DEF CON 23 - Phillip Aumasson - quantum computers vs computers security
1 like65 views
This document discusses quantum computers and their implications for computer security. It begins with introductions to quantum mechanics concepts and how quantum computers work. It then explains that quantum computers could break many current encryption standards by efficiently solving problems like integer factorization that are hard for classical computers. Alternative "post-quantum" encryption methods are discussed. The document also covers quantum key distribution, proposals for quantum copy protection, and potential applications of quantum machines for tasks like machine learning. While quantum computers may revolutionize computing, many challenges remain around building them and developing quantum algorithms.
![Xe
mod N for e in [1, 2, 3, …] and some X
will repeat with a period dividing (p-1)(q-1)
A period gives information on p and q!
Shor’s algorithm:
1. Prepare qubits to encode X,X2
,X3
,X4
, ... simultaneously
2. Find the period using the Quantum Fourier Transform
3. Exploits the period to recover p and q
Shor’s idea to factor N=pq](https://image.slidesharecdn.com/defcon-23-phillip-aumasson-quantum-computers-vs-computers-se-201030141012/85/DEF-CON-23-Phillip-Aumasson-quantum-computers-vs-computers-security-24-320.jpg)
DEF CON 23 - Phillip Aumasson - quantum computers vs computers security
- 1. Quantum Computers vs. Computers Security @veorq — http://aumasson.jp
- 2. Schrodinger equation Entanglement Bell states EPR pairs Wave functions Uncertainty principle Tensor products Unitary matrices Hilbert spaces Nobody understands this stuff, and you don’t need it to understand quantum computing
- 3. 1. QC 101 2. In practice 3. Breaking crypto 4. Post-quantum crypto 5. Quantum key distribution 6. Quantum copy protection 7. Quantum machine learning 8. Conclusions
- 4. 1. QC 101
- 5. Quantum mechanics Nature’s operating system Quantum mechanics Mathematics Gravity Electromagnetism Nuclear forcesApplications OS Hardware
- 6. Quantum mechanics Particles in the universe behaves randomly Their probabilities can be negative "Negative energies and probabilities should not be considered as nonsense. They are well-defined concepts mathematically, like a negative of money." —Paul Dirac, 1942
- 7. α |0⟩ + β |1⟩ When observed 0 with probability α2 1 with probability β2 Once observed, stays either 0 or 1 forever Quantum bit (qubit)
- 8. α0x00 |0x00⟩ + …+ α0xfe |0xfe⟩ + α0xff |0xff⟩ Again, the sum of probabilities α2 equals 1 The α’s are called amplitudes Generalizes to 32- or 64-bit quantum words Quantum byte
- 9. Set of quantum registers (bits/bytes/words) Quantum assembly instructions: Transform the probabilities of the register Probabilities should still sum to 1 Linear math transforms (matrix products) A program ends with a measurement Quantum computer
- 11. Impossible with a classical computer Possible with a quantum computer! The killer app
- 12. You heard about NP-complete problems? SAT, scheduling, Candy Crush, etc. Solution hard to find, but easy to verify QC does not solve NP-complete problems! QC vs. hard problems NNP P (easy)NNP NP (hard) NNP BQP (quantum)
- 13. Quantum speedup Make the impossible possible Example: Factoring integers Hard classically (exponential-ish) Easy with a quantum computer! Obvious application: break RSA!
- 14. Quantum parallelism “Qubits encode all values at the same time!” Caveat: you can only observe one result Different observations in different worlds
- 15. 2. In practice
- 16. Factoring experiments Only for numbers with special patterns Not really the real thing (Shor)
- 17. Constructing quantum computers Qubits obtained from physical phenomena Photons (2 polarizations) Molecules (2 nuclear spins) Superconducting (different) Major pain: correction or errors Qubits mixed up with the environment Quantum noise
- 18. Recent milestone Partial error correction for a 9-qubit state Google-sponsored research group
- 19. D-Wave Canadian company, pioneer in QC research Adiabatic computers, not real QC 512-qubit system Quantum annealing No Shor
- 20. Stability, error-correction How much will cost “N quantum operations” vs “N classical operations”? Some algorithms need quantum RAM, which we don’t really know how to do Unlikely to come in the next decade, if ever Many challenges
- 22. TL;DR: We’re doomed RSA: broken Diffie-Hellman: broken Elliptic curves: broken El Gamal: broken
- 23. RSA No more RSA encryption or signatures Based on the hardness of factoring You know N = p*q, you search p and q Hard on a classical computer (most probably) Easy on a quantum computer!
- 24. Xe mod N for e in [1, 2, 3, …] and some X will repeat with a period dividing (p-1)(q-1) A period gives information on p and q! Shor’s algorithm: 1. Prepare qubits to encode X,X2 ,X3 ,X4 , ... simultaneously 2. Find the period using the Quantum Fourier Transform 3. Exploits the period to recover p and q Shor’s idea to factor N=pq
- 25. Discrete logarithms Problem behind Diffie-Hellman, ECC You know g and gy , you search y Like factoring, a Hidden Subgroup Problem Shor works too!
- 26. What about symmetric ciphers? AES with a 128-bit key: Classical: 128-bit security Quantum: 64-bit security Grover’s algorithm: searches in N items in O(√N) time and O(log N) memory Solution: upgrade to 256-bit AES
- 28. Alternatives to RSA, Diffie-Hellman, ECC Resistance to QC can’t be totally proved http://pqcrypto.org/ Post-quantum crypto
- 29. Hash-based signatures Problem: inverting hash functions Ideas from Lamport (1979), Merkle (1989) Example of SPHINCS: (http://sphincs.cr.yp.to/) 41 KB signatures 1 KB public and private keys Slow (100s signatures/sec)
- 30. Multivariate signatures Problem: solve complex systems of equations First ideas in the 1980s 0 =X1 X2 X3 + X1 X3 + X2 X4 1 = X1 X3 X4 + X2 X3 X4 0 = X1 X3 + X2 X3 Many schemes have been broken...
- 31. Code-based crypto Problem: decoding error-correcting codes Schemes: McEliece (1979), Niederreiter (1986) Limitations: Large keys (100 KB+) Fewer optimized implementations
- 32. Lattice-based crypto Based on lattice problems (duh!) Learning-with-errors: learn a simple function given results with random noise Encryption, signature
- 33. 5. Quantum key distribution
- 34. Quantum key distribution (QKD) Use of quantum phenomena to share a key Kind of “quantum Diffie-Hellman” Not quantum computing Not quantum cryptography “Security based on the laws of physics” Eavesdropping will cause errors Keys truly random
- 35. BB84 First QKD protocol, though not really quantum Idea: Send bits in the form of polarized photons Can be observed in 2 ways, only one is right
- 36. Caveats Like any security system, it’s complicated
- 37. Security Eventually relies on classical crypto Typically with frequent rekeying QKD implementations have been attacked "Quantum hacking" (formerly NTNU, Norway)
- 38. Deployment Dedicated optical fiber links Point-to-point, limited distance (< 100 km)
- 39. 6. Quantum copy protection
- 40. Quantum copy protection Idea: leverage the no-cloning principle (cos you can't know everything about something)
- 41. Quantum cash Impossible to counterfeit, cos' physics (1969) Bills include qubits with some secret encoding ⬆ ⬈ ⬇ ⬅⬉⬇⬈ ⬈ ⬆ Only the bank can authenticate bills...
- 42. Publicly verifiable quantum cash Anyone can verify that a bill isn't counterfeit Uses public-key crypto, non-quantum Can be secure even with black-box verification
- 43. Quantum software protection Using quantum techniques: "Obfuscate" the functionality Make copies impossible verify(pwd) { return pwd == "p4s5w0rD" } 1. Turn verify() into a list of qubits 2. Verification: apply a transform that depends on pwd, then measure the qubits
- 44. 7. Quantum machine learning
- 45. Machine learning “Science of getting computers to act without being explicitly programmed” —Andrew Ng Supervised Non-supervised Successful for spam filtering, fraud detection, OCR, recommendation systems
- 46. No silver bullet, but may help ML being used for Intrusion detection (network, endpoint) Binary vulnerability discovery Nevertheless, vendors give neither Details on the techniques used, nor Effectiveness figures or measurements Machine learning and security
- 47. Quantum machine learning “Port” of basic ML techniques to QC, like k-mean clustering Neural networks Support vector machines Many use Grover for a square-root speedup Potential exponential speedup, but...
- 48. Quantum RAM (QRAM) Awesome concept Addresses are given in superposition Read values are retrieved in superposition Many QML algorithms need QRAM But it'd be extremely complicated to build
- 49. 8. Conclusions
- 50. Quantum computers s*** Because they... ARE NOT superfaster computers WOULD NOT solve NP-hard problems MAY NEVER BE BUILT anyway
- 51. Quantum computers are awesome Because they… Would DESTROY all pubkey crypto deployed Give a new meaning to "COMPUTING" May teach us a lot about physics and Nature
- 52. Thank you!