Noise properties in the ideal Kirchhoff-Law-Johnson-Noise. secure communication system

Transcription

1 Noise roeries in he ideal Kirchhoff-aw-Johnson-Noise secure communicaion sysem Zolan Gingl and ober Mingesz Dearmen of Technical Informaics, Universiy of Szeged, ungary bsrac In his aer we deermine he noise roeries needed for uncondiional securiy for he ideal Kirchhoff-aw-Johnson-Noise KJN secure key disribuion sysem using simle saisical analysis. I has already been shown using hysical laws ha resisors and Johnson-like noise sources rovide uncondiional securiy. owever real imlemenaions use arificial noise generaors, herefore i is a quesion if oher kind of noise sources and resisor values could be used as well. We answer his quesion and in he same ime we rovide a heoreical basis o analyze real sysems as well. Inroducion Communicaion securiy is geing more and more imoran in many differen alicaions including elecronic banking, roecing ersonal daa, securing inellecual roery of comanies, ransmission of medical daa and many more. The Kirchhoff-aw-Johnson-Noise KJN roocol was inroduced as a low cos uncondiionally secure key echange roocol using only assive comonens: four resisors, wo swiches and inerconnecing wires []. The roocol is based only on he laws of classical hysics and has been inroduced as an ineensive alernaive o quanum communicaors. The firs real imlemenaion has been shown a few years afer is discovery [, 3] and i has insired he develomen of anoher secre key echanged mehod [4]. There are many oenial alicaions including securing comuers, algorihms and hardware memories,

2 rocessors, keyboards, mass sorage media [5], key disribuion over he Smar Grid [6], eherne cables [7], uncloneable hardware keys [8]. Several aack mehods has been discussed [9-4], however he ideal KJN sysem is found o be secure. Debaes are sill going on [5,6] and recen aers discuss racical consideraions for he alicaions [7,8]. The KJN key echange roocol is raher simle. During he communicaion a secre key is generaed and shared beween he wo communicaing aries, lice and Bob. The sysem consiss of wo communicaors and a ransmission wire, see Fig.. Figure. The KJN secure communicaion sysem. Each communicaor includes wo resisors and and wo series volage noise sources, and B, B reresening he hermal noise of he resisors a lice and Bob, resecively: S kt f 4 f 4 S kt where S f is he ower secral densiy of he volage noise sources, B and S f is he ower secral densiy of he volage noise sources, B ; k is he Bolzmann consan and T is he emeraure. swich is used o selec one of he resisors o be conneced o he wire connecing he wo communicaors, see Fig.. he beginning of each bi echange, boh lice and Bob connec a resisor or o he wire. If boh, lice and Bob connec he higher value resisor, he volage noise level will be high in he wire. If hey boh connec he low value resisor, he volage noise will be low. If hey connec differen value resisors, he noise level will be inermediae and his is invarian if he resisors are swaed. [,3]. This level can also be idenified by he eavesdroer,

3 Eve, however she canno deermine who has chosen he low value resisor. For his reason, his is he secure sae ha can be used for key echange. Noe ha in real alicaions he noise would be oo small, herefore arificial noise generaors are used o rovide large enough signals in a given frequency band. In his case, he noise equivalen emeraure is above 0 9 K []. On he oher hand generaors can enhance he securiy and offer new schemes wih higher racical securiy in he non-ideal siuaions [7]. esuls ccording o he aers abou he KJN communicaion mehod he arificial noise generaors are only used o emulae high emeraures, so hey mus generae Johnson-like noise. Therefore he securiy roof based on hysical laws remains valid []. Our aroach is in some sense oosie o he revious ones, when securiy has been roven for he given noise roeries. ere we deermine wha he requiremens of noise roeries for uncondiional securiy are. On he oher hand, our analysis is based on saisical mehods insead of hysical laws of hermodynamics, herefore i can be more easily undersandable for comuer engineers and sofware engineers. e us assume ha he sysem is oeraed in he siuaion, when lice has swiched on he lower value resisor and noise, while Bob uses he higher value resisor and noise as shown in Fig.. In his case Eve measures he following volage E and curren I E flowing from Bob s side owards lice in he wire: E B 3 and I E B 4 where and B are he volage noise signals a lice and Bob, resecively. She can have wo hyoheses: he correc one and he oosie. She can calculae he saisics of lice s volage

4 noise for boh cases. Since she knows he resisor values and he used volage noise saisics, i is clear, ha she will know ha her assumion is wrong, if she ges invalid values during her calculaions. For he correc assumion she mus ge correc resuls of course. e us see wha haens in he case of he wrong hyohesis. In his case Eve assumes ha he high value resisor has been chosen by lice. Therefore she calculaes lice s noise volage as: B B E E I 5 B 6 B 7 The variance is given by he sum of variances: 8 where is he variance of and and are he variances of he volage noise and B, resecively. The communicaion can only be secure if =, oherwise Eve will know ha lice conneced he low value resisor and volage generaor o he wire. Subsiuing his ino Eq. 8 yields: or in oher form

5 Therefore he noise amliude mus deend on he resisance as in he case of hermal noise; i mus be roorional o he square roo of he resisance. Oherwise he communicaion is cerainly unsecure. In he following we check how he securiy deends on he robabiliy disribuion of he noise. When he eavesdroer makes he correc assumion, she can calculae he noise signal ha lice is using eacly; herefore she ges he correc robabiliy disribuion of course. When she makes he wrong assumion hen she obains: 3 The robabiliy densiy of is given by he convoluion of he robabiliy densiies of he wo indeenden erms in Eq. 3. If is he robabiliy densiy funcion wih uniy variance, 4 and 5 hen 6 where is he variance of, and d 7 If Eq. is saisfied, hen =, ha is needed for secure communicaion. Furhermore measured by Eve mus also be idenical o he robabiliy densiy funcion of he noise volages and B, oherwise Eve can deec ha her assumion is wrong. Therefore using Eqs. 6 and 7 can be eressed as 8

6 and finally we ge d. 9 Discussion Eq. 9 is valid for normal disribuion only [9], herefore we can conclude ha he noise sources, B and, B mus have normal disribuion and he raio of heir amliude mus be equal o he square roo of he raio of he corresonding resisor values. In oher words, Johnson-like noise mus be used for he secure key echange in he KJN sysem. Noe ha alhough several oher disribuions for eamle Cauchy-disribuion saisfy he condiion ha he convoluion in Eq. 9 does no change he ye of disribuion, however he finie variance required by energeic consideraions is only rovided by normal disribuion. I is easy o see ha for eamle random numbers wih uniform disribuion can be used for secure communicaion. In his case Eq. 7 gives a raezoidal robabiliy densiy funcion for as shown on Fig., herefore is deviaion from can be very easily deeced. Figure. The robabiliy densiy funcion in he case of uniform disribuion solid line srongly differs from dashed line. We have develoed a simle sofware alicaion wrien in abiew ha can be used o simulae he KJN roocol [0]. Normal or uniform disribuion can be seleced and he values of,

7 , amliude of, B and, B can be arbirarily chosen. The alicaion erforms Eve s calculaion of for boh hyoheses, and los he corresonding measured amliudes and robabiliy densiies. imiaions and Oen Quesions We have resened a mahemaical saisical aroach o deermine he noise roeries and resisor values required for secure communicaion and he resuls are in agreemen wih he original hysical aroach []. On he oher hand our work does no address he quesion of comlee securiy. Considerable addiional work could be carried ou o invesigae several aack yes wih similar aroach. For eamle, in racical alicaions he effec of resisor inaccuracies, wire resisances can also be analyzed using our mehod; Eq. 8 can be alied o find he difference beween he observed and eeced variances, and, resecively. This means ha he informaion leak due o hese inaccuracies can be esimaed. On he oher hand, if he desired securiy level is given, he required resisor values and accuracy of he comonens can be obained. Furhermore one can consider correlaion roeries, bandwidh of he noise sources ha is imoran in racical alicaions and discussed in several ublicaions. Conclusions In his aer we have shown a mahemaical saisical aroach o find ou wha kind of noise sources are required for secure communicaions in he Kirchhoff-oo-Johnson-Noise uncondiionally secure key echange sysem. In agreemen wih he resuls can be found in he lieraure we found ha he noise amliude mus scale wih he square roo of he corresonding resisor value and Gaussian noise sources mus be used. Noe ha our aroach can serve as a saring oin o quaniaively analyze several aack yes in racical alicaions.

8 cknowledgmens Zolan Gingl hanks Béla Szenáli for drawing his aenion o he roblem. Discussions wih Gyula Pa abou robabiliy disribuions are grealy areciaed. eferences. Kish B 006 Toally secure classical communicaion uilizing Johnson-like noise and Kirchhoff's law. Phys. e. 35: doi: 0.06/j.hyslea Mingesz, Gingl Z, Kish B 008 Johnson-like-noise-Kirchhoff-loo based secure classical communicaor characerisics, for ranges of wo o wo housand kilomeers, via model-line,. Phys e 37: doi: 0.06/j.hyslea Mingesz, Kish B, Gingl Z, Granqvis CG, Wen, e al. 03 Uncondiional securiy by he laws of classical hysics. Merology & Measuremen Sysems XX: 3 6 DOI:0.478/mms vailable: h:// 4. iu P 009 key agreemen roocol using band-limied random signals and feedback. IEEE J ighwave Technol 7: doi: 0.09/jl Kish B, Saidi O 008 Uncondiionally secure comuers, algorihms and hardware. Fluc Noise e 8: doi: 0.4/s Gonzalez E, Kish B, Balog S, Enjei P 03 Informaion heoreically secure, enhanced Johnson noise based key disribuion over he smar grid wih swiched filers. POS ONE 87: e7006. doi: 0.37/journal.one in, P. K., le Ivanov, Bradley Johnson, and Sunil P. Khari. " novel cryograhic key echange scheme using resisors." In Comuer Design ICCD, 0 IEEE 9h Inernaional Conference on, IEEE, 0., doi: 0.09/ICCD aszlo B. Kish, Chiman Kwan, Physical uncloneable funcion hardware keys uilizing Kirchhoff-aw-Johnson- Noise secure key echange and noise-based logic, Flucuaion and Noise eers,, h://d.doi.org/0.4/s , vailable: h://vira.org/abs/ ao F 006 Kish's key echange scheme is insecure. IEE Proc. Inform. Soc. 53: 4 4. doi: 0.049/iifs: Kish B 006 esonse o Feng ao's aer Kish's key echange scheme is insecure. Fluc. Noise e. 6: C37 C4. doi: 0.4/s Scheuer J, Yariv 006 classical key-disribuion sysem based on Johnson like noise ow secure? Phys. e. 359: doi: 0.06/j.hyslea Kish B 006 esonse o Scheuer-Yariv: classical key-disribuion sysem based on Johnson like noise ow secure?. Phys. e. 359: doi: 0.06/j.hyslea Kish B, orvah T 009 Noes on recen aroaches concerning he Kirchhoff-law-Johnson-noise-based secure key echange. Phys. e. 373: doi: 0.06/j.hyslea Kish B, Scheuer J 00 Noise in he wire: The real imac of wire resisance for he Johnson-like noise based secure communicaor. Phys. e. 374: doi: 0.06/j.hyslea Benne C, iedel CJ 03 On he securiy of key disribuion based on Johnson-Nyquis noise. vailable: h://ariv.org/abs/ Kish B, bbo D, Granqvis CG 03 Criical analysis of he Benne iedel aack on secure cryograhic key disribuions via he Kirchhoff-aw Johnson-Noise scheme. POS ONE 8: e880. doi:0.37/journal.one Kish B 03 Enhanced secure key echange sysems based on he Johnson-noise scheme. Merology & Measuremen Sysems XX: 9 04 vailable: h:// 8. Saez Y, Kish B 03 Errors and heir miigaion a he Kirchhoff-aw-Johnson-Noise secure key echange. POS ONE 8: e803. doi:0.37/journal.one Feller W 968, 97, n inroducion o robabiliy heory and is alicaions, ol. and ol., John Wiley & Sons, ISBN and Kirchhoff's-aw-Johnson-Noise secure key disribuion simulaion sofware. vailable: h://