Andrew Sergeev

MACsec (Media Access Control Security) is an IEEE 802.1AE standard for secure communication on Ethernet links. MACsec ensures the confidentiality, integrity and origin authenticity of Ethernet frames. The secrecy of MACsec stems from a root key that is either configured as a pre-shared key or derived from a mutual authentication protocol. However, both methods are not ideal because such root key may be disclosed by human mistakes or broken by quantum attacks. In this paper, we investigate QKD (quantum key distribution) as an alternative source of trust for MACsec. QKD can be used as either a root key provider or a session key generator. We develop a new key exchange protocol based on QKD for Ethernet networks. We verified by experiment that QKD could be well integrated into MACsec without performance degradation.