Extended quantum key distribution network and method for scalable initial authentication key distribution between entities

Abstract

An extended Quantum Key Distribution (QKD) network for scalable initial authentication key distribution between entities in the extended QKD network is provided. The extended QKD network comprising at least a first entity, a second entity, and a central Key Distribution Center (KDC). The KDC is configured to: obtain, using organizational security measures, a secret key between the KDC and the first entity, K(KDC,A); obtain, using organizational security measures, a secret key between the KDC and the second entity, K(KDC,B); and receive, from the first entity using information theoretically secure (ITS) communication, a request for starting the initial authentication key distribution between the first entity and the second entity.

Description

[0001] EXTENDED QUANTUM KEY DISTRIBUTION NETWORK AND METHOD FOR SCALABLE INITIAL AUTHENTICATION KEY DISTRIBUTION BETWEEN ENHTIES

[0002] TECHNICAL FIELD

[0003] The present disclosure relates to the field of authentication in Quantum Key Distribution (QKD) networks. The disclosure provides an extended QKD network for scalable initial authentication key distribution between entities, and a related method. The disclosure also relates to a non-transitory memory comprising instructions to perform the method.

[0004] BACKGROUND

[0005] Authentication in a QKD protocol: The "bare-bones" basic QKD protocol (QKD primitive) is an Information Theoretically Secure (ITS) key agreement one that is based (among others) on the availability of an authentic classical communication channel for its, so called post-processing phase. We note here in passing that the latter stage is a purely algorithmic / classical communication one and involves a number of classical cryptographic (but ITS) sub protocols necessary to guarantee overall correctness and security. More precisely QKD is a composable e-secure protocol, i.e. it can be securely combined with any other one such protocol, whereby the e is a quantitative measure of the potentially negligible probability for any attacker to break the combination. In what follows we predominantly use the more familiar term ITS, abstaining from the use of the more precise but somewhat cumbersome terminology.

[0006] However, the QKD primitive is not directly usable in a standalone fashion as authentic classical communication channels are not readily available. Moreover, it is well known that in the absence of an authenticated classical communication channel between the parties, a direct usage of a QKD primitive can easily be broken by means of straightforward man-in-the-middle (MITM) attacks, in which the adversary cuts the channels and impersonates one party to the other and vice versa during the whole protocol.

[0007] Hereinafter in this disclosure, we strictly follow a cryptographic definition that security involves both secrecy and authenticity.

[0008] More generally, communication authenticity is, in fact, a necessary condition for the security of any pure key generation primitive, as its absence immediately opens the way for its break by means of an MITM. (It is also part of the sufficient conditions for any sort of provably secure key generation.) In this sense, authentication (the security technique for providing an authenticated channel) is the basis of any form of secure communication in which it is necessary to defend against the presence of an active attacker and is therefore considered to be of equal or even greater importance than confidentiality. For this reason, key generation primitives of any sort are bundled with an authentication technique to give rise to a composite key -transport, -agreement or -growing protocol.

[0009] Authentication is achievable through the use of various types of classical security techniques. We specifically underline that any such technique is a combination of appropriate cryptographic but also organizational measures (non-cryptographic security techniques - e.g., hardware protection, procedural controls, manual transport - to achieve specific security objectives). The authentication constructions correspond to various trade-offs in terms of performance and security, but in any case, for stronger security, an offline interaction between the involved parties is required.

[0010] In symmetric cryptography, the main tool used to achieve authentication are Message Authentication Codes (MACs), which depend on the message to be sent and a secret key shared by both communication parties. With a MAC, a tag is derived out of a message, whereby a concatenation of both is sent, so that the attacker cannot successfully modify the message and produce the corresponding tag as the probability of consistently modifying the latter is low. Specifically, often a hash function in combination of the secret key is used to this end, is equivalent to having a family of hash functions, parametrized by the value of the secret key. These are known as HMACs. Naturally, an attacker cannot produce a correct authentication tag for a message of his choosing, without knowing the secret key. Note that in this case Pre-Shared secret Key (PSK) must be provided by appropriate organizational means.

[0011] Another conventional solution, using asymmetric public-key technologies, is represented by Digital Signatures which provide non-repudiation, an even stronger cryptographic property than message authentication can ensure. Combining his / her private key with the message, the sender produces a signature that can be verified by anyone knowing the corresponding public key, while the signature cannot be forged without the knowledge of the private key. In this scenario, the information that must be pre-shared in a secure way is the public key and a guarantee of authenticity of the latter must be enforced. Typically, this is done by repositories securely providing the public key of legitimate participants, known as Public Key Infrastructures, or PKIs. This is schematically depicted in FIG. 5. The key of each new participant needs to be securely, traditionally physically, brought to the PKI. In a network of N participants this means N interactions with the PKI. (Note that this is what fundamentally happens. In practice, often certificates, i.e. encrypted versions of the public keys, instead of the latter are saved in a PKI).

[0012] With respect to authentication, QKD provides no exception, compared to other key distribution methods. The QKD primitive, discussed above can be extended to a composite key growing protocol by utilizing an appropriate message authentication primitive. It is known that this can be done on the same level of security as QKD by using a special HMAC family, named Strongly Universal? (SU?) hash functions. This family assures ITS authentication: no attacker will have a better advantage than randomly choosing a tag or a signature, regardless of her / his computing power. (More precisely authentication by Si b hash functions is composable e-secure and, therefore, the combination with QKD is also composable e-secure. The price to pay for using Si b hashing, however, is that each member of the family is parametrized by a separate symmetric key. In practice, this effectively means that each new communication message in QKD post-processing requires a different (one time) key for each authentication. In a sense the Sib hash functions can be dubbed to be one-time MACs. Note that this method provides implicit key authentication - for each legitimate party all the communication messages must have come from a party that possess the same key -i.e. the other legitimate part in the QKD protocol (together with the key confirmation in post-processing this guarantees explicit key authentication).

[0013] The ITS requirement immediately rules out all available public-key solutions since they are based on computational methods that correspond to a lower level of security. The mentioned, one-time authentication itself does not represent a big deal in QKD, since authentication keys for subsequent QKD rounds, after the first one, can be obtained from the previous round. What is critical, instead, is the initialization of the authentication key in the first QKD round. To this end, again, PSK distributed by organizational means is required. This is, naturally, a burden on scalability, especially when addressing situations of significant QKD proliferation, when no PSK is already available. Indeed, distributing pairwise PSK by hand (a conventional "manual" distribution of key pairs is schematically depicted in FIG. 6) is really not efficient, and particularly, not-scalable in general but may be suitable for some specific scenarios.

[0014] Authentication in a QKD Network. Up to now, we have addressed QKD technology only, i.e. direct QKD connections. However, to distribute QKD key end-to-end QKD Networks are needed (be these Networks with Nodes that need to necessarily be trusted as this is today, or entanglement-distribution ones, powered by novel devices, called Quantum Repeaters, in the future). To this end dedicated network-wide key distribution protocols are employed. The latter protocols can ensure key distribution on the same security level as QKD, if distribution of PSK for initial authentication purposes is provided between some and, at least in certain cases, any two Network nodes, or more generally between many entities in the Network. We underline here that as the said entities are assumed to have access to QKD Network- wide key distribution they can also make use of the key growing process, described above for QKD , and, for this reason, only initial authentication key is needed for the first round of communication. (In the process consisting of key growing rounds, in each round key for authentication purposes in the next round can be reserved. If some other entities in a QKD Network (e.g. ones related to a network-wide control mechanisms) do not have access to a key, originating from a key growing process, but do need authentication key then the provision of initial authentication key is not sufficient and the process, presented in this disclosure can be performed perpetually. This can, however lead to loss of the advantages of the presented techniques.

[0015] We finally also mention that what is presented in this disclosure may be achieved using techniques and designs, described in prior art, although the latter have the disadvantages of: i) Not being directly adapted to the use case at hand: scalable pre-distribution of key for initial authentication purposes in a QKD Network, and ii) Being overcomplicated, for the present use case, as their real target is distribution of key for secure communication purposes.

[0016] SUMMARY

[0017] In view of the above, this disclosure aims to improve the conventional methods by overcoming the scalability problem of pre-shared distribution of initial authentication key for QKD Networks. To this end, the disclosure proposes an extended QDK network, and a corresponding method. The disclosure is based on the following considerations from the inventors.

[0018] PQC to initialize the QKD authentication key: A possible solution to the highlighted issue can be identified through a security-flexibility trade-off.

[0019] From a security perspective, a conventional solution to realize an authenticated key agreement scheme is to combine QKD with "one-time MACs", exchanging the initial authentication key with procedural security guarantees. Assuming that there is no gap between theory and practical implementation, the overall scheme is ITS and so it is resilient even in the face of an attacker with unlimited resources. However, QKD needs an ad-hoc infrastructure and, depending on the use case scenario, the authentication key initialization is not always doable.

[0020] From a flexibility perspective, an authenticated key agreement scheme based on Post Quantum Cryptography (PQC) can be seen as a valuable direction in both scalability and usability since it can be directly integrated into already existing communication infrastructures. An additional advantage is that PQC is considered Quantum Resistant - i.e. secure against known algorithms for prospective Quantum computers. However, as discussed above, the strict ITS security level cannot be sustained. Indeed, we are confronted with mixing of two security levels. Authentication and key agreement are carried out as in the ITS solution on the basis of QKD key exchange and one-time MAC authentication, while the initialization of the first authentication key is realized e.g. through a post-quantum KEM (rather than PQC Digital Signature). Thus more flexibility is gained at the price of reducing the security. Delving deeper into this point, the trade-off is describing a solution with quantum-resistant, but computational, security just in the first QKD round. Indeed, one may observe that the overall security of a protocol is determined by the security of its weaker component. However, if no attacker is able to intervene and break this first part in real-time, further QKD rounds guarantee unconditionally secure authenticated key agreement procedures. This resulting security model is usually defined as "Everlasting Security" (which is generally a feature of QKD). The trade-off presented above is an integration of PQC and QKD.

[0021] A couple of hints are useful for practical scenarios. The first one is actually an open problem: everlasting security holds as long as an attacker cannot force a reinitialization. Therefore, in concrete solutions it is crucial to mitigate attacks aiming at consuming all authentication keys to bring back the parties to a condition where no unconditional secure secret is already available. Therefore, this is a risk surface that is open to a hypothetic attacker, who might thwart PQC, may attempt an attack using this strategy.

[0022] The second one is that in the face of the "store now, decrypt later" attack described above, which is the most relevant current threat rising from quantum computers, unconditional confidentiality - guaranteed by the QKD protocol - with initial computational authentication might be enough. Therefore, in the transition to quantum-resistant solutions, multiple trade-offs can be considered.

[0023] However, it is to be noted in this discussion that there is an important catch. As any sufficiently strong key distribution mechanism PQC KEM does not come for free. In order to avoid a trivial MITM it requires a message authentication mechanism that boils down to the asymmetric case, described above. As stated, to this end, a PKI is needed and one must: i) Trust its integrity, ii) Accept the burden of direct (best of all physical) interaction between each participant and the PKI, which is proportional to N - the number of participants, and iii) Be security-wise content with the key distribution method (we note that the PKI distributes the public key of Alice to Bob, and vice versa, by using a KEM and the public keys of Bob / Alice that it possesses).

[0024] At first glance the trade-off is acceptable as it replaces the quadratic (more precisely proportional to N(N-l) / 2) burden of individual interactions that would be needed for a pairwise PSK distribution "by hand". Later on, in this disclosure, it is shown that one can rely on only ii) N interactions, if i) trusting the integrity of an analogue to the PKI is acceptable but not iii) relying on public key -private key cryptographic methods.

[0025] Symmetric ITS Methods to initialize the authentication key between entities in a QKD Network: The idea of a trusted repository of key or as it is traditionally called in symmetric cryptography - a Key Distribution Center (KDC) is crucial for the conventional solution of distributing a secret (session) key between any two parties in a network of participants. This method is very old indeed. It dates back to the Kerberos protocol and even the preceding Needham-Schroeder Protocol (from 1978). In essence, these protocols, very roughly, reduce to the following mechanism. The KDC initially shares a secret key with each of the participants. Essentially, this sharing has to be done by trusted couriers, or by the participants physically getting such individual PSK from the KDC by simultaneously proving their identity to it. This is an organizational effort but it is equivalent to the one in ii) above. Moreover, also as above, it is scalable. Each new participant needs to contact the KDC, prove its identity and get its individual key. When each currently active party has its PSK, it asks the KDC for a session key with another party and the KDC enables such a key by utilizing the two individual PSKs. Here, significant technical details have been neglected, allowing to thwart replay attacks and the exact sequence and direction of communication.

[0026] This conventional scheme can be modified and adapted to allow distributing individual keys between any two network participants by means of ITS (composable, e-secure) transport, specifically using secrecy by means of One Time Pad (OTP) plus SU2 message authentication.

[0027] The main objective of the present disclosure is to enable scalable key distribution for initial authentication purposes between entities in a QKD network using ITS methods alone, and in a simplified manner, compared to what can be deduced from prior art.

[0028] This and other objectives are achieved by the solutions provided in the independent claims. Advantageous implementations are further defined in the dependent claims. A first aspect of the disclosure provides an extended QKD network, whereby the extension enables scalable initial authentication key distribution between entities in the extended QKD network. The extended QKD network comprising at least a first entity, a second entity, and a central KDC. The KDC is configured to: obtain, using organizational security measures, a secret key between the KDC and the first entity, denoted as Kl'KDC.A i: obtain, using organizational security measures, a secret key between the KDC and the second entity, denoted as Kl'KDC.B i: and receive, from the first entity using information theoretically secure, ITS, communication, a request for starting the initial authentication key distribution between the first entity and the second entity.

[0029] In other words, the extended QKD network means an extension of the QKD network by a KDC.

[0030] In the extended QKD network according to this disclosure, the role of the first entity and the second entity is not symmetric, as the first entity may initiate authentication with the second entity, and may generate the secret key K(A,B) with the help of the KDC.

[0031] Initial authentication in QKD networks can be needed also between different modules and not only between nodes. Thus, in this disclosure the term "entity" is used to refer to a node or to a module in a node.

[0032] Further, in this disclosure, the notation K(zQ) and SKyare used interchangeably, and indicate a secret key between any two parties i and j of the extended QKD network, where i j and where i and j refer to two of the following: the first entity, the second entity and the KDC.

[0033] Further, in this disclosure, organizational security measures may refer to, or may comprise, non-cryptographic techniques (e.g., hardware protection, or procedural controls, or manual transport) to achieve specific security objectives.

[0034] In an implementation form of the first aspect, the request is received by the KDC using a first portion of the secret key between the KDC and the first entity, denoted as Kl'KDC.A I ). Then, the KDC is further configured to send, to the first entity using ITS communication, a first portion of the secret key between the KDC and the second entity, K(KDC,B 1 ) by using a second portion of the secret key between the KDC and the first entity, Kl'KDC.A2 |. in response to the request. Additionally, the first entity is configured to: generate an initial authentication secret key between the first entity and the second entity, denoted as Kl'A.B i: and send, to the second entity using ITS communication, the initial authentication secret key between the first entity and the second entity K(A,B) by using the first portion of the secret key between the KDC and the second entity K(KDC,B 1 ).

[0035] In an implementation form of the first aspect, the first portion of the secret key between the KDC and the first entity Ki K DC .A 1 ) is a first substring of the secret key between the KDC and the first entity Kl'KDC.A i. and has a predetermined first length / i.

[0036] In an implementation form of the first aspect, the second portion of the secret key between the KDC and the first entity K( KDC.A2 | is a second substring of the secret key between the KDC and the first entity Kl'KDC.A i and has a predetermined second length h.

[0037] In an implementation form of the first aspect, the first portion of the secret key between the KDC and the second entity K(KDC,B1) is a first substring of the secret key between the KDC and the second entity K(KDC,B) and has a predetermined third length h. In an implementation form of the first aspect, the initial authentication secret key between the first entity and the second entity K(A,B) has a predetermined fourth length U.

[0038] In an implementation form of the first aspect, the second length h is larger than the third length h, and the third length h is larger than the fourth length .

[0039] In an implementation form of the first aspect, a difference between the second length h and the third length h is equal to a difference between the third length h and the fourth length U.

[0040] In an implementation form of the first aspect, the first length / i is fixed to be minimally equal to the fourth length U.

[0041] In an implementation form of the first aspect, the usage of each one of the first substring of the secret key between the KDC and the first entity KiKDC.A l y the second substring of the secret key between the KDC and the first entity Kl'KDC.A2 ). and the first substring of the secret key between the KDC and the second entity K(KDC,B1), is a one-time usage.

[0042] In an implementation form of the first aspect, the ITS communication comprises secret communication and authentic communication.

[0043] Conventionally secret communication is frequently but erroneously used instead of secure communication. In contrast, in this disclosure both secret communication and authentic communication are performed.

[0044] In an implementation form of the first aspect, the first entity is further configured to: generate the secret key between the KDC and the first entity Kl'KDC.A ): and deliver, to the KDC, the secret key between the KDC and the first entity Kl'KDC.A ) by using organizational security measures.

[0045] In an implementation form of the first aspect, the second entity is further configured to: generate the secret key between the KDC and the second entity Kl'KDC.B ): and deliver, to the KDC, the secret key between the KDC and the second entity K(KDC,B) by using organizational security measures.

[0046] A second aspect of the disclosure provides a method of scalable initial authentication key distribution between entities in an extended QKD network, the extended QKD network comprising at least a first entity, a second entity, and a central KDC. The method comprises: obtaining, by the KDC using organizational security measures, a secret key between the KDC and the first entity, Kl'KDC.A ): obtaining, by the KDC using organizational security measures, a secret key between the KDC and the second entity, Kl'KDC.B ): and receiving, by the KDC from the first entity using ITS communication, a request for starting the initial authentication key distribution between the first entity and the second entity.

[0047] In an implementation form of the second aspect, the request is received by the KDC using a first portion of the secret key between the KDC and the first entity, K(KDC,A1), and the method further comprises: sending, by the KDC to the first entity using ITS communication, a first portion of the secret key between the KDC and the second entity, K(KDC,B1) by using a second portion of the secret key between the KDC and the first entity, Kl'KDC.A2 ). in response to the request; generating, by the first entity, an initial authentication secret key between the first entity and the second entity, K(A,B); and sending, by the first entity to the second entity using ITS communication, the initial authentication secret key between the first entity and the second entity K(A,B) by using the first portion of the secret key between the KDC and the second entity K(KDC,B 1 ). In an implementation form of the second aspect, the first portion of the secret key between the KDC and the first entity K(KDC,A1) is a first substring of the secret key between the KDC and the first entity Kl'KDC.A ). and has a predetermined first length / i.

[0048] In an implementation form of the second aspect, the second portion of the secret key between the KDC and the first entity K( KDC.A2 ) is a second substring of the secret key between the KDC and the first entity K( KDC.A ) and has a predetermined second length fain an implementation form of the second aspect, the first portion of the secret key between the KDC and the second entity K(KDC,B1) is a first substring of the secret key between the KDC and the second entity K(KDC,B) and has a predetermined third length fa.

[0049] In an implementation form of the second aspect, the initial authentication secret key between the first entity and the second entity K(A,B) has a predetermined fourth length fain an implementation form of the second aspect, the second length fa is larger than the third length fa, and the third length fa is larger than the fourth length fain an implementation form of the second aspect, a difference between the second length fa and the third length fa is equal to a difference between the third length fa and the fourth length fa.

[0050] In an implementation form of the second aspect, the first length fa is fixed to be minimally equal to the fourth length fa.

[0051] In an implementation form of the second aspect, the usage of each one of the first substring of the secret key between the KDC and the first entity KiKDC.A l y the second substring of the secret key between the KDC and the first entity Kl'KDC.A2 ). and the first substring of the secret key between the KDC and the second entity K(KDC,B1), is a one-time usage.

[0052] In an implementation form of the second aspect, the ITS communication comprises secret communication and authentic communication.

[0053] In an implementation form of the second aspect, the method further comprises: generating, by the first entity, the secret key between the KDC and the first entity Kl'KDC.A ): and delivering, by the first entity to the KDC, the secret key between the KDC and the first entity Kl'KDC.A ) by using organizational security measures.

[0054] In an implementation form of the second aspect, the method further comprises: generating, by the second entity, the secret key between the KDC and the second entity Kl'KDC.B ): and delivering, by the second entity to the KDC, the secret key between the KDC and the second entity K(KDC,B) by using organizational security measures.

[0055] The method according to the second aspect provides the same advantages and effects as the QKD network according to the first aspect and its respective implementation forms.

[0056] A third aspect of the disclosure provides a non-transitory memory comprising instructions which, when executed by a processor, cause the processor to carry out the steps performed by the KDC according to the method of the second aspect. Additionally, or alternatively, the non-transitory memory comprises instructions which, when executed by a processor, cause the processor to carry out the steps performed by the first entity according to the method of the second aspect.

[0057] Additionally, or alternatively, the non-transitory memory comprises instructions which, when executed by a processor, cause the processor to carry out the steps performed by the second entity according to the method of the second aspect.

[0058] The non-transitory memory comprising the instructions according to the third aspect provides the same advantages and effects as described above for the KDC and / or the first entity and / or the second entity according to the method of the second aspect and its respective implementation forms.

[0059] The main advantages of the solutions according to this disclosure can be summarized as follows:

[0060] • The potential weaknesses of using non-ITS communication methods are overcome, whilst allowing for scalable initial pre-sharing of key for authentication purposes, as the trust in a central KDC is an acceptable burden for an operator of a QKD network.

[0061] • The required / used amount of the key strings that need to be distributed is significantly lower compared to the number of bits used in solutions that can be derived from prior art, thereby making the initial key pre-sharing task easily manageable for a QKD network operator.

[0062] • The complexity of the task of pre-sharing key for initial authentication is reduced from quadratic to linear, as each newly introduced entity needs only to exchange a key with the KDC after it is introduced. Additionally the usage of non-ITS methods is avoided (e.g. ones based on PQC), which are widely assumed to be the only scalable option and, therefore, avoid making assumptions on the capacity (e.g. computing power) of an adversary.

[0063] It has to be noted that all devices, elements, units and means described in the present application could be implemented in the software or hardware elements or any kind of combination thereof. All steps which are performed by the various entities described in the present application as well as the functionalities described to be performed by the various entities are intended to mean that the respective entity is adapted to or configured to perform the respective steps and functionalities. Even if, in the following description of specific embodiments, a specific functionality or step to be performed by external entities is not reflected in the description of a specific detailed element of that entity which performs that specific step or functionality, it should be clear for a skilled person that these methods and functionalities can be implemented in respective software or hardware elements, or any kind of combination thereof.

[0064] BRIEF DESCRIPTION OF DRAWINGS

[0065] The above described aspects and implementation forms of the present disclosure will be explained in the following description of more specific embodiments in relation to the enclosed drawings, in which

[0066] FIG. 1 shows a schematic view of an extended QKD network according to this disclosure;

[0067] FIG. 2 shows an example of exchanged information between the first entity, the KDC, and the second entity of the extended QKD network according to this disclosure;

[0068] FIG. 3 shows a schematic view of an extended QKD network according to this disclosure;

[0069] FIG. 4 shows a flowchart of a method for an extended QKD network according to this disclosure;

[0070] FIG. 5 schematically shows an approach to establish initial pair-wise keys by using a conventional Public Key

[0071] Cryptography (and also PQC) method;

[0072] FIG. 6 schematically shows a conventional approach for pair- wise key distribution in a QKD network. FIG. 5 and FIG. 6 are not discussed below, as these reflect prior art. Also, for this reason the term "Node"', instead of "Entity" is used there, as presently initial authentication is discussed only between QKD Modules, and more generally trusted nodes, in which the said modules are located. Presently no significant differentiation is made between such nodes and the potentially different entities that are dedicated to key agreement, which are also located in these nodes.

[0073] Same elements shown in the figures are labeled with the same reference sign, and may be implemented likewise. The size of elements in the figures is not to scale and may be different compared to a real-life implementation in order to highlight details of the disclosure.

[0074] DETAILED DESCRIPTION OF EMBODIMENTS

[0075] For ease of understanding, the following first describes technical terms mentioned in this disclosure.

[0076] A key is a string that can always be represented as a binary bit string, which can be used for a variety of cryptographic purposes.

[0077] A secret or symmetric key is an identical key shared by two or more parties. In this disclosure the terms "key" and "secret key" are used interchangeably.

[0078] Public-private or asymmetric key pairs are keys whereby the public key can easily be derived from the private one but performing the inverse operation is considered practically impossible. Public Key Cryptography relies on public-private key pairs. Public Key Cryptography relies on public-private key pairs. One specific sub-class of Public Key Cryptography is PQC that uses methods that are believed to be secure against future quantum computers. That is, PQC is designed so that it will not be susceptible against a single known algorithm for quantum computers, by P. Shor, that can efficiently derive the private from the public key, when the relation of both is based on presently ubiquitously used mathematical foundations. A PQC method for key distribution is the KEM explained above in this disclosure, in which a random string is generated, encrypted by the public key of the counterpart and sent to it. A legitimate receiver and only it will be able to decrypt the message and the initial random string can be used as a symmetric key between the sender and the receiver.

[0079] A cryptographic protocol is ITS if it cannot be subverted by any adversary.

[0080] ITS secret communication is a one, for which no adversary can obtain any information on the communicated message.

[0081] ITS authentic communication is a one, that cannot be modified by any adversary . Message authentication is a method to enforce message authenticity. ITS authentication of a communication message is realized by using dedicated HMAC families, as explained above in this disclosure. Specifically, the procedure consists in augmenting the message with an additional auxiliary authentication one, whereby no adversary can obtain any information on the relation between the communication message and the auxiliary one. It is to be underlined that the authentication message is to be used only once, for which reason the term one-time HMAC is used. One way to get one-time HMACs is to derive the auxiliary authentication message by hashing the communication message with an arbitrary member of a Strongly Universal? (SU2) family of hashing functions. If two or more parties want to choose the same member of the family, they must use a pre-shared secret index of the family. Pre-sharing a secret index is equivalent to establishing a PSK.

[0082] In this disclosure, ITS communication comprises, or is, both ITS secret and ITS authentic.

[0083] FIG. 1 depicts a schematic view of an exemplary embodiment of an extended QKD network 100 for scalable initial authentication key distribution between entities in the extended QKD network 100 according to this disclosure. The QKD network 100 comprises at least a first entity 120, a second entity 130, and a KDC 110.

[0084] The QKD network 100 may comprise processing circuitry (not shown) configured to perform, conduct or initiate the various operations of the QKD network 100 described herein. The processing circuitry may comprise hardware and software. The hardware may comprise analog circuitry or digital circuitry, or both analog and digital circuitry. The digital circuitry may comprise components such as application-specific integrated circuits (ASICs), field-programmable arrays (FPGAs), digital signal processors (DSPs), or multi-purpose processors. In one embodiment, the processing circuitry comprises one or more processors and a non-transitory memory connected to the one or more processors. The non-transitory memory may carry executable program code which, when executed by the one or more processors, causes the QKD network 100 to perform, conduct or initiate the operations or methods described herein.

[0085] The KDC 110 may comprise processing circuitry (not shown) configured to perform, conduct or initiate the various operations of the KDC 110 described herein. The processing circuitry may comprise hardware and software. The hardware may comprise analog circuitry or digital circuitry, or both analog and digital circuitry. The digital circuitry may comprise components such as application-specific integrated circuits (ASICs), field-programmable arrays (FPGAs), digital signal processors (DSPs), or multi-purpose processors. In one embodiment, the processing circuitry comprises one or more processors and a non-transitory memory connected to the one or more processors. The non-transitory memory may carry executable program code, which, when executed by the one or more processors, causes the KDC 110 to perform, conduct or initiate the operations or methods described herein.

[0086] The first entity 120 may comprise processing circuitry (not shown) configured to perform, conduct or initiate the various operations of the first entity 120 described herein. The processing circuitry may comprise hardware and software. The hardware may comprise analog circuitry or digital circuitry, or both analog and digital circuitry. The digital circuitry may comprise components such as application-specific integrated circuits (ASICs), field-programmable arrays (FPGAs), digital signal processors (DSPs), or multi-purpose processors. In one embodiment, the processing circuitry comprises one or more processors and a non-transitory memory connected to the one or more processors. The non-transitory memory may carry executable program code which, when executed by the one or more processors, causes the first entity 120 to perform, conduct or initiate the operations or methods described herein.

[0087] The second entity 130 may comprise processing circuitry (not shown) configured to perform, conduct or initiate the various operations of the second entity 130 described herein. The processing circuitry may comprise hardware and software. The hardware may comprise analog circuitry or digital circuitry, or both analog and digital circuitry. The digital circuitry may comprise components such as application-specific integrated circuits (ASICs), field-programmable arrays (FPGAs), digital signal processors (DSPs), or multi-purpose processors. In one embodiment, the processing circuitry comprises one or more processors and a non-transitory memory connected to the one or more processors. The non-transitory memory may carry executable program code which, when executed by the one or more processors, causes the second entity 130 to perform, conduct or initiate the operations or methods described herein.

[0088] In the exemplary embodiment according to FIG. 1, the KDC 110 is configured to obtain, by using organizational security measures, a secret key 111 between the KDC and the first entity, Kl'KDC.A ). and to obtain, by using organizational security measures, a secret key 112 between the KDC and the second entity, K(KDC,B).

[0089] The process of obtaining these keys may be considered secured by the organizational measures (e.g. sharing two identical Hardware Security Modules) and therefore may not be subject to any security threat. For example, and not as a limitation, the first entity 120 may be configured to generate the secret key 111 between the KDC and the first entity K(KDC,A), and may provide the secret key 111 K(KDC,A) to the KDC 110 using organizational security measures. Additionally or alternatively, the second entity 120 may be configured to generate the secret key 112 between the KDC and the second entity K(KDC,B), and may provide the secret key 112 K(KDC,B) to the KDC 110 using organizational security measures.

[0090] Alternatively, the KDC 110 may be configured to generate the secret key 111 between the KDC and the first entity K(KDC,A), and may be further configured to provide the secret key 111 K(KDC,A) to the first entity 120 using organizational security measures. The KDC 110 may be further configured to generate the secret key 112 between the KDC and the second entity K(KDC,B), and may be further configure to provide said secret key 112 K(KDC,B) to the second entity 120 using organizational security measures.

[0091] In a further alternative, the KDC 110 may be configured to obtain, by using organizational security measures, the secret key 111 Kl'KDC.A ) and / or the secret key 112 K(KDC,B) from e.g. a further entity external to the QKD network 100, by using organizational security measures.

[0092] Alternatively, the KDC 110 may first obtain, using organizational security measures, the secret key 112 between the KDC an and the second entity K(KDC,B), and may subsequently obtain, using organizational security measures, the secret key 111 between the KDC and the first entity Kl'KDC.A ).

[0093] Further alternatively, KDC 110 may obtain, using organizational security measures, the secret key 111 between the KDC and the first entity K(KDC,A) and the secret key 112 between the KDC and the second entity K(KDC,B) simultaneously.

[0094] An order in which the KDC may obtain each one of the secret key 111 between the KDC and the first entity Kl'KDC.A ) and the secret key 112 between the KDC and the second entity K(KDC,B) does not limit the present disclosure.

[0095] In each of the above alternatives, the party (in this disclosure, the term "party" is used to refer to any one of the first entity 120, the second entity 130 and the KDC 110) that may receive the secret key 111 K(KDC,A) and the party that may receive the secret key 112 K(KDC,B), by means of the organizational security measures, may get a very long key bit-string.

[0096] Then, when the first entity 120 may need to share some amount of initial key with the second entity 130, i.e., when an initial authentication key agreement between the first entity 120 and the second entity 130 is to be established, an ITS communication protocol according to this disclosure may be performed, as follows: In the exemplary embodiment according to FIG. 1 , the first entity 120 may be configured to generate a request 121 for starting the initial authentication key distribution between the first entity 120 and the second entity 130.

[0097] Then, the first entity 120 may be configured to send the request 121 to the KDC 110 using ITS communication. The first entity 120 may send the request 121 using a first portion of the secret key 111 between the KDC and the first entity Kl'KDC.A ). Said first portion of the secret key K(KDC,A) 111 is denoted as K(KDC,A1 ).

[0098] Accordingly, the KDC 110 is configured to receive, from the first entity 120 using ITS communication, the request 121, which is received using the first portion K(KDC,A1 ) of the secret key 111 between the KDC and the first entity Kl'KDC.A ). Then, in response to the request 121 , the KDC 110 is further configured to send, to the first entity 120 using ITS communication, a first portion of the secret key 112 between the KDC and the second entity K(KDC,B). Said first portion of the secret key 112 K(KDC,B) is de noted as K(KDC,B1).

[0099] The KDC 110 is configured to send the first portion K(KDC,B1) to the first entity 120 by using a second portion 113 of the secret key 111 between the KDC and the first entity Ki KDC .A ). where the second portion 113 of the secret key 111 Ki K DC .A ) is denoted Kl'KDC.A2 ).

[0100] Next, the first entity 120 is configured to generate an initial authentication secret key 122 between the first entity and the second entity, K(A,B), upon reception of the second portion 113 KiKDC.A2 ) of the secret key 111 KiKDC.A ) from the KDC 110, and that comprises the first portion K(KDC,B 1 ) of the secret key 112 K(KDC,B).

[0101] For example and not as a limitation, the first entity 120 may generate the initial authentication secret key 122 K(A,B) using a random key generator.

[0102] Then, the first entity 120 is configured to send, to the second entity 130 using ITS communication, the initial authentication secret key K(A,B ) 122 by using the first portion 113 of the secret key between the KDC and the second entity K(KDC ,B 1 ).

[0103] Accordingly, the second entity 130 may receive, using ITS communication, the initial authentication secret key K(A,B) 122 and may use it to perform the initial authentication of a classical channel between the first entity 120 and the second entity 130.

[0104] The first portion of the secret key 111 between the KDC and the first entity K(KDC,A1 ) is a first substring of the secret key 111 K(KDC,A). For example, the first portion of the secret key 111 between the KDC and the first entity K(KDC,A1 ) may be a substring situated at the beginning (start) of K(KDC,A) 111.

[0105] Further, in the exemplary embodiment according to FIG. 1 , the first portion of the secret key 111 between the KDC and the first entity Kl'KDC.A 1) has a predetermined first length h.

[0106] The second portion 113 of the secret key 111 between the KDC and the first entity Kl'KDC.A2 ) is a second substring of the secret key K(KDC,A) 111 between the KDC, and has a predetermined second length h.

[0107] The first portion 113 of the secret key 112 between the KDC and the second entity K(KDC,B1) is a first substring of the secret key K(KDC,B) 112, and has a predetermined third length h.

[0108] The initial authentication secret key 122 between the first entity and the second entity K(A,B) has a predetermined fourth length k.

[0109] The second length h is larger than the third length h, and the third length h is larger than the fourth length k, h > h >k.

[0110] Further, a difference between the second length h and the third length h is equal to a difference between the third length h and the fourth length k, h -h = h - k .

[0111] Further, the first length / i is fixed to be minimally equal to the fourth length k, h = k. The fourth length U may be determined in such a way that the length of the secret key K(A,B) may be sufficient for initial authentication. If it is longer than that, the superfluous part of the string can be discarded.

[0112] If the fourth length U turns not to be sufficient, the ITS protocol according to this disclosure and explained above may be repeated with a securely communicated longer fourth length U. That is, the first entity 120 may send to the KDC 110, using ITS communication, a new request 121 for starting the initial authentication key distribution between the first entity 120 and the second entity 130, by using a new first portion of the secret key 111 between the KDC and the first entity, K(KDC,A1 ). Then, the KDC 110 may send, to the first entity 120 using ITS communication, a new first portion 113 of the secret key 112 between the KDC and the second entity, K(KDC,B1) by using a new second portion of the secret key 111 between the KDC and the first entity, K(KDC,A2), in response to the new request 121 ; and the first entity 120 may generate a new secret key K(A,B) having a new fourth length U, and may further send it, to the second entity 130 using ITS communication. The details are not repeated again.

[0113] In this disclosure, the ITS communication between any two parties of the extended QKD network 100, may be ensured as follows: That an entity sends, by using ITS communication, a portion of a key using by using another portion of another key, comprises three steps on behalf of a sender (or sending entity). The first step may involve encrypting by OTP the string to be sent by a sub-portion of the employed key-string, that is, by employing an amount of pre-shared secret key bits that is equal to the length of the message. The result is a cipher text that is ITS secret. The second step may be computing an Sih tag of an alreadv computed cypher text, obtained by means of the remaining part of the key string. The third step may be concatenating the cypher text and the tag. In other words, ITS authentication, specifically SIB message authentication, may be performed by concatenating a hash value (the tag) of the cipher text with the cipher text. To calculate the SI S hash tag, specifically to choose a member from the SI S hash family, a different, fixed but significantly lower amount of the pre-shared key is employed. All used keys must be discarded.

[0114] This may be followed by sending the concatenation to another entity (participant entity), which possess the key string, employed by the sender. The latter may first check the validity of the sent cypher text by computing the tag of the cipher text, employing the second portion of the key. If these do not coincide, the whole message is discarded. To this end a receiver or receiving entity must know where the tag starts. Then, the receiver shall decrypt the cypher text by the first portion of the key string. F inally, the sender and receiver must discard the used key-string and may move a respective "pointer" in their respective overall (long) PSK to a position starting after an end of the used key-string. In a sense their PSK is shortened by the used key-string.

[0115] Specifically, the receiver must separate the received message into two sections - a cipher text and an authentication tag, as the length of the authentication tag is publicly known (this length denoted in this disclosure as a.) Then, the receiver may identify the exact key bits of the pre-shared key that are used for choosing the SI S hashing function, may select this function and may calculate the hash tag of the cipher text. If that tag coincides with the one of the received message, the process is continued. Otherwise, the communication is discarded. Subsequently, in case of success, the receiver may use the key bits from the pre-shared key that are needed for OTP adding of the cipher text; and may decrypt the cipher text using these bits in an OTP procedure to obtain the original message of the sender. All the used key bits must be discarded

[0116] Thus, the relation of the lengths / i, h, h, as mentioned above for the exemplary embodiment according to FIG. 1, may allow each of the KDC 110, the first entity 120 and / or the second entity 130 to easily identify the end of the cypher text comprised in the sent / received substrings. Additionally or alternatively, the difference between the second length h and the third length h and the difference between the third length h and the fourth length U may be equal to the number a defined above, i.e., h - h = a and h - U = a, and the fourth length U can be fixed to be minimally equal to a, U = a. Thus, h = 2a, h = 3a, while minimally h =a.

[0117] Further, in the exemplary embodiment according to FIG. 1, the usage of each one of the first substring of the secret key 111 between the KDC and the first entity K(KDC,A1), the second substring of the secret key 111 between the KDC and the first entity K(KDC,A2), and the first substring 113 of the secret key 112 between the KDC and the second entity K(KDC,B1), is a one-time usage.

[0118] That each one of the first substring of the secret key 111 between the KDC and the first entity Ki KDC .A I ), the second substring of the secret key 111 between the KDC and the first entity K('KDC.A2 ). and the first substring 113 of the secret key 112 between the KDC and the second entity K(KDC,B 1 ), is a one-time usage may refer to, or may comprise, that after being used, each one of these strings must be deleted from the respective (longer) string it is a part of at both parties at which the respective string is situated.

[0119] For example, sending, by the first entity 120 to the KDC 110 using ITS communication, the request 121 to the KDC 110, by using the first substring K(KDC,A1) of the secret key 111 K(KDC,A) may comprise the following: The first entity 120 must remove the first substring Kl'KDC.A 1) from the secret key 111 Kl'KDC.A ). Then, after receiving, by the KDC 110 from the first entity 120 using ITS communication, the request 121, the KDC 110 may be configured to remove the first substring K(KDC,A1 ) from the secret key 111 Kl'KDC.A ).

[0120] Further, the sending, by the KDC 110 to the first entity 120 using ITS communication, the first portion of the secret key 112 between the KDC and the second entity K(KDC ,B 1 ) by using the second portion of the secret key 111 between the KDC and the first entity Kl'KDC.A2 ) may comprise that the KDC 110 must remove the first substring K(KDC,B1) from the secret key 112 K(KDC,B), and must remove the second substring Kl'KDC.A2 ) from the secret key 111 Ki KDC.A ).

[0121] Then, upon reception of the first portion of the secret key 112 between the KDC and the second entity K(KDC,B1) by using the second portion of the secret key 111 between the KDC and the first entity Kl'KDC.A2 ) from the KDC 110, the first entity 120 may be configured to remove the second substring Kl'KDC.A2 ) from the already reduced secret key 111 Kl'KDC.A ) at the first entity 120 (i.e., at the first entity 120 side).

[0122] The further reduced secret key 111 KiKDC.A ) at the first entity 120, i.e., the secret key 111 KiKDC.A ) after removing the first substring Ki KDC.A2 ) and the second substring K(KDC,A2), shall be identical to a reduced secret key 111 K(KDC,A) at the KDC 110.

[0123] Then, after sending, by the first entity 120 to the second entity 130 using ITS communication, the initial authentication secret key K(A,B) 122 by using the first portion 113 K(KDC,B1), the first entity 120 may be further configured to destroy, or discard, the first substring K(KDC,B1) received from the KDC 110.

[0124] Accordingly, after receiving, by the second entity 130, the using ITS communication, the initial authentication secret key 122 K(A,B), the second entity 130 may be further configured to remove the first substring K(KDC, Bl) from the secret key 112 K(KDC,B) that the second entity 130 may already have, i.e., at the second entity 130 side. A resulting reduced secret key 112 K(KDC,B) at the second entity 130 may be identical to the reduced secret key 112 K(KDC,B) at the KDC 110. Optionally, before receiving, from the first entity 120 using information theoretically secure, ITS, communication, the request 121 for starting the initial authentication key distribution between the first entity 120 and the second entity 130, the KDC 110 may be configured to determine whether overall ITS communication or whether only information theoretical authenticity for the request 121 is deemed necessary . Such a principle choice (to be made before any communication) may affect the first length li.

[0125] When it is determined that ITS communication is needed, the first length may be h = lo+a, where lo may be a standard bit-string length of the request 121. When it is determined that only information theoretical authenticity is needed, the first length may be / i = a.

[0126] In the ITS communication protocol according to this disclosure, and as depicted in the exemplary embodiment according to FIG. 1 , the KDC 110 may have the task to enable the communication of initial authentication keys between the first entity 120 and the second entity 130 using: the key it has with each entity, i.e., the secret key 111 Kl'KDC.A ) and the key and the secret key 112 K(KDC,B), and ITS communication alone.

[0127] Thus, the KDC 110 may be trusted by an operator of the extended QKD network 100 to:

[0128] • Exactly fulfill its prescribed functionality;

[0129] • Be non-curious and try not to eavesdrop the QKD session by legitimate entities;

[0130] • Avoid leaking willingly or non-avertedly any key material to the environment and be respectively adequately protected to make any adversarial key stealing infeasible; and

[0131] • Raise alarms if penetration attempts are registered.

[0132] Further, the analysis presented above in this disclosure shows that while using PQC for authentication of a first round in post-processing communication in QKD creates the appearance of a higher degree of practicability and scalability in a realistic scenario. This is not really the case. Indeed, such a combination of PQC and QKD allows a significant reduction of effort in the distribution pair- wise PSK by hand at the expense of accepting trust in a PKI and a reduction of the overall level of security by using a communication-protocol of lower level of security, at least in the first communication round in a chain ensuring key growing. (As outlined above the forward security of the full process wards off attacks unless these can be successfully performed and combined with a MITM during the first communication round). However, as explained above, the same effect can be achieved by replacing a PKI by a KDC and the PQC communication methods by ITS ones. While the latter is easy to organize in current and soon-to-be realized Quantum Communication Networks, the PQC based method might still have advantages on a very large scale, as existing PKIs can be simply reused and there is no need of establishing new analogous infrastructure.

[0133] Alternatively, the ITS protocol according to this disclosure may comprise other configurations in which the exchanged information and the communicator among the three parties of the extended QKD network 100 may be different.

[0134] For example and without limitation, in an embodiment (not shown), the KDC 110 may provide to the second entity 130 suitable key material that may enable the second entity 130 to generate the initial authentication secret key 122 between the first entity and the second entity K(A,B). Said suitable key material may be, or may comprise, any suitable substring of the secret key 112 K(KDC,B) and / or of the secret key 111 K(KDC,A). The details regarding the substrings exchanged between two parties of the extended QDK network 100 may be equivalent to the ITS protocol described above for the exemplary embodiment according to FIG. 1 , and are not repeated again. Thereby, a configuration of the form first entity 120 KDC 110 ^ second entity 130 first entity 120 may be implemented, as an alternative to the configuration according to the exemplary embodiment of FIG. 1 , that can be denoted as first entity 120 KDC 110 —* first entity 120 second entity 120.

[0135] In an embodiment (not shown), a further alternative configuration of the form first entity 120 KDC 110 ^ second entity 130 may also be implemented. This alternative may be more economic; however, even a completely passive KDC 110 may learn the common initial authentication key 122 between the first entity and the second entity K(A,B).

[0136] Further alternatives that enable the generation of the initial authentication key 122 between the first entity and the second entity K(A,B) with the aid of the KDC 110 that may hold both the secret key 111 Kl'KDC.A ; and the secret key 112 K(KDC,B) may be implement the ITS protocol according to the exemplary embodiment of FIG. 1.

[0137] FIG. 2 is a schematic view of an example implementation of a QKD network 100 according to this disclosure, which builds on the QKD network 100 according to FIG. 1.

[0138] The diagram according to FIG. 2 depicts the ITS protocol according to the exemplary embodiment of FIG. 1 and does not limit this disclosure. Said ITS protocol may be summarized as follows: The ITS protocol according to this disclosure and depicted in FIG. 1 , may then be summarized as follows: Each new entity 120, 130 in the extended QKD network may contact the KDC 110 and may provide it with, or may receive from it, a very big amount of individual secret key, e.g. an entity A 120 may get the overall very long key-string Kl'KDC.A ; from the KDC 110, alternatively may provide said very long key-string Kl'KDC.A ; from the KDC 110, using organizational security measures. If subsequently this entity A 120 needs to share some amount of initial key with another entity B 130, to serve as an initial key for a QKD session between A 120 and B 130, then an ITS procedure as explained below can be applied. To facilitate the mentioned above problem of identifying the end of the cypher text, four standard string lengths / i, h, h and k can be chosen, so that h > h > k, whereby h - h and h - k are two identical numbers, equal to a length of a key parameterizing a member of the used SU2 hash family. Then:

[0139] 1. The entity A 120 communicates her request (RB) 121 to get a key with B 130 using (in the above-explained sense) a first portion of her key with the KDC 110 K(KDC,A1), of length / 1, which a substring of K(KDC,A) 111. It must be chosen, whether overall IITS, or only information theoretical authenticity of this first request 121 is deemed necessary. Naturally such a principle choice (to be made before any communication) will affect the length of / 1.

[0140] 2. The KDC 110 answers with a sub-string of the key-string K(KDC,B), namely K(KDC,B1) 113 of standard length h. To do so the KDC 110 uses another portion of its key with A, namely K('KI )C.A2 ; of length h.

[0141] 3. The entity A 120 then generates a random key string K(A,B) 122 of standard length k and sends it to B 130, using the sub-string K(KDC,B1) 113.

[0142] 4. The entity A 120 and the entity B 130 can now use K(A,B) 122 for initial authentication of the communication channel between them. (Note that k has to be dimensioned in such a way that the length of K(A,B) 122 is typically sufficient for initial authentication. If it is longer than that, the superfluous part of the string can be discarded. If the length turns not to be sufficient, the procedure must be repeated with a securely communicated longer string length.)

[0143] 5. The whole process needs to be repeated for obtaining initial authentication key of A 120 with any other entity or, generally, between any two parties 120, 130.

[0144] The key strings and sub-strings used for a secure transport of another string and / or sub-string must be obviously longer, as follows from the discussion presented above in this disclosure. Naturally, the whole process critically depends on distributing very long key-strings between the KDC 110 and any individual "network entity" . Nowadays, this is not a real technical problem and can be organized trivially. If for some reason some entity runs out of initial authentication key, it needs to be "rekeyed" by "visiting" again the KDC 110.

[0145] Note that this method is equivalent in effort to the conventional solutions explained above in this disclosure and allows PSK availability to A 120 and B 130 plus entity authentication of B 130 for A 120. While the inverse is not true with the presented protocol, this is also possible by an appropriate extension.

[0146] In FIG. 2, ITSX(Y) means the ITS communicator of Y, using a portion x of the secret key 111 between the KDC and the first entity K(KDC,A) or of the secret key 112 between the KDC and the second entity K(KDC,B) and / or a portion 112. Further, a small circle after each ITS transport denotes rescinding of the used key, i.e. discarding the used substrings.

[0147] Further, in FIG. 2, the circle enclosing the key 122 between the first entity and the second entity K(A,B) depicts a local key random generator that may generate, by the first entity 120, said secret key 122 K(A,B).

[0148] FIG. 3 schematically depicts an exemplary embodiment for an extended QKD network 100 according to this disclosure, which builds on the QKD network 100 according to FIG. 1. Hereinafter, only the differences between FIG. 3 and FIG. 1 are presented.

[0149] In FIG. 3, the extended QKD network 100 may comprise a plurality of entities, for example and not as a limitation the six entities 120, 120-2, 120-3, 130, 130- 2, and 130-3, and the KDC 110 may obtain a secret key between the KDC and the each entity, depicted as K(KDC,z) where i = 1, 2, ... 6.

[0150] The ITS protocol according to this disclosure and explained above for the exemplary embodiment of FIG. 1, may also apply for each pair of entities of the plurality of entities. For example, when the third entity 120-2, depicted as Ent. 3 in FIG. 3, may need to start an initial authentication secret key between the third entity 120-2 and a fourth entity 130-2, depicted as Ent. 4, with the help of the KDC 110, the third entity 120- 2, the KDC 110 and the fourth entity 130-2 may perform the ITS protocol explained above for the exemplary embodiment of FIG. 1. The details are not repeated again here.

[0151] Additionally, or alternatively, when the fifth entity 120-3, depicted as Ent. 5 in FIG. 3, may need to start an initial authentication secret key between the fifth entity 120-3 and, for example, the sixth entity 130-3, depicted as Ent. 6, with the help of the KDC 100, the fifth entity 120- 2, the KDC 110, and the sixth entity 130 -2 may preformed the ITS protocol according to this disclosure, and explained above. The details are not repeated again.

[0152] Further, in an embodiment (not shown), the extended QKD network 100 may comprise one or more KDCs 110. Each KDC 110 may obtain a secret key between itself and each one of the plurality of entities in the extended QKD network 100.

[0153] Further, each KDC 110 may:

[0154] • Exactly fulfill its prescribed functionality;

[0155] • Be adequately protected so that no adversary will be in the position to thwart the protections of sufficient amount of KDCs; and

[0156] • Ensure that no sufficient amount of the KDCs collude.

[0157] Each of the one or more KDCs 110 may enable the key distribution, i.e., the ITS protocol, as explained above for the exemplary embodiments according to FIG. 1 and FIG. 3; thereby, a k of n Secret Sharing Scheme may be realized using one or more (separate) keys provided by the each of the one or more KDCs 110 so that if an insufficient amount of KDCs 110 collude, an initial authentication key agreed between legitimate entities remains unknown to any of the KDCs 110 irrespective of the crypto power ascribed to any of the KDCs 110, wherein n is a number of the one or more KDCs 110 in the chosen Secret Sharing Scheme, and k is a number of secret keys that are sufficient to be known to break the k of n Secret Sharing Scheme. With this embodiment (not shown), the ITS protocol for initial authentication according to this disclosure may be extended among one or more extended QKD networks that may be operated by one or more independent providers.

[0158] The solutions according to the exemplary embodiments and examples of FIG. 1, FIG. 2, and FIG. 3, require relatively low amounts of key strings that strictly need to be pre-shared with the KDC 110 of the extended QKD network 100.

[0159] Specifically, a key of length s4a bits, must be available in the key 111 Kl'KDC.A ). where is a number of entities in the extended QKD network 100, to which the first entity 120 may request an initial authentication key. Simultaneously, la bits may need to be available in each secret key between the KDC and each of the entities to which the first entity 120 may request an initial authentication key, K(KDC,z), with z-1, s may be all the entities with which the first entity 120 may require an initial authentication key. In general, ,v entities may request initial authentication key with the first entity 120. For this reason, the secret key 111 between the KDC and the first entity Ki KDC .A ) may also hold additional , ' la bits, where , ' is a number of entities that would request initial key with the first entity, and where .v+.v' cannot exceed n, where n is a number of all entities in the extended QKD network 100 (and s~s'). For this reason, the secret key Kl'KDC.A ) may hold on average riia bits of key. To be on the safe side, all the bits of the secret key 111 Kl'KDC.A ) can be increased to zzlOa for each first entity 120. Therefore, if the KDC 110 exchanges zzlOa bits with each newly subscribed entity, this may be sufficient. This number is certainly much smaller, compared to the number of bits expect to be sufficient in the conventional solutions, thereby making the initial key pre-sharing task easily manageable for an operator of the extended QKD network 100.

[0160] Moreover, in conventional QKD networks, it must be ensured that each newly introduced entity can pre-share an initial authentication key with all entities that it might communicate with. On the one hand this number is certainly unknown and also the presently practiced method is ensuring the security of pre-sharing by organizational means that implies a quadratic (in terms of entities) and increasing burden as new entities are being added.

[0161] Further, in the solutions according to the exemplary embodiments and examples of FIG. 1, FIG. 2, and FIG. 3, the secret key

[0162] 111 between the KDC and the first entity K(KDC,A) is reduced by / i +h bits (minimally 4a), while the secret key 112 between the KDC and the second entity K(KDC,B) is reduced by h bits (minimally 2a). The exact steps when the reduction takes place at the KDC 110 and the first entity 120 (or the second entity 130 in other configurations), respectively, may be subject to the specific implementation.

[0163] FIG. 4 shows an exemplary embodiment of a method 400 of scalable initial authentication key distribution between entities in an extended QKD network 100, the extended QKD network 100 comprising at least a first entity 120, a second entity 130, and a KDC 110.

[0164] The method 400 may be carried out by the extended QKD network 100 according to this disclosure and explained above in the exemplary embodiments according to FIG. 1, FIG. 2, FIG. 3, and FIG. 4.

[0165] In a step 401, the method 400 comprises obtaining, by the KDC 110 using organizational security measures, a secret key 111 between the KDC and the first entity, Kl'KDC.A ).

[0166] Then, in a step 402, the method 400 comprises obtaining, by the KDC 110 using organizational security measures, a secret key

[0167] 112 between the KDC and the second entity 130, K(KDC,B). Alternatively, the method step 402 may be performed before the step 401. That is, the KDC 110 may first obtain, using organizational security measures, the secret key 112 between the KDC an and the second entity K(KDC,B), and may subsequently obtain, using organizational security measures, the secret key 111 between the KDC and the first entity K(KDC,A).

[0168] Further alternatively, the method steps 401 and 402 may be performed simultaneously. In other words, the KDC 110 may obtain, using organizational security measures, the secret key 111 between the KDC and the first entity Kl'KDC.A ) and the secret key 112 between the KDC an and the second entity K(KDC,B) simultaneously

[0169] An order in which the KDC may obtain each one of the secret key 111 between the KDC and the first entity Kl'KDC.A ) and the secret key 112 between the KDC and the second entity K(KDC,B) does not limit the present disclosure.

[0170] The method 400 further comprises a step 403 of receiving, by the KDC 110 from the first entity 120 using information theoretically secure, ITS, communication, a request 121 for starting the initial authentication key distribution between the first entity 120 and the second entity 130.

[0171] In an embodiment, the request 121 may be received by the KDC 110 using a first portion of the secret key 111 between the KDC and the first entity, Kl'KDC.A I ). Then, the method 400 may further comprise an optimal step 404 of sending, by the KDC 110 to the first entity 120 using ITS communication, a first portion of the secret key 112 between the KDC and the second entity, K(KDC,B 1 ) 113 by using a second portion of the secret key 111 between the KDC and the first entity, K(KDC,A2), in response to the request 121.

[0172] Then, in an optional step 405 the method 400 may further comprise generating, by the first entity 120, an initial authentication secret key 122 between the first entity 120 and the second entity 130, K(A,B). Further, the method 400 may comprise an optional step of sending, by the first entity 120 o the second entity 130 using ITS communication, the initial authentication secret key 122 between the first entity 120 and the second entity 130 K(A,B) by using the first portion 113 of the secret key between the KDC and the second entity K(KDC,B1).

[0173] The present disclosure further provides a non-transitory memory comprising instructions which, when executed by a processor, cause the processor to carry out the steps of the method 400 performed by the KDC 110.

[0174] Additionally, or alternatively, the non-transitory memory may comprise instructions which, when executed by a processor, cause the processor to carry out the optional steps of the method 400 performed by the first entity 120.

[0175] Additionally, or alternatively, the non-transitory memory may comprise instructions which, when executed by a processor, cause the processor to carry out the optional steps of the method 400 performed by the second entity 130.

[0176] The instructions may be included in a computer readable medium. The computer readable medium may comprise one or more Hardware Security Modules (HSMs).

[0177] The present disclosure has been described in conjunction with various embodiments as examples as well as implementations. However, other variations can be understood and effected by those persons skilled in the art and practicing the claimed matter, from the studies of the drawings, this disclosure and the independent claims. In the claims as well as in the disclosure the word "comprising" does not exclude other elements or steps and the indefinite article "a" or "an" does not exclude a plurality. A single element or other unit may fulfill the functions of several entities or items recited in the claims. The mere fact that certain measures are recited in the mutual different dependent claims does not indicate that a combination of these measures cannot be used in an advantageous implementation.

Claims

CLAIMS1. An extended Quantum Key Distribution, QKD, network (100) for scalable initial authentication key distribution between entities in the extended QKD network (100), the extended QKD network (100) comprising at least a first entity (120), a second entity (130), and a central Key Distribution Center, KDC, (110) wherein the KDC (110) is configured to:- obtain, using organizational security measures, a secret key (111) between the KDC and the first entity, K( KDC.A ):- obtain, using organizational security measures, a secret key (112) between the KDC and the second entity, K(KDC,B); and- receive, from the first entity (120) using information theoretically secure, ITS, communication, a request (121) for starting the initial authentication key distribution between the first entity (120) and the second entity (130).

2. The extended QKD network (100) according to claim 1, wherein the request (121) is received by the KDC (110) using a first portion of the secret key (111) between the KDC and the first entity, Ki KDC.A I ): wherein the KDC (110) is further configured to:- send, to the first entity (120) using ITS communication, a first portion of the secret key (112) between the KDC and the second entity, K(KDC,B1) (113) by using a second portion of the secret key (111) between the KDC and the first entity, K(KDC,A2), in response to the request (121); and wherein the first entity (120) is configured to:- generate an initial authentication secret key (122) between the first entity (120) and the second entity (130), K(A,B); and- send, to the second entity (130) using ITS communication, the initial authentication secret key (122) between the first entity (120) and the second entity (130) K(A,B) by using the first portion (113) of the secret key between the KDC and the second entity K(KDC,B1).

3. The extended QKD network (100) according to claim 1 or 2, wherein the first portion of the secret key (111) between the KDC and the first entity K(KDC,A1) is a first substring of the secret key (111) between the KDC and the first entity K(KDC,A), and has a predetermined first length 11.

4. The extended QKD network (100) according to one of the preceding claims, wherein the second portion of the secret key (111) between the KDC and the first entity K('KDC.A2 ) is a second substring of the secret key (111) between the KDC and the first entity K(KDC,A) and has a predetermined second length 12.

5. The extended QKD network (100) according to one of the preceding claims, wherein the first portion of the secret key (112) between the KDC and the second entity K(KDC,B1) is a first substring of the secret key (112) between the KDC and the second entity K(KDC,B) and has a predetermined third length 13.

6. The extended QKD network (100) according to one of the preceding claims, wherein the initial authentication secret key (122) between the first entity and the second entity K(A,B) has a predetermined fourth length 14.

7. The extended QKD network (100) according to one of the preceding claims, wherein the second length 12 is larger than the third length 13, and the third length 13 is larger than the fourth length 14.

8. The extended QKD network (100) according to one of the preceding claims, wherein a difference between the second length 12 and the third length 13 is equal to a difference between the third length 13 and the fourth length 14.

9. The extended QKD network (100) according to one of the preceding claims, wherein the first length 11 is fixed to be minimally equal to the fourth length 14.

10. The extended QKD network (100) according to one of the preceding claims, wherein the usage of each one of the first substring of the secret key (111) between the KDC and the first entity K(KDC,A1), the second substring of the secret key (111) between the KDC and the first entity Kl'KDC.A2 ). and the first substring of the secret key (112) between the KDC and the second entity K(KDC,B1) (113), is a one-time usage.

11. The extended QKD network (100) according to one of the preceding claims, wherein the ITS communication comprises secret communication and authentic communication.

12. The extended QKD network (100) according to claim 1, wherein the first entity (120) is further configured to:- generate the secret key (111) between the KDC and the first entity Kl'K DC . A ): and- deliver, to the KDC, the secret key (111) between the KDC and the first entity K(KDC,A) by using organizational security measures.

13. The extended QKD network (100) according to claim 1, wherein the second entity (130) is further configured to:- generate the secret key (112) between the KDC and the second entity Kl'KDC.B ): and- deliver, to the KDC, the secret key (112) between the KDC and the second entity K(KDC,B) by using organizational security measures.

14. A method (400) of scalable initial authentication key distribution between entities in an extended Quantum Key Distribution, QKD, network (100), the extended QKD network (100) comprising at least a first entity (120), a second entity (130), and a central Key Distribution Center, KDC, (110) wherein the method comprises:- obtaining (401), by the KDC (110) using organizational security measures, a secret key (111) between the KDC and the first entity, Kl'KDC.A ):- obtaining (402), by the KDC (110) using organizational security measures, a secret key (112) between the KDC and the second entity (130), Kl'KDC.B ): and- receiving (403), by the KDC (110) from the first entity (120) using information theoretically secure, ITS, communication, a request (121) for starting the initial authentication key distribution between the first entity (120) and the second entity (130).

15. A non-transitory memory comprising instructions which, when executed by a processor, cause the processor to carry out the steps performed by the KDC (110), according to method (400) of claim 14.

Images