Issue #11
"Past and present"
Welcome to the 11th edition.
This week, I’ll be attending the PKI Consortium PQC conference in Amsterdam. If any readers are attending, let me know!
Meanwhile, let’s dive into the content…
Keep Calm, and Carry On Migrating
At last! The UK government has updated its guidance on post-quantum migration. Here are the key recommendations:
PQC algorithms and protocols should not be used in production until they are standardised.
Migration can be tackled during normal technology refresh cycles unless you are sharing highly sensitive long-term information.
ML-KEM-768 and ML-DSA-65 provide "appropriate levels of security and efficiency for most use cases".
Hybrid modes (which combine traditional and PQC algorithms) should be used judiciously, as an interim measure only.
See here for the full doc: https://www.ncsc.gov.uk/whitepaper/next-steps-preparing-for-post-quantum-cryptography.
The commentary on hybrid modes is the most novel part of the document. The NCSC describes scenarios where this might be useful but highlights the increased complexity and overheads. It also warns that limited research has been conducted on hybrid authentication use cases:
"With this in mind, technical system and risk owners should weigh the reasons for and against [hybrid] schemes including interoperability, implementation security, and protocol constraints, as well as the complexity, cost of maintaining a more complex system, and the need to complete the migration twice (once to a [hybrid] scheme and again to PQC-only algorithms as a future end state)."
The Great Wall of QKD Satellites
Reports suggest China plans to extend its network of QKD satellites, as well as deploying higher orbit experimental platforms.
China already leads the way on space-based QKD, having launched its first satellite in 2016.
In 2022, it launched a second QKD nano-satellite, which it claimed was orders of magnitude more effective than its predecessor.
By comparison, neither the US nor Europe has an operational QKD satellite yet.
The claims were reported on Tencent QQ and refer to a speech given at the 3rd China Space Science Conference by a leading CAS scientist: https://mp.weixin.qq.com/s/rNXAibyrJ3_jAbGKwsh0ng (note: Google Translate is your friend here).
Details are scant, but it seems like China plans to launch additional QKD satellites to form a network for secure communications. Other satellites will be launched into higher orbits for a wider range of quantum experiments.
Given the opacity of Chinese quantum claims, we should take the above with a pinch of salt. However, extending their lead in the space-based QKD is a very plausible strategy.
Finishing with Some History
In 1942, the Soviet Union made a critical mistake. They cut corners on their cryptography.
It cost them dearly. KGB spy rings were exposed in the UK, as well as the highest levels of the US government.
So what went wrong?
KGB agents encrypted data using one-time pads – the strongest form of cryptography. The sender and receiver used the same sheet of random numbers to encode and decode their messages.
In theory, this approach is infallible. But the Soviets cut corners and used the same pads multiple times. Historians suspected they couldn't produce pads fast enough and resorted to duplication.
US signals intelligence spotted this mistake and decrypted thousands of messages sent between 1942 and 1945. The decryption project, known as VENONA, exposed the Cambridge Spy Ring (in the UK) and espionage activity targeting the Manhattan Project.
It just goes to show that cryptographic mistakes are punished heavily at the nation-state level. Even with the limited technical resources available in the 1940s.