Lin Hsin Hsin Quantum Security Center
Qiskit Vulnerabilities & Exploits by Lin Hsin Hsin





Qiskit handles cryptography primarily by providing open-source tools to simulate, implement, and analyze quantum cryptographic protocols, most notably Quantum Key Distribution (QKD) and BB84. It serves as a Software Development Kit (SDK) that allows developers to construct quantum circuits for secure key exchange, leveraging quantum phenomena like superposition and entanglement to detect eavesdropping


Key Capabilities


Quantum Key Distribution (QKD)

Qiskit enables the implementation of protocols like BB84, where parties (Alice and Bob) generate a shared secret key. The code uses Hadamard (H) and Pauli-X (X) gates to encode bits into qubit states (e.g., $|0\rangle, |1\rangle, |+\rangle, |-\rangle$). If an eavesdropper (Eve) intercepts the qubits, the quantum state collapse introduces detectable errors, allowing the parties to discard compromised keys.


Quantum Random Number Generation (QRNG)

Qiskit utilizes the inherent probabilistic nature of quantum mechanics, often via Hadamard gates, to generate true random numbers essential for cryptographic key generation and nonce creation


Post-Quantum & Classical Hybrid

While Qiskit can simulate classical algorithms like RSA using quantum techniques such as modular exponentiation, it is primarily used to explore post-quantum security and quantum-resistant solutions. Frameworks like Qis|krypt⟩ built on Qiskit offer specialized protocols for quantum secure multiparty computation and authentication


Implementation Details

Developers use Qiskit’s Terra and Aer modules to


          📍 Define quantum registers
          📍 Apply gates to prepare states
          📍 Simulate measurements on backends


          the process typically involves


📍 State Preparation

Alice encodes random bits into qubits using specific bases (rectilinear or diagonal)


📍 Transmission & Measurement

Bob measures qubits in randomly chosen bases.


📍 Sifting

Alice and Bob compare bases publicly to discard mismatched measurements, retaining a correlated sifted key


📍 Error Checking

A subset of bits is compared to ensure no eavesdropping occurred; if the error rate is low, the remaining bits form the secure symmetric key for one-time pad encryption



Unlike BB84, which suffers from physical hardware exploits, Qiskit vulnerabilities are primarily software-based, focusing on

        📍 Insecure deserialization
        📍 Code execution
        📍 Supply chain risks within the classical control stack





Qiskit Vulnerability-- Core SDK

Qiskit Vulnerability-- Domain Apps

Qiskit Vulnerability-- AddOn

Qiskit Vulnerability Abridged

Snail versus Octopus

The Octopus Alternatives

Qiskit Adopters

Qiskit & PQC Hypocrisy