IKE for IPsec with QKD

Rodney Van Meter, Shota Nagayama

Published Oct 27, 2014• 1 citation

Abstract

Quantum Key Distribution (QKD) is a mechanism for creating shared, secret, random bits. This document describes extensions to the IKEv2 protocol to use random bits created via QKD as keys for IPsec. The Diffie-Hellman key agreement mechanism is replaced with QKD. The use of QKD-generated keys with standard IPsec will extend the lifetime of privacy guarantees for IPsec-protected data: future technological advances that break Diffie-Hellman key exchange will not disclose data until such time as the encryption algorithm used for the IPsec tunnel is broken.

Related papers

On the Resilience of a QKD Key Synchronization Protocol for IPsec

Stefan Marksteiner, Benjamin Rainer, Oliver Maurhart

This paper presents a practical solution to the problem of limited bandwidth in Quantum Key Distribution (QKD)- secured communication through using rapidly rekeyed Internet Protocol security (IPsec) links. QKD is a cutting-edge security technology that provides mathematically proven security by using quantum physical effects and information theoretical axioms to generate a guaranteed non-disclosed stream of encryption keys. Although it has been a field of theoretical research for some time, it has only been producing market-ready solutions for a short period of time. The downside of this technology is that its key generation rate is only around 52,000 key bits per second over a distance of 50 km. As this rate limits the data throughput to the same rate, it is substandard for normal modern communications, especially for securely interconnecting networks. IPsec, on the other hand, is a well-known security protocol that uses classical encryption and is capable of exactly creating site-to-site virtual private networks. This paper presents a solution that combines the performance advantages of IPsec with QKD. The combination sacrifices only a small portion of QKD security by using the generated keys a limited number of times instead of just once. As a part of this, the solution answers the question of how many data bits per key bit make sensible upper and lower boundaries to yield high performance while maintaining high security. While previous approaches complement the Internet Key Exchange protocol (IKE), this approach simplifies the implementation with a new key synchronization concept, proposing a lightweight protocol that uses relatively few, slim control messages and sparse acknowledgement. Furthermore, it provides a Linux-based module for the AIT QKD software using the Netlink XFRM Application Programmers Interface to feed the quantum key to the IP***ABSTRACT TRUNCATED TO 1920 CHARS***

arXiv:1801.01710Jan 5, 20182 citations

KEY MANAGEMENT OF QUANTUM GENERATED KEYS IN IPSEC

Andreas Neppach, Christian Pfaffel-Janser, Ilse Wimberger +4 more

This paper presents a key management approach for quantum generated keys and its integration into the IPsec/IKE protocol. The solution is used in a security gateway that integrates quantum key distribution (QKD) and IPsec as a system-on-chip solution. The QKD acquisition module and the IPsec part of this prototype are implemented in hardware to provide a high level of integration as well as high encryption throughput. To make use of these fast encryption capabilities, a flexible key management approach is necessary to provide keys just in time. Thus, the presented key management approach focuses on an efficient key update mechanism and minimizes the communication overhead. Furthermore, the presented approach is a first step to integrate QKD solutions into real-world commercial applications using standardized interfaces.

International Conference on Security and CryptographyJan 1, 200815 citations

Schemes of IPsec integrated with quantum key distribution

Chun-Hui 春辉 Zhang 张, Wen-Xuan Zhang, Xing-Yu Zhou +4 more

Abstract With the rapid advancement of quantum computing, traditional security protocols based on classical encryption algorithms are increasingly vulnerable to potential quantum attacks. The current IPsec protocol, which relies on classical cryptographic methods, is insufficient to withstand such threats, thereby compromising the security of long-term data transmission. To address this issue, we propose integrating quantum key distribution (QKD) into the internet protocol security (IPsec) protocol, thereby enhancing its resilience against quantum computing attacks. Here, two schemes that merge QKD-generated keys with classical cryptographic keys are designed to enhance both security and stability. Furthermore, we conduct a comprehensive evaluation of the performance of various QKD protocols implemented with the scheme, along with an assessment of its overall efficacy across a topological network configuration. This approach not only ensures secure data transmission in the era of quantum computing but also highlights the potential application value of integrating QKD with IPsec, providing valuable insights for the design and implementation of future quantum-secure communication systems.

Chinese Physics BJan 4, 20260 citations

Framework to Integrate Post-quantum Key Exchanges into Internet Key Exchange Protocol Version 2 (IKEv2)

Scott R. Fluhrer, Cen Jung Tjhai, Óscar García-Morchón +3 more

This document describes how to extend Internet Key Exchange Protocol Version 2 (IKEv2) so that the shared secret exchanged between peers has resistance against quantum computer attacks. The basic idea is to exchange one or more post-quantum key exchange payloads in conjunction with the existing (Elliptic Curve) Diffie-Hellman payload.

Jul 9, 201910 citations

IPSeQ: A Security-Enhanced IPSec Protocol Integrated with Quantum Key Distribution

Xumin Gao, Kaiping Xue, Jian Li +5 more

IPSec is a widely used network security protocol that plays a crucial role in providing secure transmission channels in the current Internet. However, the advent of quantum computing poses unprecedented challenges to the security of traditional cryptographic methods, including those used in IPSec. Fortunately, quantum key distribution (QKD) offers a theoretically unbreakable method for exchanging keys between two communicating parties. To address the security threats posed by quantum computing, we propose IPSeQ, a security-enhanced IPSec protocol that integrates QKD into its design. Specifically, IPSeQ leverages quantum keys to strengthen key negotiation, authentication, and data encryption processes. To achieve rapid key updates while ensuring transmission efficiency and key synchronization, IPSeQ introduces a sliding window-based dynamic key updating mechanism. Experiments conducted with real QKD devices demonstrate that our proposed mechanism can improve throughput by more than 50 percent compared to traditional schemes, particularly at higher quantum key generation rates. Additionally, IPSeQ effectively maintains robust data transmission in scenarios where quantum keys are scarce (e.g., when the key generation rate is less than 10 kb/s).

IEEE Communications MagazineMar 12, 20257 citations

Analysis and evaluation of quantum key distribution protocols

Reza Rouhani

Quantum Key Distribution (QKD) which is the name of cryptography in quantum environment act as the highest developed area in quantum communication and computing technology (QCIT). \n \nQKD is inventive technology which utilize the laws of quantum to create a cryptographic share key to make the communication system secure. The unique feature of QKD assures eavesdropping detectable during quantum communications which is fascinating for a high-level secure environment.Most of the traditional cryptographic methods which we use currently are based on mathematical scheme or Computational complexity theory which are not completely safe. Using quantum cryptography has been achieved extensive steps in communication security establishment. As the information Unit has been changed from “bit” to Quantum bit (Qubit), a new element has been offered that can guarantee the shared information confidentiality between parties. The confidentiality of system is established via exchanging a secret key through a channel of quantum, the key which we use for encrypting the shared data. This structure has quantum integration which has been developed by physics law and techniques of cryptography. \n \nThis thesis has proposed a modified version of QKD protocol, this new protocol will generate a cryptographic share key for a more efficient, lower cost and secure communication between two parties (sender and Receiver). This new protocol principal is similar to BBM92, but the source of photon moved to sender instead of third-party photon generator, following steps will be executed in this Experiment: \n \n•\tObserve different categories protocols of QKD in details \n•\tThe Quantum Mechanics Visualisation Project (QuVis) is the simulation software that has been used for implementing the proposed protocol [BB84 with spin] among the other three (BBM92, B92 and BB84). \n•\tProbability ratio of error will be tested and compared for all protocols, for this experiment 100 to 5000 photons will be sent. \n \nBy Analysing collected data in this experiment, it will be determined which one of this four protocols lead the detecting of eavesdropping. Simulation software accomplishes the value of error key probability which receiver can use and should not pass over the range limit of 0.25 & 0.5.

Jan 1, 20200 citations