Distributed Symmetric Key Establishment: A scalable, quantum-proof key distribution system

TL;DR

DSKE addresses scalable, information-theoretic key distribution in a quantum-safe setting by distributing trust across multiple untrusted Security Hubs and using pre-shared random data (PSKM) to distill secret keys for arbitrary client groups. The protocol hinges on four phases (PSKM generation/distribution, peer identity establishment, key agreement via $(n,k)$ secret sharing, and key validation) and leverages Shamir secret sharing or a simple XOR variant to ensure confidentiality even if some hubs are compromised. A security analysis introduces leakage, injection, malleability, and disruption thresholds, and an adaptation reduces bandwidth while preserving robustness. A prototype demonstrates feasibility with 8 Mbit keys and throughput above 50 Mbit/s in a VPN setting across AWS nodes, highlighting practical viability for quantum-secure key distribution in current networks and IoT ecosystems.

Abstract

We propose and implement a protocol for a scalable, cost-effective, information-theoretically secure key distribution and management system. The system, called Distributed Symmetric Key Establishment (DSKE), relies on pre-shared random numbers between DSKE clients and a group of Security Hubs. Any group of DSKE clients can use the DSKE protocol to distill from the pre-shared numbers a secret key. The clients are protected from Security Hub compromise via a secret sharing scheme that allows the creation of the final key without the need to trust individual Security Hubs. Precisely, if the number of compromised Security Hubs does not exceed a certain threshold, confidentiality is guaranteed to DSKE clients and, at the same time, robustness against denial-of-service (DoS) attacks. The DSKE system can be used for quantum-secure communication, can be easily integrated into existing network infrastructures, and can support arbitrary groups of communication parties that have access to a key. We discuss the high-level protocol, analyze its security, including its robustness against disruption. A proof-of-principle demonstration of secure communication between two distant clients with a DSKE-based VPN using Security Hubs on Amazon Web Server (AWS) nodes thousands of kilometres away from them was performed, demonstrating the feasibility of DSKE-enabled secret sharing one-time-pad encryption with a data rate above 50 Mbit/s and a latency below 70 ms.

Figures (6)

• Figure 1: Results of the PSKM generation and physical distribution phase. DSKE clients Alice, Bob and Charlie share an ordered table of bits with each of the two Security Hubs. Each Security Hub only knows his own part of the users' tables.
• Figure 2: In share generation (1), Alice generates $n$ shares, one associated with each Security Hub, which she will use to build the key using an $(n,k)$ secret sharing scheme. In share distribution (2), Alice transmits each share to Bob using the associated Security Hub, with pre-shared secret random data being used to secure the communication from Alice to the Security Hub, and from the Security Hub to Bob. In key reconstruction (3), both Alice and Bob combine their local shares into a final key $S$ using the same $(n,k)$ secret sharing scheme.
• Figure 3: Share segmentation for Shamir's secret sharing scheme.
• Figure 4: Communication paths in the DSKE protocol after PSKM distribution. Only one message propagates on each arrow. Examples of attack sites modeled with the implementation are shown.
• Figure 5: Scaling behavior of processing rate of 8 Mbit keys agreed as a function of $n$ and $k$. Time is in seconds.