Authentication is a well-studied area of classical cryptography: a sender S and a receiver R sharing a classical private key want to exchange a classical message with the guarantee that the message has not been modified by any third party with control of the communication line. In this paper we define and investigate the authentication of messages composed of quantum states. Assuming S and R have access to an insecure quantum channel and share a private, classical random key, we provide a non-interactive scheme that enables S both to encrypt and to authenticate (with unconditional security) an m qubit message by encoding it into m+s qubits, where the failure probability decreases exponentially in the security parameter s. The classical private key is 2m+O(s) bits. To achieve this, we give a highly efficient protocol for testing the purity of shared EPR pairs. We also show that any scheme to authenticate quantum messages must also encrypt them. (In contrast, one can authenticate a classical message while leaving it publicly readable.) This has two important consequences: On one hand, it allows us to give a lower bound of 2m key bits for authenticating m qubits, which makes our protocol asymptotically optimal. On the other hand, we use it to show that digitally signing quantum states is impossible, even with only computational security.
In conventional cryptography, information-theoretically secure message authentication can be achieved by means of universal hash functions, and requires that the two legitimate users share a random secret key, which is twice as long as the message. We address the question as of whether quantum resources can offer any advantage over classical unconditionally secure message authentication codes. It is shown that passive prepare-and-measure quantum message-authentication schemes cannot do better than their classical counterparts. Subsequently we present an interactive entanglement-assisted scheme…
We demonstrate how adversaries with unbounded computing resources can break Quantum Key Distribution (QKD) protocols which employ a particular message authentication code suggested previously. This authentication code, featuring low key consumption, is not Information-Theoretically Secure (ITS) since for each message the eavesdropper has intercepted she is able to send a different message from a set of messages that she can calculate by finding collisions of a cryptographic hash function. However, when this authentication code was introduced it was shown to prevent straightforward Man-In-The-M…
Quantum message authentication codes are families of keyed encoding and decoding maps that enable the detection of tampering on encoded quantum data. Here, we study a new class of simulators for quantum message authentication schemes, and show how they are applied in the context of two codes: the Clifford and the trap code. Our results show for the first time that these codes admit an efficient simulation (assuming that the adversary is efficient). Such efficient simulation is typically crucial in order to establish a composable notion of security.
We consider a setup in which the channel from Alice to Bob is less noisy than the channel from Eve to Bob. We show that there exist encoding and decoding which accomplish error correction and authentication simultaneously; that is, Bob is able to correctly decode a message coming from Alice and reject a message coming from Eve with high probability. The system does not require any secret key shared between Alice and Bob, provides information theoretic security, and can safely be composed with other protocols in an arbitrary context.
In this paper we investigate the capability of quantum routing (quantum state fusion) to implement two useful quantum communications protocols. The analyzed protocols include quantum authentication of quantum messages and non-destructive linear-optical Bell state manipulation. We also present the concept of quantum decoupler -- a device implementing an inverse operation to quantum routing. We demonstrate that both quantum router and decoupler can work as specialized disentangling gates.
Verifier-initiated quantum message-authentication via quantum zero-knowledge proofs
Graduate School of Mathematics, Nagoya University（名古屋大学大学院数学研究科）；School of Data Science, The Chinese University of Hong Kong, Shenzhen（香港中文大学（深圳）数据科学学院）；International Quantum Academy（国际量子学院）
In this paper, we propose a new theoretical scheme for quantum secure direct communication (QSDC) with user authentication. Different from the previous QSDC protocols, the present protocol uses only one orthogonal basis of single-qubit states to encode the secret message. Moreover, this is a one-time and one-way communication protocol, which uses qubits prepared in a randomly chosen arbitrary basis, to transmit the secret message. We discuss the security of the proposed protocol against some common attacks and show that no eaves-dropper can get any information from the quantum and classical ch…
We propose a class of quantum no-key protocols for private communication of classical message based on quantum computing of random Boolean permutations, and demonstrate that they are information-theoretic secure. These protocols are designed to resist middleman attack for two parties preshared authentication key, and achieve perfect mutual data origin authentication which ensures the permanent reusing of authentication key. Finally, we simplify the protocol to a 4-round one, and show that any protocol with 3 or less rounds cannot achieve perfect security without consuming preshared key.
Information-theoretically secure (ITS) authentication is needed in Quantum Key Distribution (QKD). In this paper, we study security of an ITS authentication scheme proposed by Wegman & Carter, in the case of partially known authentication key. This scheme uses a new authentication key in each authentication attempt, to select a hash function from an Almost Strongly Universal$_2$ hash function family. The partial knowledge of the attacker is measured as the trace distance between the authentication key distribution and the uniform distribution; this is the usual measure in QKD. We provide direc…
In this paper, we generalize a secured direct communication process between N users with partial and full cooperation of quantum server. The security analysis of authentication and communication processes against many types of attacks proved that the attacker cannot gain any information during intercepting either authentication or communication processes. Hence, the security of transmitted message among N users is ensured as the attacker introduces an error probability irrespective of the sequence of measurement.
Public-key cryptosystems for quantum messages are considered from two aspects: public-key encryption and public-key authentication. Firstly, we propose a general construction of quantum public-key encryption scheme, and then construct an information-theoretic secure instance. Then, we propose a quantum public-key authentication scheme, which can protect the integrity of quantum messages. This scheme can both encrypt and authenticate quantum messages. It is information-theoretic secure with regard to encryption, and the success probability of tampering decreases exponentially with the security …
Quantum secure direct communication (QSDC) and deterministic secure quantum communication (DSQC) are two important branches of quantum cryptography, where one can transmit a secret message securely without encrypting it by a prior key. In the practical scenario, an adversary can apply detector-side-channel attacks to get some non-negligible amount of information about the secret message. Measurement-device-independent (MDI) quantum protocols can remove this kind of detector-side-channel attack, by introducing an untrusted third party (UTP), who performs all the measurements during the protocol…
Barnum, Crepeau, Gottesman, Tapp, and Smith (quant-ph/0205128) proposed methods for authentication of quantum messages. The first method is an interactive protocol (TQA') based on teleportation. The second method is a noninteractive protocol (QA) in which the sender first encrypts the message using a protocol QEnc and then encodes the quantum ciphertext with an error correcting code chosen secretly from a set (a purity test code (PTC)). Encryption was shown to be necessary for authentication. We augment the protocol QA with an extra step which recycles the entire encryption key provided QA acc…
Recently, Yan et al. proposed a quantum secure direct communication (QSDC) protocol with authentication using single photons and Einstein-Podolsky-Rosen (EPR) pairs (Yan et al., CMC-Computers, Materials \& Continua, 63(3), 2020). In this work, we show that the QSDC protocol is not secure against intercept-and-resend attack and impersonation attack. An eavesdropper can get the full secret message by applying these attacks. We propose a modification of this protocol, which defeats the above attacks along with all the familiar attacks.
In their seminal work on authentication, Wegman and Carter propose that to authenticate multiple messages, it is sufficient to reuse the same hash function as long as each tag is encrypted with a one-time pad. They argue that because the one-time pad is perfectly hiding, the hash function used remains completely unknown to the adversary. Since their proof is not composable, we revisit it using a composable security framework. It turns out that the above argument is insufficient: if the adversary learns whether a corrupted message was accepted or rejected, information about the hash function is…
We present a quantum multi-factor authentication mechanism based on the hidden-matching quantum communication complexity problem. It offers step-up graded authentication for users via a quantum token. In this paper, we outline the protocol, demonstrate that it can be used in a largely classical setting, explain how it can be implemented in SASL, and discuss arising security features. We also offer a comparison between our mechanism and current state-of-the-art multi-factor authentication mechanisms.
In this work the novel usage of a physically unclonable function composed of a network of Mach-Zehnder interferometers for authentication tasks is described. The physically unclonable function hardware is completely reconfigurable, allowing for a large number of seemingly independent devices to be utilized, thus imitating a large array of single-response physically unclonable functions. It is proposed that any reconfigurable array of Mach-Zehnder interferometers can be used as an authentication mechanism, not only for physical objects, but for information transmitted both classically and quant…
We give a new class of security definitions for authentication in the quantum setting. These definitions capture and strengthen existing definitions of security against quantum adversaries for both classical message authentication codes (MACs) and well as full quantum state authentication schemes. The main feature of our definitions is that they precisely characterize the effective behavior of any adversary when the authentication protocol accepts, including correlations with the key. Our definitions readily yield a host of desirable properties and interesting consequences; for example, our se…
A concept named induced trapdoor one-way quantum transformation (OWQT) has been introduced, and a theoretical framework of public-key encryption (PKE) of quantum message is presented based on it. Then several kinds of quantum public-key encryption (QPKE) protocols, such as quantum version PKE of RSA, ElGamal, Goldwasser-Micali, elliptic curve, McEliece, Niederreiter and Okamoto-Tanaka-Uchiyama, are given within this framework. Though all of these protocols are only computationally secure, the last three are probably secure in post-quantum era. Besides, theoretical frameworks for public-key aut…
When sending quantum information over a channel, we want to ensure that the message remains intact. Quantum error correction and quantum authentication both aim to protect (quantum) information, but approach this task from two very different directions: error-correcting codes protect against probabilistic channel noise and are meant to be very robust against small errors, while authentication codes prevent adversarial attacks and are designed to be very sensitive against any error, including small ones. In practice, when sending an authenticated state over a noisy channel, one would have to wr…
We investigate quantum authentication schemes constructed from quantum error-correcting codes. We show that if the code has a property called purity testing, then the resulting authentication scheme guarantees the integrity of ciphertexts, not just plaintexts. On top of that, if the code is strong purity testing, the authentication scheme also allows the encryption key to be recycled, partially even if the authentication rejects. Such a strong notion of authentication is useful in a setting where multiple ciphertexts can be present simultaneously, such as in interactive or delegated quantum co…
With the development of quantum computers, traditional cryptographic systems are facing more and more serious security threats. Fortunately, quantum key distribution (QKD) and post-quantum cryptography (PQC) are two cryptographic mechanisms with quantum-resistant security, and both will become important solutions for future information security. However, neither of them is perfect, and they are complementary. Quantum key distribution has unconditional security that post-quantum cryptography does not have, and PQC can provide secure and convenient authentication for QKD networks. In this paper,…
Physical unclonable functions have been shown a useful resource of randomness for implementing various cryptographic tasks including entity authentication. All of the related entity authentication protocols that have been discussed in the literature so far, either they are vulnerable to an emulation attack, or they are limited to short distances. Hence, quantum-safe remote entity authentication over large distances remains an open question. In the first part of this work we discuss the requirements that an entity authentication protocol has to offer in order to be useful for remote entity auth…
Send the Key in Cleartext: Halving Key Consumption while Preserving Unconditional Security in QKD Authentication
QTI S.r.l.（QTI有限公司）；Telsy S.p.A.（Telsy公司）；Department of Computer Science, University of Copenhagen（哥本哈根大学计算机科学系）；National Institute of Optics National Research Council (INO–CNR)（国家光学研究所（意大利国家研究委员会））；Department of Physics and Astronomy, University of Florence（佛罗伦萨大学物理与天文学系）
We study the security of a specific authentication procedure of interest in the context of Quantum Key Distribution (QKD). It works as follows: use a secret but fixed Strongly Universal$_2$ (SU$_2$) hash function and encrypt the output tag with a one-time pad (OTP). If the OTP is completely secret, the expected time for an adversary to create a tag for a chosen message is exponential in the tag length. If, however, the OTP is partially known in each authentication round, as is the case in practical QKD protocols, then the picture is different; the adversary's partial knowledge of the OTP in ea…
Kang et al. [Chin. Phys. B 24 (2015) 090306] proposed a controlled mutual quantum entity authentication protocol. We find that the proposed protocol is not secure, that is, Charlie can eavesdrop the shared keys between Alice and Bob without being detected.
In a post-quantum world, where attackers may have access to full-scale quantum computers, all classical password-based authentication schemes will be compromised. Quantum copy-protection prevents adversaries from making copies of existing quantum software; we suggest this as a possible approach for designing post-quantum-secure password authentication systems. In this paper, we show an implementation of quantum copy-protection for password verification on IBM quantum computers. We also share our quantum computation results and analyses, as well as lessons learned.
This study proposes a quantum secret authentication code for protecting the integrity of secret quantum states. Since BB84[1] was first proposed, the eavesdropper detection strategy in almost all quantum cryptographic protocols is based on the random sample discussion, in which the probability of eavesdropper detection is depending on the number of check qubits eavesdropped by the eavesdropper. Hence, if the eavesdropper interferes only a few qubits of the transmitted quantum sequence, then the detection probability will be very low. This study attempts to propose a quantum secret authenticati…
With the advent of Physical Unclonable Functions (PUFs), PUF-based quantum authentication systems (QAS) have been proposed for security purposes and recently proof-of-principle experiment has been demonstrated. As a further step towards completing the security analysis, we investigate quantum cloning attacks against PUF-based quantum authentication systems and prove that quantum cloning attacks outperform the so-called challenge-estimation attacks. We present the analytical expression of the false accept probability by use of the corresponding optimal quantum cloning machines and extend the pr…
Quantum key distribution (QKD) provides information theoretically secures key exchange requiring authentication of the classic data processing channel via pre-sharing of symmetric private keys. In previous studies, the lattice-based post-quantum digital signature algorithm Aigis-Sig, combined with public-key infrastructure (PKI) was used to achieve high-efficiency quantum security authentication of QKD, and its advantages in simplifying the MAN network structure and new user entry were demonstrated. This experiment further integrates the PQC algorithm into the commercial QKD system, the Jinan …
