CQP Tool kit

The system provides various components for integrating QKD into a security system. It's written in C++11 but uses [GRPC][] interfaces so can be integrated with lots of different languages.

Quick Start

To run the software natively, ether:

download and install the Ubuntu deb packages or
clone the source, ensuring submodules are updated and build locally

To clone the source including submodules:

git clone --recurse-submodules [email protected]:QComms/cqptoolkit.git

If you cloned without using --recurse-submodules, submodules can be updated by running git submodule update --init from within the source folder.

Here is a list of dependencies you need to compile the project (please read further down below for more details on the installation):

sudo apt install pkg-config ca-certificates file build-essential cmake ninja-build libusb-1.0-0-dev libcurl4-openssl-dev \
	libcrypto++-dev libcap-dev uuid-dev libssl-dev libsqlite3-dev libprotobuf-dev libgrpc++-dev \
	libssl-dev protobuf-compiler protobuf-compiler-grpc checkinstall
mkdir build-cqptoolkit
cd build-cqptoolkit
cmake -G Ninja ../cqptoolkit && ninja

Quick test

From the build folder, to run two sites (on the same local computer) each with a QKD device , first start site "A" by starting a site agent and connecting an Alice "dummy driver" to it: (If the binaries have been installed, omit the paths to the commands from the instructions.)

./src/Tools/SiteAgentRunner/SiteAgentRunner -p 8000 &
./src/Drivers/DummyQKDDriver/DummyQKDDriver -r localhost:8000 -a

./src/Tools/SiteAgentRunner/SiteAgentRunner -p 8001 &
./src/Drivers/DummyQKDDriver/DummyQKDDriver -r localhost:8001 -b

This will not start producing key immediately as this system is designed to be controlled by a management system, the connection needs to be established with the command SiteAgentCtl.

First, you can verify the list of available devices with:

./src/Tools/SiteAgentCtl/SiteAgentCtl -d -c localhost:8000

which should produce something similar to this by default, if SiteAgentRunner and DummyQKDDriver were lauched without specifying a configuration JSON string file argument:

{
 "url": "<hostname>:8000",
 "devices": [
  {
   "config": {
    "id": "dummyqkd__0__16_alice",
    "kind": "dummyqkd"
   },
   "controlAddress": "<hostname>:34219"
  }
 ]
}

and port 8001 should produce something similar to

{
 "url": "<hostname>:8001",
 "devices": [
  {
   "config": {
    "id": "dummyqkd__0__16_bob",
    "side": "Bob",
    "kind": "dummyqkd"
   },
   "controlAddress": "<hostname>:38367"
  }
 ]
}

Now, the connection can now be made by calling:

./src/Tools/SiteAgentCtl/SiteAgentCtl -c localhost:8000 -j localhost:8001

This will create a single hop from one site to the next, again more complex routes can be defined by using the -a option with a JSON string specifying the path.

After a few seconds there should be key available which can be tested by requesting a key.

NOTE: The -k parameter must be the url shown in the details of the second site, not "localhost:8001"

./src/Tools/SiteAgentCtl/SiteAgentCtl -c localhost:8000 -k `hostname`:8001

The link can be stopped with the unjoin command:

./src/Tools/SiteAgentCtl/SiteAgentCtl -c localhost:8000 -u localhost:8001

Not that key is still available even though generation has stopped, as long as the site agents are running. It can be requested with the same key request command above.

Encryption example

With the launched site agents and drivers on the same local computer as described above and after having started the link for key exchange, one can also test the encryption features.

First, start one side of the "VPN" on the bob which will listen on port 9010 and connect to Bob's key store:

./src/Tools/QTunnelServer/QTunnelServer -p 9010 --keystore-url=`hostname`:8001

Now start the Alice side of the VPN, defining the tunnel to create. Two ports will be opened, one for each side on 9000 and 9001, anything entering these ports will be encrypted, transfered to the other side, decrypted and produced on the other port.

./src/Tools/QTunnelServer/QTunnelServer --keystore-url=`hostname`:8000 --remote=localhost:9010 --start-node=tcpsrv://0.0.0.0:9000 --end-node=tcpsrv://0.0.0.0:9001

Anything which uses tcp communications can then use this port, netcat is a simple program which will send data over the ports, start one on one side:

nc localhost 9000

and one on the other:

nc localhost 9001

Anything typed into one side will appear on the other when enter is pressed. Inspecting the packets travelling through ports 9000 and 9001 with a tool such as wireshark will show the data being encrypted and the key ID used.

Other forms of connection can be created, instead of tcpserv:

Progress

Planed and completed features

It is hoped that this project can prove useful for both scientific research work and large projects. More details on the project can be found in this paper.

To contribute to this project please see the Contribution file.

CQPToolkit

Most Popular

CQP Tool kit

Quick Start

Progress

Installation