38+17 pages, 13 figures. v2: constructed ideal secure channel and secret key resource have been slightly redefined; also added a proof in the appendix for quantum authentication without key recycling that has better parameters and only requires weak purity testing codes
发表信息：
Advances in Cryptology - EUROCRYPT 2017, Proceedings, Part III, vol. 10212 of LNCS, pages 339-368. Springer, 2017
We show that a family of quantum authentication protocols introduced in [Barnum et al., FOCS 2002] can be used to construct a secure quantum channel and additionally recycle all of the secret key if the message is successfully authenticated, and recycle part of the key if tampering is detected. We give a full security proof that constructs the secure channel given only insecure noisy channels and a shared secret key. We also prove that the number of recycled key bits is optimal for this family of protocols, i.e., there exists an adversarial strategy to obtain all non-recycled bits. Previous works recycled less key and only gave partial security proofs, since they did not consider all possible distinguishers (environments) that may be used to distinguish the real setting from the ideal secure quantum channel and secret key resource.
We investigate quantum authentication schemes constructed from quantum error-correcting codes. We show that if the code has a property called purity testing, then the resulting authentication scheme guarantees the integrity of ciphertexts, not just plaintexts. On top of that, if the code is strong purity testing, the authentication scheme also allows the encryption key to be recycled, partially even if the authentication rejects. Such a strong notion of authentication is useful in a setting where multiple ciphertexts can be present simultaneously, such as in interactive or delegated quantum co…
In their seminal work on authentication, Wegman and Carter propose that to authenticate multiple messages, it is sufficient to reuse the same hash function as long as each tag is encrypted with a one-time pad. They argue that because the one-time pad is perfectly hiding, the hash function used remains completely unknown to the adversary. Since their proof is not composable, we revisit it using a composable security framework. It turns out that the above argument is insufficient: if the adversary learns whether a corrupted message was accepted or rejected, information about the hash function is…
Quantum information is a valuable resource which can be encrypted in order to protect it. We consider the size of the one-time pad that is needed to protect quantum information in a number of cases. The situation is dramatically different from the classical case: we prove that one can recycle the one-time pad without compromising security. The protocol for recycling relies on detecting whether eavesdropping has occurred, and further relies on the fact that information contained in the encrypted quantum state cannot be fully accessed. We prove the security of recycling rates when authentication…
We propose an information-theoretically secure encryption scheme for classical messages with quantum ciphertexts that offers detection of eavesdropping attacks, and re-usability of the key in case no eavesdropping took place: the entire key can be securely re-used for encrypting new messages as long as no attack is detected. This is known to be impossible for fully classical schemes, where there is no way to detect plain eavesdropping attacks. This particular application of quantum techniques to cryptography was originally proposed by Bennett, Brassard and Breidbart in 1982, even before propos…
Quantum key distribution (QKD) enables unconditionally secure communication between distinct parties using a quantum channel and an authentic public channel. Reducing the portion of quantum-generated secret keys, that is consumed during the authentication procedure, is of significant importance for improving the performance of QKD systems. In the present work, we develop a lightweight authentication protocol for QKD based on a `ping-pong' scheme of authenticity check for QKD. An important feature of this scheme is that the only one authentication tag is generated and transmitted during each of…
We propose a new Quantum Key Recycling (QKR) protocol, which can tolerate the noise in the quantum channel. Our QKR protocol recycles the used keys according to the error rate. The key recycling rate of the pre-shared keys in our QKR protocol is optimized depending on the real error rate in the quantum channel. And our QKR protocol has higher efficiency than the exiting QKR protocol with error-tolerance. The security proof shows the security of the recycled keys is universal composable.
We consider a setup in which the channel from Alice to Bob is less noisy than the channel from Eve to Bob. We show that there exist encoding and decoding which accomplish error correction and authentication simultaneously; that is, Bob is able to correctly decode a message coming from Alice and reject a message coming from Eve with high probability. The system does not require any secret key shared between Alice and Bob, provides information theoretic security, and can safely be composed with other protocols in an arbitrary context.
We calculate the key sharing rate of Lu et al.'s Quantum Key Recycling (QKR) protocol. The key sharing rate is another version of the key rate, but it can be calculated for both the Quantum Key Distribution (QKD) protocols and the QKR protocols. We define the key sharing rate in this study and compare the key sharing rate of the QKR protocol to the rate of the QKD protocols. We found Lu et al.'s QKR protocol can be used to share keys more efficiently than BB84 in some situations. We also compare the six-state version of Lu et al.'s QKR protocol to the six-state QKD protocol. The results of thi…
Barnum, Crepeau, Gottesman, Tapp, and Smith (quant-ph/0205128) proposed methods for authentication of quantum messages. The first method is an interactive protocol (TQA') based on teleportation. The second method is a noninteractive protocol (QA) in which the sender first encrypts the message using a protocol QEnc and then encodes the quantum ciphertext with an error correcting code chosen secretly from a set (a purity test code (PTC)). Encryption was shown to be necessary for authentication. We augment the protocol QA with an extra step which recycles the entire encryption key provided QA acc…
Quantum key distribution (QKD) has been developed for decades and several different QKD protocols have been proposed. But two difficulties limit the implementation of most QKD protocols. First, the involved participants are required to have heavy quantum capabilities, such as quantum joint operation, quantum register, and so on. Second, a hypothetical authenticated classical channel is used in most of the existing QKD protocols and this assumed channel does not exist in reality. To solve both the above limitations at the same time, this study proposes three lightweight authenticated QKD protoc…
We re-visit Unclonable Encryption as introduced by Gottesman in 2003. We look at the combination of Unclonable Encryption and Key Recycling, while aiming for low communication complexity and high rate. We introduce a qubit-based prepare-and-measure Unclonable Encryption scheme with re-usable keys. Our scheme consists of a single transmission by Alice and a single classical feedback bit from Bob. The transmission from Alice to Bob consists entirely of qubits. The rate, defined as the message length divided by the number of qubits, is higher than what can be achieved using Gottesman's scheme. We…
We answer an open question about Quantum Key Recycling (QKR): Is it possible to put the message entirely in the qubits without increasing the number of qubits? We show that this is indeed possible. We introduce a prepare-and-measure QKR protocol where the communication from Alice to Bob consists entirely of qubits. As usual, Bob responds with an authenticated one-bit accept/reject classical message. Compared to Quantum Key Distribution (QKD), QKR has reduced round complexity. Compared to previous qubit-wise QKR protocols, our scheme has far less classical communication. We provide a security p…
Information-theoretically secure (ITS) authentication is needed in Quantum Key Distribution (QKD). In this paper, we study security of an ITS authentication scheme proposed by Wegman & Carter, in the case of partially known authentication key. This scheme uses a new authentication key in each authentication attempt, to select a hash function from an Almost Strongly Universal$_2$ hash function family. The partial knowledge of the attacker is measured as the trace distance between the authentication key distribution and the uniform distribution; this is the usual measure in QKD. We provide direc…
Quantum Key Recycling (QKR) is a quantum-cryptographic primitive that allows one to re-use keys in an unconditionally secure way. By removing the need to repeatedly generate new keys it improves communication efficiency. Skoric and de Vries recently proposed a QKR scheme based on 8-state encoding (four bases). It does not require quantum computers for encryption/decryption but only single-qubit operations. We provide a missing ingredient in the security analysis of this scheme in the case of noisy channels: accurate bounds on the privacy amplification. We determine optimal attacks against the …
With the development of quantum computers, traditional cryptographic systems are facing more and more serious security threats. Fortunately, quantum key distribution (QKD) and post-quantum cryptography (PQC) are two cryptographic mechanisms with quantum-resistant security, and both will become important solutions for future information security. However, neither of them is perfect, and they are complementary. Quantum key distribution has unconditional security that post-quantum cryptography does not have, and PQC can provide secure and convenient authentication for QKD networks. In this paper,…
We propose a scheme for authentication of physical keys that are materialized by optical multiple-scattering media. The authentication relies on the optical response of the key when probed by randomly selected coherent states of light, and the use of standard wavefront-shaping techniques that direct the scattered photons coherently to a specific target mode at the output. The quadratures of the electromagnetic field of the scattered light at the target mode are analysed using a homodyne detection scheme, and the acceptance or rejection of the key is decided upon the outcomes of the measurement…
We demonstrate how adversaries with unbounded computing resources can break Quantum Key Distribution (QKD) protocols which employ a particular message authentication code suggested previously. This authentication code, featuring low key consumption, is not Information-Theoretically Secure (ITS) since for each message the eavesdropper has intercepted she is able to send a different message from a set of messages that she can calculate by finding collisions of a cryptographic hash function. However, when this authentication code was introduced it was shown to prevent straightforward Man-In-The-M…
We consider various issues which arise as soon as one tries to practically implement simple networks of quantum relays for QKD. In particular we discuss authentication and routing which are essential ingredients of any QKD network. This paper aims to address some gaps between quantum and networking aspects of QKD networks usually reserved to specialist in physics and computer science respectively.
We present a quantum-public-key identification protocol and show that it is secure against a computationally-unbounded adversary. This demonstrates for the first time that unconditionally-secure and reusable public-key authentication is possible in principle with (pure-state) public keys.
We consider a recently proposed entity authentication protocol, in which a physical unclonable key is interrogated by random coherent states of light, and the quadratures of the scattered light are analysed by means of a coarse-grained homodyne detection. We derive a sufficient condition for the protocol to be secure against an emulation attack, in which an adversary knows the challenge-response properties of the key, and moreover he can access the challenges during the verification. The security analysis relies on Holevo's bound and Fano's inequality, and suggests that the protocol is secure …
We propose a quantum key distribution protocol with quantum based user authentication. Our protocol is the first one in which users can authenticate each other without previously shared secret and then securely distribute a key where the key may not be exposed to even a trusted third party. The security of our protocol is guaranteed by the properties of the entanglement.
The security of the previous quantum key distribution (QKD) protocols, which is guaranteed by the nature of physics law, is based on the legitimate users. However, impersonation of the legitimate communicators by eavesdroppers, in practice, will be inevitable. In fact, the previous QKD protocols is unsecure without authentication in practical communication. In this paper, we proposed an improved QKD protocol that can simultaneously distribute the quantum secret key and verify the communicators' identity. This presented authentication scheme is provably secure.
Quantum Spectral Authentication: Entity Authentication and Key Derivation from a Hidden Eigenstate of a Public Unitary Challenge
University of Technology Sydney（悉尼科技大学）；Centre for Quantum Software and Information, University of Technology Sydney（悉尼科技大学量子软件与信息中心）；Data61, CSIRO（CSIRO数据六一分部）；Institute of Computer Science, Polish Academy of Sciences（波兰科学院计算机科学研究所）
We study the security of a specific authentication procedure of interest in the context of Quantum Key Distribution (QKD). It works as follows: use a secret but fixed Strongly Universal$_2$ (SU$_2$) hash function and encrypt the output tag with a one-time pad (OTP). If the OTP is completely secret, the expected time for an adversary to create a tag for a chosen message is exponential in the tag length. If, however, the OTP is partially known in each authentication round, as is the case in practical QKD protocols, then the picture is different; the adversary's partial knowledge of the OTP in ea…
Starting from Barnum's recent proposal to use entanglement and catalysis for quantum secure identification [quant-ph/9910072], we describe a protocol for quantum authentication and authenticated quantum key distribution. We argue that our scheme is secure even in the presence of an eavesdropper who has complete control over both classical and quantum channels.
Optical physical unclonable keys are currently considered to be rather promising candidates for the development of entity authentication protocols, which offer security against both classical and quantum adversaries. In this work we investigate the robustness of a continuous-variable protocol, which relies on the scattering of coherent states of light from the key, against three different types of intercept-resend emulation attacks. The performance of the protocol is analysed for a broad range of physical parameters, and our results are compared to existing security bounds.
In conventional cryptography, information-theoretically secure message authentication can be achieved by means of universal hash functions, and requires that the two legitimate users share a random secret key, which is twice as long as the message. We address the question as of whether quantum resources can offer any advantage over classical unconditionally secure message authentication codes. It is shown that passive prepare-and-measure quantum message-authentication schemes cannot do better than their classical counterparts. Subsequently we present an interactive entanglement-assisted scheme…
Although key distribution is arguably the most studied context on which to apply quantum cryptographic techniques, message authentication, i.e., certifying the identity of the message originator and the integrity of the message sent, can also benefit from the use of quantum resources. Classically, message authentication can be performed by techniques based on hash functions. However, the security of the resulting protocols depends on the selection of appropriate hash functions, and on the use of long authentication keys. In this paper we propose a quantum authentication procedure that, making …
Quantum key distribution without authentication and information leakage
State Key Laboratory of Precision and Intelligent Chemistry, University of Science and Technology of China（中国科学技术大学精密与智能化学国家重点实验室）；Hefei National Laboratory, University of Science and Technology of China（中国科学技术大学合肥国家实验室）
Quantum key distribution (QKD) provides information theoretically secures key exchange requiring authentication of the classic data processing channel via pre-sharing of symmetric private keys. In previous studies, the lattice-based post-quantum digital signature algorithm Aigis-Sig, combined with public-key infrastructure (PKI) was used to achieve high-efficiency quantum security authentication of QKD, and its advantages in simplifying the MAN network structure and new user entry were demonstrated. This experiment further integrates the PQC algorithm into the commercial QKD system, the Jinan …
Authentication provides the trust people need to engage in transactions. The advent of physical keys that are impossible to copy promises to revolutionize this field. Up to now, such keys have been verified by classical challenge-response protocols. Such protocols are in general susceptible to emulation attacks. Here we demonstrate Quantum-Secure Authentication ("QSA") of an unclonable classical physical key in a way that is inherently secure by virtue of quantum-physical principles. Our quantum-secure authentication operates in the limit of a large number of channels, represented by the more …
Quantum key distribution (QKD) can provide information theoretically secure key exchange even in the era of quantum computer. However, QKD requires the classical channel to be authenticated, and the current method is pre-sharing symmetric keys. For a QKD network of $n$ users, this method requires $C_n^2 = n(n-1)/2$ pairs of symmetric keys to realize pairwise interconnection. In contrast, with the help of mature public key infrastructure (PKI) and post-quantum cryptography (PQC) with quantum resistant security, each user only needs to apply for a digital certificate from certificate authority (…
We realize shamir's no-key protocol via quantum computation of Boolean permutation and private quantum channel. The quantum no-key (QNK) protocol presented here is one with mutual authentications, and proved to be unconditionally secure. An important property of this protocol is that0 its authentication key can be reused permanently.
This paper presents a hybrid cryptographic protocol, using quantum and classical resources, for authentication and authorization in a network. One or more trusted servers distribute streams of entangled photons to individual resources that seek to communicate. It is assumed that each resource shares a previously distributed secret key with the trusted server, and that resources can communicate with the server using both classical and quantum channels. Resources do not share secret keys with each other, so that the key distribution problem for the network is reduced from O(n^2) to O(n). Some ad…
Utilizing the advantage of quantum entanglement swapping, a multi-party quantum key agreement protocol with authentication is proposed. In this protocol, a semi-trusted third party is introduced, who prepares Bell states, and sends one particle to multiple participants respectively. After that the participants can share a Greenberger-Horne-Zeilinger state by entanglement swapping. Finally, these participants measure the particles in their hands and obtain an agreement key. Here, classical hash function and Hadamard operation are utilized to authenticate the identity of participants. The correl…
Using the previously shared Einstein-Podolsky-Rosen pairs, a proposal which can be used to distribute a quantum key and identify the user's identification simultaneously is presented. In this scheme, two local unitary operations and the Bell state measurement are used. Combined with quantum memories, a cryptographic network is proposed. One advantage is no classical communication is needed, which make the scheme more secure. The secure analysis of this scheme is shown.
Quantum key distribution (QKD) promises secure key agreement by using quantum mechanical systems. We argue that QKD will be an important part of future cryptographic infrastructures. It can provide long-term confidentiality for encrypted information without reliance on computational assumptions. Although QKD still requires authentication to prevent man-in-the-middle attacks, it can make use of either information-theoretically secure symmetric key authentication or computationally secure public key authentication: even when using public key authentication, we argue that QKD still offers stronge…
We present a protocol for the amplification and distribution of a one-time-pad cryptographic key over a point-to-multipoint optical network based on computational ghost imaging (GI) and compressed sensing (CS). It is shown experimentally that CS imaging can perform faster authentication and increase the key generation rate by an order of magnitude compared with the scheme using computational GI alone. The protocol is applicable for any number of legitimate user, thus, the scheme could be used in real intercity networks where high speed and high security are crucial.
Smart grid solutions enable utilities and customers to better monitor and control energy use via information and communications technology. Information technology is intended to improve the future electric grid's reliability, efficiency, and sustainability by implementing advanced monitoring and control systems. However, leveraging modern communications systems also makes the grid vulnerable to cyberattacks. Here we report the first use of quantum key distribution (QKD) keys in the authentication of smart grid communications. In particular, we make such demonstration on a deployed electric uti…
We propose a class of quantum no-key protocols for private communication of classical message based on quantum computing of random Boolean permutations, and demonstrate that they are information-theoretic secure. These protocols are designed to resist middleman attack for two parties preshared authentication key, and achieve perfect mutual data origin authentication which ensures the permanent reusing of authentication key. Finally, we simplify the protocol to a 4-round one, and show that any protocol with 3 or less rounds cannot achieve perfect security without consuming preshared key.
Kang et al. [Chin. Phys. B 24 (2015) 090306] proposed a controlled mutual quantum entity authentication protocol. We find that the proposed protocol is not secure, that is, Charlie can eavesdrop the shared keys between Alice and Bob without being detected.
This note presents a method to authenticate a quantum message based on classical SN-S authentication code and the computations between different quantum registers. If the pre-coding generator matrix in SN-S code is public, the quantum scheme is a public-key data integrity scheme; if it is secret, the quantum scheme is a hybrid data origin authentication scheme.
Public-key cryptosystems for quantum messages are considered from two aspects: public-key encryption and public-key authentication. Firstly, we propose a general construction of quantum public-key encryption scheme, and then construct an information-theoretic secure instance. Then, we propose a quantum public-key authentication scheme, which can protect the integrity of quantum messages. This scheme can both encrypt and authenticate quantum messages. It is information-theoretic secure with regard to encryption, and the success probability of tampering decreases exponentially with the security …
This paper presents a simple, but efficient class of non-interactive protocols for quantum authentication of $m$-length clas sical messages. The message is encoded using a classical linear algebraic code $C[n,m,t]$. We assume that Alice and Bob share a classical secret key, $x_{AB}$, of $n$ bits. Alice creates $n$ qubits based on the code word and the key, that indicates the bases used to create each qubit. The quantum states are sent to Bob through a noiseless quantum channel. We calculate the failure probability of the protocol considering several types of attacks.
Secure communication requires message authentication. In this paper we address the problem of how to authenticate quantum information sent through a quantum channel between two communicating parties with the minimum amount of resources. Specifically, our objective is to determine whether one elementary quantum message (a qubit) can be authenticated with a key of minimum length. We show that, unlike the case of classical-message quantum authentication, this is not possible.
