Abstract Media access control security (MACsec) is an IEEE 802.1AE standard for secure communication on Ethernet links. MACsec ensures the confidentiality, integrity and origin authenticity of Ethernet frames. The secrecy of MACsec stems from a root key that is either configured as a pre‐shared key or derived from a mutual authentication protocol. However, both methods are not ideal because such a root key may be disclosed due to human errors or broken by quantum attacks. Here, the authors investigate the quantum key distribution (QKD) as an alternative source of trust for MACsec. QKD can be used as either a root key provider or a session key generator. The authors develop a new key exchange protocol based on QKD for Ethernet networks. Furthermore, it is verified by the experiment that QKD could be well integrated into MACsec without performance degradation.
Abstract Media access control security (MACsec) is an IEEE 802.1AE standard for secure communication on Ethernet links. MACsec ensures the confidentiality, integrity and origin authenticity of Ethernet frames. The secrecy of MACsec stems from a root key that is either configured as a pre‐shared key or derived from a mutual authentication protocol. However, both methods are not ideal because such a root key may be disclosed due to human errors or broken by quantum attacks. Here, the authors investigate the quantum key distribution (QKD) as an alternative source of trust for MACsec. QKD can be used as either a root key provider or a session key generator. The authors develop a new key exchange protocol based on QKD for Ethernet networks. Furthermore, it is verified by the experiment that QKD could be well integrated into MACsec without performance degradation.
The demand on MACsec in Ethernet is increasing substantially since MACsec fits well for industrial applications which require strong security as well as efficiency. To provide a long-term security, the MACsec protocol should be resistant to future attacks including quantum attacks. In this paper, MACsec is analysed under a quantum attack scenario. To achieve 128-bit quantum security, AES (Advanced Encryption Standard) algorithms defined in MACsec should mandate to use 256-bit keys. On the other hand, classical public-key cryptosystems in MKA are not secure at all against quantum attacks so that they need to be replaced by post-quantum crypto schemes in a quantum world. We propose an authenticated post-quantum key establishment protocol which is suitable for long-term secure MACsec. The proposed protocol is used in the hybrid mode, an ephemeral key exchange, and an end-to-end encryption. We verified by experiments that the proposed protocol can be deployed in existing a MACsec-enabled Ethernet network.
Advancements in quantum computing pose a significant threat to most of the cryptography currently deployed in our communication networks. Fortunately, cryptographic building blocks to mitigate this threat are already available; mostly based on Post-Quantum Cryptography (PQC) and Quantum Key Distribution (QKD), but also on symmetric cryptography techniques. Notably, those building blocks must be deployed as soon as possible in communication networks due to the “harvest-now decrypt-later” attack scenario, which is already challenging our sensitive and encrypted data today. Following an agile and defense-in-depth approach, Hybrid Authenticated Key-Exchange (HAKE) protocols have recently been gaining significant attention. Such protocols have the benefit of modularly combining classical (symmetric) cryptography, PQC, and QKD to achieve strong confidentiality, authenticity, and integrity guarantees for network channels. Unfortunately, only a few protocols have yet been proposed (mainly Muckle and Muckle+) with different flexibility guarantees. Looking at available standards in the network domain – especially at the Media Access Control Security (MACsec) standard – we believe that HAKE protocols could already bring strong security benefits to MACsec today. MACsec is a standard designed to secure communication at the data link layer in Ethernet networks by providing confidentiality, authenticity, and integrity for all traffic between trusted nodes. In addition, it establishes secure channels within a Local Area Network (LAN), ensuring that data remain protected from eavesdropping, tampering, and unauthorized access, while operating transparently to higher layer protocols. Currently, MACsec does not offer enough protection against the aforementioned threats. In this work, we tackle the challenge and propose a new versatile HAKE protocol, dubbed VMuckle, which is sufficiently flexible for use in MACsec. The use of VMuckle in MACsec provides LAN participants with quantum-safe hybrid key material to ensure secure communication even in the event of cryptographically relevant quantum computers.
The industrial demand on MACsec in Ethernet networks is increasing substantially, in particular for 5G networks, mainly due to its efficiency paired with strong security. MKA (MACsec Key Agreement) is a companion protocol of MACsec that provides methods of authentication and cryptographic key establishment. In this paper, the MACsec and MKA protocol are analysed under a quantum attack scenario. Even though the threat of quantum computers should not be overstated, it is necessary to provide a new countermeasure that is robust against this potential, yet critical risk. Symmetric-key crypto algorithms defined in MACsec and MKA can achieve 128-bit quantum security if 256-bit keys are mandated. However, classical public-key crypto schemes are known to be vulnerable to quantum attacks so that MKA protocol needs to support post-quantum public-key crypto schemes. We implemented a McEliece-based key establishment which is the most conservative post-quantum public-key cryptosystem with a large size of key, yet feasible for MKA. For entity authentication, we implemented a XMSS hash-based signature scheme that is standardised in IETF. We verified by experiments that selected schemes fit well for a MACsec-enabled Ethernet network.
It is the fact that wireless local area networks are increasingly deployed by businesses, government and SOHO users as they offer many advantages to its customers with mobility, flexibility, convenience etc. It opened a wide range of new commercial areas for hardware vendors, at low cost. This justifies why wireless networks have become one of the most widely used communication systems in the world. However, since there are no boundaries in wireless networks, they are vulnerable to security threats than wired networks. Therefore, providing secure communication for wireless networks has become one of the prime concerns. Quantum cryptography, to be precise, Quantum Key Distribution (QKD), offers the promise of unconditional security. In this paper, we extend our previous research work of how QKD can be used in IEEE 802.11 wireless networks to ensure secure key distribution. Our contributions in this paper are as follows: (1) We discussed how QKD can be used in IEEE 802.11 wireless networks to securely distribute the keys. (2) We use new protocol QKD. (3) We introduced a method that take the advantage of mutual authentication features offered by some EAP variants of 802.1X Port-Based Network Access Control. (4) Finally, we present a new code called Quantum Message Integrity Code (Q-MIC) which provides mutual authentication between the two communication parties. Also experimental results are presented with Simulink Model.
It is the fact that wireless networks have become one of the most widely used communication systems in the world. However, providing secure communication for wireless networks has become one of the prime concerns. Quantum cryptography, namely Quantum Key Distribution (QKD), offers the promise of unconditional security. In this paper, we have extended our previous research work to a new protocol with the method of integrating quantum cryptography for key distribution in 802.11 wireless networks. Our contributions, based on our previous results [1], are as follows: (1) we shall show how QKD can be implemented in IEEE 802.11 wireless networks to securely distribute the keys. (2) We shall introduce a novel protocol with a method that take the advantage of mutual authentication features offered by some EAP variants of 802.1X Port-Based Network Access Control. (3) Finally, we present a new code called Quantum Message Integrity Code (Q-MIC) which provides mutual authentication between the two communication parties and its implementation
Wireless networks have become one of the most widely used communication systems in the world. However, providing secure communication for wireless networks has become one of the prime concerns. Quantum cryptography, namely Quantum Key Distribution (QKD), offers the promise of unconditional security. In our paper, we shall extend our previous research work to a new method of integrating quantum cryptography for key distribution in 802.11 wireless networks. Our contributions, based on our previous results [1], are as follows: (1) We shall show how QKD can be used in IEEE 802.11 wireless networks to securely distribute the keys. (2) We shall introduce a method that take the advantage of mutual authentication features offered by some EAP variants of 802.1X Port-Based Network Access Control. (3) Finally, we present a new code called Quantum Message Integrity Code (Q-MIC) which provides mutual authentication between the two communication parties and its implementation