Quantum threat: How to protect your optical network

Quantum threat
23 September 2022, Dr. Vincent Sleiffer MSc, senior systems consultant
How to protect your optical network

© 2022 ADVA. All rights reserved.
2
POP
POP
POP
Location 2
Location N
Location 1
The big picture
Making networks secure with multi-layer encryption
Ethernet
1-100 Gbit/s
Optical (DWDM)
100-400 Gbit/s
FSP 150
(MACsec aggregation)
ENC
FSP 150
(MACsec, VNF)
FSP 150
(MACsec, VNF)
FSP 150
(MACsec, VNF)
FSP 150
(MACsec aggregation)
FSP 3000
FSP 3000
FSP 3000
ENC

3
Can you access data in an optical fiber?
3

4
Fiber tapping
Fiber tap
Transmitter Receiver
Hacker

5
Sumitomo, OFC 2019
Does this really protect your sensitive data?
Physical layer protection
https://lumenisity.com/core
smart-unique-nanf-
hollowcore-technology/
https://www.wirestrander.com/blog/submarine
Carrying the
sensitive data
Noise

6
https://www.profitap.com/fiber-taps/
Amplification
and MUX
points
Network
monitoring
points
Encrypt your sensitive data!

7
Optical fibers traverse hostile locations
Detecting tapping using OTDR technology

8 © 2022 ADVA. All rights reserved.
8
Encrypt all your data, and then you’re done …
Right?

Setting up the cryptography (AES256)
Key exchange

10
Alice
Bob
How to protect confidential information?
Confidential Confidential
• Uses a different, separate protocol
• Secure delivery: privacy, integrity, assurance
• Needs to be handed to the rightful recipient
Key exchange protocol
Secure transport

11
Symmetrical encryption algorithms are fast and efficient
Protecting communication systems
AES-GCM-256 AES-GCM-256
Secret
Session
key
Secret
Plaintext Ciphertext Plaintext
Alice Bob
Session
key

12
Present crypto-systems are resistant to computing attacks using large prime numbers
Protecting communication systems
Secret
Diffie-
Hellman
Diffie-
Hellman
Session
key
Key exchange
Secret
Alice Bob
Session
key

What’s the danger with this approach?

14
Symmetric ciphers are quantum resistant – public key cryptography is vulnerable
Quantum computers break present crypto systems
Secret
Diffie-
Hellman
Diffie-
Hellman
Session
key
Key exchange
Secret
Alice Bob
Session
key

15
Symmetric ciphers are quantum resistant – public key cryptography is vulnerable
Quantum computers break present crypto systems
Secret
Diffie-
Hellman
Diffie-
Hellman
Session
key
Key exchange
Secret
Alice Bob
Session
key
Source: https://quantum-computing.ibm.com/composer/docs/iqx/guide/shors-algorithm
Shor’s algorithm -> fast factorization (find prime numbers)

Time to prepare for quantum era
Why care about future quantum computers?
The quantum computer threat
Minutes
Hours
Days
Months
Years
Millenniums
High-performance
computer (2018)
Quantum
computer (202x)
Cracking time

17
Solutions
Two possible solutions
Post-quantum cryptography (PQC)
Quantum-key distribution (QKD)
Solution 1 Solution 2
Based on physics!
Based on very
complex math

18
Quantum key distribution (QKD) is securing key exchange by quantum transport
Solution 1: Quantum transmission for key sharing
Alice
Bob recognizes the
observation
Session
key
Session
key
Quantum channel
Quantum key processing Quantum transport
And others emerging

19 © 2022 ADVA. All rights reserved.
19
Quantum physics: detection collapses state
Eavesdropper will be detected due to increasing QBER
One photon per quantum bit:
how to cope with fiber (+other) losses?

20
Identifying attacks against key
exchange
Multivendor solution utilizing
open key exchange interfaces
Quantum-safe encryption of
DWDM user traffic
Integrated into live network of
major CSP
First quantum-safe network
with public service providers
Financial institution Quantum key distribution
Quantum safe cryptography: QKD
Cambridge
Adastral Park,
Ipswich
Quantum channel
Encrypted
data channels
<40km point-to-point link

21
Code- and lattice-based asymmetrical encryption algorithms are quantum-safe
Solution 2: Quantum-safe key exchange
Alice
Bob
Session
key
Session
key
Quantum-safe key
exchange protocol
Quantum-safe key
exchange protocol
Key exchange
NIST, July 2022: Standardization candidate: CRYSTALS-Kyber. Round 4 candidates:
BIKE, Classic McEliece, HQC and SIKE
BSI, August 2020: Classic McEliece and FrodoKEM, a.o., in a hybrid solution

22
One of the last of these three models was Rainbow, a signature
system that has a secret key that is only known by the user and that
can be verified by the recipient. Ward Beullens cracked the access
system in a little less than a weekend and using only a laptop.
Source: https://english.elpais.com/science-tech/2022-03-24/using-just-a-laptop-an-encryption-
code-designed-to-prevent-a-quantum-computer-attack-was-cracked-in-just-53-hours.html
The team, from Computer Security and Industrial
Cryptography group (CSIS) at KU Leuven, were able to
crack the algorithm SIKE — or Supersingular Isogeny Key
Encapsulation (SIKE) — using a mathematical approach
to understand SIKE’s encryption and then predict and
steal its encryption keys.
Source: https://thequantuminsider.com/2022/08/05/nist-approved-post-
quantum-safe-algorithm-cracked-in-an-hour-on-a-pc/

23
• Field upgradable with
firmware images digitally
signed by ADVA
• Updates enable crypto
agility for addition of new
algorithms and deletion of
undesired algorithms
• Hardware-ready for
quantum safe public key
exchanges (e.g., classic
McEliece)
Field upgradable to enable crypto agility
Crypto submodule (CSM)

24
ADVA protects EU research network against quantum attacks
Quantum-safe key exchange using McEliece algorithm
100G user payload is protected by quantum-resistant
AES-256 cipher
Joint demo with regional research network providers
and super-computing centers
Quantum safe cryptography: post-quantum ciphers

25
Quantum-safe cryptography options
Future-proof security
• New cryptographic algorithms, e.g., McEliece
or Frodo, thought to be secure against cyber
attacks by quantum computers
• The security of the encryption relies on the
computational difficulty
• Reach limitation based on optical interface
Post-quantum cryptography (PQC)
Session
key
Session
key
Quantum safe
key exchange
protocol
Quantum-safe
key exchange
protocol
Key
exchange
• Use quantum physics for secure key exchange:
A try to eavesdrop introduces detectable
anomalies in quantum states
• The security of the encryption relies on the
foundations of quantum mechanics.
• Limited reach due to fiber loss
Quantum-key distribution (QKD)
Session
key
Session
key
Quantum channel
Key exchange
Solution 1 Solution 2

26
Post-quantum security with PQC and QKD
Plaintext Plaintext
Alice Bob
AES encryption AES encryption
Secret
Diffie-
Hellman
Diffie-
Hellman
Session
key
Key exchange
Secret
Ciphertext
Session
key
PQC PQC
Key exchange
QKD QKD
Key distribution
Future-proof data security and flexibility
Protection
against quantum
computers
attacks

27
Dr. Vincent Sleiffer MSc
Senior Systems Consultant
+46 76 795 32 57
VSleiffer@adva.com
Linkedin.com/in/VSleiffer
Getting access to data inside
the fiber is possible. Therefore
it is necessary to encrypt your
sensitive data
Quantum computers are going
to be able to break current key
exchange methods (RSA,
Diffie-Hellman, elliptic curve
cryptography)
Protect your data now against
the quantum threat by using
quantum key distribution
(QKD) and post-quantum
cryptography (PQC)!
Further
listening:
Quantum threat: How to protect your optical network
Takeaways

Quantum threat: How to protect your optical network

Recommandé

Recommandé

Contenu connexe

Tendances

Tendances (20)

Similaire à Quantum threat: How to protect your optical network

Similaire à Quantum threat: How to protect your optical network (20)

Plus de ADVA

Plus de ADVA (20)

Dernier

Dernier (20)

Quantum threat: How to protect your optical network