Internet Engineering Task Force Interim Meetings, 2 Feb 2022

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: IETF-QIRG-20220202-1200

Description

QIRG meeting session at IETF
2022/02/02 1200

https://datatracker.ietf.org/meeting//proceedings/

A

If you need to be there's a reload meeting materials button in the top left reload meeting materials in the top left, if you've got the meeting materials, then there's a.

B

Yes, yes, now it's showing up.

A

A

Yes, so I'll start now with a notewell as people might slowly be filtering.

B

A

um So first uh hi everybody uh we're gonna, have a talk given by mark kaplan from very cloud, but before we get to that, I'm gonna go through the note. Well, I'm going to kind of leave it on the screen as usual and go through the slides for you to just slowly absorb them.

A

And this is a recorded session.

A

And there's a reminder of that at the bottom right.

A

And yeah just to wrap up the uh not well iotf is their research organization, not a standard organization like the itf. So do keep that in mind and our focus is fostering collaboration and talking about research.

A

With that said, I'm gonna.

A

Introduce our speaker, uh so our speaker for today is uh mark kaplan, uh mark kaplan graduated from the university of paris suit, and he has worked in montreal with universal and in edinburgh, with alan kashifi and before founding very cloud. His research was focused on using quantum algorithms to break classical cryptographic. Systems on the design of customers and alternatives and mark is from very cloud which is a startup based in paris, as founded by mark alam and alain kashafi and joshua, as focuses on developing solutions for long-term security based on quantum communication networks.

A

In particular, it has developed queue line, which I will let mark talk about today. So that said, I will stop showing your slides and hi mark.

C

Hi paycheck hi hi everyone thanks a lot for the invitation um and the introduction. Can you hear me no problem? No.

D

Yes, I can hear you now perfect. Okay, so I'll now share the slides.

D

Right these are the ones.

C

All right, so um I'm going to.

A

Present mark sorry, just before we start are you okay with questions during the session, or would you prefer if we leave them before the end.

C

No during the session is fine: okay, yeah, it would make things more interactive. uh So no no problem.

C

Right so I will, I will present our work uh at very cloud. um Actually, what I'm going to present is the core of my work, uh but I want to to start with a quick intro about who we are and what what we're doing uh took a bit at the end of more longer term longer-term goals, also in terms of research.

C

So as as it was said, we are started based in paris. We work in the in quantum networks. These two people, joshua and elhan kashifi, are my co-founders. All three of us. I mean josh and elham work in academia. I have an academic background, but transitioned to very cloud a few years.

A

C

And the the ambition that put us together is that quantum communication is, of course, a great uh great realization, but in order to to transfer what we knew about uh the technology to to to the industry, we believe that there was a lot of work to be done on the on the software level right. It's not only about building better and better devices, but also adapting those devices to match uh specific use cases right.

C

So so everything I'm going to tell about is new work that we performed at very clouds, but just keep in mind that we don't do anything new. Regarding the physics there uh at very cloud, all of our work is on the the abstract layers of quantum networks and, of course, one important thing I'll talk about it at the end.

C

Is that we're driven by this long-term vision that, uh of course, everybody there uh likes a lot of uh building a quantum internet, so global quantum network, and especially the work of el, am on secure quantum cloud computing was a strong driving force to uh to to start very cloud in the first place right. So, as I was saying this, this is the this. Is the core of our work, uh but but we also participate to a few uh research projects, including the quantum internet uh alliance.

C

uh So so, if you're interested into uh uh you know, partnering through research in research projects, don't hesitate to to contact me all right, so this uh are actually all the people that are involved uh into this work about uh about q-line, and uh although we've been developing this uh this architecture for a long time, the the paper uh summarizing all the results is still under under publication.

C

uh So josh elem and I worked on the core idea and the realization girl here is the photonics person in charge of the application and ann and mina work more on the security proofs and and software aspects right. So uh probably one thing that I don't have to tell here, but I like to remind uh to people when I talk about quantum quantum technologies, is that quantum networks is already a rather mature field in the sense that we can find quantum networks in the world. uh Some of them already exist.

C

Some are uh in development, uh the main one or the most important one today is the chinese quantum quantum communication network uh in europe. There is a strong push toward this uh euro european quantum communication infrastructure project, uh with lots of local initiatives now uh being built, local local quantum network by local. I mean at the scale of the city, for example, and connections between them using using satellites right.

C

So uh when we talk about quantum technologies and in particular quantum computers, we're talking about something that is long term, quantum networks are still at the beginning, I would say, but but it's something that that is happening now, as you all know here, but it's always good to to remind it uh to to to audiences in general right, and why do people do that?

C

uh So this is a very short summary, of course, a summary of years and years of research and also I'm summarizing the story uh more from the from the user point of view or the customer point of view. I should say, uh of course, with quantum key distribution that you can run on quantum network. You get this unconditional security, which implies. I mean it has lots of very nice implications.

C

Your data. Can you can guarantee the security of your data for very long term, uh which becomes more and more relevant since the value of the data has sold over the last decade? I would say: yeah.

C

One thing that is really cool is that you can use quantum key distribution in combination with symmetric cryptography, to make it more efficient, and I don't I don't think that's downgrading the security. It's not unconditional anymore, of course, but what you get in the end is a quantum safe system using I mean for the encryption part using only only standardized algorithms, which I believe is a somewhat a very interesting feature of quantum key distribution right and other other other consequences.

C

You can prevent data harvesting all the attacks of the type type of storing outbreak later, and it changes the way you can think of encryption uh in general right. So whether you believe that this is important for for your use case or not, uh is debatable, but but there are some some advantages, not only theoretical, but in practice, when you, when you deploy a qkt, you can you can have these these advantages, but now, of course, we're talking about quantum technologies and, as always, the main issue with quantum technologies is scaling here by scaling.

C

We don't we're not talking about having more qubits but having more nodes in the network and the way qkd networks are scaled. Today is a little bit embarrassing in the sense that it's first, it's very expensive, because qkd is a point-to-point task. So when you want to add more nodes, you add more point-to-point or more more edges, in fact to your to your network and also um in order to distribute keys in your network. What you do in general is using trusted nodes to route keys.

C

I talk more about it later and just denote the inject vulnerabilities in the system right. So these are big big drawbacks of when, when scaling quantum key distribution to the network level right. So what we do at uh at very cloud, we we have.

C

We wanted to address very specific use cases for for quantum key distribution and what we came out with is a novel quantum network architecture and with this architecture the goal is not to develop a nationwide network, but networking to do quantum networking at the local area scale- or, I would say local or metropolitan area scale- we'll talk more about the scale later, um but but I like to think about it as a quantum ethernet, because in fact it's also very reminiscent to the the very first version of the ethernet protocol in terms of architecture and in this very specific regime, so local or short distance.

C

um What we get is a with the q line is a fully connected quantum communication infrastructure, meaning any any pair of nodes can communicate securely or establish keys in our case without using trusted nodes. So this is the first, the first property then also the scaling is somewhat better because you don't use. um We use mostly standard telecom components, rather than as opposed to uh to quantum specific components, uh as you will see, and also we, because we have this long-term vision.

C

uh We are also talking about uh when uh connecting these these architecture to quantum computers, I'll show you how this can be done uh at the end of the talk all right. So what I want to to show you today is what is the the q-line protocol? uh It's an architecture with a protocol.

C

uh Again everything happens at the at the abstract level, uh what we can show or what we can say about the tier, the the security of qli, how you prove security in theory and what what it means in practice and then discuss the use cases for today and for for the future all right. So it's a good time to to stop and ask if there are questions before entering into the technical description of the protocol or the somewhat technical description of the protocol.

C

If not, I can ah sorry stephen.

B

Oh wait: let's see, it looks like there's a cue up.

E

Stephen yeah can you you can hear me right sure. Yes, I just want to ask it's not like a token ring scheme right. It doesn't go all the way around.

C

uh Well, you'll have the answer at the end of this decision.

C

Okay, thanks! um So the way I mean there are multiple ways of uh of uh introducing the the protocol. uh The way I like to do, it is well first, it's at my very computer science level level.

C

I'm not going to talk again about physics in this in this in this talk and and compare it with the standard qkd right. So one way of thinking about ukd is on the left. Here you have two two parties alice and bob, and you can think about alice, uh generating a quantum state, a qubit and encoding some information in some basis in this quantum state. These are the role of these two operators x and h, and then sending this state to bob bob chooses he does performs these two operations.

C

He chooses a measurement basis for the qubit. This is the row of this operator h and then performs the measurement, and if you write everything down you, you can have that the the the mathematics tell you that if they chose the same basis, meaning r equals s, then a is the measured value by bob right and based on that you can derive the whole protocol and and security proof.

C

So one way of thinking about q-line is just decoupling. These operations in qna. What we do is rather simple.

C

I introduce these two parties in the middle, charlie, 1 and charlie 2, and I would redistribute the roles at least generates the qubit again sends it to to charlie. Of course, the qubit is a photon in the standard implementation, charlie encodes the information and chooses a basis, charlie two chooses the measurement basis and bob performs the measurement right. So at this stage you can't do much because the result is known by bob only and if he announces the result then then well, everybody would know what is the the secret key.

C

But uh oh here it is the the fix is very simple: it surprises to re-inject uh some randomness right. So, oh sorry, I should I should uh precise here. The goal is for c1 and c2. So let me go back here. C1 and c2 want to establish a shared the shared bit in this case. So if bob announces the bt, then everybody would know it and not only c1 and c2, but the fix is quite simple. It surprises for c2 to re-inject some randomness with this operator x to the b here and now.

C

What bob announces is the the parity of the two bits, a plus b and, of course, a is not known by c1 and b is known by by c2. So if a and b is broadcasted, then c2 can also derive a, but as long as he keeps b private, no one else knows the value of a.

C

I see there's another question here:.

A

Scott, would you like to ask a question.

C

Okay, let's continue anyway. The protocol has a few more steps and if the question comes, I can interrupt again uh right so so this uh the role of this uh x to the b here, is to re-inject some some randomness into the into the information to keep it private to c1 and c2 and in fact, it's very easy to see that this is still not secure, and you also need in fact, to read to inject randomness at all of the stages of the protocol.

C

So a would start with a random random state, uh random bb-84 state, for example, or from the same state, a set of states, uh uh c1 and c2, and the rest of the protocol follows as long as you take into account the required uh corrections. Yes, paycheck.

A

uh So the question was asked in the chat, so I'm just going to read the question. Scott asks, who selected a and b and there's a similar question. So I might as well already straight away, is and who selects r and s.

C

Yes, so the the selections are made locally, meaning c1 chooses uh a which is the the bit the random bit. That would be the the key in the end and um r is also the the the basis of encryption is also chosen by c1, but they are kept private. They are not broadcasted, and similarly c2 chooses b and s here right, so at the end they can just select on so at the end. After all, the measurements are done.

C

um They only keep the bit if r equals s, they chose the same basis, and in this case a plus b is the result of the measurement. This is broadcasted.

C

So, of course, if you want to use a as a secret bit and c1 already knows, a and c2 can derive the value of a from b and a plus b, of course. So so it's just as long as all the data are kept private.

C

You can broadcast this a plus b in the end, and it gives you the it gives you it gives you the it allows only uh the legitimate parties to learn the the shared secret beat, which is a at the end.

A

And the follow-up question in the chat is: who is c1 and c2? Are they intermediate devices or are they sub components of a and b.

C

No, no, sorry, sorry for the misunderstanding: these are new intermediate nodes that we are putting in the in the.

C

My goal here is to build a network from from a qkd network. So qkd is point to point here, I'm adding more nodes to the network. So in this example here I have a four node network with alice here, uh bob at the other end and and c1 and c2 in the middle charlie, one and charlie two intermediate the reason I I keep uh a and b at the x as extreme points is because um they will be in terms of uh information processing or what they can do physically.

C

They are equivalent to the a alice and bob of ukds right, whereas, as we see, c1 and c2 are much lighter in terms of physical components required to uh to implement them right. So I have a four node network. I started so to say from a and b which are standard, qkd devices, and I added to the network. These two nodes, c1 and c2,.

C

All right, so a very rough picture here is a if you want to think about the the components or the costs. As I was saying, the the extremal nodes are the same, so in q-line at my alice is composed of laser and modulators.

C

The bob at the very end, has this very specific and costly uh component, uh very specific for qkd, which is a single photon detector right. uh So when I want to build uk a qkd network, I have to put all those components in at all the nodes of my my network, whereas with qline the the intermediate nodes are just standard, photon modulators.

C

This is a standard piece of telecom component and literally something that sorry literally, something that you can buy online by uh you know, drag and dropping it to your cart and pay with your credit card right which which, as far as I know, you cannot do with single photon detectors. For example, now the the the counterpart is that, as I was saying, this is not for uh this is not a replacement for qkd. uh It's a different regime, because in a standard qkd network I would have around, let's say: 100.

C

Kilometers between each node, whereas with q line now it's the distance between the laser that emits the photon and the single photon detector. At the end, this complete distance has to be roughly 100 kilometers right and I'm hiding a bit of details because all the modulators here might or will induce a little bit more noise. So the more nodes you add to your system, uh the the shorter the shorter the distance you can reach will become. So it's a trade-off between between those two parameters that you can reach.

C

Let's say that four to five nodes is the normal regime for q9, but it's very good for some of the use cases that we want to. We want to reach, as I would explain, or it's good enough for the for the use cases that we want to reach all right. um The first remark: uh people might uh people that have been involved into into qkd networks. Might you know already see that um they don't work the same in terms of key establishment right?

C

What happens in key uh sorry in ukd in the qkd network is that each pair of each pair of devices will establish a shared key or each pair of adjacent devices or connected devices will um will establish a pair of key and everything will happen in parallel right. So here, if I sort of keep the same topology, I have alice charlie 1, charlie 2 and bob. We might uh remember these qkd devices, so they have all they can do a single photo measurement and then coding decoding everything.

C

um So I would have at a given uh time bin. I would have a bit or a shared key, let's say established here and in parallel here and there right. So it seems that it seems very, very, very good or very efficient, but now the thing is that in practice on the qkd network, you also want to establish keys between non-adjacent devices, and for this you need to use key routing.

C

Tier routing is just done by you know, choosing a key at, for example, addis sending it uh encrypted to to charlie one and then charlie, one uh re-encrypt and transmits to charlie 2., and this is how alice and charlie 2 would would establish a shared key, which is in this dotted arrow.

C

The first noted arrow on top here, so this this, this pink dot in the middle uh means that charlie one uh is in fact a trusted node in the sense that uh you will get a clear copy of the the key that is established by alice and charlie too, but also another. Another important thing is that sending or routing the keys to non-adjacent parties will also consume some of the primary keys, the keys that were established uh in the first place right. So so I have one.

C

Of course, I have an efficient system in the sense that every all the key establishment happens all in parallel, but on the other hand, when I want to route keys to non-adjacent parties, I need to consume the primary ones right. So what happens on q-line is that we simply use some.

C

Some some some round robin scheduling, for example, or we we we use uh time multiplexing, it's a better term uh by uh giving to each pair of node a dedicated amount of time. uh The the protocol that I showed you earlier allows the charlie one and charlie two to establish keys, but if you want to have keys between alice and charlie two or uh alice and charlie one, you just leave the other, the other devices passing uh during this round. So it's not uh it's not a big dinner.

C

um I mean the the previous protocol captures the core of uh the key establishment on culina, and so it seems much less efficient in the sense that not everything happens in parallel.

C

Roughly speaking, there is only one detector, so it can only be used by one pair of node at the at the same time, and while this pair is establishing a short key, the others have to wait. But now in the the counterpart is that there is no key routing right. So this.

C

While the number of pairs grows, quadratically, you don't need key routing and um if well again, once again, whether it's good or better than qkd. I don't think it's the right. The right way of assessing the question uh you need to to look at very specific use cases, but what we can.

C

What we can show is that, under following assumptions uh that every the keys are uniformly distributed among pairs of nodes, meaning each pair of nodes equally need a key key establishment and that the cost of the system is dominated by uh by the by the cost of the detector.

C

Then the price per bit of key is the same as with qkt right, so q line and qkd with this figure of merit under these assumptions, are comparable right, but once again uh it depends a lot on what use case you want to. You want to choose that you want to you want to solve if you want to make a precise comparison, a more precise comparison, how about security, um so the the security of q-line uh for the theoretical part? uh I wouldn't say it's easy, but it's as as easy as you can think of.

C

uh We have. um We have, and it took a lot of time to to get them, but we have good good uh frameworks for proving the security of ukd and in our case we uh we we rely on the work of toma, mikhail and very for for proving the the security of quantum key distribution, and uh so in my example here I only have one uh center node, but it's the same.

C

I mean it's the same for for when you add more and more chinese, uh the goal is to show that, if you can, if you can attack the q9 protocol, then you also get a an attack on the understandable utility right and the reason based on the protocol. It's quite uh straightforward is because, at all the steps of the protocol of queue line, this is how it's designed for sure and standard ukd and ifs dropper will see exactly the same. The same state right. So this is the the the core idea.

C

Now, of course, translating it into a formal, uh formal uh scientific argument takes like half a dozen pages, but but this is exactly how uh how the proof, the proof works or the core argument of the proof.

C

Another very important chapter of security in the world of ukd are the side channel attacks so that we know that um we know that the the the the there are differences between uh the the theory, the mathematical model of uh of qkd and its implementation, with physic physical, physical components, and in fact you can exploit those discrepancies to uh to attack it so well, of course, we we have all the the qkd the side, channel attacks of qkd that still hold in our case, but but since the extension of the qkd protocol to a q-line protocol happens at uh at the cubic level, uh all the physical implementation can is compatible with what we're doing so.

C

In particular, if you want to use decoy state protocols, uh it's still possible with with q9, it doesn't change anything now. um There are other other types of attacks that um that that are possible, uh in particular, I'm talking about trojan horse attacks that consists in injecting light into the the system for the east dropper to uh to try to measure what's happening at in charlie.

C

These are things that we can. We can prevent with very standard techniques.

C

But there are also more, I would say, elaborate attacks, relying on uh non-destructive photon, counting, so some devices that uh are much more difficult to to build today and, as as I know, I'm not not commercially available.

C

uh So this is we're still performing some some research and development in order to close these attacks that might be uh be available in the in the future for futurist chopper all right. So this was the this was the the theory part of uh of uh the peer representation of q line protocol and and security.

C

What I want to to spend the the second half of the talk is to to present you why we think this is a good good architecture, or I should say in which case we believe that this is a good. This is a good architecture.

C

I'll also use this to to answer stephen's questions a stephen question or to make a remark of lower primary, so the first application that we are thinking about when using q-line is how it integrates in global quantum networks.

C

So you remember that uh the the the sorry when you want to scale quantum networks or qkd networks- you usually what you do is just using um sorry just using key routing to uh to to to to route keys to another json party.

C

So these these connections happen at the software level right, so q line is complete, is compatible with any other qkd implementation, in the sense that you can combine them all together to build a large-scale network, and this view here it's an artistic view, but this is uh this: is the the work in progress in this euro qci project european communication architecture? You see that there are.

C

There exist several layers with satellites, probably locally. You would have a backbone a high-speed backbone, and what we do with with q9 is is the the last kilometer or last mile of the of the network, uh how to distribute the keys at the local area scale so one. So we are deploying this architecture testing in real field. Now, with the deutsche telekom in berlin, it's actually more involved than that we want to do is show that q-line can be used to build complex metropolitan architecture. It's just one building block of the global global network.

C

So, yes, it is a token ring, but you can also you can also use it in combination with other techniques to build complex networks um and in in paris, for example, uh orange the the french telco is building a quantum communication architecture at the paris region level and q line will be deployed at the level of a city that has several critical infrastructures in the south of paris.

C

Yes, so I'm gonna.

A

Transcribe a question from the chat, which is ukd networks with trusted nodes can be built without optical switches. Is there any advantage of q line compared to that.

C

A

Wait without trusted nodes, yeah.

C

I'm I'm trying to.

A

Sorry, I'm gonna, I'm gonna, just I'm gonna clarify that. uh I guess the question is: could you network without trusted? Okay, sorry, qkd networks without trusted nodes can be built with optical switches. Is there any advantage compared of q line compared to that? That's the question.

C

I guess I mean I'm not sure, I'm not sure what this.

C

I mean the way I see qkd networks without trusted nodes is by using repeaters, but I'm not sure what this is. The question.

A

I think the question implies that you can just route photons. I guess, with an optical switch.

C

Yes, uh okay, yeah! No, I see no so that again, this is um this is the.

C

How can I say this is a technique that can also be used in queue line right, so the the advantage that you still have is that you can add nodes using only standard telecom components, but once again I mean again the standard modulator.

C

uh They are the sorry, the the photon modulator, for example, if you use uh polarization encryption, this would be polarization modulation, so you can also combine it with this technique of using optical switches.

C

As far as as far as I understand the question.

C

A

Sorry, there's a uh follow-up in case you're we're running out of time. We can leave some of these questions for the end by the way mark. So just let me know if you have a lot of material.

C

Well, not so much and I I can also go faster at the end.

C

This question about the core architecture actually.

A

Yeah, so somebody stephen as a follow-up to that question suggests that he thinks also the q-line versus optical switching provides higher connectivity.

A

Is that correct.

E

Expand a bit I just mean like in the diagram. The connectivity was like a completely connected network for optical switching with the routing. Maybe it doesn't give the same thing. It's like.

C

No yeah, I think I see what it means uh would be interesting to uh to compare it for a specific uh for a specific um network topology, for example, or a specific use case. uh You know how how you can take uh advantages of this uh of this fully connected architecture. For example, I'm going to uh I'm going to show an example uh of usage uh in a moment- and this is something that can be as far as understand realized exactly the same with the with optical switching.

C

So I'm going to show an example where there is no advantage of q line over optical switching but but yeah might not always be the case. I mean not the second one. Actually, so, let's try to uh to see uh if these questions make sense for the for the next two examples or if we can.

A

C

A

Is a slightly unrelated question so I'll I'll ask it mate as well. um Just can you expand how q line would work on a fully quantum network, one that shares entangled qubits and what advantages would it have over simpler approaches.

C

Transform? Okay.

C

I'm not sure I can say something about this right now, uh but but this is um so for uh of uh of our full quantum network that can transport and tangle qubits. You could also have intermediate nodes, I'm not sure, I'm not sure, in which case it's interesting like you could you could ask the same chinese, but I'm not sure in which uh yeah something that we need to.

A

My guess is the implementation complexity, it's just maintaining entanglement. You don't need quantum memories, for example in any of the q-line implementations. To start with, it's already a huge simplification, so I'd say it's just the stage how advanced your networks are.

C

Yeah, so I'm I'm going to show an example uh at the very end uh where it's interesting in the the the furthest term networks, uh so even beyond beyond quantum and entanglement. But for the specific of uh for the specific question of entanglement, I don't know.

A

Okay, that's all the questions in the chat for now.

C

Okay, thank you. Thank you. um The second example. The second use case uh is for secure storage right.

C

We know that uh it's not something that we invented, but we know that it's possible to combine quantum quantum key distribution and classical cryptography to protect not only communication but also storage, and a full specification of the protocol was given in the in the paper uh put it here, and I think it's a beautiful, uh beautiful idea uh by by combining qkd with with a secret sharing scheme that distributes those shares here over several servers, uh you can get very highly secure storage.

C

uh The the classical cryptography protects against data leakage. You can ensure that corrupting one server is not enough to to recover the original data, and in fact this, the number of servers that need to be corrupted is very easy to to parameterize in the system.

C

With the quantum communication you protect against data interception and by continuously re-encrypting the shares, you can make sure that an evs dropper that wants to learn your data needs to need to attack several servers within the time slot of re-encryption right. So it's a very strong idea. um The only thing that we the well the the new thing that we bring here right now, what I can tell you is that q-line, since it doesn't have trusted nodes, uh it also has less vulnerabilities.

C

So it's uh it's just a better way of doing it and it's also compatible with, for example, the notion of sorry the concept of cloud availability zones that usually you know when you store your data to the cloud they are distributed on several servers all in the same metropolitan area. So it's the right scale for for deploying the cuban another thing, but it's still also.

C

I mean, I think it's not it's not only a research topic, uh it's known that this um secret sharing. uh I mean it's known that some secret sharing protocols also it's possible to compute on top of shares, so you can run some computation with some overhead, of course, uh to um to to to to compute on the shares without reconstructing the the information without recentralizing the information which would be a security breach.

C

um So you can use secure, multi-party computation uh for that, but also um I want to stress that the very similar architecture was uh introduced in research papers.

C

Similar to queue line in order to do secret, sharing, uh classical sequel sharing protocols, so it seems possible to do some computation, uh assisted with the with the some classical computation, assisted with the the the quantum quantum communication right quantum communication, classical computation, quantum assisted classical computing.

C

This is what I wanted to say right, so here you, you can really take advantage of the fact that you have a fully connected network, and this would be an interesting place to compare with the switching argument that was asked previously.

C

Okay, um last but not least, and another uh application that we just putting forward when we when we talk about uh uh q line in in practical environments, it's a very practical question again right. So suppose you want to build these global quantum networks.

C

You would have at some point an interconnection between the between the two to two networks operated by two different operators right, so you have your first network on the left second network on the right, and if you want to make this connection you have to um you have to to to rely on a trusted node here in the middle, and the dotted line here says that the trustee node is operated by the operator of qkd network 2 on the right.

C

But it's actually an issue right. How do you? How do you know or how do you establish the trust between the two operators? They might have different uh different standards on what trusted nodes are and how they are implemented in practice.

C

Here, it's just completely straightforward application. I I built two queue lines that overlap right and now I have two routes to uh two independent path: to route keys without trusting nodes right. The green one and the blue and here are completely independent.

C

So now I don't rely on the trusted node anymore, in the sense that, if an if dropper wants to learn uh the key established by network one and two they will, they would have to attack the two nodes uh on the left and on the right right.

C

So it's it's a very uh straightforward, uh straightforward application of the or straightforward consequence of the fact that we we can have multiple paths uh using uh using qri, but for for a practical problem and my uh my understanding now uh for this problem is that there will be no advantage over of switching as it was uh mentioned earlier. As far as I understand the technique.

C

All right, the just to before, before concluding another thing that we are uh investigating, uh which is more for this uh future applications uh um is the connection with quantum computers and one thing that people here might might know, or otherwise are just reminding very very quickly. Is that once you can connect quantum computers to networks, you unlock secure quantum cloud computing and by secure here I mean uh verifiable and blind right.

C

So in the picture here you have a quantum computer and you have a distant party that um okay, I'm cheating a little bit here. I'll just explain the details on the next slide, but with the device that is somewhat similar to what ukd is doing today uh it can delegate the computation to the server with blindness, meaning the server does not learn the computation it's executing and verify verifiability, meaning that you can.

C

You can detect the deviations from the original computation.

C

This is. uh This is the work of uh many people, but in particular I have to quote my uh my my co-founder ellen kashifi for her work on the verifiable blind quantum computing here and now you remember that, with q line, we started with two devices that are uh similar to to qkd as well. In fact, it's easy to see that you can. You can do the same here to to delegate your quantum computation you can rather than starting from ukd.

C

You start with q line and you replace the end node one of the end nodes with a quantum computer as if it was easy to do, and then what you have is um the ability for multiple clients to delegate their computation to the to the to the server right. So what we get is a somewhat scalable architecture for secure quantum cloud application. You can also run some distributed quantum computing on this with this type of architecture.

C

Now the only the only detail, I would say in addition to having a quantum computer is that first, it's not known when I said here you start from a qkd device. You know that in practice, qkd devices, especially the uh the part that emits the photon can be, can be done very easily using attenuated states.

C

It's not known that you can do it with attenuated state for for secure quantum cloud computing, so you might need true single photon generators which are not easy to to to build, and in order to connect your quantum computer to the network, you might need. For example, this looks very much like a superconducting qubit, so you might need some frequency conversion, which is also difficult to to implement, but at the end of the day, these devices, I believe that they are simpler to build than a quantum computer in the first place right.

C

So so so there are lots of details in the implementation. Even uh even you know, if the research or the development of quantum computers uh is doing well these days, uh there is a lot more to do to uh to to get this kind of application right. So so this is exactly uh well. This is one of the things that we spend. Research effort on is to try to show that this is this vision that we have is possible in practice.

C

um Okay, so let me let me conclude here: I introduced this architecture, the queue line we like to think about it as a quantum ethernet. It's using these.

C

Sorry, this scalability with a standard telecom component, so it's possible to um it's possible to uh to well, we get, let's say a better uh node connectivity for for a given cost in the in the network. uh This this architecture is scalable in the sense that we can add and it's easier to add, more nodes in the system and also uh secure because it's not using trusted nodes. We get some.

C

We have proven the security and also I mean it's still working progress for from more futuristic attacks, but we consider the situation.

C

I have introduced some application and this very cool vision in the future that also we can use it in combination with, um with uh quantum class, uh sorry with the quantum computers uh to perform uh secure quantum cloud computing.

C

So this is sort of the roadmap that we have at very cloud with this euro qci, but also initiatives outside of europe. We have a very nice playground for secure communication. We can. We can deploy these uh this hardware and all the quantum communication networks that are being built today.

C

Secure storage is something that we are already developing, with the hope of showing how qn can be used in a in a real implementation. uh Let's say at the beginning of next year. We are also developing and researching on how to compute.

C

On top of these uh stored data, uh by running uh mostly classical, I mean for classical computing, uh but uh also a quantum assisted, classical computing, and the long-term vision is that all these things should evolve toward a quantum internet, where we will be able to to run these algorithms that were developed for secure quantum cloud computing thanks a lot everyone.

C

I hope this was interesting to to everyone, and we have some time for questions.

A

Thank you mark so first, I guess a digital applause, uh thanks for the talk um and now open as mark asks floors open to questions. So please ask your questions. Ideally, you could raise your hand and ask them with your microphone, but if that's not possible for you try the chat but you'll likely get a faster response by raising your hand and asking with a microphone.

A

uh So actually rodney started rodney. I guess: go ahead. Ask a question.

B

So thanks uh mark this is a really interesting talk. um I'm not sure what limits the scalability of the system you're designing. You initially presented it as lan or maybe maybe metro area scale systems, but I'm I'm uncertain what limits the inter-node distance and the maximum number of nodes you might use.

C

Well, I would say, as always, with the quantum communication, the limit comes from the losses in the fiber, uh which you know, apart from being very careful with the fiber. We cannot do much uh so so the so.

C

Ultimately, this distance here is um limited by I mean what we, the limit is the distance between the the first node that emits the qubits and the last node that measures the qubits, regardless of the number of intermediate nodes, you have an inherent limit, but also in addition to that, each of the intermediate nodes they add some losses to the to the systems uh and here well, the best you can do is do very, very nice engineering, but uh but well, I guess we will always have some losses that will uh that will decrease the maximum distance that we that we can get with the system.

B

So your modulators here are just um they're modifying the photons, but but they're not regenerating.

C

B

Okay, so that's that means that your end to end your left to right limit here is single photon in fiber transmission limits, that's a 100, kilometers or so. Okay,.

C

But the number of intermediate nodes now is limited also by the fact that these modulators they are not perfect and they also induce some loss to the to the system. It makes sense: well not not really the modulators, but the connection between the fiber and the modulation yeah.

B

The fiber couplers and whatnot okay, thanks.

A

E

I just want to ask: uh do you think there's an advantage if some of the mods, like the intermediate nodes, have the ability to detect like do you get more, maybe more robustness or something um it means more expensive though, but.

C

Yeah well um yeah, so you get advantages also for the security, uh for example, the for the you know for these.

C

Attacks but I guess, if you ask, if you add a modulator, this would be very sorry if you add a detector, the intermediate nodes. This will be also very similar to um to the to the switching that was mentioned earlier.

E

Yeah maybe like okay sounds makes sense, so he thinks.

A

Thanks steven there's a question in the chat, which is, please clarify the advantage of cue night versus traditional qkd. Is it just cost effective or is there more.

C

The way I mean what I believe is so indeed, because the cost or the the scalability, let's say for a given cost you have, you can have more nodes, is one thing, but also the fact that it does not use trusted nodes uh when you, when you scale it to a to a network but you're, going to have a connected fully connected network without trusting nodes.

A

Great any other questions.

A

um So with that uh thanks again mark uh it's a great talk and thank you, this is, I think this is. These kind of trucks are a great contribution, especially I think they're, at their quite the right uh level. um So I really appreciate that physics was very limited and the maths was kept outside so as good as very focused on networks and the kind of advantages so yeah. So I I I like the level of the talk. So thanks a lot, and hopefully we'll see you at the qrg, otherwise.

C

Yeah yeah yeah- this is, I have to say this- is the probably one of the most technical talks I've been giving over the last couple of years.

C

C

I'm happy to recommend other people to delve into the details of the of the security proof. For example,.

D

A

Thanks uh ronnie, do you have anything to add.

B

uh No just again, then, thanks for for doing the talk mark, I I let go that was. It was really good and I think it was about the right level for this audience um and thanks for making it on time, because I'm sure lots of people have various other things on their schedule for the day. So it's nice to squeeze it actually in an hour um wojtek. Do you and I have any any other announcements that we're ready to make in front of the group. Yet uh no.

A

Everything's on the mailing list: okay,.

A

Okay, great thanks mark and thanks everybody.

A

Thank you. Bye.

B

B

Stay safe, everybody.

B