Attacks on quantum key distribution protocols that employ non-ITS authentication

We demonstrate how adversaries with large computing resources can break Quantum Key Distribution (QKD) protocols which employ a particular message authentication code suggested previously. This authentication code, featuring low key consumption, is not Information-Theoretically Secure (ITS) since for each message the eavesdropper has intercepted she is able to send a different message from a set of messages that she can calculate by finding collisions of a cryptographic hash function. However, when this authentication code was introduced it was shown to prevent straightforward Man-In-TheMiddle (MITM) attacks against QKD protocols. In this paper, we prove that the set of messages that collide with any given message under this authentication code contains with high probability a message that has small Hamming distance to any other given message. Based on this fact we present extended MITM attacks against different versions of BB84 QKD protocols using the addressed authentication code; for three protocols we describe every single action taken by the adversary. For all protocols the adversary can obtain complete knowledge of the key, and for most protocols her success probability in doing so approaches unity. Since the attacks work against all authentication methods which allow to calculate colliding messages, the underlying building blocks of the presented attacks expose the potential pitfalls arising as a consequence of non-ITS authenti1 C Pacher (E-mail: [email protected]), T Lorünser, and M Peev Digital Safety & Security Department, AIT Austrian Institute of Technology, Austria 2 A Abidin and J-Å Larsson Department of Electrical Engineering, Linköping University, Linköping, Sweden 3 R Ursin and A Zeilinger Institute for Quantum Optics and Quantum Information, Austrian Academy of Sciences, Austria 4 A Zeilinger Vienna Center for Quantum Science and Technology (VCQ), Faculty of Physics, University of Vienna, Austria. ar X iv :1 20 9. 03 65 v2 [ qu an tph ] 3 1 A ug 2 01 5