf Landauer described it, is physical. Quantum theorists suggest that it is never really lost, as in since the present state of the universe preserves all the past as well, systems should be able to encode information about each other so that every process is theoretically reversible and the information is always conserved.

A consequence of special relativity is that one can not transmit information between two objects more quickly than the speed of light. Light is the carrier in case of quantum transmissions, it may be coming through an optic fiber or may be through the open air itself, the former better suits telecommunication networks while the latter, photons carrying information through open air, better fits the communication needs of space-based systems.

The move towards communication and computing which is based upon quantum mechanics is driven not just by the promise of exponentially better information processing but also the idea that information security over the quantum landscape will be guaranteed by the laws of physics.

HACKING PHYSICS

“Still I have finally succeeded in illuminating a magnetic curve, and in magnetising a ray of light.” — Michael Faraday

Photons are particles of energy. Measurement is destructive, as Heisenberg’s uncertainty principle directs us, a measurement of the photon’s quantum state changes its quantum state and the particle ends up with the result of the measurement as its new state. It must be noted here that quantum information is always represented between a vertical bar and an angled bracket, this is Dirac’s notation who had formulated a relativistic version of quantum mechanics.

So |Ψ> becomes |Ψ’> measured classically as |0> or |1> depending upon what the measurement was irrespective of the original quantum state |Ψ>. The No-Cloning Theorem states that it is impossible to accurately copy an unknown quantum state, at least perfectly, however the laws of quantum mechanics do not prevent a sophisticated attacker from making an imperfect copy and carry out an Approximate Cloning based attack.

TELEPORTATION for COMMUNICATION

Two photons once entangled, remain linked even after traveling light-years apart from each other. This means that if we measure one as vertically polarized, the other one automatically and instantly becomes horizontally polarized. No signal could have had the time to travel between them, time after all being a human construct, not a thing but merely an “order of things”.

While a profound discussion over the nature of existence and the emergence of the fabric of reality is beyond the scope of this article, it will be best to assume for the ease of conceptual understanding that this is, as John Wheeler put it, a participatory universe of observer-participants and all things physical are information-theoretic in origin, imagining the world as a system self-synthesized by quantum networking. Chinese scientists recently used these “spooky actions” to teleport images in one-time pad cryptographic configuration from China to Austria as well as from Austria to China, using a low-earth-orbit satellite called Micius which acted as a trusted relay for secure key distribution between multiple nodes in China and Europe under the international research collaboration QUESS (Quantum Experiments at Space Scale) which aims to build a global quantum teleportation network by 2030.

Data Teleportation, also referred to as counterfactual communication, is in its infancy. It does promise to bring about the super-secure quantum internet and a communication framework for future long-distance space travel and exploration, but the information still remains vulnerable before transmitting the quantum state and after the state is measured. Which brings us to the crucial issue of platform security, as even in case of the Micius satellite_,_ one of the drawbacks was an implicitly assumed trust in the platform.

PLATFORM & BRUTE FORCE

Physical implementations of quantum mechanics based systems are far from ideal and the security of a combined system can not be greater than either of its constituent systems. In between hardware and software, the attacks which are centered upon the hardware implementation have the potential to be far more threatening because of the implementation requiring highly sophisticated equipments which may not be easily replaceable at short intervals. Since an imperfect setup can be a cause of many errors on its own, even a composite classical-quantum system may turn up as potentially less ideal than the classical system alone.

The electrical or the electromagnetic signals from the implementation hardware can be exploited using attacks on classical cryptographic channel and near-field surveillance techniques. However a well inspected quantum cryptosystem is exponentially better than traditional cryptosystems for a lot of traditional tasks such as archiving long-term secret data at remote locations, simply because the sophistication of physical implementation overruns the challenges posed by rapid technological advances. An attacker who is up against a quantum system would require, at least theoretically, limitless computational power. Still long term security against unknown technological changes can never be truly guaranteed. The platform has to be secured against end-to-end attacks, trojan horses, and fake states etc as well.

The errors can be caused by noise, loss in the quantum channel, an imperfect generation of quantum states at Alice’s end or an imperfect detection setup at Bob’s end. Infrastructural maintenance is a major concern as well since an attacker could mount a denial-of-service attack by cutting wires or blocking light by atmospheric manipulation. Earth’s atmosphere has a high transmission wavelength but it is also highly dependent on the type of weather and many sophisticated and resourceful actors may be able to manipulate weather along the transmission channel using a combination of satellites and aerial drones or ground systems launching air burst attacks.

Also designing a system-of-systems which includes a fiber optic system is often described as a balancing act wherein the system architects have to account for the fiber-loss factor, type of fibers, the quality of transmitter, the sensitivity of receiver, and the overall loss margin among other considerations. If the transmission is happening through open air, factors such as diffraction of light, turbulence, atmospheric absorption, errors in pointing of beam etcetera contribute to the overall loss margin.

OPTICAL ATTACKS

Broadly, optical attacks could be executed by exploiting the photo-detectors, implementing a state estimation device or a cloning machine, splitting a portion of the transmitted signal with a beam splitter, quantifying the information carriers, or manipulating the photon states using retardation plates and Faraday rotations.

Bob needs a photon detector to measure the polarization or the phase of the incoming photons. Generally a photon detector is an avalanche photo-diode. When the photon hits the semiconductor, it causes an avalanche of electrons, creating an electric signal which leads to the detection of the incoming particle. Sometimes the photon may simply be absorbed without causing any avalanche. Or this avalanche may also occur (and can be made to occur) without an incoming stream using thermal noise or band-to-band tunneling process, this type of false alarm is often referred to as a Dark Count. Producing and detecting single photons in a reliable manner is difficult as it is. Also as the distance between Alice and Bob increases, the number of photons arriving safely to the recipient reduces and the Dark Count increases.

While quantum mechanics does cause disturbance upon measurement of the state of the photon, the laws of quantum physics do not prevent an attacker from measuring the number of photons without causing any disturbance. For an incoming pulse which is carrying multiple photons, an attacker can mount an ‘intercept and resend’ without changing the phase or polarization of the received pulse. Alice and Bob can try to overcome this by employing decoy states or measuring photon number statistics after detection.

Since an attacker can not acquire direct information of the transmission’s content without disturbing its quantum state, it is very much likely that the exploitatory strategy first could be to acquire information about the secret key between Alice & Bob as a mathematical function of the disturbance induced itself. Once there is access to the key output, the attacker could keep the imperfect (approximate) clones in quantum memory till the sender reveals the encoding rules, and thereafter break the cipher.

INTERCEPT, INSERT

These are the age-old and time-tested strategies which can be implemented as an individual attack, a collective attack, or a joint attack. The last two can be grouped under the umbrella of coherent attacks while individual attacks are seen as an incoherent attack. In an individual attack, the attacker probes each state independently and measures each probe independently as well. Measurements out of an individual attack can be modeled as a random variable, which is not the case with a collective or a joint attack strategy. In collective attacks, each quantum state is probed independently but measurement is made on the entire set of probes. In joint attacks, which can be executed only after the communication is complete, all states are probed jointly and measured jointly as well.

In quantum cryptography, Alice has four different qubits to choose from to encode classical bits, that is two qubits per bit value, |0> or |+> for bit 0 & |1> or |-> for bit 1. The encoding is also heavily dependent on the hardware used. For an eavesdropper executing an ‘intercept and send’ attack, there is a significant probability of introducing an error and a significant probability of going unnoticed as well, similar to the tossing of a coin. Alice and Bob may undertake reconciliation measures to establish secure transmission, but again, absence of errors gives statistical confidence only and is not a guarantee of safe transmission.

In attacking the authentication between Alice & Bob, there is always a non-zero probability of success. A quantum key distribution requires a classical authentication channel to work and must start with a secret key to begin with, differentiating it from Public Key Cryptosystems which being a many-to-one communication system requires as many number of public and private keys for as the number of nodes in network. Secret key Cryptosystems on the other hand are one-to-one in nature, making all the more paramount the need for securing the authentication channel and the key distribution system. If an attacker can determine the key, the cryptographic primitive stands broken. The sender and receiver therefore have to a be able to check and validate independently of the system that they are indeed talking to each other. An attacker could mount Impersonation and Substitution attacks against the authentication scheme itself, altering or replacing a message after seeing the previous messages, which would allow the eavesdropper to feign legitimacy of transmission when there is none.

The hacker may convert a qubit into classical information by performing a measurement and then try to recreate quantum information using this measurement to send to the actual intended recipient, because otherwise the recipient would simply ignore the photon as lost, making eavesdropping an entirely useless and futile activity.

POST QUANTUM SECURITY & FINAL REMARKS

The future looks to be moving towards device and channel agnostic implementations of security. Post Quantum security solutions will be difficult to attack by quantum and classical computers both, this is a vibrant arena for present day mathematicians, physicists, and information security researchers alike.

“Weapons change, but man changes not at all.” — George Patton

There are many ongoing debates and discussions around how the landscape of information security will change post the advent (and commercialization) of quantum computers and cryptosystems based on energy-time entanglement. While classical cryptographic algorithms assume the that the cipher will be unbreakable in a reasonable time-frame and the adversary has limited resources, quantum cryptographic systems rely heavily on strong physical laws of quantum mechanics but are prone to unintended surprises and exploitation with regards to the software and hardware platform used to implement this mechanics which may not behave exactly as in theory.

P.S. Some cool papers.