New QED-C Publication – QKD: Part of a Defense-in-Depth Security Strategy
In a new report published in May 2024, the Quantum Economic Development Consortium (QED-C) discusses the crucial role hybridized cryptographic systems that leverage both quantum key distribution (QKD) and post-quantum cryptography (PQC) will play in future defense-in-depth strategies.
Defense-in-depth security, a well-recognized security strategy, is a multi-layered approach to cybersecurity that ensures no single point of failure can compromise the entire system, amongst its other benefits. It involves implementing multiple defensive measures, which do not rely on each other, to safeguard digital assets against even the most advanced attacks. Needed more than ever, this strategy is vital due to the unprecedented impact of the quantum computing threat and the increasing sophistication of cyber-attacks, which constantly seek to exploit vulnerabilities in various security layers. Furthermore, it provides for increased flexibility in cryptographic agility and reduces the overall complexity and cost of the inevitable cryptographic migrations in front of us.
Given its complementary properties, QKD in combination with PQC significantly strengthens the resistance to the quantum threat. Importantly, the report highlights that existing fiber optical telecommunication networks can be easily retrofitted with QKD equipment that takes care of key exchange and interfaces with the existing network encryption equipment. The report also underlines that QKD offers a clear, theoretical advantage since it enables Information Theoretically Secure (ITS) confidentiality from ITS authentication alone, a feat that is not possible classically. In practical terms, due to the fact that ITS has not been easy to implement with other methods, QKD offers perfect forward secrecy and long-term confidentiality.
The report also provides a compelling analysis of various authentication schemes, which should be used in conjunction with QKD:
- Information theoretically secure authentication
- Authentication with hash-based signatures
- Authentication with other PQC signatures
There are pros and cons for each such authentication scheme, where some could be better suited than others. For simple point-to-point networks, pre-shared keys within an ITS scheme offer the best security. However, this becomes less viable as the scale and complexity of the network increases. For larger networks where long-term confidentiality is required, the use of PQC algorithms for authentication is a sound approach.
QKD and PQC: The Best of Both Worlds
The experts agree that the next generation of secure networks will feature both PQC and QKD. The public key infrastructures that we have been relying on to secure the Internet and corporate systems will be in continuous transition to newly standardized PQC algorithms over the next few decades. Until the security of a particular generation of PQC is proven, PQC algorithms will often operate in a hybrid mode, alongside today’s classical Error Correction Code (ECC) and RSA algorithms.
Where long-term confidentiality and high-assurance security are needed, local and regional QKD infrastructure could be used to ensure data protection. The security of any system is only as good as its weakest link: By employing a defense-in-depth approach with QKD at the core of the network and PQC extending security to the edge or protecting the application layer communication, the attack surface is significantly reduced.
This approach significantly enhances the overall security of the network and enables the zero-trust architecture. For cloud and telecommunications service providers, offering Quantum-Safe as part of their services provides for a point of differentiation that will appeal to customers seeking seamless and cost-efficient “secure by design” solutions.
The report concludes with this statement:
“Given the advantages and disadvantages of various quantum-safe strategies, using just one system or relying on just one approach, while less complex, is inherently less secure. A defense-in-depth strategy provides layers of protection resulting in superior resilience.”
About ID Quantique
ID Quantique (IDQ), founded in 2001, initially operated as a spin-off company of the University of Geneva, working on research projects to demonstrate the feasibility of quantum key distribution (or QKD, also known as quantum cryptography). In late 2003, IDQ developed the first QKD product for data centers to protect data in transit. 20 years later, IDQ released its 4th generation of quantum key distribution systems and remains the market leader in quantum safe cryptography and quantum sensing solutions. It maintains close ties with academic institutions by participating in numerous research programs and plays a leading role in cutting-edge projects to drive innovation to the market.
To request more information or a quotation for any ID Quantique products, contact IL Photonics.