From c42beae11a7af3922ff89d459408e0be75f1ed9b Mon Sep 17 00:00:00 2001 From: Michael Date: Thu, 12 Dec 2024 17:59:00 +0000 Subject: [PATCH 1/8] adding dqkd docs --- content/DQKD/_index.md | 67 +++++++++++++++++++++++++++++ content/DQKD/images/dqkddiagram.svg | 11 +++++ 2 files changed, 78 insertions(+) create mode 100644 content/DQKD/_index.md create mode 100644 content/DQKD/images/dqkddiagram.svg diff --git a/content/DQKD/_index.md b/content/DQKD/_index.md new file mode 100644 index 0000000..858d28c --- /dev/null +++ b/content/DQKD/_index.md @@ -0,0 +1,67 @@ ++++ +menuTitle = "DQKD" +title = "Digital Quantum Key Distribution (DQKD) " +date = 2021-12-10T11:01:08-04:00 +weight = 2 +disableToc = "true" ++++ + +## What is DQKD? + +DQKD is a functional and easy-to-set-up alternative to [QKD](https://www.nsa.gov/Cybersecurity/Quantum-Key-Distribution-QKD-and-Quantum-Cryptography-QC/), aiming to attain the level of security granted by QKD with a fraction of the deployment cost. We do so by using Qrypt's [BLAST](https://www.qrypt.com/wp-content/uploads/2022/03/Whitepaper-EverlastingSecurity.pdf#page=9) technology to generate key material safely at the endpoints. Unlike standard QKD, Qrypt's BLAST-based QKD removes the need for specialized instalations such as satalite and fiber optic. +## How it works: +### From the User Perspective (simplest example) +1. Alice wants to generate symmetric keys with bob, without sending the key material directly between her and Bob + +2. Using her cert from Qrypt, and the ID of Bob's Key Management Entity (KME), Alice calls the API for a single key. + +2. A moment later, she recieves the key and respective key ID from her KME on site. + +3. Behind the scenes, Alice's KME securely transmits the data required for Bob's KME to generate the exact same key through BLAST. + +4. Then, she comfortably shares the key ID over a public channel with Bob, say over Discord or Whatsapp. Bob recieves the key ID. + +5. Bob then sends a request to his KME through the same API to replicate the key. + +6. From his on-site KME, Bob then recieves the key material that was generated by Alice, and can then use that material to sensitive data to Alice. +See graphic below for a visual. + +![FullPage](images/dqkddiagram.svg) + +Alice and Bob have successfully established a post-quantum cryptographic connection without digging 100's of miles of cable or launching multiple satalites. +### Technical Implementation Details +Alice requests a fresh quantum-random key, tagging Bob's server to allow dqkd to make the key available on that server. + + curl --cert My_Cert.p12 \ + "https://dqkd-eastus-1.qrypt.net/api/v1/keys/(Bob's KME ID)/enc_keys" + +The API defaults to one key of size 256, because Alice only needs one default key, she leaves the data fields blank, and recieves a key: + + + {"keys": [{"key": “actual key”,"key_ID": “key id of actual key”}]} + +{{% notice note %}} +To request more than the default, use the following format, by adding the following to the data field of the request: +{{% /notice %}} +```c + curl --cert My_Cert.p12 \ + "https://dqkd-eastus-1.qrypt.net/api/v1/keys/(Bob's KME ID)/enc_keys" \ + -d '{"number": 1, "size":256}' +``` + +Alice then sends the key ID to Bob, who already has Alice's KME ID, then sends the request for the Key Alice generated on her end. + + curl --cert My_Cert.p12 \ + "https://dqkd-westus-1.qrypt.net/api/v1/keys/(Alice's KME ID)/dec_keys" \ + -H "Content-Type: application/json" \ + -d '{"key_IDs": [{"key_ID": “key id of actual key”}]}' + +Bob then recieves the same message generated by Alice + + {"keys": [{"key": “actual key”,"key_ID": “key id of actual key”}]} + +From here the key can be used for any number of use cases, with the assurance that the key data is secure. This example is only to show how the system works, there can be any number of Alices or Bobs under a single KME, and unlimited KMEs that communicate with one another in a network. There is also the option to have a Time To Live (TTL) which can time-gate key decodes for shorter than the default of one hour. + +{{% notice note %}} +We have implemented Qrypt DQKD in accordance with the [ETSI GS QKD 014](https://www.etsi.org/deliver/etsi_gs/QKD/001_099/014/01.01.01_60/gs_qkd014v010101p.pdf) specification. +{{% /notice %}} \ No newline at end of file diff --git a/content/DQKD/images/dqkddiagram.svg b/content/DQKD/images/dqkddiagram.svg new file mode 100644 index 0000000..fa6f955 --- /dev/null +++ b/content/DQKD/images/dqkddiagram.svg @@ -0,0 +1,11 @@ + + + + + + + + Alice's KMEBob's KMEAliceBobBLAST serversMetadata to reproduce key sent"Generate 1 key andsend a copy of the metadata to Bob'sKME"KEY: XFAJYJHVXKEY ID: "Key 1"Step 1Step 2Step 4Send key ID through any channel"Key ID is 1"Step 5"I want 'Key 1' thatwas generated on Alice's KME"KEY: XFAJYJHVXKEY ID: "Key 1"Step 6Step 3 (Server side)SITE BSITE AOver the public internet...server: "BLST:3kqxqsdsd..." \ No newline at end of file From 9b33f293cd4cc9e5d9336be0926d668e3c54b6a1 Mon Sep 17 00:00:00 2001 From: Michael Date: Thu, 12 Dec 2024 18:06:54 +0000 Subject: [PATCH 2/8] updating dqkd docs --- content/DQKD/_index.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/content/DQKD/_index.md b/content/DQKD/_index.md index 858d28c..38c7765 100644 --- a/content/DQKD/_index.md +++ b/content/DQKD/_index.md @@ -11,7 +11,7 @@ disableToc = "true" DQKD is a functional and easy-to-set-up alternative to [QKD](https://www.nsa.gov/Cybersecurity/Quantum-Key-Distribution-QKD-and-Quantum-Cryptography-QC/), aiming to attain the level of security granted by QKD with a fraction of the deployment cost. We do so by using Qrypt's [BLAST](https://www.qrypt.com/wp-content/uploads/2022/03/Whitepaper-EverlastingSecurity.pdf#page=9) technology to generate key material safely at the endpoints. Unlike standard QKD, Qrypt's BLAST-based QKD removes the need for specialized instalations such as satalite and fiber optic. ## How it works: ### From the User Perspective (simplest example) -1. Alice wants to generate symmetric keys with bob, without sending the key material directly between her and Bob +1. Alice wants to generate symmetric keys with Bob, without sending the key material directly between her and Bob 2. Using her cert from Qrypt, and the ID of Bob's Key Management Entity (KME), Alice calls the API for a single key. @@ -23,7 +23,7 @@ DQKD is a functional and easy-to-set-up alternative to [QKD](https://www.nsa.gov 5. Bob then sends a request to his KME through the same API to replicate the key. -6. From his on-site KME, Bob then recieves the key material that was generated by Alice, and can then use that material to sensitive data to Alice. +6. From his on-site KME, Bob then recieves the key material that was generated by Alice, and can then use that material to send sensitive data to Alice. See graphic below for a visual. ![FullPage](images/dqkddiagram.svg) From fa7a39dc38b2ecda4ab951982b326426aadc6a6f Mon Sep 17 00:00:00 2001 From: Michael Date: Thu, 12 Dec 2024 18:09:27 +0000 Subject: [PATCH 3/8] updating dqkd docs --- content/DQKD/_index.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/content/DQKD/_index.md b/content/DQKD/_index.md index 38c7765..53405a0 100644 --- a/content/DQKD/_index.md +++ b/content/DQKD/_index.md @@ -8,7 +8,7 @@ disableToc = "true" ## What is DQKD? -DQKD is a functional and easy-to-set-up alternative to [QKD](https://www.nsa.gov/Cybersecurity/Quantum-Key-Distribution-QKD-and-Quantum-Cryptography-QC/), aiming to attain the level of security granted by QKD with a fraction of the deployment cost. We do so by using Qrypt's [BLAST](https://www.qrypt.com/wp-content/uploads/2022/03/Whitepaper-EverlastingSecurity.pdf#page=9) technology to generate key material safely at the endpoints. Unlike standard QKD, Qrypt's BLAST-based QKD removes the need for specialized instalations such as satalite and fiber optic. +DQKD is a functional and easy-to-set-up alternative to [QKD](https://www.nsa.gov/Cybersecurity/Quantum-Key-Distribution-QKD-and-Quantum-Cryptography-QC/), aiming to attain the level of security granted by QKD with a fraction of the deployment cost. We do so by using Qrypt's [BLAST](https://www.qrypt.com/wp-content/uploads/2022/03/Whitepaper-EverlastingSecurity.pdf#page=9) technology to generate key material safely at the endpoints. Unlike standard QKD, Qrypt's BLAST-based QKD removes the need for specialized instalations such as satalite or fiber optic. ## How it works: ### From the User Perspective (simplest example) 1. Alice wants to generate symmetric keys with Bob, without sending the key material directly between her and Bob @@ -35,7 +35,7 @@ Alice requests a fresh quantum-random key, tagging Bob's server to allow dqkd to curl --cert My_Cert.p12 \ "https://dqkd-eastus-1.qrypt.net/api/v1/keys/(Bob's KME ID)/enc_keys" -The API defaults to one key of size 256, because Alice only needs one default key, she leaves the data fields blank, and recieves a key: +The API defaults to one key of size 256, because Alice only needs one default-size key, she leaves the data fields blank, and recieves a key: {"keys": [{"key": “actual key”,"key_ID": “key id of actual key”}]} From 8ab4e2c51b48b3e7524fdf3567c1ef55be408c57 Mon Sep 17 00:00:00 2001 From: Michael Date: Mon, 16 Dec 2024 17:55:20 +0000 Subject: [PATCH 4/8] updating dqkd docs --- docs/404.html | 16 +- docs/categories/index.html | 77 +- docs/concepts/entropy-projection/index.html | 77 +- docs/concepts/index.html | 77 +- .../key-generation-architecture/index.html | 77 +- docs/concepts/otp/index.html | 77 +- docs/dqkd/images/dqkddiagram.svg | 11 + docs/dqkd/index.html | 1040 +++++++++++++++++ docs/dqkd/index.xml | 12 + docs/eaas/appliance/index.html | 107 +- docs/eaas/index.html | 77 +- docs/eaas/nist/index.html | 77 +- docs/eaas/pkcs11/index.html | 77 +- docs/eaas/rngd/index.html | 77 +- docs/faqs/index.html | 77 +- docs/getting_started/index.html | 77 +- docs/index.html | 77 +- docs/index.json | 7 + docs/openssh/index.html | 77 +- docs/postquantumproxy/index.html | 77 +- docs/quantumreadiness/index.html | 77 +- docs/sdk/api/cpp/index.html | 77 +- docs/sdk/api/index.html | 77 +- docs/sdk/changelogs/index.html | 77 +- docs/sdk/index.html | 77 +- docs/sdk/nvidia/index.html | 77 +- docs/sdk/overview/index.html | 93 +- docs/sdk/quickstarts/cpp/index.html | 95 +- docs/sdk/quickstarts/index.html | 77 +- docs/sitemap.xml | 3 + docs/tags/index.html | 77 +- 31 files changed, 2463 insertions(+), 615 deletions(-) create mode 100644 docs/dqkd/images/dqkddiagram.svg create mode 100644 docs/dqkd/index.html create mode 100644 docs/dqkd/index.xml diff --git a/docs/404.html b/docs/404.html index 872e91f..3d490e2 100644 --- a/docs/404.html +++ b/docs/404.html @@ -9,15 +9,15 @@ 404 Page not found - - - - - - - + + + + + + + - + + + + Alice's KMEBob's KMEAliceBobBLAST serversMetadata to reproduce key sent"Generate 1 key andsend a copy of the metadata to Bob'sKME"KEY: XFAJYJHVXKEY ID: "Key 1"Step 1Step 2Step 4Send key ID through any channel"Key ID is 1"Step 5"I want 'Key 1' thatwas generated on Alice's KME"KEY: XFAJYJHVXKEY ID: "Key 1"Step 6Step 3 (Server side)SITE BSITE AOver the public internet...server: "BLST:3kqxqsdsd..." \ No newline at end of file diff --git a/docs/dqkd/index.html b/docs/dqkd/index.html new file mode 100644 index 0000000..53789d1 --- /dev/null +++ b/docs/dqkd/index.html @@ -0,0 +1,1040 @@ + + + + + + + + + + + + Digital Quantum Key Distribution (DQKD) :: Qrypt + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
+
+
+ + +
+ +
+ + + + + + + +
+ +

+ + Digital Quantum Key Distribution (DQKD) +

+ + + + + + +

What is DQKD?

+

DQKD is a functional and easy-to-set-up alternative to QKD, aiming to attain the level of security granted by QKD with a fraction of the deployment cost. We do so by using Qrypt’s BLAST technology to generate key material safely at the endpoints. Unlike standard QKD, Qrypt’s BLAST-based QKD removes the need for specialized instalations such as satalite or fiber optic.

+

How it works:

+

From the User Perspective (simplest example)

+
    +
  1. +

    Alice wants to generate symmetric keys with Bob, without sending the key material directly between her and Bob

    +
    2. +
  2. +

    Using her cert from Qrypt, and the ID of Bob’s Key Management Entity (KME), Alice calls the API for a single key.

    +
    3. +
  3. +

    A moment later, she recieves the key and respective key ID from her KME on site.

    +
    4. +
  4. +

    Behind the scenes, Alice’s KME securely transmits the data required for Bob’s KME to generate the exact same key through BLAST.

    +
    5. +
  5. +

    Then, she comfortably shares the key ID over a public channel with Bob, say over Discord or Whatsapp. Bob recieves the key ID.

    +
    6. +
  6. +

    Bob then sends a request to his KME through the same API to replicate the key.

    +
    7. +
  7. +

    From his on-site KME, Bob then recieves the key material that was generated by Alice, and can then use that material to send sensitive data to Alice. +See graphic below for a visual.

    +
    8. +
+

FullPage

+

Alice and Bob have successfully established a post-quantum cryptographic connection without digging 100’s of miles of cable or launching multiple satalites.

+

Technical Implementation Details

+

Alice requests a fresh quantum-random key, tagging Bob’s server to allow dqkd to make the key available on that server.

+
curl --cert My_Cert.p12 \
+"https://dqkd-eastus-1.qrypt.net/api/v1/keys/(Bob's KME ID)/enc_keys"
+
+

The API defaults to one key of size 256, because Alice only needs one default-size key, she leaves the data fields blank, and recieves a key:

+
{"keys": [{"key": “actual key”,"key_ID": “key id of actual key”}]}  
+
+ +

To request more than the default, use the following format, by adding the following to the data field of the request:

+
+ +
    curl --cert My_Cert.p12 \
+    "https://dqkd-eastus-1.qrypt.net/api/v1/keys/(Bob's KME ID)/enc_keys" \
+    -d '{"number": 1,  "size":256}'
+

Alice then sends the key ID to Bob, who already has Alice’s KME ID, then sends the request for the Key Alice generated on her end.

+
curl --cert My_Cert.p12 \
+"https://dqkd-westus-1.qrypt.net/api/v1/keys/(Alice's KME ID)/dec_keys" \
+-H "Content-Type: application/json" \
+-d '{"key_IDs": [{"key_ID": “key id of actual key”}]}'
+
+

Bob then recieves the same message generated by Alice

+
{"keys": [{"key": “actual key”,"key_ID": “key id of actual key”}]}  
+
+

From here the key can be used for any number of use cases, with the assurance that the key data is secure. This example is only to show how the system works, there can be any number of Alices or Bobs under a single KME, and unlimited KMEs that communicate with one another in a network. There is also the option to have a Time To Live (TTL) which can time-gate key decodes for shorter than the default of one hour.

+ +

We have implemented Qrypt DQKD in accordance with the ETSI GS QKD 014 specification.

+
+ + + + + + +
+ +
+ + +
+ + +
+ + + +
+ +
+
+
+ + + + + + + + + + + + + + + + + + + + diff --git a/docs/dqkd/index.xml b/docs/dqkd/index.xml new file mode 100644 index 0000000..1f11203 --- /dev/null +++ b/docs/dqkd/index.xml @@ -0,0 +1,12 @@ + + + + Digital Quantum Key Distribution (DQKD) on Qrypt + https://QryptInc.github.io/dqkd/ + Recent content in Digital Quantum Key Distribution (DQKD) on Qrypt + Hugo + en-us + + + + diff --git a/docs/eaas/appliance/index.html b/docs/eaas/appliance/index.html index 65c784b..0bb22d3 100644 --- a/docs/eaas/appliance/index.html +++ b/docs/eaas/appliance/index.html @@ -3,7 +3,7 @@ - + @@ -12,22 +12,22 @@ :: Qrypt - - - - - - - - - - + + + + + + + + + + - + - + @@ -147,6 +147,21 @@ +
  • + + DQKD + + +
    • +
  • Performance - - + + - - + + - - + +
    256 bit keys per requestRequests per second256 bit keys per requestRequests per second
    512~7,200512~7,200
    1~12,0001~12,000
    @@ -555,13 +570,13 @@

    Appliance Administration UI

    - - + + - - + - - + - - +
    StateExplanationStateExplanation
    Appliance Administration UI Active The card is healthy and streaming entropy.The card is healthy and streaming entropy.
    Appliance Administration UI Pending The card is in a temporary calibration state; this will resolve into either Active or Error.The card is in a temporary calibration state; this will resolve into either Active or Error.
    Appliance Administration UI Error The card is reporting an error; the error message can be found in details section.The card is reporting an error; the error message can be found in details section.
    @@ -815,7 +830,7 @@

    Server Specs

    - + @@ -1068,6 +1083,22 @@

    Server Specs

    + + + + + + + + + + + + + + + + @@ -1337,19 +1368,19 @@

    Server Specs

    - - - - - - + + + + + + - - - + + + - + + @@ -147,6 +147,21 @@
    • +
  • + + DQKD + + +
    • +
  • Curl + + + + + + + + + + + + + + + + @@ -1156,19 +1187,19 @@

    Curl

    - - - - - - + + + + + + - - - + + + - + + @@ -147,6 +147,21 @@
    • +
  • + + DQKD + + +
    • +
  • JSON Response Fields + + + + + + + + + + + + + + + + @@ -1299,19 +1330,19 @@
    JSON Response Fields
    - - - - - - + + + + + + - - - + + + - + + @@ -147,6 +147,21 @@
    • +
  • + + DQKD + + +
    • +
  • References + + + + + + + + + + + + + + + + @@ -958,19 +989,19 @@

    References

    - - - - - - + + + + + + - - - + + + - + + @@ -147,6 +147,21 @@
    • +
  • + + DQKD + + +
    • +
  • Service Usage + + + + + + + + + + + + + + + + @@ -1016,19 +1047,19 @@

    Service Usage

    - - - - - - + + + + + + - - - + + + - + + @@ -147,6 +147,21 @@
    • +
  • + + DQKD + + +
    • +
  • + + + + + + + + + + + + + + + + @@ -963,19 +994,19 @@

    - - - - - - + + + + + + - - - + + + - + + @@ -147,6 +147,21 @@

    • +
  • + + DQKD + + +
    • +
  • Explore Qrypt’s Services + + + + + + + + + + + + + + + + @@ -946,19 +977,19 @@

    Explore Qrypt’s Services

    - - - - - - + + + + + + - - - + + + - + + @@ -147,6 +147,21 @@
    • +
  • + + DQKD + + +
    • +
  • Portable OpenSSH + + + + + + + + + + + + + + + + @@ -930,19 +961,19 @@

    Portable OpenSSH
    - - - - - - + + + + + + - - - + + + - + + @@ -147,6 +147,21 @@

    • +
  • + + DQKD + + +
    • +
  • Instructions to build from sourceInstructions to build from source
    - - - - - - + + + + + + - - - + + + - + + @@ -147,6 +147,21 @@
    • +
  • + + DQKD + + +
    • +
  • Setup + + + + + + + + + + + + + + + + @@ -937,19 +968,19 @@

    Setup

    - - - - - - + + + + + + - - - + + + - + + @@ -147,6 +147,21 @@
    • +
  • + + DQKD + + +
    • +
  • Demo + + + + + + + + + + + + + + + + @@ -949,19 +980,19 @@

    Demo

    - - - - - - + + + + + + - - - + + + - + + @@ -147,6 +147,21 @@
    • +
  • + + DQKD + + +
    • +
  • + + + + + + + + + + + + + + + + @@ -935,19 +966,19 @@

    - - - - - - + + + + + + - - - + + + - + + @@ -147,6 +147,21 @@

    • +
  • + + DQKD + + +
    • +
  • Qrypt SDK + + + + + + + + + + + + + + + + @@ -932,19 +963,19 @@

    Qrypt SDK

    - - - - - - + + + + + + - - - + + + - + + @@ -147,6 +147,21 @@
    • +
  • + + DQKD + + +
    • +
  • SDK v0.6.4 + + + + + + + + + + + + + + + + @@ -1028,19 +1059,19 @@

    SDK v0.6.4

    - - - - - - + + + + + + - - - + + + - + + @@ -147,6 +147,21 @@
    • +
  • + + DQKD + + +
    • +
  • Nvidia Quantum Se + + + + + + + + + + + + + + + + @@ -939,19 +970,19 @@

    Nvidia Quantum Se
    - - - - - - + + + + + + - - - + + + - + + @@ -147,6 +147,21 @@

    • +
  • + + DQKD + + +
    • +
  • Create a directory to clone + + + + + + + + + + + + + + + + @@ -1366,19 +1397,19 @@

    Create a directory to clone
    - - - - - - + + + + + + - - - + + + - + + @@ -147,6 +147,21 @@

    • +
  • + + DQKD + + +
    • +
  • Library Compatibility - - - - + + + + - - - - + + + +
    PlatformVersionCompilerCPUPlatformVersionCompilerCPU
    Ubuntu22.04gcc 11.4.0x64Ubuntu22.04gcc 11.4.0x64
    @@ -677,6 +692,22 @@

    Library Compatibility

    + + + + + + + + + + + + + + + + @@ -956,19 +987,19 @@

    Library Compatibility

    - - - - - - + + + + + + - - - + + + - + + @@ -147,6 +147,21 @@
    • +
  • + + DQKD + + +
    • +
  • Library Compatibility - - - - + + + + - - - - + + + +
    PlatformVersionCompilerCPUPlatformVersionCompilerCPU
    Ubuntu22.04gcc 11.4.0x64Ubuntu22.04gcc 11.4.0x64
    @@ -537,7 +552,7 @@

    Prerequisites

    A Qrypt Account. Create an account for free.

    Quickstarts

    -

    Distributed key generation

    +

    Distributed key generation

    Generate One-Time Pads
    @@ -686,6 +701,22 @@

    - - - - - - + + + + + + - - - + + + - + + @@ -147,6 +147,21 @@
    • +
  • + + DQKD + + +
    • +
  • Qrpyt SDK Quickstarts + + + + + + + + + + + + + + + + @@ -933,19 +964,19 @@

    Qrpyt SDK Quickstarts

    - - - - - - + + + + + + - - - + + + - + + @@ -147,6 +147,21 @@
    • +
  • + + DQKD + + +
    • +
  • + + + + + + + + + + + + + + + + @@ -926,19 +957,19 @@

    - - - - - - + + + + + + - - - + + + - + + @@ -957,19 +957,19 @@

    - - - - - - + + + + + + - - - + + + - + + @@ -1086,19 +1086,19 @@

    Formula

    - - - - - - + + + + + + - - - + + + - + + @@ -964,19 +964,19 @@

    One-Time Pad (OTP)

    - - - - - - + + + + + + - - - + + + - + + @@ -993,19 +993,19 @@

    - - - - - - + + + + + + - - - + + + - + + @@ -1078,19 +1078,19 @@

    Levels of Security

    - - - - - - + + + + + + - - - + + + - + + @@ -1016,19 +1016,19 @@

    Technical Implementation Details

    - - - - - - + + + + + + - - - + + + - + + @@ -1368,19 +1368,19 @@

    Server Specs

    - - - - - - + + + + + + - - - + + + - + + @@ -1187,19 +1187,19 @@

    Curl

    - - - - - - + + + + + + - - - + + + - + + @@ -1330,19 +1330,19 @@
    JSON Response Fields
    - - - - - - + + + + + + - - - + + + - + + @@ -989,19 +989,19 @@

    References

    - - - - - - + + + + + + - - - + + + - + + @@ -1047,19 +1047,19 @@

    Service Usage

    - - - - - - + + + + + + - - - + + + - + + @@ -994,19 +994,19 @@

    - - - - - - + + + + + + - - - + + + - + + @@ -977,19 +977,19 @@

    Explore Qrypt’s Services

    - - - - - - + + + + + + - - - + + + - + + @@ -961,19 +961,19 @@

    Portable OpenSSH
    - - - - - - + + + + + + - - - + + + - + + @@ -1014,19 +1014,19 @@

    Instructions to build from source

    - - - - - - + + + + + + - - - + + + - + + @@ -968,19 +968,19 @@

    Setup

    - - - - - - + + + + + + - - - + + + - + + @@ -980,19 +980,19 @@

    Demo

    - - - - - - + + + + + + - - - + + + - + + @@ -966,19 +966,19 @@

    - - - - - - + + + + + + - - - + + + - + + @@ -963,19 +963,19 @@

    Qrypt SDK

    - - - - - - + + + + + + - - - + + + - + + @@ -1059,19 +1059,19 @@

    SDK v0.6.4

    - - - - - - + + + + + + - - - + + + - + + @@ -970,19 +970,19 @@

    Nvidia Quantum Se
    - - - - - - + + + + + + - - - + + + - + + @@ -1397,19 +1397,19 @@

    Create a directory to clone
    - - - - - - + + + + + + - - - + + + - + + @@ -987,19 +987,19 @@

    Library Compatibility

    - - - - - - + + + + + + - - - + + + - + + @@ -1000,19 +1000,19 @@

    - - - - - - + + + + + + - - - + + + - + + @@ -964,19 +964,19 @@

    Qrpyt SDK Quickstarts

    - - - - - - + + + + + + - - - + + + - + + @@ -957,19 +957,19 @@

    - - - - - - + + + + + + - - - + + + - + + @@ -957,19 +957,19 @@

    - - - - - - + + + + + + - - - + + + - + + @@ -1086,19 +1086,19 @@

    Formula

    - - - - - - + + + + + + - - - + + + - + + @@ -964,19 +964,19 @@

    One-Time Pad (OTP)

    - - - - - - + + + + + + - - - + + + - + + @@ -993,19 +993,19 @@

    - - - - - - + + + + + + - - - + + + - + + @@ -1078,19 +1078,19 @@

    Levels of Security

    - - - - - - + + + + + + - - - + + + - + + @@ -523,64 +523,56 @@

    What is DQKD?

    -

    DQKD is a functional and easy-to-set-up alternative to QKD, aiming to attain the level of security granted by QKD with a fraction of the deployment cost. We do so by using Qrypt’s BLAST technology to generate key material safely at the endpoints. Unlike standard QKD, Qrypt’s BLAST-based QKD removes the need for specialized instalations such as satalite or fiber optic.

    +

    Alice is at one location (Site A), and Bob is at a different location (Site B). Each location has its own Key Management Entity (KME) that stores keys and makes them available for use by local clients.

    +

    Alice wants to generate a symmetric encryption key and store it in the KME at Site A. She also wants to share that key with Bob and store it in the KME at Site B. It should then be possible to retrieve the key from either site, using the same key id.

    +

    Traditional QKD systems use isolated fiber-optic or satellite based networks to send the key material between the sites.

    +

    Qrypt’s DQKD solution uses Qrypt’s BLAST protocol instead. The advantage of this protocol is that it makes it possible to exchange keys between sites securely over the public internet, without having to establish an isolated fiber-optic or satellite network.

    How it works:

    -

    From the User Perspective (simplest example)

    +

    A DQKD cluster consists of multiple sites, each of which has a KME that is identified by a unique KME ID.

    +

    Each site has a server exposes the same API, which is an instance of the ETSI GS QKD 014 specification.

    +

    The cluster is secured using a single certificate trust chain. All endpoints on the cluster enforce mutual TLS, so all clients will need a client cert that is part of the same trust chain to call the endpoints on the respective sites.

    +

    Generating a key - example data flow

      +
    1. Alice calls the enc_keys endpoint on Site A to generate a key that she wants to share with Bob:
      2. +
    +
     curl --cert My_Certs.p12 \
+    "https://dqkd-eastus-1.qrypt.net/api/v1/keys/(Bob's KME ID)/enc_keys"
+
    1. -

      Alice wants to generate symmetric keys with Bob, without sending the key material directly between her and Bob

      +

      The DQKD server uses the BLAST protocol to generate a key and a new random key ID, and stores the key in the local KME

    2. -

      Using her cert from Qrypt, and the ID of Bob’s Key Management Entity (KME), Alice calls the API for a single key.

      +

      The key ID and metadata required to re-genrate that key is sent to site B.

    3. -

      A moment later, she recieves the key and respective key ID from her KME on site.

      +

      The DQKD server at site B receives the metadata and uses it to re-generate the key.

    4. -

      Behind the scenes, Alice’s KME securely transmits the data required for Bob’s KME to generate the exact same key through BLAST.

      +

      The key is then stored and associated with the key ID in site B’s KME.

    5. -

      Then, she comfortably shares the key ID over a public channel with Bob, say over Discord or Whatsapp. Bob recieves the key ID.

      +

      Alice receives the key material along with the key ID in the response to her original request:

      6. +
    +
    {"keys": [{"key": "KEY_MATERIAL","key_ID": "SOME_KEY_ID"}]}
+
    1. -

      Bob then sends a request to his KME through the same API to replicate the key.

      +

      Alice sends Bob the key ID.

    2. -

      From his on-site KME, Bob then recieves the key material that was generated by Alice, and can then use that material to send sensitive data to Alice. -See graphic below for a visual.

      +

      Bob calls the dec_keys endpoint on the DQKD server at site B to get a copy of the key:

    +
     curl --cert My_Cert.p12 \
+    "https://dqkd-westus-1.qrypt.net/api/v1/keys/(Alice's KME ID)/dec_keys" \
+    -H "Content-Type: application/json" \
+    -d '{"key_IDs": [{"key_ID": "SOME_KEY_ID"}]}'
+
      +
    1. Bob receives the key material in the response:
      2. +
    +
    {"keys": [{"key": "KEY_MATERIAL", "key_ID": "SOME_KEY_ID"}]} 
+

    Data flow - Illustrated

    FullPage

    -

    Alice and Bob have successfully established a post-quantum cryptographic connection without digging 100’s of miles of cable or launching multiple satalites.

    -

    Technical Implementation Details

    -

    Alice requests a fresh quantum-random key, tagging Bob’s server to allow dqkd to make the key available on that server.

    -
    curl --cert My_Cert.p12 \
-"https://dqkd-eastus-1.qrypt.net/api/v1/keys/(Bob's KME ID)/enc_keys"
-
    -

    The API defaults to one key of size 256, because Alice only needs one default-size key, she leaves the data fields blank, and recieves a key:

    -
    {"keys": [{"key": “actual key”,"key_ID": “key id of actual key”}]}  
-
    - -

    To request more than the default, use the following format, by adding the following to the data field of the request:

    -
    - -
        curl --cert My_Cert.p12 \
-    "https://dqkd-eastus-1.qrypt.net/api/v1/keys/(Bob's KME ID)/enc_keys" \
-    -d '{"number": 1,  "size":256}'
-

    Alice then sends the key ID to Bob, who already has Alice’s KME ID, then sends the request for the Key Alice generated on her end.

    -
    curl --cert My_Cert.p12 \
-"https://dqkd-westus-1.qrypt.net/api/v1/keys/(Alice's KME ID)/dec_keys" \
--H "Content-Type: application/json" \
--d '{"key_IDs": [{"key_ID": “key id of actual key”}]}'
-
    -

    Bob then recieves the same message generated by Alice

    -
    {"keys": [{"key": “actual key”,"key_ID": “key id of actual key”}]}  
-
    -

    From here the key can be used for any number of use cases, with the assurance that the key data is secure. This example is only to show how the system works, there can be any number of Alices or Bobs under a single KME, and unlimited KMEs that communicate with one another in a network. There is also the option to have a Time To Live (TTL) which can time-gate key decodes for shorter than the default of one hour.

    - -

    We have implemented Qrypt DQKD in accordance with the ETSI GS QKD 014 specification.

    -
    - @@ -1016,19 +1008,19 @@

    Technical Implementation Details

    - - - - - - + + + + + + - - - + + + - + + @@ -1368,19 +1368,19 @@

    Server Specs

    - - - - - - + + + + + + - - - + + + - + + @@ -1187,19 +1187,19 @@

    Curl

    - - - - - - + + + + + + - - - + + + - + + @@ -1330,19 +1330,19 @@
    JSON Response Fields
    - - - - - - + + + + + + - - - + + + - + + @@ -989,19 +989,19 @@

    References

    - - - - - - + + + + + + - - - + + + - + + @@ -1047,19 +1047,19 @@

    Service Usage

    - - - - - - + + + + + + - - - + + + - + + @@ -994,19 +994,19 @@

    - - - - - - + + + + + + - - - + + + - + + @@ -977,19 +977,19 @@

    Explore Qrypt’s Services

    - - - - - - + + + + + + - - - + + + - + + @@ -961,19 +961,19 @@

    Portable OpenSSH
    - - - - - - + + + + + + - - - + + + - + + @@ -1014,19 +1014,19 @@

    Instructions to build from source

    - - - - - - + + + + + + - - - + + + - + + @@ -968,19 +968,19 @@

    Setup

    - - - - - - + + + + + + - - - + + + - + + @@ -980,19 +980,19 @@

    Demo

    - - - - - - + + + + + + - - - + + + - + + @@ -966,19 +966,19 @@

    - - - - - - + + + + + + - - - + + + - + + @@ -963,19 +963,19 @@

    Qrypt SDK

    - - - - - - + + + + + + - - - + + + - + + @@ -1059,19 +1059,19 @@

    SDK v0.6.4

    - - - - - - + + + + + + - - - + + + - + + @@ -970,19 +970,19 @@

    Nvidia Quantum Se
    - - - - - - + + + + + + - - - + + + - + + @@ -1397,19 +1397,19 @@

    Create a directory to clone
    - - - - - - + + + + + + - - - + + + - + + @@ -987,19 +987,19 @@

    Library Compatibility

    - - - - - - + + + + + + - - - + + + - + + @@ -1000,19 +1000,19 @@

    - - - - - - + + + + + + - - - + + + - + + @@ -964,19 +964,19 @@

    Qrpyt SDK Quickstarts

    - - - - - - + + + + + + - - - + + + - + + @@ -957,19 +957,19 @@

    - - - - - - + + + + + + - - - + + + - + + @@ -957,19 +957,19 @@

    - - - - - - + + + + + + - - - + + + - + + @@ -1086,19 +1086,19 @@

    Formula

    - - - - - - + + + + + + - - - + + + - + + @@ -964,19 +964,19 @@

    One-Time Pad (OTP)

    - - - - - - + + + + + + - - - + + + - + + @@ -993,19 +993,19 @@

    - - - - - - + + + + + + - - - + + + - + + @@ -1078,19 +1078,19 @@

    Levels of Security

    - - - - - - + + + + + + - - - + + + - + + @@ -532,12 +532,12 @@

    How it works:

    Each site has a server exposes the same API, which is an instance of the ETSI GS QKD 014 specification.

    The cluster is secured using a single certificate trust chain. All endpoints on the cluster enforce mutual TLS, so all clients will need a client cert that is part of the same trust chain to call the endpoints on the respective sites.

    Generating a key - example data flow

    -
      +
      • Alice calls the enc_keys endpoint on Site A to generate a key that she wants to share with Bob:
        • -
    + 
     curl --cert My_Certs.p12 \
     "https://dqkd-eastus-1.qrypt.net/api/v1/keys/(Bob's KME ID)/enc_keys"
-
      +

      • The DQKD server uses the BLAST protocol to generate a key and a new random key ID, and stores the key in the local KME

        • @@ -553,23 +553,23 @@

        Generating a key - example data fl

      • Alice receives the key material along with the key ID in the response to her original request:

        • -

    + 
    {"keys": [{"key": "KEY_MATERIAL","key_ID": "SOME_KEY_ID"}]}
-
      +

      • Alice sends Bob the key ID.

      • Bob calls the dec_keys endpoint on the DQKD server at site B to get a copy of the key:

        • -
    + 
     curl --cert My_Cert.p12 \
     "https://dqkd-westus-1.qrypt.net/api/v1/keys/(Alice's KME ID)/dec_keys" \
     -H "Content-Type: application/json" \
     -d '{"key_IDs": [{"key_ID": "SOME_KEY_ID"}]}'
-
      +
      • Bob receives the key material in the response:
        • -
    + 
    {"keys": [{"key": "KEY_MATERIAL", "key_ID": "SOME_KEY_ID"}]}

    Data flow - Illustrated

    FullPage

    @@ -1008,19 +1008,19 @@

    Generating a key - example data fl
    - - - - - - + + + + + + - - - + + + - + + @@ -1368,19 +1368,19 @@

    Server Specs

    - - - - - - + + + + + + - - - + + + - + + @@ -1187,19 +1187,19 @@

    Curl

    - - - - - - + + + + + + - - - + + + - + + @@ -1330,19 +1330,19 @@
    JSON Response Fields
    - - - - - - + + + + + + - - - + + + - + + @@ -989,19 +989,19 @@

    References

    - - - - - - + + + + + + - - - + + + - + + @@ -1047,19 +1047,19 @@

    Service Usage

    - - - - - - + + + + + + - - - + + + - + + @@ -994,19 +994,19 @@

    - - - - - - + + + + + + - - - + + + - + + @@ -977,19 +977,19 @@

    Explore Qrypt’s Services

    - - - - - - + + + + + + - - - + + + - + + @@ -961,19 +961,19 @@

    Portable OpenSSH
    - - - - - - + + + + + + - - - + + + - + + @@ -1014,19 +1014,19 @@

    Instructions to build from source

    - - - - - - + + + + + + - - - + + + - + + @@ -968,19 +968,19 @@

    Setup

    - - - - - - + + + + + + - - - + + + - + + @@ -980,19 +980,19 @@

    Demo

    - - - - - - + + + + + + - - - + + + - + + @@ -966,19 +966,19 @@

    - - - - - - + + + + + + - - - + + + - + + @@ -963,19 +963,19 @@

    Qrypt SDK

    - - - - - - + + + + + + - - - + + + - + + @@ -1059,19 +1059,19 @@

    SDK v0.6.4

    - - - - - - + + + + + + - - - + + + - + + @@ -970,19 +970,19 @@

    Nvidia Quantum Se
    - - - - - - + + + + + + - - - + + + - + + @@ -1397,19 +1397,19 @@

    Create a directory to clone
    - - - - - - + + + + + + - - - + + + - + + @@ -987,19 +987,19 @@

    Library Compatibility

    - - - - - - + + + + + + - - - + + + - + + @@ -1000,19 +1000,19 @@

    - - - - - - + + + + + + - - - + + + - + + @@ -964,19 +964,19 @@

    Qrpyt SDK Quickstarts

    - - - - - - + + + + + + - - - + + + - + + @@ -957,19 +957,19 @@

    - - - - - - + + + + + + - - - + + + - +