How To Make A Secure Internet On A Physcal Nose (A Key Dstrbuton) System For A Secure Network On A Network On The Pc Or Macbook Or Ipa (Aipa) On A Pc Or Ipo (A

Transcription

1 NOISE SECURED INTERNET Geraldo A. Barbosa QuantaSec, Consultng and Projects n Quantum Cryptography Ltd. Av. Portugal 1558, Belo Horzonte G Brazl. Emal: GeraldoABarbosa@hotmal.com (Dated: 18 January 2006.) arxv:quant-ph/ v3 28 Feb 2006 Ths work shows how a secure Internet can be mplemented through a fast key dstrbuton system that uses physcal nose to protect the transmtted nformaton. Startng from a shared random sequence K 0 between two (or more) users, long sequences R of random bts can be shared and not nvolvng a thrd party. The sgnals sent over the Internet are determnstc but have a bult-n Nature-made uncertanty that protects the shared sequences. After prvacy amplfcaton the shared R random bts encrypted by nose are subsequently utlzed n one-tme-pad data cpherng. The physcal generated protecton s not susceptble to advances n computaton or mathematcs. In partcular, t does not depend on the dffculty of factorng prme numbers as many cryptography systems rely on. KeyWords: Cryptography, Physcal Nose, Internet, Secret Key, No Thrd-Party, fast communcaton, amplfcaton allowed INTRODUCTION The Internet s currently the man communcaton vehcle for ctzens n general, banks and E-commerce. Protocols based on mathematcal complextes strve to offer a secure Internet whle hackers attempt to break n for profts. As a matter of fact, the exstng Internet offers only tenuous securty. Whle a few securty provders offer reasonable servce wthn the current technologcal landscape, they are vulnerable to technologcal advances. A search for new paradgms to establsh a secure Internet but not senstve to technologcal or mathematcal advances s ongong. Ths paper descrbes how to mplement a practcal secure communcaton system for the Internet whle avodng altogether protocols based purely on mathematcal complextes. Ths nose-encrypton system reles on laws of Nature but also avods sngle-photon state protocols such as BB84 [1]. Sngle-photon protocols cannot be amplfed and therefore do not work for the long-haul communcatons necessary for the Internet. Furthermore, sgnals from sngle-photon protocols cannot be converted from optcal to electrcal and back to optcal wthout loss of securty. Nor they are practcal for wavelength multplexng (WD). These steps are necessary to the Internet. Alternatve systems such as those usng dscrete or contnuous varable processes and relyng on homodyne measurements (e.g., Ref. [2]) are very senstve to nose, whch leads to low key rate transfer, and cannot work n the naturally dsturbed and complex Internet networks. In the proposed mplementaton of a secure Internet determnstc cphered sgnals go through arbtrary communcaton channels. They are cphered by random sgnals from physcal sources n nonorthogonal -ry bases. Ths system has evolved from a key dstrbuton system recently proposed [3, 4](See also [6] and [7]). Ths secure Internet dstrbutes determnstcally random sequences of bts to be utlzed n a fast one-tme-pad scheme. A smplfed but mperfect llustraton of ths system based on physcal nose would be a publc rado staton emtter A that changes ts carrer frequency n a very fast and truly random way. A user B who possesses a perfect knowledge of ths random varaton could set hs tuner to automatcally lock onto t. A clear sound or message would result. To an ntruder who does not possess any nformaton on the carrer varatons, only nose wll be detected. Actually, the presented cryptographc system does not rely on frequency varatons but on random jumps among dstnct nonorthogonal phase bases where the bts are nscrbed. Ths s as far as ths analogy goes. The securty of the key dstrbuton provded by ths system reles on a few ponts: 1) A shared secrecy by A and B on a startng key sequence K 0 and 2) a bt-by-bt uncertanty Nature-made nose N assocated to each bt R and recorded on a nterleaved -ry nonorthogonal bass. Knowledge of K 0 gves for the legtmate users the mappng of the bases jumps n the emtter and thus the bt R nscrbed on each bass. Prvacy amplfcaton procedures statstcally exclude the eventually compromsed fracton of shared bts. The sequences of random bts R wll be generated by a truly random process and sent oneby-one between users A (Alce) and B (Bob). The batch of shared secret bts R wll be used subsequently n onetme-pad cpherng. The nose N protects each bt R from the attacker E (Eve) and provdes the nformaton securty level assocated wth all shared R. Whle ths nose-secured Internet s logcally equvalent to the optcal system dscussed on Refs. [3] and [4] t has a major dstnctve feature: In Ref. [3] the nose arses as part of the sgnal measurement by the attacker and

2 2 s nherent to the optcal feld n a fber channel. Here the sgnal sent over the network s a recorded sgnal and, as such, t s determnstc but contans bt nformaton R and the assocated nose N. Ths s equvalent to recordng the results of an exceedngly nosy experment and gvng them to two researchers for nterpretaton: one that knows how to subtract the nose and the other one, the attacker, that cannot get rd of the nherent nose. BASIC SCHEE The sgnals are created by a physcal random generator (PhRG). The nose N assocated wth the bt R nscrbed onto the -ry nonorthogonal bass ( 2) produces the uncertanty measured by the attacker. Ths mples that the the emtter has to be equpped to detect and record the sgnals generated by the PhRG. In other words, the defnton of the measurng system s made by the emtter, not the attacker. The sgnal sent s the sgnal controlled and measured by the emtter wth a detecton system of hs choce. No restrctons are placed on the attacker to obtan the exchanged sgnals on a publc channel. She may obtan perfect copes of the transmsson. The sgnals emtted by the legtmate user obey constrants mposed to provde full securty. Among the advantages of the proposed system are: 1) Any publc channel may be used for transmsson (optcal fbers, TV, mcrowave, and so on); 2) The determnstc sgnals can be amplfed wth no securty loss; 3) Sgnals can be converted from electromagnetc to electrcal and back to electromagnetc wth no securty loss; 4) Wavelength multplexng s allowed on the network; 5) Current Network and IP protocols can be used wth no modfcatons for users n any IP classes. Fg. 1 shows a block dagram for one cycle of the key dstrbuton system. It descrbes how legtmate users A and B dstrbute or transfer fresh random key bts generated by a PhRG (to be descrbed ahead). Just to be more general, a descrpton startng wth a ry system of levels wll be presented. At the end, ths system wll be smplfed for a speed-up n the communcaton process wth no securty loss. A and B share a startng random key sequence (#1) desgnated by K 0 (#2) of length L (See Fg. 1). These L bts are dvded nto blocks of sze k (b(k ), b(k 1 ),...b(k 1 )) and each block defnes randomly a bass k 0 over a nonorthogonal set of bases on a cpherng wheel (#3) wth bases, where = 2 k. k 0 = b(k )2 k 1 b(k 1 )2 k 2...b(k 1 )2 0. (1) Gven a k 0 value (#4), a bt 0 could be nscrbed, e.g., n a unform cpherng wheel such as the one shown n Ref. [3] where the phase values defnng each bass are k PhR G #1 #2 N σ N σ #2 K 0 K 0 #3 #4 #4 #3 L k 0 k Y1 = R1 N1 k 0 #6 0 R 1 #8 N 1 R1 N1 #7 #9 #10 ( πk φ, πr ϕ, πn φ ) A #5 k b N #6 #11 R 1 k 1 #16 R N 2 2? R 2 Y = R N k #15 #13 #17 #8 #6 #11 B 0 11 GABarbosa 12 July ? R 1 k 1 R 2 N 2 K R, R,... R, R,... #13 #14 k PhR G FIG. 1: A sketch of one cycle of operatons of the key dstrbuton process n the Nose Secured Internet s shown. gven by φ k0 = π [ k0 1 ] ( 1)k0, k 0 = 0, 1,... 1, (2) 2 and a bt 1 wll be nscrbed dsplaced by π wth respect to bt 0 over each bass. A PhRG (#5) generates random bts R 1 (#6) that A would lke to transfer securely to B. These sgnals contan nose N 1 (#7) wth a natural phase dstrbuton (e.g., Gaussan dstrbuted) of wdth σ φ. R 1 can be understood n phase unts (rd): values 0 or π for bts 0 and 1. The Gaussan dstrbuton wdth σ φ (Set such that σ φ < π/2) may be wrtten σ φ = πn σφ / where N σ s the number of bases covered by N (See Ref. [3]). The sgnal to be sent over the generc Internet communcaton channel (#8) (network and servers) s Y 1 = R 1 N 1 k 0. The combned effects of N 1 k 0 s to hde the bt value R 1 on the cpherng wheel (#9). Although contanng random nformaton Y 1 s a determnstc sgnal and as such can be amplfed and converted nto dfferent sgnals through arbtrary nodes wthout any loss of securty. B has to extract R 1 from Y 1. To ths end he utlzes the same sequences from K 0 utlzed by A to generate the base values k 0 (#4). He subtracts ths value from Y 1 and obtans R 1 N 1 (#10) and obtan sgnals n bnary bases (sngle k value). The effect of the nose N 1 on Bob s bnary bass s neglgble because σ φ < π/2 and hs decson on the bt value s easy; therefore, he obtans R 1 (#6). From the receved sequence R he forms bt blocks of length k and constructs a new base sequence k 1. The next steps are smlar to the frst ones. Bob s PhRG (#12) generates sgnal contanng bts R 2 (#13) assocated to nose N 2 (#14). The sgnal Y 2 = R 2 N 2 k 1 s sent over the communcaton channel (#8). The bt value #12 k

3 3 R 2 s hdden by the overall nose N 2 k 1 (#15). From her knowledge of R 1 (#6) and, therefore, k 1 (#14), Alce subtracts k 1 from Y 2 and obtans R 2 N 2 (#16). On her bnary bass she easly obtans R 2 (#13). The frst cycle s complete. A and B contnue to exchange random sequences as n the frst cycle. The shared sequences (R 1,..., R 2,...), after a prvacy amplfcaton process, are the random bts to be subsequently utlzed for one-tmepad cpher. Note that whle for noseless sgnals Y 1 = b and Y 2 = b carryng a repeated bt b, one has Y 1 Y 1 = 0, nosy sgnals gve Y 1 = b N 1 and Y 1 = b N 2 and, therefore, Y 1 Y 1 = N 1 N 2 (= 0 or1). Ths frustrates several correlaton attacks. SOE SECURITY CONSIDERATIONS Securty analyses were presented for the purely optcal counterparts of ths -ry key dstrbuton system for Internet and are equally vald here. Ref. [3] presented a bt-by-bt analyss and [5] showed that the attacker s ntal uncertanty on the whole sequence of shared bts s equal to her uncertanty of the startng shared sequence K 0. Ths dependence on the frst key shared key sequence K 0 can be seen from the mutual nformaton, defned by I(R : Y (R)) = H(R) H(R Y (R)). (3) I(R : Y (R)) s used to wrte the dfference between the mutual nformaton between B and E n one cycle of length L: I = I B I E = [H(R) H(R Y B (R))] [H(R) H(R Y E (R))] = H(R Y E (R)) H(R Y B (R)). (4) Eve s uncertanty on R gven Y E (R) s maxmal (H(R Y E (R)) L) whle Bob may obtan the whole sequence R from Y B : H(R Y B (R)) = 0. Therefore, I L n the frst cycle. Applyng the chan rule H(L 1, L 2,..., L n Y E ) = one may see that H(L 1, L 2,..., L n Y E ) = n H(L Y, L 1,..., L 1 ), (5) =1 =H(L 1 Y E ) H(L 2 Y E, L 1 ) H(L 3 Y E, L 1, L 2 ).. (6) If the startng key (K 0 wth length L = L 1 ) s open to Eve, she obtans L 2 (H(L 2 Y E, L 1 ) = 0) n the same way as Bob and also obtans all keys n the subsequent rounds. The nose level superposed to the bts sent are desgned to hde each L j from the attacker. Prvacy amplfcaton a necessary step appled to the shared bts dscards nformaton eventually leaked to the attacker and defnes the fnal shared length of secure bts. laser detector NDF V V V V sgn = V V V = V, V = ± V π R φ ref V R V K0 φ mod PhRG FIG. 2: Sketch of PhRG wth a coherent lght source. Ths modulus can be added externally or externally to a computer. The laser beam s dvded by a beam spltter. The upper part shows a detectng system where sgnals V are generated correspondng to the sgn of the generated sgnal wth respect to the average sgnal ntensty. These bnary sgnals are converted nto bnary voltages V R = ±V π that consttute fresh random bts to be shared by A and B. The bottom part shows an nterferometer wth an optcal phase modulator (φ mod) n one of the arms. The laser beam s adjusted to an adequate ntensty by a neutral densty flter (or automatzed flter). Voltage values V K0 defnng -ry phase bases (e.g, = 2) are added to V R and appled to the phase modulator. Detectors at the nterferometer output produce the phase sgnals carryng bass, bt and nose nformaton shown n Fg. 1 as Y. THE PHYSICAL RANDO GENERATOR Fg. 2 sketches the PhRG and the nput V K0 contanng recorded bases nformaton. The PhRG generate voltage sgnals correspondng to bts V R. These sgnals are added to the bass nformaton suppled by V K0 and suppled to a phase modulator n one arm of an optcal nterferometer. Output lght s detected and converted to phase sgnals (wth respect to the laser feld) that also contan phase nose assocated wth coherent lght. These sgnals are wrtten Y n Fg. 1. As shown n Refs. [3] and [4], ths phase modulaton of coherent sgnals produce sgnals that carry a phase uncertanty gven by the Gaussan dstrbuton p u e ( φ)2 /2σ 2 φ, (7) where σ φ = 2/ n and n s the average number of photons n one bt. Whle several desgn varatons are possble, Fg. 2 shows basc parts to be consdered. For secure transmsson of sgnals the physcal randomness s necessary as no known mathematcal algorthm has been proven to generate true random numbers. Several physcal sources may be used alternatvely such as optcal or thermal sources. However, optcal sources can be much faster than the thermal ones and are therefore necessary

4 4 when speed s requred. A PhRG can be seen as modulus that can be hooked (nternally or externally) to a computer lnked to the Internet ether n dedcated use or open to users such as n a cybercafe. In such a publc system users may generate and record on portable memores a batch of secure keys or use them to exchange one-tme-pad cphered nformaton. One may also wonder about the cost of a brute force attack to determne the startng key K 0 from the transmtted sgnals. Under the assumpton that the uncertanty presented to the attacker covers N σ bases, the attacker would know that the bass k used n a gven transmsson s around a gven regon wthn the uncertanty N σ. For a -ry system of unformly spaced bases ths amounts that only a set of less relevant bts b(k σ ) n Eq. (1) hde the correct bass. These b(k σ ) bts could be permutated n b(k σ )! ways. As each bt could be ether 0 or 1 the total number of permutatons to be searched for each bt emsson would be (log 2 N σ )!N σ. For the total number of K 0 bts the number of combnatons would be C = 2 K0 (log 2 N σ )!N σ. (8) Under ths example of a unform cpherng wheel exemplfed by Eq. (2), t s understood that the attacker may know the fracton 1 (N σ /) of the total number of shared bts k used by A and B to cpher a fresh generated bt. For a sequence of L shared bts, Eve may obtan L[1 (N σ /)] bts among L because they were not covered by nose. These bts have to be subsequently dscarded by A and B through prvacy amplfcaton processes. SIPLIFIED BASES Use of a non-unform set of bases leads to a more economcal system: nstead of a unformly spaced crcle of phases gven by Eq. (2) one may use just a sector of phase values where the number of bases s just = 2. See Fg. 3. The sector wdth or bases separaton s made less than 2N σ. Therefore, all bases wll be wthn the phase fluctuatons caused by the nose N j. Phase postons on ths sector are gven by φ k0 = [ k 0 φ 1 π 1 ( 1)k0 2 ], k 0 = 0, 1. (9) Wth ths sector of phase bases the number of possble combnatons for a brute force attack searchng for all possbltes that may lead to K 0 s C = 2 2 K0. Reasonable K 0 lengths could be, say, 10 6, 10 9 ; they gve a number of combnatons C to be tred that s not computatonally feasble. Ref. [4] derved explct equatons for the mutual nformaton of the process and showed numercal examples to quantfy securty n terms of the dfference of the mutual nformaton functons for A and B and A and E 2σ φ = 2 2/ n k = 0 k = 1 FIG. 3: A cpherng set of bases n a phase sector wth = 2. σ φ s the standard devaton n the phase caused by fluctuatons n the lght feld. φ 1 s the spacng between two bases and should be kept φ 1 π/2. n s adjusted so that π/2 > σ φ φ 1, e.g. n < 100. Two states or bts can be nscrbed on each bass. Dark crcles ndcate postons for a bt 0 and open crcles gve possble postons for a bt 1. (I AE = ǫi AB, ǫ 1). As has also been shown, the securty of one sequence sent depends on the secrecy of the former sequence receved. Ths s an a-pror condton over whch I AB > I AE follows. Statstcally, the attacker may acqure some bts correctly and the legtmate users have to use prvacy amplfcaton protocols to elmnate that possble amount of nformaton acqured by Eve. Prvacy amplfcaton randomly reduce the number of bts to elmnate possble nformaton leaked to Eve. A and B are able to share a large number of random sequences R K 0 before the bt reconclaton and prvacy amplfcaton steps severely shorten the length L of the sequences. These length reductons lead to a slow down of the process and eventually to ts halt. A convenent mnmum length L mn can be chosen so that a new fresh sequence K 0 restarts the whole process. See Ref. [4] for a dscusson on the dstllaton process. The amount of possble leakage can be estmated usng mutual nformaton functons as shown n Ref. [4]. It was shown that a fracton 1 f (f n the example gven) could be compromsed n every cycle; therefore, 0.1% should be elmnated by prvacy amplfcaton protocols. As a result, the remanng fracton f of bts n every cycle s secure. A and B then succeed after many cycles n sharng a number of secure bts much larger than the ntal shared sequence K 0. Wth the example gven n Ref. [4], after sharng 10 3 L bts, 660L (66%) wll be dstlled by prvacy amplfcaton. Renewal of fresh startng sequences K 0 was dscussed n Refs. [3] and [4]. Ancent methods such as hand-to-hand delvery and steganography could be used for some applcatons. Even certfed key provders may be acceptable for some uses. The slow BB84 key dstrbuton process could also be used to φ 1

5 5 dstrbute the startng sequences K 0 wth proven securty; the speed of the key dstrbuton process wll then boosted by the Nose Secured Internet system descrbed here. CONCLUSIONS It has been shown that two (or more) Internet users startng from a shared secret sequence of random bts K 0 and addng a smple hardware modulus (PhRG) to ther computers wll succeed n generatng a large number of secret keys to be used n one-tme-pad cpher. The system works at optcal speed and does not requre any specal Internet protocol. Sgnals assocated wth nose are generated n the PhRG and the sgnals to be sent are determnstc ones. The assocated securty s not related to protocols based on mathematcal complextes n current use. Ths system s proposed as a possble new paradgm for a secure Internet. Emal: geraldoabarbosa@hotmal.com Phone: Brazl(31) Conf. on Computers, Systems, and Sgnal Processng, Bangalore, Inda, 1984, pp. 175 to 179. [2] F. Grosshans and P. Granger, Contnuous Varable Quantum Cryptography Usng Coherent States, Phys. Rev. Lett. vol. 88, (2002) pp to to [3] G. A. Barbosa, Fast and secure key dstrbuton usng mesoscopc coherent states of lght, Phys. Rev. A vol. 68, (2003) pp to US Pat. Appl. 11/000,662, Publ. No. US2005/ A1. [4] G. A. Barbosa, Informaton theory for key dstrbuton systems secured by mesoscopc coherent states, Phys. Rev. A vol. 71, (2005) pp to [5] G. A. Barbosa, Fast and secure key dstrbuton usng mesoscopc coherent states of lght, quant-ph/ v4 28 Apr 2004 pp. 1 to 10. [6] G. A. Barbosa, E. Corndorf, P. Kumar, H. P. Yuen, Secure communcaton usng mesoscopc coherent states, Phys. Rev. Lett. 90, (2003) pp to [7] E. Corndorf, G. A. Barbosa, C. Lang, H. P. Yuen, P. Kumar, Hgh-speed data encrypton over 25km of fber by two-mode coherent-state quantum cryptography, Opt. Lett. 28, (2003) pp Quantum Cryptography wth Coherent-state Lght: Demonstraton of a Secure Data Encrypton Scheme Operatng at 100kb/s; G. A. Barbosa, E. Corndorf, and P. Kumar, Quantum Electroncs and Laser Scence Conference, OSA Techncal Dgest, Vol. 74, (2002) pp [1] C. Bennett, G. Brassard, Quantum cryptography, Publc key dstrbuton and con tossng, n Proc. IEEE Int.