So my name is Kevin Borkner. I'm a PhD student at Cosec. Cosec focuses about everything.
Cryptography related at the University of Kyoliv and Belgium.
And I want to talk about quantum distance bounding, how to advance your proximity.
So the term quantum distance bounding basically divides into two areas.
So you have the quantum part in the distance bounding part.
The distance bounding part is a cryptographic protocol between two communicating parties.
These parties are communicating in such a way that you are able to estimate the physical distance between these two parties.
And quantum in this part basically means that we are relying on quantum mechanics to achieve this physical distance approximation.
Usually when I talk about quantum and cryptography, people confuse these two topics.
So we have quantum cryptography and quantum cryptography.
Post quantum cryptography is basically the development or the upgrade of our current classical cryptography,
because we have the advancements of short algorithm and gross algorithm,
and they currently break our classical systems.
That's why we are developing post quantum cryptography.
It's basically slapping more mathematics on the issues,
and it's not breakable even when we have access to large-scale quantum computers.
On the other hand, we have quantum cryptography, which basically relies on the magic of quantum mechanics.
So these systems are even safe when you have access to unlimited computing power.
In this talk, we're going to focus on the later ones.
So I'm not really, I think I'm the only one in this timetable who focuses on quantum cryptography
and not really on quantum computing in that sense.
All right, I want to start with a problem called a chess grandmaster problem.
So just imagine you have two countries that are involved with each other.
So you have country yellow and country green,
and there's an actual system that got developed during World War II called Identification Friend or Four.
And so how does it work?
So both countries have access to missiles and also two planes.
So what the missile does when it finds a plane flying above the territory,
it gives the plane a challenge, and this plane then responds to this challenge,
so the plane is not shut down.
It's identified as a friend.
So what happens if a missile finds a plane which turns out to be an enemy plane?
The plane, of course, or the pilot is smart, so what they are doing,
they take this challenge, reload it to an airline missile.
This airline missile finds an enemy plane.
The enemy plane doesn't want to get shot, of course.
So it responds to this challenge.
This challenge is really back to the plane and used as the response for the missile from the enemy system.
And with this concept, they're able to circumvent the whole thing and it's actually happened.
So people thought maybe there's an interesting way if we implement clever cryptography
to get rid of this whole problem, turned out that's not the case,
but there is something we can exploit and it's basically the fact that this blue black arrows take way longer
than the communication here on the green side.
So this was kind of the development of distance-bounding protocols,
so it will give you a really high level overview of distance-bounding protocols.
You have a trust-boundary which is pre-determined, so it's basically a physical distance.
You have two communicating parties, the very fire and the prouver.
And these parties are communicating with each other in a challenge response manner,
so what I basically told you, the very fire sensor challenge to the prouver,
the prouver responds to this challenge.
What the very fire does, the very fire stops the time how long it takes for the prouver
to respond to this challenge, once the response is there on the very fire side,
they can estimate the distance between these two parties.
As in this example, the prouver is outside of this trust-boundary, so access is denied.
If we have another party within this trust-boundary, then access is granted.
And if someone tries to trick the system by relaying the challenge, then access is also denied
as basically the slide I showed you before.
And we might be asking where's the quantum party here?
So the traditional or classical distance-bounding protocols,
they usually use as this medium-of-exchange classical bits,
but in our example, we will use Q bits for that.
So you might be asking, why are we doing this?
Why are we not sticking with traditional distance-bounding protocols?
So what's the motivation for quantum distance-bounding protocols?
So there are some issues on the physical layer for classical distance-bounding protocols.
So you have conversion delays from analog to digital communication,
and then you need to do the vice-versa conversion and this introduce some delays.
So the distance measurement isn't as accurate as any more.
Then people thought, okay, maybe switch to full analog processing thing,
so we will get rid of all the digital stuff, to full analog stuff.
Turns out it's also introduced some new attacks,
and people then thought some researchers, okay, how about we change the whole system.
Instead of using radio-frequency, we will use ultrasonic channels to slow the whole protocol down.
Turns out it's also introduced some attack vectors.
So you might be wondering, well, what are some possible applications for quantum distance-bounding?
Usually these two pop up in that case, so you have quantum networks,
which are basically fiber-based quantum networks,
where you have several parties communicating with each other, you have quantum repeater,
and it makes sense to imply quantum distance-bounding there,
to kind of check that these parties are the amount of part, as we expect them,
that they are, so we will kind of have an additional security measurement.
The same can also be applied to satellite to ground communication,
where you have free space links from Earth station and satellites.
And what I want to emphasize on, that to implement quantum distance-bounding protocols,
you don't need a hardware infrastructure upgrade.
If you have quantum networks already in place, it's basically a plug-and-play solution.
So we've talked about entanglement, and usually I'm sure some people already saw this exam,
but I will try to quickly explain entanglement with this one.
So just imagine you have a classical coin flip with two independent coins,
and you flip them at the same time, that's your experiment.
What you are looking for is the outcome, is you have tails tails or heads heads,
so you're looking for the same outcome.
If you have classical coins, you flip them at some stage,
at some point you maybe receive a certain result, tails and heads.
You repeat the whole experiment, and then by some chance you receive heads and heads.
So what I want to point out is that in the classical sense,
if you repeat this experiment a lot of times, then it makes you can have a probability of 50%
to have the same outcome, so tails tails or heads heads.
So what happens if you have some quantum coins that are entangled in a special way?
So you repeat the whole experiment, two coins, you flip them at a time,
then you receive tails tails, then you lie okay, that's crazy.
Let's repeat again, flip them two coins, then you receive heads heads heads.
And if you think like, okay, that's something is off.
Something strange is going on here, then I will congratulate you on this idea,
because you just had a similar idea as Albert Einstein, 93rd or 5.
Where he wrote a paper about it, can quantum mechanical description of physics really be considered complete?
Here the R, yes, that's basically it, you can read about it.
John Stuart Bell came up with the theory about it in 2022.
These three gentlemen's Ellen S. Beck, John F. Gloser and Anton Silinger.
They proved it with the experiments that quantum entanglement is actually a thing.
Okay, with this information, we're able to tackle the quantum distance bounding protocol on a really high level.
So as I told you, you have the two communicating parties.
Here on the left side, we have the very fire and on the right side, we have the proofer.
These two parties agree on a secret key, only known to these two parties.
And as I told you, they are communicating in a challenge response manner,
so the verifier sends the challenge to the proveer, the proveer then responds to this challenge.
The protocol starts by the verifier generating an entangled pair of particles.
Since one half of the particle to the proveer, the other half is kept by the verifier,
what a verifier, that's once this particle leaves the verifier, is it starts the clock.
This is used for this timing measurement that I told you before.
The verifier then, while this particle is flying, the cube is to the proveer,
the verifier measures their own particle and receives some result.
Once this particle reaches the proveer, the proveer also performs the measurement.
And as we learned by the slides before, these two measurements need to be correlated,
because they are basically this quantum coin flip that I just told you about.
So what the proveer then does, the proveer uses this measurement result as the one ingredient,
and the key as the second ingredient, to generate a new cube with this mixture,
then sent over to the verifier as the response.
So this flies to the verifier side, the verifier then stops the clock.
And as I told you this timing component is then used to estimate a distance between these two communicating parties.
So the verifier performs a measurement, and this measurement is determined by the private key.
And if the proveer, generally, did the action on their integral particle,
and if the proveer has access to the secret key, then these two measurement results on the verifier side should be the same,
which means that the proveer was successfully executed, and you can estimate a distance between these two communicating parties.
And you don't do this once, you do this a lot of times, because in quantum mechanics as we already learned,
you have this probabilistic thing, so an attacker has some chance to succeed if you do it only once,
but we repeat this whole proveer a lot of times, and can then use this distance to say how far these two parties are apart.
So in terms of contribution, I use a kiss kit for a lot of my simulations, basically all of them nowadays.
So I first simulated protocols, which are public in this repo.
And I also take, or we also take inspiration from traditional distance bounding protocols, what kinds of attack are applied there,
try to simulate them in our example, to kind of make sure that these do not apply an our protocol is safe, in that sense.
So we've written four papers, I only want, so to be honest.
The rest one is done by my promoters, so the two on the bottom, they do not even use entanglement,
so you only rely on this key, on the secret key, these two parties are sharing with each other.
The second bullet point is a protocol where we have entanglement, and there you have entanglement to have one execution of the whole protocol,
and with that you are able to authenticate not only the sort of verifies not able to authenticate only the proveer,
but also vice versa, so the proveer can authenticate a verifier.
And the first paper, and we will use, we use belts inequality, I won't touch on that, but it's basically an additional security measurement to really see that the proveer generally,
perform the actions on the received particle.
So what are the future plans for now this theoretical idea and theoretical protocol?
First step, should we have a former security analysis?
So what I told you about is that we are looking at some attacks in the traditional distance bounding protocols,
but we want to have a proper security proof in that sense, once this is done,
and we are finally sure that our protocol is secure, we move on to an experimental setup,
so I am in contact with some experimental physicists that already have some experience in that domain,
so we want to have this distance bounding quantum distance bounding protocol on a really small scale,
so in some lab setting, and once this is also working as intended, then we can scale this up to some bigger distance.
So the two final takeaways of this presentation are first with a quantum distance bounding protocol,
you are not only able to ensure who you are talking to, but you also able to identify how far the other party is apart from you,
and the second point is with quantum distance bounding protocol.
It's basically a plug-and-place solution, you have seamless integration in networks where you already have this quantum hardware in place.
That's it from my side, I am happy to take any questions.
Yeah?
So the question is the difference between the classical distance bounding and quantum distance bounding,
maybe I will skip to this slide, so I know I didn't cover all of the details how cubits work,
but I have some really interesting properties, so for classical distance bounding, you are exchanging classical bits, as we know them,
and for the quantum part, you exchange cubits for this part, and they have some interesting properties, as I said, this entanglement thing,
is once that make them unique, they have no cloning theorem, so you are basically not able to copy and paste, as we know it in our usual normal world,
and another property is when you have an eavesdropper that wants to make a measurement on this cubit, it basically destroys it.
So you are not able, if you have an eavesdropper on adversary that sits between these two communicating parties,
wants to pick up a cubit and read it, and then sense it over what this doesn't work.
That's a really fundamental physical thing in quantum mechanics.
So this is some advantage that we use, that's why we are translated to quantum distance bounding,
but the general idea is the same, so that is answer your question.
Can I follow you from there, then I understand that you cannot like to know it, but if you, but if ultimately what you want to do,
extend back the cubit with some additional stuff, or if you want to find that you are the friend of the enemy,
are you not also then able to descend the cubit that goes into you around and kind of do the same thing, as you have it.
So you're basically, what you're trying, the question is if you're not basically able to reflect or incoming cubit right as a challenge,
so it's basically sending a mirror in between.
Yeah, you get sent to like the cubit with some challenge.
Yeah, obviously you are, let's say the enemy in this case, so you know you can return the challenge correctly.
So you just send it to your own missile, which then sends it to you as if it's, oh, this is our own quantum thing,
but you know what I mean, like the same thing that happened in the war in the, yeah, yeah.
I will use maybe this, I don't know if it's answers your question, so basically sending the incoming cubit back,
I don't know if I cover this correctly.
So stop it.
No, what happened in the war war two, that you said was like that you send that challenge around basically to a friend,
so let's say 48, the challenge to 40 people to be kind of like, reply it to the missile that is connected to it,
and then you ask a plane from 48 to basically do this proof and when it sends it back,
kind of disrupted all the way back around.
But that's basically, so the question is if in this example, I showed with missiles and planes,
if it's not able to kind of root the cubit or the challenge in a clever way, right?
To mitigate the whole thing, but that's the timing component component that we have here, which makes it not possible.
So if someone tries to root anything, it's, so you have here sending the cubits or photons in that sense,
so you have to speed up light as fast as possible, so it can go any faster,
and you basically have this timing component, so it's not able for someone.
It would be spotted if you take your the cubit, send it to somewhere else, send it there,
and back and forth and it doesn't work.
So in another point, it's the secret key, so the thing is the proof that that's not only received the cubit,
but the proof also performs this action on the cubit, right?
So therefore, only if they have to access to the key, and also use the entangle cubit they received,
then they are able to send the correct response.
Okay, but also if the timing is kind of what makes the difference, the timing can also be used successfully.
Yeah, the timing is also a thing in the traditional distance bounding protocols.
That's not a unique thing to quantum distance bounding, but maybe we are having some issues,
but we can talk anywhere else after the presentation.
So I have two questions.
First of all, we have a mission to exchange a key at quantum distance bounding protocol.
So how do we have two parties choose the basis in which they imagine a key or a key?
Is it chosen random or in fixed basis?
So in this example, we have the orange basis, you there are fixed, in this example.
So we have this M correlation, and for this part we have the proof of the Peter question.
So the question is how are the basis chosen basically in the protocol?
For this example, the key basically determines the basis.
So if the key is binary, if the key is zero, and this thing then we use the computational basis,
and if it's one, we use the hard amount basis, and with this it verifies
also able to correctly decode the incoming keyword.
And that's like a question as well.
We have like physical properties of the human exchange.
Like at the end of the talk, you mentioned like military applications like IFF.
Yeah.
How would you exchange a coherent keyword stage in such a situation?
Like if you use polarised photons, you have to aim pretty precisely.
Yeah.
Yeah, that's right.
So the question is how to make this cubic exchange, also with regards to this military example, I showed in the beginning.
Yeah, that's right.
It also comes down to these applications of quantum distance bounding protocol.
And I have a lot of slides.
So here it's read forward for quantum networks.
Right.
You have fiber.
They are fiber based.
So it's easy to communicate.
But I get that's of course an interest and good point that you're pointing out here.
That the satellite or ground communication, they need to be really accurate in a certain angle to make this exchange possible.
And also you need to this line of size.
So it's also better dependent.
But yeah.
I'm not really on this physical side.
So I can't give you a satisfying answer on that sense.
But yeah.
Of course, there are, you have quantum key distribution.
I maybe you've heard of that.
Yeah.
There are also, they use this satellite to ground communication over a really, really long distance.
The Chinese did it with like, I don't know.
400, 500 kilometers.
So it's possible.
It's feasible.
But I don't know how they exactly pull this one off.
Yeah.
In our example, we want to have a communication from the ground to the satellite and
forward.
Back and forth.
If you want to authenticate the satellite, yeah.
Yeah.
That's a good point.
We're working on that.
On purpose that we are.
Is it possible to call it the question?
Is it possible to combine our quantum distance bounding protocol with quantum key distribution protocol?
And it is.
But I didn't mention it.
So the thing is the outcome of quantum key distribution protocol is this one time pad that
both parties agreed on.
And basically, you can first have a quantum key distribution protocol in our protocol afterwards.
It didn't mention it in this way because it may look like our quantum distance bounding protocol
depends on QKD, which is not the case.
You can also have some other kind of key exchange.
But of course, it's an easy target.
So it's an easy thing.
You can conclude those two and a really nice thing is that you have to same hardware on both sides.
So for quantum key distribution also for quantum distance bounding, you will use the same hardware.
So if it's already in place, why not also extend it?
Thanks, Kevin.