[Paper Review] Overview of Quantum Key Distribution Technique within IPsec Architecture

Emir Dervisevic, Miralem Mehić|arXiv (Cornell University)|Dec 24, 2021

Quantum Information and Cryptography4 citations

TL;DR

This paper presents a comprehensive overview of integrating Quantum Key Distribution (QKD) into the IPsec architecture to enable post-quantum-secure key exchange. By leveraging QKD-generated symmetric keys within IPsec's Internet Key Exchange (IKE) protocol, the approach ensures information-theoretic security, with solutions like Rapid Rekeying and QIKE enabling high-speed key synchronization and fast rekeying to overcome performance limitations of classical key exchange.

ABSTRACT

Quantum Key Distribution (QKD) is an approach for establishing symmetrical binary keys between distant users in an information-theoretically secure way. In this paper we provide an overview of existing solutions that integrate QKD within the most popular architecture for establishing secure communications in modern IP (Internet Protocol) networks - IPsec (Internet Protocol security). The provided overview can be used to further design the integration of QKD within the IPsec architecture striving for a standardized solution.

Motivation & Objective

• To analyze existing solutions for integrating Quantum Key Distribution (QKD) with the IPsec architecture to achieve post-quantum security.
• To identify limitations in current QKD-IPsec integration, particularly slow rekeying rates and reliance on classical cryptography for control channels.
• To evaluate protocols that enable fast, scalable key synchronization between IPsec endpoints using QKD-generated keys.
• To assess the feasibility of replacing classical key exchange (e.g., DH) in IKE with QKD-based key distribution for enhanced security.
• To provide a foundation for standardizing QKD integration within IPsec for future deployment in critical infrastructure.

Proposed method

• Surveying and categorizing existing QKD-IPsec integration solutions, including DARPA Quantum Network, Secure Quantum Key Exchange (SQKE), MagiQ Technologies, QIKE, AQUA, and Rapid Rekeying.
• Analyzing the role of the Internet Key Exchange (IKE) protocol in IPsec and how QKD keys can be used to establish and rekey Security Associations (SAs).
• Evaluating key synchronization mechanisms such as pre-allocated SPIs and QKD key queues to enable fast rekeying without negotiation delays.
• Assessing the use of ISAKMP informational messages in QIKE to synchronize SA databases by exchanging only SPI values of expired SAs.
• Examining the use of multiple SAs in parallel to allow simultaneous use of old and new keys, improving resilience and throughput.
• Investigating the role of post-processing in QKD, including error correction and privacy amplification, to ensure final key secrecy and integrity.

Experimental results

Research questions

• RQ1 How can QKD be effectively integrated into the IPsec architecture to replace classical key exchange mechanisms?
• RQ2 What are the performance bottlenecks in existing QKD-IPsec solutions, particularly regarding rekeying speed and control channel security?
• RQ3 How do different protocols (e.g., QIKE, Rapid Rekeying) achieve fast key synchronization while maintaining backward compatibility with IPsec?
• RQ4 To what extent can QKD-generated keys be used to secure the control channel in IKE, and what are the implications for authentication?
• RQ5 What architectural changes are required in IPsec to support high-speed, scalable rekeying using QKD keys?

Key findings

• The DARPA Quantum Network solution introduced an IKE/QKD interface but suffered from slow rekeying due to reliance on sequential key exchange.
• The Secure Quantum Key Exchange (SQKE) protocol supports preshared authentication with QKD keys, enhancing control channel security, but requires on-demand QKD key exchange, limiting data rates if one-time pad encryption is used.
• MagiQ Technologies and QIKE protocols enable fast rekeying by maintaining multiple SAs in parallel and pre-allocating QKD keys, significantly improving throughput.
• The Rapid Rekeying protocol achieves high rekeying rates by synchronizing QKD keys via a lightweight protocol that exchanges only SPI values, eliminating negotiation delays.
• The AQUA solution extends IKEv2 to support QKD key negotiation and fallback mechanisms but does not resolve the slow rekeying issue present in earlier designs.
• The study concludes that IPsec can maintain relevance in the post-quantum era if enhanced with QKD integration, particularly through mechanisms that support multiple SAs and pre-synchronized keys.