Comparison between classical forward secrecy and QKD
As mentioned by others, we don't have any provably safe post quantum public key algorithm, just like we don't have any provably safe public key algorithm in a world where quantum computers don't exist (only ones that are provably broken by quantum computers).
Of course, things are even riskier for quantum computers, since everything is newer, and therefore we don't have the "people have tried to break it for several years" argument, e.g. Rainbow from the NIST competition was recently was broken on the 3rd round on a classical computer.
But from a purely mathematical point of view, the answer is very similar to the "QKD vs classical public key cryptography?" question, which I shall analyze next.
What does QKD give you and what are its requirements?
First, just to make sure that I'm not wrong about it/so that we are on the same page, I'll state the hypothesis:
what you need:
a custom quantum channel in addition to the classical channel, e.g. linking up two points with specialized hardware via optic fiber
a pre-shared key, i.e. one securely shared common secret,e.g. by driving over in a car with a USB. This is used to sign messages on the classical channel.
Without this, you could get man-in-the-middle'd exactly as you could by an attacker that splices your classical + quantum channel and fakes the key generation for both sides.
what you get: you can now generate common secrets in a way that simply cannot be snooped according the known laws of physics without you noticing it.
If someone tries to snoop, you will be able to notice it every time, and therefore abort the communication without compromising your information.
The rate of generation of the common secret may be limited. Wikipedia reports speeds of kbit/s to Mbit/s range.
Every time you want to setup a new secret, communication over the classical channel is necessary. If someone were to steal your pre-shared key, they can perform man in the middle for any new key generation.
What you could do with a pre-shared key classically?
As we've mentioned on the previous section, a pre-shared key is a requirement for QKD.
Note however that is not a a problem exclusive to QKD: if you assume that the attacker can always man in the middle you (i.e. read and alter any encrypted message on the wire), then you also need a pre-shared key in classic cryptography for authentication. In both cases, given a shared key you don't need public key signature: we can instead just do something like sending (message + secret + sequence number + hash of the previous string), schemes like these are called message authentication codes.
So now let's review what you could do with such a pre-shared key classically, before we finally compare with the advantage of QKD:
option 0) use it as a one time pad
- upside: provably secure encryption
- you can only encrypt one bit per secret bit as you can't reuse the one time pad bits. So that is generally too restrictive
- no forward secrecy, i.e. if someone ever obtains the key, they crack all messages they ever intercepted.
option 1) just the secret directly as the password of a symmetric encryption like AES.
- downside: no forward secrecy
option 2) if you want forward secrecy (you do!), you could just use a classical forward secrecy protocol with the pre-shared key:
- use the shared key only to sign/authenticate messages and prevent MITM, not to encrypt
- whenever you are going to send a new message, first setup a new shared secret in memory using public key cryptography like RSA. Prevent MITM by signing this communication with the secure common secret.
- if any intermediate encryption key is captured (unlikely since was only in memory, and used for a short period of time), the attacker can decrypt only one message
- if the pre-shared key is captured, the attacker still cannot decrypt messages that were sent up until that point, as these were encrypted
- if the pre-shared key is captured and we don't notice, future communications are susceptible to man in the middle
- you have to rely on public key cryptography, of which we are less certain about quantum computer resistance than symmetric encryption
QKD vs the classical options
Finally, we can see how QKD solves one of the problems of option 2:
if the key generation rate is high enough we can have perfect one-time pad encryption with the shared key.
Otherwise, we can just use it as a password for symmetric encryption to encrypt a larger message.
But in any case, we don't need public key cryptography, and so we feel more safe against yet undiscovered future quantum computer attacks, since it doesn't seem that quantum computers will break symmetric encryption.
However, we still have the second problem of option 2):
- if the pre-shared key is captured without us noticing we can get man in the middle'd starting from the next key generation phase.
Besides that, the downside of QKD is cost, as we need a new type of hardware for the quantum channel. If longer distances are reached however, it is not unimaginable that these costs may be justified for certain applications, like communication between governmental entities like embassies and intelligence services. Or perhaps in telecom backbones.