Evaluation of PUF and QKD integration techniques as root of trust in communication systems

Universidad de Sevilla Grado en F´ısica Evaluation of PUF and QKD integration techniques as root of trust in communication systems Trabajo de Fin de Grado Blanca A. L´opez R´ıos Tutores: Macarena Cristina Mart´ınez Rodr´ıguez Antonio Jos´e Acosta Jim´enez Departamento de Electr´onica y Electromagnetismo Facultad de F´ısica Sevilla, Junio de 2022 palabra A mi padre, por darme alas. Y a mi madre, por ponernos los pies en el suelo a los dos. Resumen La Criptograf´ıa Cu´antica podr´ıa ser la pr´oxima tecnolog´ıa clave en relaci´on a la seguridad de las comunicaciones pero, como toda nueva tecnolog´ıa, presenta problemas que deben ser resueltos antes de llegar a ser una realidad en el d´ıa a d´ıa. Este trabajo discute la integraci´on de Funciones F´ısicas No-Clonables (PUFs, por sus siglas en ingl´es) como soluci´on a la autenticaci´on de los extremos en un protocolo de comunicaci´on cu´antica. El uso de PUFs permitir´ıa la autenticaci´on de dispositivos sin necesidad de depender de terceros, adem´as de abrir la posibilidad a la conmutaci´on de canales de comunicaci´on cu´antica; dos caracter´ısticas nunca vistas en la Distribuci´on Cu´antica de Claves (QKD, por sus siglas en ingl´es) hasta ahora. Se analiza en detalle la integraci´on de PUFs en el protocolo BB84, ya que es la base de todos los protocolos de QKD, y se proponen dos esquemas de autenticaci´on distintos, atendiendo a las caracter´ısticas de los extremos de la comunicaci´on y la distancia entre ellos. Despu´es, estas propuestas se generalizan para el resto de protocolos de QKD. Adem´as, se estudian distintos tipos de PUF con el objeto de encontrar la m´as adecuada para nuestro prop´osito. i no ii Abstract Quantum Cryptography could be the next key technology in terms of secure communication, but, as with every new technology, it presents problems that need to be solved in order to become a reality in daily life. This work discusses the integration of Physical Unclonable Functions (PUFs) as a solution for the authentication of the endpoints in quantum communication protocols. The use of PUF constructions would allow the authentication of devices without the need of relying on third parties, and support switched trustworthy quantum communication channels; two unseen features in Quantum Key Distribution (QKD) until now. We analyze in detail PUF integration within the BB84 protocol, as it is the foundation for all QKD protocols, and two proposals for an authentication scheme are made, depending on the connection characteristics of the communication endpoints and the distance between them. These proposals are then generalized for other types of QKD protocol. Moreover, different types of PUF are analyzed to conclude which ones are the most suitable for our purpose. iii palabra iv Contents 1 Introduction 1 1.1 Cryptography and Public Key Distribution . . . . . . . . . . . . . . . . . . 1 1.2 Basic notions of Quantum Key Distribution . . . . . . . . . . . . . . . . . 3 1.2.1 Applications of Quantum Communication and QKD . . . . . . . . . 5 1.3 Basic notions of Physical Unclonable Functions . . . . . . . . . . . . . . . 6 1.3.1 What is a Physical Unclonable Function . . . . . . . . . . . . . . . 6 1.3.2 Using a PUF as authenticator . . . . . . . . . . . . . . . . . . . . . 7 1.4 Goalsandmotivations ............................. 9 2 The BB84 protocol 11 2.1 Protocoldefinition ............................... 11 2.2 Practical implementation . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13 2.2.1 Polarization encoded systems . . . . . . . . . . . . . . . . . . . . . 13 2.2.2 Phase encoded systems . . . . . . . . . . . . . . . . . . . . . . . . . 14 2.2.3 Frequency encoded systems . . . . . . . . . . . . . . . . . . . . . . 14 2.3 Conclusions ................................... 15 3 Integration of PUFs into the BB84 protocol 17 3.1 Adding an authentication step in the BB84 protocol . . . . . . . . . . . . . 18 3.2 Choosing the best authenticating PUF . . . . . . . . . . . . . . . . . . . . 19 3.2.1 First candidate: Optical PUF . . . . . . . . . . . . . . . . . . . . . 20 3.2.2 Second candidate: Ring Oscillator PUF . . . . . . . . . . . . . . . . 22 3.2.3 Third candidate: Butterfly PUF . . . . . . . . . . . . . . . . . . . . 23 3.3 Conclusions ................................... 25 4 Integration of PUFs into other QKD protocols 27 4.1 Prepare-and-measure-based protocols . . . . . . . . . . . . . . . . . . . . . 27 v Chapter 1 1.3. BASIC NOTIONS OF PHYSICAL UNCLONABLE FUNCTIONS 1.3 Basic notions of Physical Unclonable Functions 1.3.1 What is a Physical Unclonable Function A Physical Unclonable Function (PUF) is a device that takes advantage of inherent randomness introduced during manufacturing to give a physical entity an unique “fingerprint” [15]. PUFs are clone proof, cost efficient and resistant to various physical attacks. The output produced by a PUF (suitable to be used as a key) is internal to the device and is not assigned by an outside source (thus, the random variation is analogous to an unique fingerprint). For each PUF, an input query or “challenge” receives an instance specific output or “response”, a process known as a Challenge-Response Pair (CRP). A CRP can be lodged and then later used to identify the authenticity of a PUF. Remote authentication is also possible once the CRP is recorded in a secure database only known by the trusted party (server). Although there are many PUF constructions, we can divide them into two broad categories [16]: weak PUFs and strong PUFs. The names of the groups can be misleading, as the names are not related to the level of security provided by the PUF, instead, the two categories differ in the use the PUFs are given. Weak PUFs have a small CRP space, that is, they can provide a small number of values2. As a consequence, if an attacker can physically access the PUF, they would gain the full set of CRP for any given time, and even if the PUF cannot be physically copied, the knowledge of the full set of CRPs will surely be enough to simulate the PUF behaviour (in our terms, Eve could impersonate Bob at any time). Weak PUFs are generally utilized for key reconstruction and as source of entropy for the generation of Number used Only Once (nonce)3and seeds. On the other hand, strong PUFs have a very large CRP space, so large that even if an attacker can access the PUF at a given time, it would not be possible for them to record all of the CRPs. This implies that no one but the user with physical access to the PUF at the time where the challenge is received can give the correct response to be authenticated. This is why strong PUFs are usually implemented for identification and authentication processes. However, since strong PUFs generally do not have any protection that prevents an eavesdropper from challenging the PUF and getting a response, they are vulnerable against numerical modelling attacks. 2We are talking about low hundreds. 3An arbitrary number used just once in a crypthography exchange. 6 1.3. BASIC NOTIONS OF PHYSICAL UNCLONABLE FUNCTIONS Chapter 1 We can make another classification of PUFs, according to the implementation process of the PUF in an Integrated Circuit (IC): non-silicon PUFs, which require special fabrication steps, and silicon PUFs, which can be implemented by standard manufacturing processes [17]. As said, non-silicon PUFs can only be implemented in ICs by adding special fabrication steps, making them costlier and more difficult to install in a device. They base their CRPs on the measurements over a special layer of deposed material that contains some kind of embedded elements. Examples of this type of PUFs are coating PUFs [18], which incorporate a layer of dielectric material containing dielectric particles of different electrical permittivity and base its CRPs in the measurement of the capacitance of said layer, and optical PUFs [19], which consist of a thin layer that contains light scattering particles that produce a speckle pattern when irradiated with a laser beam. The optical PUF will be discussed in more depth in Chapter 3. Alternatively, we have silicon PUFs, which exploit the small variations that occur in the Complementary Metal-Oxide-Semiconductor (CMOS) manufacturing process of an IC. Depending on the parameter selected to make the PUF, we have different types of silicon PUF, being able to classify them into three subgroups [17]: leakage-current-based PUFs [20], which are based on the different leakage current consumption that different physical realizations of the same circuit have, delayed-based PUFs as arbiter PUFs [21] and Ring Oscillator (RO) PUFs [22] [23], which exploit the fact that even implementig identical layout masks, the manufacturing process inserts delays in different realizations of the same circuits, and memory-based PUFs as SRAM PUFs [24], butterfly PUFs [25] and NOR PUFs [26], which use cross-coupled circuits that count with two stable opperating points and one unstable opperating point, when the circuit is not driven by any input, the mismatches between the two ideally symmetrical parts of the cross-coupled circuit make the circuit go more often to one of the two stable states. Later in this work, we will analyze RO and butterfly PUFs in more detail. As we have said, strong PUFs are usually implemented for identification and authentication processes. Therefore, we will focus on them, as our goal is to set a PUF-based ID to overcome the QKD flaw: being sure you are sharing the key with the right person. 1.3.2 Using a PUF as authenticator Currently, the PUF-derived key is usually presented in a symmetric manner, the first type of scheme we discussed in Section 1.1. The verifier who enrols the PUF key and the PUF 7 Chapter 1 1.3. BASIC NOTIONS OF PHYSICAL UNCLONABLE FUNCTIONS (a) Symmetric scheme. (b) Asymmetric scheme. Figure 1.4: PUF key scheme for device authentication [27]. device (prover) restores the same key (in essence: if Alice wants to verify that it is Bob who is receiving the message, she must know his PUF beforehand) [27]. This scheme is shown in Figure 1.4a, where the PUF device counts with a key generator, which is used to derive an actual key suitable for symmetric cryptographic algorithms. Using a PUF- based symmetric scheme authentication would not be any better than using a shared-key authentication scheme, not adding any extra security layer. On the other hand, PUFs can also offer us an asymmetric scheme: a PUF device with its key generator, derives a key that meets the constraints imposed by an asymmetric cryptographic algorithm and can be used directly as a private key. Then, a corresponding public key is generated, building upon the private key and being broadcasted on a publickey server [27]. This scheme is shown in Figure 1.4b. Another possibility of creating a public and private key pair is to use the PUF to produce a stream of random bits which, combined with another random number source (or sources), is used to seed a public-private key pair generation process [28]. The advantage of this asymmetric key setting is that the private and public key pair is bound to the PUF device. Any party can now conveniently authenticate this PUF device by sending a nonce and accepting the PUF authenticity if the private key signature (that is, the nonce signed) is correctly verified by using the public key. Secure device-to-device communication is naturally enabled, and only the intended PUF device can apply the private key to open/decrypt the message encoded by its public key [27]. This application can be seen in Figure 1.5. 8 1.4. GOALS AND MOTIVATIONS Chapter 1 Figure 1.5: PUF asymmetric key scheme application for device authentication [27]. 1.4 Goals and motivations Threatened by the increase of computational power and the evolution of cryptanalysis techniques, cryptography has to implement new technologies and schemes in order to ensure security against new strong attacks. QKD provides a scheme for secure key sharing relying on Quantum Mechanics Principles. Although the information is physically secure in this scheme, the endpoints need to be sure they are sharing this information with the right peer, i.e. they need mutual authentication in order to ensure totally secure communication. Nowadays, this authentication presents two problems: first, it is traditionally done by the use of special certificates, relying its security on an external third party with human intervention [13]; second, the authentication schemes do not allow the use of switched QKD channels: every time a new connection between two endpoints is established, the human-mediated process has to be repeated [11]. This work analyzes a possible solution for these authentication issues, using special PUF constructions, addressing both: the need of an external trusted third party and the limitations for switched QKD channels. The structure is as follows: in Chapter 2, the BB84 protocol is explained in depth, as it lays the foundations for all the other QKD protocols. Next, in Chapter 3, the integration of a PUF-based authentication into the BB84 protocol is analyzed; firstly, discussing the theoretical authentication scheme (Section 3.1), and secondly, evaluating which type of PUF is the most appropriate for it (Section 3.2). In Chapter 4, other QKD protocols are taken into account, exploring the integration of a PUF-based authentication scheme 9 Chapter 1 1.4. GOALS AND MOTIVATIONS within them. Finally, Chapter 5 gathers the conclusions of this dissertation. 10 Chapter 2: The BB84 protocol When you change the way you look at things, the things you look at change. – Wayne Dyer The BB84 protocol is a discrete variable coding named after its inventors, Charles Bennet and Gilles Brassard, and the year of its first publication (1984) [29]. This protocol was the first quantum cryptography protocol and laid the foundation for following proposals. 2.1 Protocol definition The protocol is as follows: 1. Alice prepares a random set of qubits selected from one of the next four states: Base 1 ↔   |Φ0i=|0i |Φ1i=|1i    (2.1) Base 2 ↔   |Φ+i=1 √2(|0i+|1i) |Φ−i=1 √2(|0i−|1i)    (2.2) and send them to Bob via a quantum channel. Note that each pair of states forms a base of a two-dimension quantum space; therefore, the conditions hΦ0|Φ1i= 0 and hΦ+|Φ−i= 0 corresponding to scalar products between states have to be satisfied. At the same time, states in the different bases defined are not orthogonal and have maximum overlapping1. This means that there is no measurement procedure capable of determining with 100% certainty the specific state in which Alice prepared the qubit. 1Overlap is the meassure of the diferrence between two quantum states, i.e | hΦa|Φbi |. 11 Chapter 2 2.1. PROTOCOL DEFINITION 2. Bob receives the qubits and randomly chooses one of the two possible bases to measure, performs the measurement, and records the results. 3. Bob uses a public channel to announce to Alice the position and the base used to measure each bit (without indicating the result of this measure). This sequence is called the raw key. 4. Alice and Bob keep the bits for which the base employed in the enconding and the decoding processes coincide and discard the rest2. This generates what is called the sifted key, which has the length of around half of the bits originally sent (due to Bob having 50% chance to choose the right base). Figure 2.1: A basic sketch of Quantum Key Distribution [30]. There is no mechanism to prevent the interception of the qubits sent in the first step by an unwanted eavesdropper (Eve). So it is thought possible for Eve to know part of the key. Anyway, the QKD system allows Alice and Bob to detect the presence of an intruder. Note that, as Bob, Eve has to choose one of the bases described in Step 1 to perform the measurement and determine the incoming state. Therefore, she has a 50% chance of employing the incorrect base, resulting in a disagreement between what Bob detects and what Alice had sent. Using this fact, Alice and Bob have a really simple way to detect Eve: they just have to perform an error detection check by sharing a subset of the bits. If the error rate is high, they discard the key and start over. If the error rate is 2If Bob measures a qubit in the original base it was sent, they can be sure both have the same value for that specific bit. 12 2.2. PRACTICAL IMPLEMENTATION Chapter 2 small, Alice and Bob can carry out other processes known as error correction and privacy amplification over the rest of the bits in the key that have not been made public. While a quantum error correcting protocol is necessary to preserve quantum states against noise and other unwanted interactions that may occur during the communication process [31], privacy amplification is a general cryptography technique for distilling highly secret shared information from a larger body of shared information that is only partially secret [32], i.e. privacy amplification is used to counteract the knowledge Eve may have acquired by spying the communication. The unconditional security of the BB84 protocol has been proved with different methods [33] [34]. 2.2 Practical implementation Let us now discuss the most relevant methods for the implementation of the BB84 protocol [35]. 2.2.1 Polarization encoded systems In this scheme Alice has four laser diodes which emit photon pulses polarized at −π 4, 0, π 4 and π 2rad. For a given bit, only one diode is triggered. After a set of attenuating filters, just a photon is sent for each bit, encoding the information in its polarization. These photons travel by optic fiber to Bob’s location, where they are extracted and put through a set of waveplates designed to restore the initial polarization states, which may have suffered a little transformation due to the fiber path. Then, they reach a Beam- Splitter (BS), responsible of implementing the random base choice and finish their route travelling through a polarizing BS (for base 1 photons are analyzed in a vertical-horizontal filter and for base 2 they go through a diagonal filter) endend in two photon-countig detectors. As an example, let us take the values of Figure 2.2 (this is: bit=0 if the polarization is π 2or π 4rad, and bit=1 if the polarization is 0 or −π 4rad). Imagine that a 0 rad polarized photon prepared by Alice reaches the symmetric BS and it is randomly transmitted to “base 1”, it will surely be counted as “1”, thus the used filter does not change its state. On the other hand, when it reaches the symmetric BS, it has 50% chance to be transmitted to “base 2”, where the used filter will transform the original state, producing an uncertain result. 13 Chapter 2 2.2. PRACTICAL IMPLEMENTATION Figure 2.2: Polarization encoding scheme [2]. 2.2.2 Phase encoded systems This scheme is based on the properties of interferometers, and the coding is implemented by changing the relative optical path lengths or phase between the internal arms of an interferometer. In these systems, Alice and Bob share an interferometer, each of them controlling a phase modulator in their respective half. The probability of counting a photon sent by Alice as 1 or 0 varies due to an interference phenomenon related to the phase difference ∆ϕ=ϕA−ϕB(in an identical manner to the classical interference pattern). For example, imagine that the device is built to give a 0 if ∆ϕ= 0 rad and return a 1 if ∆ϕ=πrad. Halfway values will not be deterministic: if ∆ϕ=±π 2rad the photon is equally likely to be counted as 0 or as 1. As in every other QKD design, if any measurement is applied over the system (even if it is “just” to locate the photon, i.e. know in which arm of the interferometer it is) the information is lost. The main flaw of using this strategy is the complexity of keeping the path difference stable when the distance between Alice and Bob is larger than a few meters. 2.2.3 Frequency encoded systems In these systems, Alice has a source that emits short pulses of monochromatic light with a frequency ω0. The beam goes through an Electro-Optical Modulator (EOM) that mod- 14 2.3. CONCLUSIONS Chapter 2 ulates its phase with a radio frequency Ω << ω0and a small modulation depth. This process generates two sidebands at frequencies ω0±Ω. The EOM is driven by a radiofrequency local oscillator whose phase, ϕA, can be changed between four values: 0, πand π 2,3π 2, which implement the pair of conjugated bases. Before being sent, the signal is attenuated to ensure that it contains only one photon per bit. When the photon arrives at Bob’s location, it experiences a second modulation by another EOM, which has its own local oscillator with the same frequency Ω and a phase ϕBthat can be varied among two values: 0 and π 2which represent the choice between bases that Bob has to make to measure the qubits. The sidebands at frequencies ω0±Ω are mutually coherent and thus interfere. These designs are controlled by the phase of the radiofrequency oscillators, which is six orders of magnitude smaller than the optical frequency and thus easier to stabilize and synchronize. 2.3 Conclusions The BB84 protocol is the most widely known QKD protocol, as it was the first of its kind and laid the groundwork for the following proposals. We have analyzed the protocol steps, that can be divided in a first part where qubits are involved (Step 1 and Step 2) and a second part where classical information needs to be exchanged (Step 3 and Step 4). An error detecting check, quantum error correction and privacy amplification are then performed. This protocol can be implemented in several ways, being the use of polarization encoded systems the most used. The security of this protocol has been proved in the literature, as long as the channels used in the processes are authenticated. 15 Chapter 3 3.2. CHOOSING THE BEST AUTHENTICATING PUF device. This is not possible in many other types of PUF because they usually rely on an IC characteristic and the only solution to obtain a new PUF is to change said IC for a new one. While the possibility of having virtually infinite PUFs with just one device is really appealing, it is important to note that optical PUFs are really sensitive to environmental factors: temperature, humidity, movement, and ageing can seriously damage the device, which is also difficult and expensive to integrate in an already built device compared to other types of PUF; as shown in Table 3.2. 3.2.2 Second candidate: Ring Oscillator PUF An oscillator is a circuit that converts a DC signal into an alternating signal with a specific frequency. A RO is a type of oscillator formed by an odd number of inverter gates. A specific frequency can be achieved by changing the number of inverter gates. A RO PUF [22] exploits the random but static variations between the frequencies of two allegedly identical ROs. For each comparison of a pair of ROs, we get a bit of information; that is, a PUF formed by n identic ROs could produce n! 2!(n−2)! response bits. But to use these responses as a PUF-based ID we need these bits to be uncorrelated. Otherwise, Eve could deduce the entire ID code by knowing some of the bits. It has been proven that the frequency of a RO on a chip is influenced by its location on the chip [24]. Ideally, we could eliminate this correlation effect by analyzing the distribution of the RO frequencies, but this process can be costly and certainly timeconsuming. As an intermediate solution, to counteract the correlation between bits, the ROs are placed as close as possible and compared only with adjacent ROs. A pessimistic estimate assuming maximum correlation leaves us with (n-1) independent bits for a PUF of n-ROs. To use a PUF as an ID, we need it to be reliable. That is, we need it to respond the same way for a given challenge without changing when things like temperature and supply voltage fluctuate. As shown in Table 3.2, RO PUFs deal really well with this type of environmental variation, contrary to what we had with optical PUFs. However, it is true that alterations in the voltage supply deteriorate the uniqueness of the PUF [22]. Uniqueness measures how accurately the PUF can identify the device where it is implemented; therefore, if we lose uniqueness, we lose the ability to distinguish two different emitters or receivers. RO PUFs are really easy to install because we can build them in ordinary Field 22 3.2. CHOOSING THE BEST AUTHENTICATING PUF Chapter 3 Figure 3.3: 5-stage RO output [44]. Programmable Gate Arrays (FPGAs) and require a very small area. A 5-stage RO PUF (which provides us with 4 independent bits) needs almost a full Configurable Logic Block (CLB), so, to get a 2048 bit key, we would need 512 CLBs, which is totally affordable in a typical FPGA [43]. RO PUFs do present a little disadvantage over other types of PUF: we need some time to obtain the desired response, as the frequencies of the ROs must be stabilized. The output of a 5-stage RO can be seen in Figure 3.3. As shown, the RO needs almost 1 ms to stabilize. 3.2.3 Third candidate: Butterfly PUF A butterfly PUF [25] is a cross-coupled circuit that behaves as shown in Figure 3.4: it can be brought to an unstable state before allowing it to settle to one of two possible stable states. To achieve this performance, we can use two latches3that bring opposite values when excited with high voltage (this is, for high voltage, Latch 1 gives a 1 and Lacth 2 gives a 0); as a result, when applying this voltage we bring the complete circuit to an unstable point, as both latches have opposite signals on their outputs. When the applied voltage is reduced, the butterfly PUF cell goes to one of the two possible stable states, 3A latch is a circuit which retains whatever output state results from a momentary input signal until reset by another signal. 23 Chapter 3 3.2. CHOOSING THE BEST AUTHENTICATING PUF Figure 3.4: Example of cross-coupled circuit behaviour [25]. 0 or 1, depending on the differences in the delays of the connecting wires, which are designed as symmetric as possible and similar to every other butterfly PUF cell that may be installed in the device, ensuring that the variation of the responses is based on the intrinsic characteristics of the IC. A circuit diagram of a butterfly PUF cell is shown in Figure 3.5. Figure 3.5: Butterfly PUF cell scheme based on a cross-coupled circuit of two latches [25]. This type of PUF can be easily implemented in any FPGA, making it a really cheap and simple way to add an authentication PUF-based device to our communication end- 24 3.3. CONCLUSIONS Chapter 3 point. Another advantage of a butterfly PUF is that its responses are directly binary; meanwhile, other PUFs (as we saw when discussing the optical one) need further processing to achieve a digital output. Also, butterfly PUF responses are obtained almost instantaneously, in contrast to other types, such as the RO PUF. 3.3 Conclusions We have discussed first the correct position of an authentication step inside the BB84 protocol, concluding that depending on how far away our endpoints are, and by which infrastructure are they connected, it is more appropriate to use a scheme with two authentications or a scheme with only one right before starting the classical communication. If Alice and Bob are separated more than a few tens of kilometers and their quantum and classical channels share the same physical infrastructure, it would be better for the communication process to rely on two authentications: one before starting the protocol and the other in the middle, before classical communication starts. If Alice and Bob are closer than a few tens of kilometers, it would be better in terms of time consumption and easiness to do just one authentication in the middle of the protocol, after sending the qubits and right before Alice and Bob start sharing classical information. Even if the channels share its infrastructure. This is due to the fact that we have discussed earlier: Alice will not always mistake Bob at the beginning of the communication, saving an authentication round. If we have any other circumstances, for example, if they are separated more than a few tens of kilometers but the two communication channels do not share their infrastructure, other things like the encoding system or the authentication protocols available for each channel must be taken into account. In general, it will be easier to use the twoauthentication scheme, as the authentication protocols are usually faster than the sifted key rates presented in Table 3.1 for different BB84 encoding systems. Second, we discussed which type of PUF was better for integrating it as an ID for the devices located at our endpoints (i.e. Alice and Bob devices), analyzing different parameters such as environmental sensitivity and implementation difficulty. After a first filter, we limit our candidates to three: optical, RO and butterfly PUFs. In most applications, the butterfly PUF would be our final choice, as it presents an easy, cheap, and reliable source of achieving a PUF-based ID for a device. On the other hand, we have seen that optical PUFs, as reconfigurable PUFs, give us the chance of renewing our ID (if, for example, an attacker becomes capable of modelling its responses) 25 Chapter 3 3.3. CONCLUSIONS without having to modify the device. Although optical PUFs are definitely more expensive and sensitive than butterfly PUFs, the fact that they are reconfigurable may be a decisive attribute when the aim is to protect a device at an endpoint exchanging highly sensitive information, as changing the physical structure of the PUF might be complex if it has to be done several times in a short period of time. 26 Chapter 4: Integration of PUFs into other QKD protocols Something that looks like a protocol but does not accomplish a task is not a protocol - it’s a waste of time. – Bruce Schneier We have focused on analyzing the BB84 protocol, as it was the first protocol proposed for QKD and it is the foundational reference for most today’s practical implementations. However, tens of QKD protocols have been proposed since the publication of Bennet and Brassard in 1984. We can divide QKD protocols into two categories [45]: prepare-and-mesure-based protocols and entanglement-based protocols. 4.1 Prepare-and-measure-based protocols As the name suggests, in this first type of protocol, the emitter “prepares” the information in the form of qubits and sends them to the receiver, relying on Heisenberg’s Uncertainty Principle to protect the information against eavesdroppers. BB84 belongs to the prepare- and-measure category. Some other protocols of this type are the B92 protocol [46], which is a simplification of the BB84 which only uses two encoding states, the SSP protocol [47], which can be seen as a version of the BB84 with an additional base of the quantum space, the SARG04 protocol [48] and the S13 protocol [49]. The analysis we have made for the BB84 protocol can be applied to any of these prepare-and-measure protocols due to the similarities that all of them share. In recent years, a different kind of prepare-and-measure protocol has been proposed. An optical field admits two interpretations: a system of single photons or a wave that 27 Chapter 4 4.2. ENTANGLEMENT-BASED PROTOCOLS travels in space with observable phase and amplitude. While all the protocols presented above work with the first interpretation, this new type of protocol, known as Continuous- Variable (CV) protocols, uses the wave interpretation. Altough in both cases we have to deal with the problems of noise and loss in transmission, the second interpretation comes with an advantage: detecting and measuring the phase and the amplitude of an optical wave is more efficient in operational conditions, suitable for its widespread application. Basically, CV protocols use the quadrature modulations and measurements of phase and amplitude from a bright laser to encrypt the information [50]. Depending on the protocol, the preparation and measurement processes will differ, and as we saw in the BB84 this will surely affect the secure key rates provided by the protocols. Publications on CV protocols have reported faster secure key rates [51] than discrete-variable protocols, predicting a record of 3 Mbit/s at a distance of 30 km. Although it is a huge improvement over the values presented in Table 3.1 for the different practical implementations of the BB84 protocol, it can be seen [51] that the secure key rate in CV protocols drops drastically when distances are greater than 100 km. Therefore, a two-authentication scheme would still be more efficient when Alice and Bob are separated by more than some tens of kilometers. 4.2 Entanglement-based protocols Two particles are said to be entangled if the state of the system both form cannot be written as a product as a state-vector for each particle [52]. Imagine a system of two particles, each of spin 1 2, in a state that can be written as: |Ψi=1 √2(|+i1|−i2±|−i1|+i2) (4.1) Here |+iand |−i impplies positive and negative projection of the spin on the z-axis respectively, and the subscript indicates the particle to which the ket belongs. Imagine now that these two particles (each described as 4.1) are separated, and that we measure one of them. The state collapse due to the measurement would fix not only the projection value of the measured particle, but also the projection value of the other one. For example, if we measure particle 1 and it gives a positive projection of the spin as a result, we can be sure that measuring particle 2 would have a negative projection outcome. Entanglementbased QKD bases its protocols on this phenomenon. The first entanglement-based protocol was proposed by Artur Ekert in 1991 [53], 28 4.3. CONCLUSIONS Chapter 4 followed by Bennett, Brassard and Mermin in 1992 [54], and the DPS (2003) and the COW (2004) protocols [55] [56]. In these schemes, one member of an entangled pair is sent to Alice, the other one is sent to Bob, and measures are made at both endpoints. For this kind of protocol, a record for a secure key rate of 1 Gbit/s has been reported using Superconducting Nanowire Single-Photon Detectors (SNSPDs) over a distance of 1 m [57]. Another research [58] has reported a secure key rate of 300 bit/s over an atmospheric free-space link with a distance of 143 km between the Canary Islands of La Palma y Tenerife. Some promising technologies such as quantum repeaters could help to improve these rates, but nowadays they are all theoretical and definitely difficult to implement. This discussion has led us to the same conclusion we had with the prepare-and- measure protocols: until we have the technology to ensure faster QKD secure key rates over distances greater than a few tens of kilometers, it is better to rely on two classical authentication processes whenever a connection is established. 4.3 Conclusions After analyzing all the differents types of QKD protocol, we have come to the same conclusion we had for the BB84 protocol: only in cases where the endpoints of the communication are closer than a few tens of kilometers, using the scheme with just one authentication before the classical information exchange would be more appropiate. Nowadays, the technology available does not allow high enough secure key rates for greater distances, hence relying on a scheme with two PUF-based authentication ensure more speed in the general communication process than having to re-do a process involving quantum information (i.e having to resend the qubits). Our PUF choices have not changed, as in every proposed protocol, Alice and Bob’s devices do not differ in their classical physical abilities, matching the data shown in Table 3.2. Therefore butterfly PUFs would be our choice for ordinary endpoints, while optical PUFs would be more appropiate for more sensitive endpoints. 29 Chapter 4 4.3. CONCLUSIONS palabra 30 Chapter 5: Conclusions Alea iacta est. – Julio C´esar QKD is one of the key paths in the evolution of cryptography. But it still has a long way to go before it can be implemented in today’s infrastructures. In this work, we have tried to take a small step to make QKD a daily reality, using accessible technologies to add a needed authentication process inside QKD protocols. Firstly, we analyzed the most relevant QKD protocol, the BB84 protocol, proposing two different authentication schemes depending on the characteristics of the endpoints we are trying to connect. The first scheme, proposed for distances less than a few tens of kilometers, counts with one authentication step before the classical communication within the protocol starts. We proposed a second scheme for distances larger than a few tens of kilometers, and discussed the advantages of authenticating twice inside the BB84 protocol, once before the start of the protocol and once before starting the classical communication, as the authentication processes are much faster than processes that involve sending quantum information between distant points. Secondly, we discussed the best PUF construction to use as the authentication device at the QKD protocol endpoints. We reduce our options to two final candidates, the optical PUF and the butterfly PUF, arguing that the optical PUF would be more appropriate for endpoints that require special security needs, while the butterfly PUF (easier to install and preserve) would be our final proposal for an authenticator PUF in regular communication exchanges. After analyzing and giving an answer for the BB84 protocol, we looked at other types of QKD protocols, relying on the secure key rates reported in the literature to argue the convenience of the two possible authentication schemes proposed for the BB84 protocol. As long as technologies such as quantum repeaters are out of hand, we found that secure key rates drop drastically when distances of more than a few tens of kilometers 31 BIBLIOGRAPHY [28] B. Cambou, M. Gowanlock, B. Yildiz, D. Ghanaimiandoab, K. Lee, S. Nelson, C. Philabaum, A. Stenberg, and J. Wright. Post Quantum Cryptographic Keys Generated with Physical Unclonable Functions. Applied Sciences, 11(6), 2021. doi: 10.3390/app11062801. [29] C. H. Bennett and G. Brassard. Quantum cryptography: Public key distribution and coin tossing. Theoretical Computer Science, 560:7–11, 2014. doi: 10.1016/j.tcs. 2014.05.025. Theoretical Aspects of Quantum Cryptography – celebrating 30 years of BB84. [30] M. Haitjema. A Survey of the Prominent Quantum Key Distribution Protocols. Washington University in St. Louis, 2007. URL https://www.cse.wustl.edu/ ˜jain/cse571-07/ftp/quantum/. Last visited: June 2022. [31] E. Knill and R. Laflamme. Theory of quantum error-correcting codes. Physical Review A - Atomic, Molecular, and Optical Physics, 55:900–911, 1997. doi: 10.1103/ PhysRevA.55.900. [32] A. M. Abbas, S. El-Kassas, and A. Goneid. Privacy Amplification in Quantum Cryptography BB84 using Combined Univarsal - Truly Random Hashing Implementing security typed applications. IJINS, 3:98–115, 2014. URL http://ijins.iaescore. com/index.php/IJINS/article/view/20288. Last visited: June 2022. [33] P. W. Shor and J. Preskill. Simple Proof of Security of the BB84 Quantum Key Distribution Protocol. Phys. Rev. Lett., 85:441–444, 2000. doi: 10.1103/PhysRevLett. 85.441. [34] B. Kraus, N. Gisin, and R. Renner. Lower and upper bounds on the secret-key rate for quantum key distribution protocols using one-way classical communication. Physical Review Letters, 95, 2005. doi: 10.1103/PhysRevLett.95.080501. [35] A. Ruiz-Alba, D. Calvo, V. Garc´ıa-Mu˜noz, A. Mart´ınez, W. Amaya, J.G. Rozo, J. Mora, and J. Campmany. Practical Quantum Key Distribution based on the BB84 protocol. Waves Magazine, 1(3):4–14, 2011. URL http://hdl.handle.net/ 10251/53967. Last visited: June 2022. [36] J. Vinod and M. Srinivas. 6 - Emerging Trends in Packet Optical Convergence. In Network Convergence, pages 525–552. Morgan Kaufmann, 2014. doi: 10.1016/ B978-0-12-397877-6.00006-0. 38 BIBLIOGRAPHY [37] X. Tang, L. Ma, A. Mink, A. Nakassis, H. Xu, B. Hershman, J. Bienfang, D. Su, R. F. Boisvert, C. Clark, and C. Williams. Quantum key distribution system operating at sifted-key rate over 4 Mbit/s. In Eric J. Donkor, Andrew R. Pirich, and Howard E. Brandt, editors, Quantum Information and Computation IV, volume 6244, pages 182–189. International Society for Optics and Photonics, SPIE, 2006. doi: 10.1117/ 12.664455. [38] Y. Liu, T. Y. Chen, J. Wang, W. Q. Cai, X. Wan, L. K. Chen, J. H. Wang, S. B. Liu, H. Liang, L. Yang, C. Z. Peng, K. Chen, Z. B. Chen, and J. W. Pan. Decoy-state quantum key distribution with polarized photons over 200 km. Optics Express, 18: 8587–8594, 2010. doi: 10.1364/OE.18.008587. [39] A. R. Dixon, Z. L. Yuan, J. F. Dynes, A. W. Sharpe, and A. J. Shields. Gigahertz decoy quantum key distribution with 1 mbit/s secure key rate. Optics Express, 16: 18790–18797, 2008. doi: 10.1364/OE.16.018790. [40] J. Cussey, F. Patois, N. Pelloquin, and J. M. Merolla. High Frequency Spectral Domain QKD Architecture with Dispersion Management for WDM Network. In OFC/NFOEC 2008 - 2008 Conference on Optical Fiber Communication/National Fiber Optic Engineers Conference, pages 1–3. IEEE, 2008. doi: 10.1109/OFC.2008. 4528717. [41] J. Guajardo, S. S Kumar, G. J. Schrijen, and P. Tuyls. Physical Unclonable Functions and Public-Key Crypto for FPGA IP protection. In 2007 International Conference on Field Programmable Logic and Applications. IEEE, 2007. doi: 10.1109/FPL.2007. 4380646. [42] U. R¨uhrmair, C. Hilgers, S. Urban, A. Weiersh¨auser, E. Dinter, B. Forster, and C. Jirauschek. Optical PUFs Reloaded. Cryptology ePrint Archive, paper 2013/215. URL https://eprint.iacr.org/2013/215.pdf. Last visited: June 2022. [43] V. Betz and J. Rose. VPR: A new packing, placement and routing tool for FPGA research. In W. Luk, P. Y. K. Cheung, and M. Glesner, editors, Field-Programmable Logic and Applications, pages 213–222. Springer Berlin Heidelberg, 1997. doi: 10. 1007/3-540-63465-7 226. [44] M. F Ali. Manufacturing and Modeling of an Organic Thin Film Transistor. PhD thesis, Military Technical College (Egypt), 2016. 39 BIBLIOGRAPHY [45] A. I. Nurhadi and N. R. Syambas. Quantum Key Distribution (QKD) Protocols: A Survey. In Proceeding of 2018 4th International Conference on Wireless and Telematics, ICWT 2018, pages 1–5. Institute of Electrical and Electronics Engineers Inc., 2018. doi: 10.1109/ICWT.2018.8527822. [46] C. H Bennett. Quantum Cryptography Using Any Two Nonorthogonal States. Physical Review Letters, 68:3121–3124, 1992. doi: 10.1103/PhysRevLett.68.3121. [47] H. Bechmann-Pasquinucci and N. Gisin. Incoherent and Coherent Eavesdropping in the 6-state Protocol of Quantum Cryptography. Physical Review Letters, 59:4238– 4248, 199. doi: 10.1103/PhysRevA.59.4238. [48] V. Scarani, A. Ac´ın, G. Ribordy, and N. Gisin. Quantum Cryptography Protocols Robust against Photon Number Splitting Attacks for Weak Laser Pulse Implementations. Physical Review Letters, 92, 2004. doi: 10.1103/PhysRevLett.92.057901. [49] E. H. Serna. Quantum Key Distribution From A Random Seed. arXiv, 2013. doi: 10.48550/arXiv.1311.1582. [50] O. Thearle. Protocols and Resources for New Generation Continuous Variable Quantum Key Distribution. PhD thesis, Australian National University (Australia), 2017. URL https://anuquantumoptics.org/pdf/theses/2017thearle.pdf. Last visited: June 2022. [51] X. Tang, R. Kumar, S. Ren, A. Wonfor, R. V. Penty, and I. H. White. Performance of continuous variable quantum key distribution system at different detector bandwidth. Optics Communications, 471, 2020. doi: 10.1016/j.optcom.2020.126034. [52] A. Whitaker. The new quantum age: from Bell’s theorem to quantum computation and teleportation. Oxford University Press, reprint edition, 2016. ISBN 9780198754763. [53] A. K Ekert. Quantum Cryptography Based on Bell’s Theorem. Physical Review Letters, 67:661–663, 1991. doi: 10.1103/physrevlett.67.661. [54] C. H. Bennett, G. Brassard, and N. D. Mermin. Quantum cryptography without Bell’s theorem. Physical Review Letters, 68:557–559, 1992. doi: 10.1103/ PhysRevLett.68.557. 40 BIBLIOGRAPHY [55] K. Inoue, E. Waks, and Y. Yamamoto. Differential-phase-shift Quantum Key Distribution using coherent light. Physical Review A - Atomic, Molecular, and Optical Physics, 68, 2003. doi: 10.1103/PhysRevA.68.022317. [56] N. Gisin, G. Ribordy, H. Zbinden, D. Stucki, N. Brunner, and V. Scarani. Towards practical and fast Quantum Cryptography. arXiv, 2004. doi: 10.48550/arXiv.quantph/0411022. [57] S. P. Neumann, M. Selimovic, M. Bohmann, and R. Ursin. Experimental entanglement generation for Quantum Key Distribution beyond 1 Gbit/s. arXiv, 2021. doi: 10.48550/arXiv.2107.07756. [58] S. Ecker, B. Liu, J. Handsteiner, M. Fink, D. Rauch, F. Steinlechner, T. Scheidl, A. Zeilinger, and R. Ursin. Strategies for achieving high key rates in satellite-based QKD. npj Quantum Information, 7, 2021. doi: 10.1038/s41534-020-00335-5. [59] R. Uppu, T. A. W. Wolterink, S. A. Goorden, B. Skoric, A. P. Mosk, and P. W. H. Pinkse. Secure communication with coded wavefronts. In 2017 Conference on Lasers and Electro-Optics Europe and European Quantum Electronics Conference (CLEO/Europe-EQEC). OSA - The Optical Society, 2017. doi: 10.1109/cleoe-eqec. 2017.8087422. [60] G. Gianfelici, H. Kampermann, and D. Bruß. Theoretical framework for Physical Unclonable Functions, including quantum readout. Physical Review A, 101:042337, 2020. doi: 10.1103/PhysRevA.101.042337. [61] A. Lord. Where Does QKD Fit in a Post-quantum Secure World? In Quantum West, volume 11714. SPIE, 2021. doi: 10.1117/12.2593555. [62] G. M. Nikolopoulos. Remote quantum-safe authentication of entities with Physical Unclonable Functions. Photonics, 8(7), 2021. doi: 10.3390/photonics8070289. 41