Secure key leasing (a.k.a. key-revocable cryptography) enables us to lease a cryptographic key as a quantum state in such a way that the key can be later revoked in a verifiable manner. We propose a simple framework for constructing cryptographic primitives with secure key leasing via the certified deletion property of BB84 states. Based on our framework, we obtain the following schemes.
- A public key encryption scheme with secure key leasing that has classical revocation based on any IND-CPA secure public key encryption scheme. Prior works rely on either quantum revocation or stronger assumptions such as the quantum hardness of the learning with errors (LWE) problem.
- A pseudorandom function with secure key leasing that has classical revocation based on one-way functions. Prior works rely on stronger assumptions such as the quantum hardness of the LWE problem.
- A digital signature scheme with secure key leasing that has classical revocation based on the quantum hardness of the short integer solution (SIS) problem. Our construction has static signing keys, i.e., the state of a signing key almost does not change before and after signing. Prior constructions either rely on non-static signing keys or indistinguishability obfuscation to achieve a stronger goal of copy-protection.
In addition, all of our schemes remain secure even if a verification key for revocation is leaked after the adversary submits a valid certificate of deletion. To our knowledge, all prior constructions are totally broken in this setting. Moreover, in our view, our security proofs are much simpler than those for existing schemes.
Secure software leasing is a quantum cryptographic primitive that enables us to lease software to a user by encoding it into a quantum state. Secure software leasing has a mechanism that verifies whether a returned software is valid or not. The security notion guarantees that once a user returns a software in a valid form, the user no longer uses the software. In this work, we introduce the notion of secret-key functional encryption (SKFE) with secure key leasing, where a decryption key can be securely leased in the sense of secure software leasing. We also instantiate it with standard cryptog…
A Unified Approach to Quantum Key Leasing with a Classical Lessor
NTT Social Informatics Laboratories（NTT社会信息学实验室）；NTT Research Center for Theoretical Quantum Information（NTT理论量子信息中心）；Fujitsu Research of America（富士通美国研究中心）；AIST（产业技术综合研究所）
Formulating cryptographic definitions to protect against software piracy is an important research direction that has not received much attention. Since natural definitions using classical cryptography are impossible to achieve (as classical programs can always be copied), this directs us towards using techniques from quantum computing. The seminal work of Aaronson [CCC'09] introduced the notion of quantum copy-protection precisely to address the problem of software anti-piracy. However, despite being one of the most important problems in quantum cryptography, there are no provably secure solut…
Trapdoor Functions with Secure Key Leasing and Copy Protection
NTT Social Informatics Laboratories（NTT社会信息学实验室）；NTT Research Center for Theoretical Quantum Information（NTT理论量子信息中心）；Yukawa Institute for Theoretical Physics, Kyoto University（京都大学汤川理论物理研究所）
Secure software leasing (SSL) is a quantum cryptographic primitive that enables users to execute software only during the software is leased. It prevents users from executing leased software after they return the leased software to its owner. SSL can make software distribution more flexible and controllable. Although SSL is an attractive cryptographic primitive, the existing SSL scheme is based on public key quantum money, which is not instantiated with standard cryptographic assumptions so far. Moreover, the existing SSL scheme only supports a subclass of evasive functions. In this work, we p…
We consider the problem of secure key distribution among $n$ trustful agents: the goal is to distribute an identical random bit-string among the $n$ agents over a noisy channel such that eavesdroppers learn little about it. We study the general situation where the only resources required are secure bipartite key distribution and authenticated classical communication. Accordingly, multipartite quantum key distribution can be proven unconditionally secure by reducing the problem to the biparitite case and invoking the proof of security of bipartite quantum key distribution.
A simple counter-example is given on the prevalent interpretation of the trace distance criterion as failure probability in quantum key distribution protocols. A summary of its ramifications is listed.
The oblivious transfer primitive is sufficient to implement secure multiparty computation. However, secure multiparty computation based only on classical cryptography is severely limited by the security and efficiency of the oblivious transfer implementation. We present a method to efficiently and securely generate and distribute oblivious keys by exchanging qubits and by performing commitments using classical hash functions. With the presented hybrid approach, quantum and classical, we obtain a practical and high-speed oblivious transfer protocol, secure even against quantum computer attacks.…
Device-independent quantum key distribution is the task of using uncharacterized quantum devices to establish a shared key between two users. If a protocol is secure regardless of the device behaviour, it can be used to generate a shared key even if the supplier of the devices is malicious. To date, all device-independent quantum key distribution protocols that are known to be secure require separate isolated devices for each entangled pair, which is a significant practical limitation. We introduce a protocol that requires Alice and Bob to have only one device each. Although inefficient, our p…
The previous work showed that the Y00 protocol could stay secure with the eavesdropper's guessing probability on the secret keys being strictly less than one under an unlimitedly long known-plaintext attack with quantum memory. However, an assumption that at least a fast correlation attack is completely disabled by irregular mapping. The present study shows that the Y00 protocol can be information-theoretic secure under any quantum-computational crypto-analyses if the Y00 system is well designed. The Y00 protocol directly encrypts messages with short secret keys expanded into pseudo-random run…
Quantum public-key encryption [Gottesman; Kawachi et al., Eurocrypt'05] generalizes public-key encryption (PKE) by allowing the public keys to be quantum states. Prior work indicated that quantum PKE can be constructed from assumptions that are potentially weaker than those needed to realize its classical counterpart. In this work, we show that quantum PKE can be constructed from any quantum-secure one-way function. In contrast, classical PKE is believed to require more structured assumptions. Our construction is simple, uses only classical ciphertexts, and satisfies the strong notion of CCA s…
The fairness of a secure multi-party quantum key agreement (MQKA) protocol requires that all involved parties are entirely peer entities and can equally influence the outcome of the protocol to establish a shared key wherein no one can decide the shared key alone. However, it is found that parts of the existing MQKA protocols are sensitive to collusion attacks, i.e., some of the dishonest participants can collaborate to predetermine the final key without being detected. In this paper, a multi-party QKA protocol resisting collusion attacks is proposed. Different from previous QKA protocol resis…
The information theoretically secure Kirchhoff-law-Johnson-noise (KLJN) key exchange scheme, similarly to quantum key distribution (QKD), is also potentially vulnerable against clock attacks, where Eve takes over the control of clock synchronization in the channel. This short note aims to introduce a time synchronization protocol scheme for Alice and Bob, which is resistant against arbitrary time delay attacks, both symmetric and asymmetric ones. We propose and explore various ways of clock synchronization for the KLJN system and propose an ultimate protocol that preserves time and hardware in…
We study the practical effectiveness of privacy amplification for classical key-distribution schemes. We find that in contrast to quantum key distribution schemes, the high fidelity of the raw key generated in classical systems allow the users to always sift a secure shorter key if they have an upper bound on the eavesdropper probability to correctly guess the exchanged key-bits. The number of privacy amplification iterations needed to achieve information leak of 10^-8 in existing classical communicators is 2 or 3 resulting in a corresponding slowdown 4 to 8. We analyze the inherent tradeoff b…
A theorem is proved which states that no classical key generating protocol could ever be provably secure. Consequently, candidates for provably secure protocols must rely on some quantum effect. Theorem relies on the fact that BB84 Quantum key distribution protocol has been proven secure.
We present a quantum-public-key identification protocol and show that it is secure against a computationally-unbounded adversary. This demonstrates for the first time that unconditionally-secure and reusable public-key authentication is possible in principle with (pure-state) public keys.
We demonstrate a weak pulse quantum key distribution system using the BB84 protocol which is secure against all individual attacks, including photon number splitting. By carefully controlling the weak pulse intensity we demonstrate the maximum secure bit rate as a function of the fibre length. Unconditionally secure keys can be formed for standard telecom fibres exceeding 50 km in length.
A new cryptographic tool, anonymous quantum key technique, is introduced that leads to unconditionally secure key distribution and encryption schemes that can be readily implemented experimentally in a realistic environment. If quantum memory is available, the technique would have many features of public-key cryptography; an identification protocol that does not require a shared secret key is provided as an illustration. The possibility is also indicated for obtaining unconditionally secure quantum bit commitment protocols with this technique.
A new scheme of Quantum Key Distribution is proposed using three entangled particles in a GHZ state. Alice holds a 3-particle source and sends two particles to Bob, keeping one with herself. Bob uses one particle to generate a secure key, and the other to generate a master-key. This scheme should prove to be harder to break in non-ideal situations as compared to the standard protocols BB84 and Eckert. The scheme uses the concept of Quantum Disentanglement Eraser. Extension to multi-partite scheme has also been investigated.
We report the first gigahertz clocked decoy-protocol quantum key distribution (QKD). Record key rates have been achieved thanks to the use of self-differencing InGaAs avalanche photodiodes designed specifically for high speed single photon detection. The system is characterized with a secure key rate of 1.02 Mbit/s for a fiber distance of 20 km and 10.1 kbit/s for 100 km. As the present advance relies upon compact non-cryogenic detectors, it opens the door towards practical and low cost QKD systems to secure broadband communication in future.
Protecting secure random key from eavesdropping in quantum key distribution protocols has been well developed. In this letter, we further study how to detect and eliminate eavesdropping on the random base string in such protocols. The correlation between the base string and the key enables Alice and Bob to use specific privacy amplification to distill and reuse the previously shared base string with unconditional security and high efficiency. The analysis of the unconditional secure reusable base string brings about new concept and protocol design technique.
In all existing protocols of private communication with encryption and decryption, the pre-shared key can be used for only one time. We give a deterministic quantum key expansion protocol where the pre-shared key can be recycled. Our protocol is exponentially secure. Our protocol costs less qubits and almost zero classical communications with authentication steps being included. Since our protocol can distribute the deterministic bits, it can also be used for direct communication.
We use a recent numerical security proof approach to calculate tight secure key rates in the presence of collective attacks for a continuous-variable (CV) eight-state phase-shift keying (8PSK) protocol with heterodyne detection in the asymptotic limit. The results are compared to achievable secure key rates of a QPSK protocol obtained with the same security proof technique. Furthermore, we investigate the influence of radial postselection on the secure key rate and examine a recently suggested strategy to reduce the computational requirements on the error-correction phase for four-state phase-…
We report two key distribution schemes achieved by swapping quantum entanglement. Using two Bell states, two bits of secret key can be shared between two distant parties that play symmetric and equal roles. We also address eavesdropping attacks against the schemes.
We propose a class of quantum no-key protocols for private communication of classical message based on quantum computing of random Boolean permutations, and demonstrate that they are information-theoretic secure. These protocols are designed to resist middleman attack for two parties preshared authentication key, and achieve perfect mutual data origin authentication which ensures the permanent reusing of authentication key. Finally, we simplify the protocol to a 4-round one, and show that any protocol with 3 or less rounds cannot achieve perfect security without consuming preshared key.
In this report we discuss the insecurity with present implementations of the Ekert protocol for quantum-key distribution based on the Wigner Inequality. We propose a modified version of this inequality which guarantees safe quantum-key distribution.
Quantum cryptography (QC) can provide unconditional secure communication between two authorized parties based on the basic principles of quantum mechanics. However, imperfect practical conditions limit its transmission distance and communication speed. Here we implemented the differential phase shift (DPS) quantum key distribution (QKD) with up-conversion assisted hybrid photon detector (HPD) and achieved 1.3 M bits per second secure key rate over a 10-km fiber, which is tolerant against the photon number splitting (PNS) attack, general collective attacks on individual photons, and any other k…
We present a quantum no-key protocol for direct and secure transmission of quantum and classical messages based on simple Boolean function computation with several quantum gates and Shamir's interactive idea of classical message encryption. This protocol has inherent personal identification and message authentication. It probably is the first quantum protocol that can resist the man-in-the-middle attack by itself.
In this report, we simulate practical feature of Yuen-Kim protocol for quantum key distribution with unconditional secure. In order to demonstrate them experimentally by intensity modulation/direct detection(IMDD) optical fiber communication system, we use simplified encoding scheme to guarantee security for key information(1 or 0). That is, pairwise M-ary intensity modulation scheme is employed. Furthermore, we give an experimental implementation of YK protocol based on IMDD.
Quantum private states are the states that represent some amount of perfect secure key. A simple symmetry of any generalised private quantum state (ie. the states that represent perfect key but not fully random) is provided and extended on Devetak-Winter so called ccq (classical-classical-quantum) and cqq (classical-quantum-quantum) lower bound on secure key. This symmetry is used to develop a practical method of estimating the Alice measurement that is optimal form the perspective of single shot Devetak-Witner lower bound on secure key. The method is particularly good when the noise does not …
Quantum key distribution (QKD) is theoretically secure using the principle of quantum mechanics; therefore, QKD is a promising solution for the future of secure communication. Although several experimental demonstrations of QKD have been reported, they have not considered the polarization-dependent loss in state preparation in the key-rate estimation. In this study, we experimentally characterized polarization-dependent loss in realistic state-preparation devices and verified that a considerable PDL exists in fiber- and silicon-based polarization modulators. Hence, the security of such QKD sys…
We construct multipartite entangled states with underlying W-type structure satisfying positive partial transpose (PPT) condition under any (N-1)|1 partition. Then we show how to distill N-partite secure key form the states using two different methods: direct application of local filtering and novel random key distillation scheme in which we adopt the idea form recent results on entanglement distillation. Open problems and possible implications are also discussed.
Precise quantum key distribution (QKD) secure bound analysis is essential for practical QKD systems. The effect of uniformity of random number seed for privacy amplification is not considered in existing secure bound analysis. In this paper, we propose and prove the quantum leftover hash lemma with non-uniform random number seeds based on the min-entropy, and we give a precise QKD secure bound analysis with non-uniform random number seeds on this basis. We take the two-decoy BB84 protocol as an example to simulate the effect of random number seed uniformity on the secure bound of a QKD system.…
We present a protocol for quantum cryptographic network consisting of a quantum network center and many users, in which any pair of parties with members chosen from the whole users on request can secure a quantum key distribution by help of the center. The protocol is based on the quantum authentication scheme given by Barnum et al. [Proc. 43rd IEEE Symp. FOCS'02, p. 449 (2002)]. We show that exploiting the quantum authentication scheme the center can safely make two parties share nearly perfect entangled states used in the quantum key distribution. This implies that the quantum cryptographic …
The four-state continuous-variable quantum key distribution (CVQKD) protocol has a long practical secure distance \cite{Leverrier_PRL_2009}, while it has the difficulty of parameter estimation. We propose an improved four-state protocol, where the covariance matrix can be estimated from experimental data without using the linear channel assumption, and thus ensuring its unconditional security in the asymptotical limit. Our new scheme keeps the advantages of high reconciliation efficiency and long secure distance of the four-state protocol, and it can be implemented under current technology.
We present a quantum key distribution experiment in which keys that were secure against all individual eavesdropping attacks allowed by quantum mechanics were distributed over 100 km of optical fiber. We implemented the differential phase shift quantum key distribution protocol and used low timing jitter 1.55 um single-photon detectors based on frequency up-conversion in periodically poled lithium niobate waveguides and silicon avalanche photodiodes. Based on the security analysis of the protocol against general individual attacks, we generated secure keys at a practical rate of 166 bit/s over…
We propose an unconditionally secure quantum key distribution (QKD) protocol, which uses a relatively strong signal pulse. While our protocol shares similar security bases as the Bennett 1992 protocol with a strong reference pulse (B92), our scheme uses a smaller number of detectors and it is robust against Rayleigh scattering in an optical fibre. We derive a lower bound of secret key generation rate of our protocol and show that our protocol can cover relatively long distances, assuming precise phase modulations and stable interferometers.
Secure key rate of decoy-state quantum key distribution protocols has been improved with biased basis choice, however, the security standards and parameters of current protocols are different. As a result, we cannot give an accurate key rate comparison between different kinds of protocols. Taking the schemes based on different formula of secure key rate as examples, we give a fair comparison between typical protocols under universal composable security standard. Through analyzing the relationship of security parameters in post-processing stage and final secure key, we achieve the unified quant…
The single photon detection efficiency of the detector unit is crucial for the security of common quantum key distribution protocols like Bennett-Brassard 1984 (BB84). A low value for the efficiency indicates a possible eavesdropping attack that exploits the photon receiver's imperfections. We present a method for estimating the detection efficiency, and calculate the corresponding secure key generation rate. The estimation is done by testing gated detectors using a randomly activated photon source inside the receiver unit. This estimate gives a secure rate for any detector with non-unity sing…
Random generation and confidential distribution of cryptographic keys are fundamental building blocks of secure communication. Using quantum states in which the transmitted quantum bit is entangled with a stationary memory quantum bit allows the secure generation and distribution of keys to be based on fundamental properties of quantum mechanics. At the same time, the reach of secure communication networks can be enhanced, in particular, since this architecture would be compatible with quantum repeaters which are an integral part for scaling quantum networks. Here, we realize a true single-pho…
In search of a quantum key distribution scheme that could stand up for more drastic eavesdropping attack, I discover a prepare-and-measure scheme using $N$-dimensional quantum particles as information carriers where $N$ is a prime power. Using the Shor-Preskill-type argument, I prove that this scheme is unconditional secure against all attacks allowed by the laws of quantum physics. Incidentally, for $N = 2^n > 2$, each information carrier can be replaced by $n$ entangled qubits. And in this case, I discover an eavesdropping attack on which no unentangled-qubit-based prepare-and-measure quantu…
The importance of quantum key distribution as a cryptographic method depends upon its purported strong security guarantee. The following gives reasons on why such strong security guarantee has not been validly established and why good QKD security is difficult to obtain.
We report here a complete experimental realization of one-way decoy-pulse quantum key distribution, demonstrating an unconditionally secure key rate of 5.51 kbps for a 25.3 km fibre length. This is two orders of magnitudes higher than the value that can be obtained with a non-decoy system. We introduce also a simple test for detecting the photon number splitting attack and highlight that it is essential for the security of the technique to fully characterize the source and detectors used.
The method of decoy-state quantum key distribution (QKD) requests different intensities of light pulses. Existing theory has assumed exact control of intensities. Here we propose a simple protocol which is secure and efficient even there are errors in intensity control. In our protocol, decoy pulses and signal pulses are generated from the same father pulses with a two-value attenuation. Given the upper bound of fluctuation of the father pulses, our protocol is secure provided that the two-value attenuation is done exactly. We propose to use unbalanced beam-splitters for a stable attenuation. …
Semi-quantum protocols that allow some of the users to remain classical are proposed for a large class of problems associated with secure communication and secure multiparty computation. Specifically, first time semi-quantum protocols are proposed for key agreement, controlled deterministic secure communication and dialogue, and it is shown that the semi-quantum protocols for controlled deterministic secure communication and dialogue can be reduced to semi-quantum protocols for e-commerce and private comparison (socialist millionaire problem), respectively. Complementing with the earlier propo…
Based on the detection loophole-free photon key distribution (PKD) compatible with classical optical systems, an optical key distribution (OKD) protocol is presented for unconditionally secured cryptography in fiber-optic communications networks using addressable continuous phase basis, where each communication channel is composed of paired transmission lines. The unconditional security in OKD lies in quantum superposition between the paired lines of each channel. The continuous phase basis in OKD can be applied for one-time-pad optical cryptography in networks, whose network address capacity …
Long-distance quantum communication requires quantum repeaters to overcome photon loss in optical fibers. Here we demonstrate a repeater node with two memory atoms in an optical cavity. Both atoms are individually and repeatedly entangled with photons that are distributed until each communication partner has independently received one of them. An atomic Bell-state measurement followed by classical communication serves to establish a key. We demonstrate scaling advantage of the key rate, increase the effective attenuation length by a factor of two, and beat the error-rate threshold of 11\% for …
