Media access control security (MACsec) is an IEEE 802.1AE standard for secure communication on Ethernet links. MACsec ensures the confidentiality, integrity and origin authenticity of Ethernet frames. The secrecy of MACsec stems from a root key that is either configured as a pre-shared key or derived from a mutual authentication protocol. However, both methods are not ideal because such a root key may be disclosed due to human errors or broken by quantum attacks. Here, the authors investigate the quantum key distribution (QKD) as an alternative source of trust for MACsec. QKD can be used as either a root key provider or a session key generator. The authors develop a new key exchange protocol based on QKD for Ethernet networks. Furthermore, it is verified by the experiment that QKD could be well integrated into MACsec without performance degradation.This is an open access article under the terms of the Creative Commons Attribution-NonCommercial License, which permits use, distribution and reproduction in any medium, provided the original work is properly cited and is not used for commercial purposes.

No abstract

No abstract

We demonstrate a flexible and scalable quantum-resistant encryption framework applicable to existing optical networks. Computationally intensive key exchange processes are offloaded on a centralized crypto module while encryption keys are converted into n shares and distributed to key servers in such a way that those keys can be securely reconstructed by a threshold key management protocol.

We demonstrate a practical key management scheme for a quantum key distribution network. Multi-vendor QKD systems are interoperated via a standard interface and a key relay is dynamically routed by SDN.