Analysis of article: New laser may stop computer hackers
Author: AAP
Publication date: 07-11-2005

Preface:
I found this article while keeping an eye on articles linked from Rootsecure.net (kudos), the title immediately struck me as somewhat ludicrous given its phrasing, but I guessed that it probably had to do with quantum cryptography. Fairly regularly I'll see articles floating out on popular security sites about the media's (mis)use of terminology. This is a dead horse; anyone who is mildly involved with the security world knows there is a serious disconnect between "our" use of terminology and the media's use of the same terms. The article I'm focusing on is guilty of misuse of terms, but also misuse of concepts and hilariously bad wording. And, to be fair, I needed to put something else in the statistics/analysis section at Attrition.org.

Source: NEWS.com.au Remote
Local

Full Disclosure:
I do not have a physics degree. My knowledge of quantum cryptography and the physics applied here come from a general interest in that area, Wikipedia and a few industry texts on cryptography. If you're a physicist and I mis-apply any concept please e-mail me and explain, I'm always interested!


The Goods:
The title of this article serves its purpose, it grabs the attention of the reader: "New laser may stop computer hackers". After conferring with my esteemed colleague Dr. Lyger J. Attrition we determined two possible meanings: 1) A new laser, similar in function to Cerebro of X-Men fame, was able to target hackers destroy them or 2) Some kind of laser technology was able to eliminate vectors a nefarious hacker might employ to compromise data. Although we hoped for Patrick Stewart we were rewarded with Jim Varney.

The article begins by saying:

A THEORY first proposed by Albert Einstein 70 years ago has provided the basis for a new electronic "key" that could spell the demise of computer hackers.
Aside from the dubious use of the word "demise" as it pertains to the first possible meaning for the article title, the article seems to imply that hacking is simply the interception and possible decryption of data. Obviously no matter which hacker hat you might wear, the craft is much broader than that.

The confusion between "intercepting" and "being hacked" continues throughout the article, eventually culminating in the incorrect ascertation that data transmitted in this manner could not be eavesdropped. This quantum cryptographic method holds that no one can intercept the data without that interception being noticed by any of the legitimate parties. It is my understanding that the interception in effect corrupts the data at the quantum level and any meaning is lost because the quantum representations of the data have been altered. Based on this idea, as a malicious third party I may not be able to decrypt the data but I can prevent meaningful communication from taking place via interception. This attack scenario may not be viable given a practical implementation of quantum cryptography that insures the communication channel.

The article goes on to suggest a questionable interpretation of modern security:

The security of quantum cryptography was guaranteed by the laws of physics where the security of conventional cryptographic methods relied on the complexity of mathematical operations.

Bruce Schneier has suggested that without a revolution in our understanding of physics we can not possess the computational power to decrypt data given a key length of over 1024 bits and a sound encryption algorithm, in any practical amount of time. So in effect, good modern cryptography is also guaranteed by the laws of physics.

Even if the methods mentioned in this article were fully developed and integrated into the every day of future computing, the implementation would still be vulnerable to attack. For example, I can encrypt data using PGP and a 2,048 bit key, make that encrypted data available to the world, and never fear it being decrypted. However, the method I use to implement this encryption may be vulnerable to attack. Does the program I use save sensitive temporary data in an unencrypted format? Can I intercept the unencrypted text on the computer performing the encryption before that process takes place? Where is the private key stored? Is that storage method vulnerable?

The point here is twofold: 1) confusion of terminology continues and 2) there is no silver bullet in encryption or security.


Useful Links:
Wikipedia: Quantum Entanglement
Wikipedia: Quantum Cryptography
Bruce Schneier: Schneier on Security


main page ATTRITION feedback